diff --git a/openapi.json b/openapi.json
index da6c00f8..daccc967 100644
--- a/openapi.json
+++ b/openapi.json
@@ -326,6 +326,59 @@
         },
         "description": "A key's own enforcement levers, in the shape `/config` uses. Each lever set here replaces the instance's for this key, looser or stricter; a lever left out stays the instance's."
       },
+      "ProfilePermissions": {
+        "type": "object",
+        "properties": {
+          "*": {
+            "type": "string",
+            "enum": [
+              "read",
+              "write"
+            ],
+            "description": "Access to every profile field. write changes only name and avatar."
+          },
+          "name": {
+            "type": "string",
+            "enum": [
+              "read",
+              "write"
+            ],
+            "description": "Access to the owner's name."
+          },
+          "email": {
+            "type": "string",
+            "enum": [
+              "read"
+            ],
+            "description": "Read access to the owner's email address."
+          },
+          "avatar": {
+            "type": "string",
+            "enum": [
+              "read",
+              "write"
+            ],
+            "description": "Access to the owner's avatar URL."
+          }
+        },
+        "additionalProperties": false,
+        "description": "Profile field permissions. Only the owner can change email."
+      },
+      "StoredProfilePermissions": {
+        "type": "object",
+        "additionalProperties": {
+          "$ref": "#/components/schemas/PermissionLevel"
+        },
+        "description": "Stored profile levels by field. Only name and avatar permit writes."
+      },
+      "PermissionLevel": {
+        "type": "string",
+        "enum": [
+          "read",
+          "write"
+        ],
+        "description": "What a key may do with an entry: `read` it, or `write` it (which includes reading). A name no entry covers is denied."
+      },
       "ItemState": {
         "type": "string",
         "enum": [
@@ -1043,10 +1096,7 @@
         "properties": {
           "name": {
             "type": "string",
-            "enum": [
-              "marfa"
-            ],
-            "description": "Always `marfa`."
+            "description": "The instance's display name. Defaults to `Marfa`."
           },
           "version": {
             "type": "string",
@@ -5980,11 +6030,14 @@
             "description": "Registrations the key may make: `types` to register types and `edge_types` to register edge types, at `write`. `*` covers both."
           },
           "profile_permissions": {
-            "type": "object",
-            "additionalProperties": {
-              "$ref": "#/components/schemas/PermissionLevel"
-            },
-            "description": "What the key may `read` or `write` of the owner's profile: `name`, `email` or `avatar`, or `*` for all of it."
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/StoredProfilePermissions"
+              },
+              {
+                "description": "Stored profile levels by field. Only name and avatar permit writes; email is read-only, including under a wildcard."
+              }
+            ]
           },
           "enforcement_override": {
             "allOf": [
@@ -6061,14 +6114,6 @@
         ],
         "description": "What a key may do with a type: `read` it, `write` it (which includes reading), or `none`, which denies a type a wildcard entry would reach."
       },
-      "PermissionLevel": {
-        "type": "string",
-        "enum": [
-          "read",
-          "write"
-        ],
-        "description": "What a key may do with an entry: `read` it, or `write` it (which includes reading). A name no entry covers is denied."
-      },
       "ApiKeyPage": {
         "type": "object",
         "properties": {
@@ -6165,11 +6210,14 @@
             "description": "Registrations the key may make: `types` to register types and `edge_types` to register edge types, at `write`. `*` covers both."
           },
           "profile_permissions": {
-            "type": "object",
-            "additionalProperties": {
-              "$ref": "#/components/schemas/PermissionLevel"
-            },
-            "description": "What the key may `read` or `write` of the owner's profile: `name`, `email` or `avatar`, or `*` for all of it."
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/StoredProfilePermissions"
+              },
+              {
+                "description": "Stored profile levels by field. Only name and avatar permit writes; email is read-only, including under a wildcard."
+              }
+            ]
           },
           "enforcement_override": {
             "allOf": [
@@ -6260,6 +6308,12 @@
             "type": "string",
             "description": "Unique identifier for the instance, the same value `GET /` returns."
           },
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "description": "The instance's display name, without control or bidirectional formatting characters. Spaces at each end are trimmed. Absent: `Marfa`."
+          },
           "enforcement": {
             "type": "object",
             "properties": {
@@ -6330,7 +6384,7 @@
         "required": [
           "instance_id"
         ],
-        "description": "The instance configuration: its enforcement levers and retention settings, with the instance's ID."
+        "description": "The instance configuration: its display name, enforcement levers and retention settings, with the instance's ID."
       },
       "InvalidPropertiesOrInvalidSchemaOrValidationErrorRefusal": {
         "type": "object",
@@ -8034,7 +8088,7 @@
           "Instance"
         ],
         "summary": "Describe the instance",
-        "description": "Describes the instance: its `instance_id`, the build it runs, the contract version it speaks and the features it serves. Needs no credential.",
+        "description": "Describes the instance: its display name, `instance_id`, the build it runs, the contract version it speaks and the features it serves. Needs no credential.",
         "responses": {
           "200": {
             "description": "Returns the instance's description. A request whose `Accept` header prefers `text/html` gets an HTML page instead.",
@@ -39011,11 +39065,14 @@
                     "description": "Registrations the key may make: `types` to register types and `edge_types` to register edge types, at `write`. `*` covers both."
                   },
                   "profile_permissions": {
-                    "type": "object",
-                    "additionalProperties": {
-                      "$ref": "#/components/schemas/PermissionLevel"
-                    },
-                    "description": "What the key may `read` or `write` of the owner's profile: `name`, `email` or `avatar`, or `*` for all of it."
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/ProfilePermissions"
+                      },
+                      {
+                        "description": "Profile access by `name`, `email`, `avatar`, or `*`. `write` permits name and avatar changes and implies read; email accepts only `read`. `*` reads every field and writes only name and avatar."
+                      }
+                    ]
                   },
                   "enforcement_override": {
                     "allOf": [
@@ -40380,11 +40437,14 @@
                     "description": "Registrations the key may make: `types` to register types and `edge_types` to register edge types, at `write`. `*` covers both."
                   },
                   "profile_permissions": {
-                    "type": "object",
-                    "additionalProperties": {
-                      "$ref": "#/components/schemas/PermissionLevel"
-                    },
-                    "description": "What the key may `read` or `write` of the owner's profile: `name`, `email` or `avatar`, or `*` for all of it."
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/ProfilePermissions"
+                      },
+                      {
+                        "description": "Profile access by `name`, `email`, `avatar`, or `*`. `write` permits name and avatar changes and implies read; email accepts only `read`. `*` reads every field and writes only name and avatar."
+                      }
+                    ]
                   },
                   "permissions": {
                     "type": "array",
@@ -40753,7 +40813,7 @@
           "Instance"
         ],
         "summary": "Get the configuration",
-        "description": "Returns the instance configuration: its enforcement levers and retention settings, with its `instance_id`. A setting nobody has set is left out. Requires `config.manage`.",
+        "description": "Returns the instance configuration: its display name, enforcement levers and retention settings, with its `instance_id`. A setting nobody has set is left out. Requires `config.manage`.",
         "security": [
           {
             "bearerAuth": []
@@ -41026,6 +41086,12 @@
                     "minLength": 1,
                     "description": "This instance's ID, accepted so you can send back what `GET /config` returned. It sets nothing."
                   },
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200,
+                    "description": "The instance's display name, without control or bidirectional formatting characters. Spaces at each end are trimmed. Absent: `Marfa`."
+                  },
                   "enforcement": {
                     "type": "object",
                     "properties": {
@@ -41128,7 +41194,7 @@
             }
           },
           "400": {
-            "description": "- `missing_required_field`: a lever lacks `types` or `sources`.\n- `validation_error`: the body names a setting Marfa doesn't know, a retention value is out of range, or `instance_id` names a different instance.",
+            "description": "- `missing_required_field`: a lever lacks `types` or `sources`.\n- `validation_error`: the body names a setting Marfa doesn't know, a retention value is out of range, the name is invalid, or `instance_id` names a different instance.",
             "content": {
               "application/json": {
                 "schema": {
@@ -42727,13 +42793,18 @@
           }
         }
       },
-      "post": {
-        "operationId": "createOwner",
+      "patch": {
+        "operationId": "updateOwner",
         "tags": [
           "Access"
         ],
-        "summary": "Claim the instance",
-        "description": "Creates the one owner using a machine-issued setup code or setup-only browser session. The claim, consumed proof, and audit commit together. A claimed instance never reopens setup.",
+        "summary": "Update the owner",
+        "security": [
+          {
+            "ownerSession": []
+          }
+        ],
+        "description": "Updates the owner's email or name and returns the owner. Requires a direct owner sign-in within five minutes or private machine authority. Changing email needs no confirmation; credentials, sessions, and grants keep their identity.",
         "requestBody": {
           "required": true,
           "content": {
@@ -42745,34 +42816,23 @@
                     "type": "string",
                     "maxLength": 254,
                     "format": "email",
-                    "description": "Email address the owner uses to sign in."
-                  },
-                  "password": {
-                    "type": "string",
-                    "description": "Password for the new owner."
+                    "description": "Email address used to sign in. Stored in lowercase; changing it clears email verification."
                   },
                   "name": {
                     "type": "string",
+                    "minLength": 1,
                     "maxLength": 200,
-                    "description": "Display name. Defaults to the part before @ in the email address when omitted or blank."
-                  },
-                  "code": {
-                    "type": "string",
-                    "description": "Machine-issued setup code. Omit when using a setup-only browser session."
+                    "description": "Display name, without control or bidirectional formatting characters. Spaces at each end are trimmed."
                   }
                 },
-                "required": [
-                  "email",
-                  "password"
-                ],
                 "additionalProperties": false
               }
             }
           }
         },
         "responses": {
-          "201": {
-            "description": "The new owner can sign in.",
+          "200": {
+            "description": "The updated owner.",
             "content": {
               "application/json": {
                 "schema": {
@@ -42786,11 +42846,20 @@
               },
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
               }
             }
           },
           "400": {
-            "description": "Owner details are invalid, or the body has a field this endpoint doesn't take.",
+            "description": "The body is empty, has an unknown field, or a field is invalid.",
             "content": {
               "application/json": {
                 "schema": {
@@ -42805,13 +42874,22 @@
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
               },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
           "401": {
-            "description": "Setup proof is invalid, expired, or replaced.",
+            "description": "`unauthorized`: the request has no credential, or its credential is not valid.",
             "content": {
               "application/json": {
                 "schema": {
@@ -42826,13 +42904,22 @@
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
               },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
           "403": {
-            "description": "The browser origin or transport is not permitted.",
+            "description": "The request needs private machine authority or direct owner authentication within five minutes.",
             "content": {
               "application/json": {
                 "schema": {
@@ -42847,24 +42934,26 @@
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
               },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
-          "409": {
-            "description": "The instance has already been claimed.",
+          "404": {
+            "description": "The owner is unavailable.",
             "content": {
               "application/json": {
                 "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/OwnerExistsRefusal"
-                    },
-                    {
-                      "$ref": "#/components/schemas/InstanceChangedRefusal"
-                    }
-                  ]
+                  "$ref": "#/components/schemas/OwnerNotFoundRefusal"
                 }
               }
             },
@@ -42875,17 +42964,26 @@
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
               },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
-          "413": {
-            "description": "`request_too_large`: the request body is larger than this instance accepts.",
+          "409": {
+            "description": "`instance_changed`: `X-Marfa-Instance-Id` names another instance. Nothing is written. Rebuild the working copy from the instance at this address.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RequestTooLargeRefusal"
+                  "$ref": "#/components/schemas/InstanceChangedRefusal"
                 }
               }
             },
@@ -42896,17 +42994,26 @@
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
               },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
-          "429": {
-            "description": "The address has used its setup-code attempts.",
+          "413": {
+            "description": "`request_too_large`: the request body is larger than this instance accepts.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RateLimitedRefusal"
+                  "$ref": "#/components/schemas/RequestTooLargeRefusal"
                 }
               }
             },
@@ -42919,18 +43026,15 @@
               },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
-              },
-              "Retry-After": {
-                "$ref": "#/components/headers/Retry-After"
               }
             }
           },
-          "500": {
-            "description": "`internal_error`: Marfa failed in a way it didn't expect, and the request may not have completed. Read what you changed before you repeat a write.",
+          "429": {
+            "description": "`rate_limited`: you sent too many requests. Wait for the number of seconds in `Retry-After`, then try again.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/InternalErrorRefusal"
+                  "$ref": "#/components/schemas/RateLimitedRefusal"
                 }
               }
             },
@@ -42941,46 +43045,29 @@
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
               },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
+              },
+              "Retry-After": {
+                "$ref": "#/components/headers/Retry-After"
               }
             }
-          }
-        },
-        "parameters": [
-          {
-            "name": "X-Marfa-Instance-Id",
-            "in": "header",
-            "required": false,
-            "schema": {
-              "type": "string",
-              "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
-            },
-            "description": "The ID of the instance you expect, as `GET /` returns it. If another instance answers at this address, Marfa returns `409 instance_changed` and doesn't write. Leave it out to send the request to whichever instance answers."
-          }
-        ]
-      }
-    },
-    "/owner/sign-ins": {
-      "get": {
-        "operationId": "listSignIns",
-        "tags": [
-          "Access"
-        ],
-        "summary": "List sign-ins",
-        "security": [
-          {
-            "ownerSession": []
-          }
-        ],
-        "description": "Returns every browser, app and key that can reach Marfa, marking the browser that sent the request. Requires the owner's browser session or the local command.",
-        "responses": {
-          "200": {
-            "description": "Returns every live sign-in.",
+          },
+          "500": {
+            "description": "`internal_error`: Marfa failed in a way it didn't expect, and the request may not have completed. Read what you changed before you repeat a write.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SignInList"
+                  "$ref": "#/components/schemas/InternalErrorRefusal"
                 }
               }
             },
@@ -42999,15 +43086,367 @@
               },
               "X-RateLimit-Reset": {
                 "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
-          "400": {
-            "description": "- `validation_error`: the query has a parameter this endpoint doesn't take.",
+          "503": {
+            "description": "`write_contention`: the database was busy, and Marfa couldn't complete the request in time. Nothing changed. Try the request again.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ValidationErrorRefusal"
+                  "$ref": "#/components/schemas/WriteContentionRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "507": {
+            "description": "`insufficient_storage`: the disk that holds the instance's data has no room for the request, or the request would leave less free than the instance keeps in reserve. Nothing changed, unless `details.write_outcome` is `unknown`, which means the write may have landed: read what you changed before you repeat it. Free space on the disk, then try the request again.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InsufficientStorageRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "X-Marfa-Instance-Id",
+            "in": "header",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+            },
+            "description": "The ID of the instance you expect, as `GET /` returns it. If another instance answers at this address, Marfa returns `409 instance_changed` and doesn't write. Leave it out to send the request to whichever instance answers."
+          }
+        ]
+      },
+      "post": {
+        "operationId": "createOwner",
+        "tags": [
+          "Access"
+        ],
+        "summary": "Claim the instance",
+        "description": "Creates the one owner using a machine-issued setup code or setup-only browser session. The claim, consumed proof, and audit commit together. A claimed instance never reopens setup.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "maxLength": 254,
+                    "format": "email",
+                    "description": "Email address the owner uses to sign in."
+                  },
+                  "password": {
+                    "type": "string",
+                    "description": "Password for the new owner."
+                  },
+                  "name": {
+                    "type": "string",
+                    "maxLength": 200,
+                    "description": "Display name. Defaults to the part before @ in the email address when omitted or blank."
+                  },
+                  "code": {
+                    "type": "string",
+                    "description": "Machine-issued setup code. Omit when using a setup-only browser session."
+                  }
+                },
+                "required": [
+                  "email",
+                  "password"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "The new owner can sign in.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Owner"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              }
+            }
+          },
+          "400": {
+            "description": "Owner details are invalid, or the body has a field this endpoint doesn't take.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MissingRequiredFieldOrValidationErrorRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "401": {
+            "description": "Setup proof is invalid, expired, or replaced.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UnauthorizedRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "403": {
+            "description": "The browser origin or transport is not permitted.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ForbiddenRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "409": {
+            "description": "The instance has already been claimed.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "anyOf": [
+                    {
+                      "$ref": "#/components/schemas/OwnerExistsRefusal"
+                    },
+                    {
+                      "$ref": "#/components/schemas/InstanceChangedRefusal"
+                    }
+                  ]
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "413": {
+            "description": "`request_too_large`: the request body is larger than this instance accepts.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RequestTooLargeRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "429": {
+            "description": "The address has used its setup-code attempts.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RateLimitedRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              },
+              "Retry-After": {
+                "$ref": "#/components/headers/Retry-After"
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error`: Marfa failed in a way it didn't expect, and the request may not have completed. Read what you changed before you repeat a write.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InternalErrorRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "X-Marfa-Instance-Id",
+            "in": "header",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+            },
+            "description": "The ID of the instance you expect, as `GET /` returns it. If another instance answers at this address, Marfa returns `409 instance_changed` and doesn't write. Leave it out to send the request to whichever instance answers."
+          }
+        ]
+      }
+    },
+    "/owner/sign-ins": {
+      "get": {
+        "operationId": "listSignIns",
+        "tags": [
+          "Access"
+        ],
+        "summary": "List sign-ins",
+        "security": [
+          {
+            "ownerSession": []
+          }
+        ],
+        "description": "Returns every browser, app and key that can reach Marfa, marking the browser that sent the request. Requires the owner's browser session or the local command.",
+        "responses": {
+          "200": {
+            "description": "Returns every live sign-in.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SignInList"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              }
+            }
+          },
+          "400": {
+            "description": "- `validation_error`: the query has a parameter this endpoint doesn't take.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ValidationErrorRefusal"
                 }
               }
             },
@@ -43874,18 +44313,426 @@
               },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
-              },
-              "Retry-After": {
-                "$ref": "#/components/headers/Retry-After"
+              },
+              "Retry-After": {
+                "$ref": "#/components/headers/Retry-After"
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error`: Marfa failed in a way it didn't expect, and the request may not have completed. Read what you changed before you repeat a write.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InternalErrorRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "503": {
+            "description": "`write_contention`: the database was busy, and Marfa couldn't complete the request in time. Nothing changed. Try the request again.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/WriteContentionRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "507": {
+            "description": "`insufficient_storage`: the disk that holds the instance's data has no room for the request, or the request would leave less free than the instance keeps in reserve. Nothing changed, unless `details.write_outcome` is `unknown`, which means the write may have landed: read what you changed before you repeat it. Free space on the disk, then try the request again.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InsufficientStorageRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          }
+        }
+      }
+    },
+    "/owner/passkeys": {
+      "get": {
+        "operationId": "listOwnerPasskeys",
+        "tags": [
+          "Access"
+        ],
+        "summary": "List passkeys",
+        "security": [
+          {
+            "ownerSession": []
+          }
+        ],
+        "description": "Returns every registered owner passkey, oldest first. Requires the owner's browser session or private local authority.",
+        "responses": {
+          "200": {
+            "description": "Returns every registered owner passkey.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OwnerPasskeyList"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              }
+            }
+          },
+          "400": {
+            "description": "- `validation_error`: the query has a parameter this endpoint doesn't take.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ValidationErrorRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized`: the request has no credential, or its credential is not valid.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UnauthorizedRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "403": {
+            "description": "Requires direct owner or local authority. Mutations require an owner sign-in within five minutes.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ForbiddenRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "429": {
+            "description": "`rate_limited`: you sent too many requests. Wait for the number of seconds in `Retry-After`, then try again.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RateLimitedRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              },
+              "Retry-After": {
+                "$ref": "#/components/headers/Retry-After"
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error`: Marfa failed in a way it didn't expect, and the request may not have completed. Read what you changed before you repeat a write.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InternalErrorRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "503": {
+            "description": "`write_contention`: the database was busy, and Marfa couldn't complete the request in time. Nothing changed. Try the request again.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/WriteContentionRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
+              }
+            }
+          },
+          "507": {
+            "description": "`insufficient_storage`: the disk that holds the instance's data has no room for the request, or the request would leave less free than the instance keeps in reserve. Nothing changed, unless `details.write_outcome` is `unknown`, which means the write may have landed: read what you changed before you repeat it. Free space on the disk, then try the request again.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InsufficientStorageRefusal"
+                }
+              }
+            },
+            "headers": {
+              "X-Marfa-Contract": {
+                "$ref": "#/components/headers/X-Marfa-Contract"
+              },
+              "X-Request-ID": {
+                "$ref": "#/components/headers/X-Request-ID"
+              },
+              "X-RateLimit-Limit": {
+                "$ref": "#/components/headers/X-RateLimit-Limit"
+              },
+              "X-RateLimit-Remaining": {
+                "$ref": "#/components/headers/X-RateLimit-Remaining"
+              },
+              "X-RateLimit-Reset": {
+                "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
               }
             }
+          }
+        }
+      }
+    },
+    "/owner/passkeys/{id}": {
+      "patch": {
+        "operationId": "updateOwnerPasskey",
+        "tags": [
+          "Access"
+        ],
+        "summary": "Rename a passkey",
+        "security": [
+          {
+            "ownerSession": []
+          }
+        ],
+        "description": "Renames the passkey and returns its public details. Requires the owner's browser session authenticated within five minutes or private local authority.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "description": "The ID of the passkey."
+            },
+            "required": true,
+            "description": "The ID of the passkey.",
+            "name": "id",
+            "in": "path"
           },
-          "500": {
-            "description": "`internal_error`: Marfa failed in a way it didn't expect, and the request may not have completed. Read what you changed before you repeat a write.",
+          {
+            "name": "X-Marfa-Instance-Id",
+            "in": "header",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+            },
+            "description": "The ID of the instance you expect, as `GET /` returns it. If another instance answers at this address, Marfa returns `409 instance_changed` and doesn't write. Leave it out to send the request to whichever instance answers."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200,
+                    "description": "The new name. Marfa trims spaces from each end."
+                  }
+                },
+                "required": [
+                  "name"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Returns the renamed passkey.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/InternalErrorRefusal"
+                  "$ref": "#/components/schemas/OwnerPasskey"
                 }
               }
             },
@@ -43904,18 +44751,15 @@
               },
               "X-RateLimit-Reset": {
                 "$ref": "#/components/headers/X-RateLimit-Reset"
-              },
-              "X-Error-Code": {
-                "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
-          "503": {
-            "description": "`write_contention`: the database was busy, and Marfa couldn't complete the request in time. Nothing changed. Try the request again.",
+          "400": {
+            "description": "The name is missing, empty, too long, or holds a control or bidirectional character, or the body contains another field.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/WriteContentionRefusal"
+                  "$ref": "#/components/schemas/MissingRequiredFieldOrValidationErrorRefusal"
                 }
               }
             },
@@ -43940,12 +44784,12 @@
               }
             }
           },
-          "507": {
-            "description": "`insufficient_storage`: the disk that holds the instance's data has no room for the request, or the request would leave less free than the instance keeps in reserve. Nothing changed, unless `details.write_outcome` is `unknown`, which means the write may have landed: read what you changed before you repeat it. Free space on the disk, then try the request again.",
+          "401": {
+            "description": "`unauthorized`: the request has no credential, or its credential is not valid.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/InsufficientStorageRefusal"
+                  "$ref": "#/components/schemas/UnauthorizedRefusal"
                 }
               }
             },
@@ -43969,30 +44813,13 @@
                 "$ref": "#/components/headers/X-Error-Code"
               }
             }
-          }
-        }
-      }
-    },
-    "/owner/passkeys": {
-      "get": {
-        "operationId": "listOwnerPasskeys",
-        "tags": [
-          "Access"
-        ],
-        "summary": "List passkeys",
-        "security": [
-          {
-            "ownerSession": []
-          }
-        ],
-        "description": "Returns every registered owner passkey, oldest first. Requires the owner's browser session or private local authority.",
-        "responses": {
-          "200": {
-            "description": "Returns every registered owner passkey.",
+          },
+          "403": {
+            "description": "Requires direct owner or local authority. Mutations require an owner sign-in within five minutes.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/OwnerPasskeyList"
+                  "$ref": "#/components/schemas/ForbiddenRefusal"
                 }
               }
             },
@@ -44011,15 +44838,18 @@
               },
               "X-RateLimit-Reset": {
                 "$ref": "#/components/headers/X-RateLimit-Reset"
+              },
+              "X-Error-Code": {
+                "$ref": "#/components/headers/X-Error-Code"
               }
             }
           },
-          "400": {
-            "description": "- `validation_error`: the query has a parameter this endpoint doesn't take.",
+          "404": {
+            "description": "No registered passkey of the owner has this ID.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ValidationErrorRefusal"
+                  "$ref": "#/components/schemas/PasskeyNotFoundRefusal"
                 }
               }
             },
@@ -44044,12 +44874,12 @@
               }
             }
           },
-          "401": {
-            "description": "`unauthorized`: the request has no credential, or its credential is not valid.",
+          "409": {
+            "description": "`instance_changed`: `X-Marfa-Instance-Id` names another instance. Nothing is written. Rebuild the working copy from the instance at this address.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/UnauthorizedRefusal"
+                  "$ref": "#/components/schemas/InstanceChangedRefusal"
                 }
               }
             },
@@ -44074,12 +44904,12 @@
               }
             }
           },
-          "403": {
-            "description": "Requires direct owner or local authority. Mutations require an owner sign-in within five minutes.",
+          "413": {
+            "description": "`request_too_large`: the request body is larger than this instance accepts.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ForbiddenRefusal"
+                  "$ref": "#/components/schemas/RequestTooLargeRefusal"
                 }
               }
             },
@@ -44090,15 +44920,6 @@
               "X-Request-ID": {
                 "$ref": "#/components/headers/X-Request-ID"
               },
-              "X-RateLimit-Limit": {
-                "$ref": "#/components/headers/X-RateLimit-Limit"
-              },
-              "X-RateLimit-Remaining": {
-                "$ref": "#/components/headers/X-RateLimit-Remaining"
-              },
-              "X-RateLimit-Reset": {
-                "$ref": "#/components/headers/X-RateLimit-Reset"
-              },
               "X-Error-Code": {
                 "$ref": "#/components/headers/X-Error-Code"
               }
@@ -44228,21 +45049,19 @@
             }
           }
         }
-      }
-    },
-    "/owner/passkeys/{id}": {
-      "patch": {
-        "operationId": "updateOwnerPasskey",
+      },
+      "delete": {
+        "operationId": "removeOwnerPasskey",
         "tags": [
           "Access"
         ],
-        "summary": "Rename a passkey",
+        "summary": "Remove a passkey",
         "security": [
           {
             "ownerSession": []
           }
         ],
-        "description": "Renames the passkey and returns its public details. Requires the owner's browser session authenticated within five minutes or private local authority.",
+        "description": "Removes one passkey so it cannot sign in again. Existing sign-ins remain usable. Requires the owner's browser session authenticated within five minutes or private local authority.",
         "parameters": [
           {
             "schema": {
@@ -44265,35 +45084,13 @@
             "description": "The ID of the instance you expect, as `GET /` returns it. If another instance answers at this address, Marfa returns `409 instance_changed` and doesn't write. Leave it out to send the request to whichever instance answers."
           }
         ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "minLength": 1,
-                    "maxLength": 200,
-                    "description": "The new name. Marfa trims spaces from each end."
-                  }
-                },
-                "required": [
-                  "name"
-                ],
-                "additionalProperties": false
-              }
-            }
-          }
-        },
         "responses": {
           "200": {
-            "description": "Returns the renamed passkey.",
+            "description": "Returns `ok: true`. The passkey was removed.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/OwnerPasskey"
+                  "$ref": "#/components/schemas/Ok"
                 }
               }
             },
@@ -44316,11 +45113,11 @@
             }
           },
           "400": {
-            "description": "The name is missing, empty, too long, or holds a control or bidirectional character, or the body contains another field.",
+            "description": "- `validation_error`: the query has a parameter this endpoint doesn't take.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MissingRequiredFieldOrValidationErrorRefusal"
+                  "$ref": "#/components/schemas/ValidationErrorRefusal"
                 }
               }
             },
@@ -44610,44 +45407,52 @@
             }
           }
         }
-      },
-      "delete": {
-        "operationId": "removeOwnerPasskey",
+      }
+    },
+    "/profile": {
+      "patch": {
+        "operationId": "updateProfile",
         "tags": [
           "Access"
         ],
-        "summary": "Remove a passkey",
+        "summary": "Update the profile",
+        "description": "Updates the owner's name or avatar and returns `ok: true`. Requires profile write permission for every submitted field; email cannot be changed here. All fields commit together.",
         "security": [
           {
-            "ownerSession": []
+            "bearerAuth": []
           }
         ],
-        "description": "Removes one passkey so it cannot sign in again. Existing sign-ins remain usable. Requires the owner's browser session authenticated within five minutes or private local authority.",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string",
-              "description": "The ID of the passkey."
-            },
-            "required": true,
-            "description": "The ID of the passkey.",
-            "name": "id",
-            "in": "path"
-          },
-          {
-            "name": "X-Marfa-Instance-Id",
-            "in": "header",
-            "required": false,
-            "schema": {
-              "type": "string",
-              "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
-            },
-            "description": "The ID of the instance you expect, as `GET /` returns it. If another instance answers at this address, Marfa returns `409 instance_changed` and doesn't write. Leave it out to send the request to whichever instance answers."
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200,
+                    "description": "Display name, without control or bidirectional formatting characters. Spaces at each end are trimmed."
+                  },
+                  "avatar": {
+                    "type": [
+                      "string",
+                      "null"
+                    ],
+                    "maxLength": 2048,
+                    "format": "uri",
+                    "description": "HTTP or HTTPS avatar URL, at most 2048 characters. null clears it. Marfa does not fetch the URL."
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
           }
-        ],
+        },
         "responses": {
           "200": {
-            "description": "Returns `ok: true`. The passkey was removed.",
+            "description": "Returns ok: true. The profile was updated.",
             "content": {
               "application/json": {
                 "schema": {
@@ -44674,11 +45479,11 @@
             }
           },
           "400": {
-            "description": "- `validation_error`: the query has a parameter this endpoint doesn't take.",
+            "description": "The body is empty, contains an unknown field, or a field is invalid.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ValidationErrorRefusal"
+                  "$ref": "#/components/schemas/MissingRequiredFieldOrValidationErrorRefusal"
                 }
               }
             },
@@ -44734,7 +45539,7 @@
             }
           },
           "403": {
-            "description": "Requires direct owner or local authority. Mutations require an owner sign-in within five minutes.",
+            "description": "The credential lacks profile write permission for a submitted field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -44764,11 +45569,11 @@
             }
           },
           "404": {
-            "description": "No registered passkey of the owner has this ID.",
+            "description": "The owner is unavailable.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PasskeyNotFoundRefusal"
+                  "$ref": "#/components/schemas/OwnerNotFoundRefusal"
                 }
               }
             },
@@ -44967,7 +45772,19 @@
               }
             }
           }
-        }
+        },
+        "parameters": [
+          {
+            "name": "X-Marfa-Instance-Id",
+            "in": "header",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+            },
+            "description": "The ID of the instance you expect, as `GET /` returns it. If another instance answers at this address, Marfa returns `409 instance_changed` and doesn't write. Leave it out to send the request to whichever instance answers."
+          }
+        ]
       }
     },
     "/export": {
diff --git a/src/generated/cli-download.md b/src/generated/cli-download.md
index 9e105bf0..b7bcab0a 100644
--- a/src/generated/cli-download.md
+++ b/src/generated/cli-download.md
@@ -1,5 +1,5 @@
 ```bash
-curl -fsSL https://github.com/withmarfa/marfa/releases/download/v0.0.12/marfa-0.0.12-darwin-arm64.tar.gz | tar -xz
+curl -fsSL https://github.com/withmarfa/marfa/releases/download/v0.0.13/marfa-0.0.13-darwin-arm64.tar.gz | tar -xz
 sudo mkdir -p /usr/local/bin
 sudo mv marfa /usr/local/bin/
 marfa --version
diff --git a/src/generated/contract-index.json b/src/generated/contract-index.json
index 1a6071d0..012a4d64 100644
--- a/src/generated/contract-index.json
+++ b/src/generated/contract-index.json
@@ -2803,7 +2803,20 @@
       "instance-claim/recovery-clears-sign-in-lock": "28340e02d9755cd9",
       "instance-claim/recovery-keeps-keys": "2cc3ab5fddb9a646",
       "instance-claim/management-metrics": "4584ce7fe3e4de05",
-      "instance-claim/control-only-recovery": "81b8c5f27479b583"
+      "instance-claim/control-only-recovery": "81b8c5f27479b583",
+      "instance-claim/profile-owner-unavailable": "9e35b62bb9862e97",
+      "instance-claim/owner-update": "541ea155b2826939",
+      "instance-claim/owner-update-authority": "1c204c9e55362965",
+      "instance-claim/owner-update-identity": "35061d017b7df1f0",
+      "instance-claim/owner-update-email": "ea5f7bb9e9351e19",
+      "instance-claim/profile-input": "aca334a7213b29e2",
+      "instance-claim/delegated-profile-update": "283a88306f44b57c",
+      "instance-claim/delegated-profile-atomic": "485da85f0b99d472",
+      "instance-claim/profile-email-owner-only": "34cbf8c80b12c31d",
+      "instance-claim/profile-grant-closed": "74b7b94f0d9ca6de",
+      "instance-claim/owner-update-email-unverified": "f10d1b6930e4df1c",
+      "instance-claim/owner-update-password-identity": "ae96a8d14488cdad",
+      "instance-claim/profile-email-write-scope": "2c8d39d2b5553841"
     },
     "instance": {
       "instance/id-at-root": "bc89ddd4415e9dfa",
@@ -2825,7 +2838,7 @@
       "instance/write-instance-ignored": "2e4f66174d3e2660",
       "instance/root-no-credential": "173bdaf186d1c92a",
       "instance/root-fields": "0aca6005f699f19c",
-      "instance/root-name": "96459fe807cb773a",
+      "instance/root-name": "46717bc3472d9a07",
       "instance/root-version": "c9aa784e6a869141",
       "instance/features-array": "4e9c2ebf1bf3693e",
       "instance/features-served": "3ca30b6709009d39",
@@ -2902,6 +2915,11 @@
       "instance/unfinished-ends-fresh": "61342c461e97bf9f",
       "instance/unfinished-foreign-ignored": "bcc0619f1f50c807",
       "instance/unfinished-foreign-kept": "c4c7366f20b155fd",
+      "instance/config-name": "9a6bdf702ff1c7a0",
+      "instance/config-name-invalid": "3b440d44f094476f",
+      "instance/config-name-live": "19c0321e55efb4fb",
+      "instance/config-name-durable": "9d3e558780bb234b",
+      "instance/config-name-page-escaped": "d98e8312272e4218",
       "instance/config-unauthenticated": "faaeae46d1e703ea",
       "instance/config-management-no-bypass": "97bdec88710d7075",
       "instance/config-permission-first": "f5785ff9266e1e87",
diff --git a/src/generated/marfa-release.json b/src/generated/marfa-release.json
index 30b4f24e..3094569a 100644
--- a/src/generated/marfa-release.json
+++ b/src/generated/marfa-release.json
@@ -1 +1 @@
-{"version":"v0.0.12"}
+{"version":"v0.0.13"}