diff --git a/.github/scripts/postgres-concurrency-tests.ts b/.github/scripts/postgres-concurrency-tests.ts
index 5e334ea0c..358618382 100644
--- a/.github/scripts/postgres-concurrency-tests.ts
+++ b/.github/scripts/postgres-concurrency-tests.ts
@@ -2,7 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 // eslint-disable-next-line no-restricted-imports -- Native filesystem paths are never embedded in source.
 import { join } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
+import { fileURLToPath } from 'node:url';
 import { parseSync } from 'vite';
 import { isRecord } from '../../packages/deploy-core/src/is-record.ts';
 import { compatibilityTestFiles } from './schema-compat-tests.ts';
@@ -38,7 +38,7 @@ function usesPostgresEnvironment(node: unknown): boolean {
 }
 
 /** Select real PostgreSQL cases without repeating the whole in-memory API suite. */
-export function postgresConcurrencyTestFiles(root: string): Array<string> {
+function postgresConcurrencyTestFiles(root: string): Array<string> {
   const files = compatibilityTestFiles(root).filter((file) => {
     const parsed = parseSync(file, readFileSync(join(root, file), 'utf8'));
     if (parsed.errors.length > 0) {
@@ -52,16 +52,14 @@ export function postgresConcurrencyTestFiles(root: string): Array<string> {
   return files;
 }
 
-if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
-  const files = postgresConcurrencyTestFiles(process.cwd());
-  // Reuse the bounded runner's independent database clones and cleanup for every file.
-  const result = spawnSync(
-    process.execPath,
-    [fileURLToPath(new URL('./schema-compat-tests.ts', import.meta.url)), ...files],
-    { stdio: 'inherit' },
-  );
-  if (result.error) {
-    throw result.error;
-  }
-  process.exitCode = result.status ?? 1;
+const files = postgresConcurrencyTestFiles(process.cwd());
+// Reuse the bounded runner's independent database clones and cleanup for every file.
+const result = spawnSync(
+  process.execPath,
+  [fileURLToPath(new URL('./schema-compat-tests.ts', import.meta.url)), ...files],
+  { stdio: 'inherit' },
+);
+if (result.error) {
+  throw result.error;
 }
+process.exitCode = result.status ?? 1;
diff --git a/.github/scripts/production-baseline.ts b/.github/scripts/production-baseline.ts
index 060185903..744efc469 100644
--- a/.github/scripts/production-baseline.ts
+++ b/.github/scripts/production-baseline.ts
@@ -1,12 +1,10 @@
 import { appendFileSync } from 'node:fs';
-import { pathToFileURL } from 'node:url';
 
-export async function productionBaseline(options: {
+async function productionBaseline(options: {
   configuredSha?: string;
   repository: string;
   token?: string;
-  environment?: string;
-  request?: typeof fetch;
+  environment: string;
 }): Promise<string> {
   if (options.configuredSha) {
     if (options.configuredSha.length !== 40 || !/^[0-9a-f]{40}$/i.test(options.configuredSha)) {
@@ -21,11 +19,10 @@ export async function productionBaseline(options: {
       'Provide a GitHub repository and read token, or set VOID_PLATFORM_PRODUCTION_REF to the deployed SHA.',
     );
   }
-  const request = options.request ?? fetch;
   const signal = AbortSignal.timeout(60_000);
-  const environment = options.environment ?? 'Prod';
+  const { environment } = options;
   const get = async (path: string): Promise<unknown> => {
-    const response = await request(`https://api.github.com/repos/${options.repository}/${path}`, {
+    const response = await fetch(`https://api.github.com/repos/${options.repository}/${path}`, {
       headers: {
         Accept: 'application/vnd.github+json',
         Authorization: `Bearer ${options.token}`,
@@ -70,15 +67,13 @@ export async function productionBaseline(options: {
   );
 }
 
-if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
-  const sha = await productionBaseline({
-    configuredSha: process.env.PRODUCTION_REF,
-    repository: process.env.GITHUB_REPOSITORY ?? '',
-    token: process.env.GITHUB_TOKEN,
-    environment: process.env.PRODUCTION_ENVIRONMENT || 'Prod',
-  });
-  if (process.env.GITHUB_OUTPUT) {
-    appendFileSync(process.env.GITHUB_OUTPUT, `sha=${sha}\n`);
-  }
-  console.log(`Previous production runtime: ${sha}`);
+const sha = await productionBaseline({
+  configuredSha: process.env.PRODUCTION_REF,
+  repository: process.env.GITHUB_REPOSITORY ?? '',
+  token: process.env.GITHUB_TOKEN,
+  environment: process.env.PRODUCTION_ENVIRONMENT || 'Prod',
+});
+if (process.env.GITHUB_OUTPUT) {
+  appendFileSync(process.env.GITHUB_OUTPUT, `sha=${sha}\n`);
 }
+console.log(`Previous production runtime: ${sha}`);
diff --git a/.github/scripts/schema-compat-tests.ts b/.github/scripts/schema-compat-tests.ts
index b85fbd5cd..93aceba9c 100644
--- a/.github/scripts/schema-compat-tests.ts
+++ b/.github/scripts/schema-compat-tests.ts
@@ -7,9 +7,9 @@ import { createRequire } from 'node:module';
 import { join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
-export const legacyZoneFixture = `      const second = await createTestProject(env.db, user.id, 'concurrent-zone-second');
+const legacyZoneFixture = `      const second = await createTestProject(env.db, user.id, 'concurrent-zone-second');
       stubCustomerCf({ zones });`;
-export const correctedZoneFixture = `      const second = await createTestProject(env.db, user.id, 'concurrent-zone-second');
+const correctedZoneFixture = `      const second = await createTestProject(env.db, user.id, 'concurrent-zone-second');
       const mx: Record<string, Array<string>> = {
         'concurrent-one.example.com': [],
         'concurrent-two.example.com': [],
@@ -32,13 +32,13 @@ export const correctedZoneFixture = `      const second = await createTestProjec
         },
       });`;
 
-export const legacyZoneProvision = `      await runEmailOperation(env.db, bindings(), accepted.value.operationId);`;
-export const correctedZoneProvision = `      provisionedDomain = (await env.db.select().from(emailDomainRoutes))[0]!.domain;
+const legacyZoneProvision = `      await runEmailOperation(env.db, bindings(), accepted.value.operationId);`;
+const correctedZoneProvision = `      provisionedDomain = (await env.db.select().from(emailDomainRoutes))[0]!.domain;
       await runEmailOperation(env.db, bindings(), accepted.value.operationId);`;
 
-export const legacyDeployBodyFixture = `    expect(res.status).not.toBe(413);
+const legacyDeployBodyFixture = `    expect(res.status).not.toBe(413);
   });`;
-export const correctedDeployBodyFixture = `    expect(res.status).not.toBe(413);
+const correctedDeployBodyFixture = `    expect(res.status).not.toBe(413);
     // Finish the deployment's database work before the next fixture resets its tables.
     await res.text();
   });`;
@@ -63,7 +63,7 @@ function correctKnownFixture(
 }
 
 /** Correct only the known deployed test fixture; runtime code and every assertion stay intact. */
-export function correctLegacyEmailFixture(source: string): string {
+function correctLegacyEmailFixture(source: string): string {
   return correctKnownFixture(
     source,
     'bf3ec4cd84c85a9e2cd01c7906ca6952dce5d7b957dc38487d6cfe99e9257eed',
@@ -74,7 +74,7 @@ export function correctLegacyEmailFixture(source: string): string {
   );
 }
 
-export function correctLegacyDeployFixture(source: string): string {
+function correctLegacyDeployFixture(source: string): string {
   return correctKnownFixture(
     source,
     'a62cdbc79573bba09da2212c441ebdcec74569d5ec4193d494f54fad98722f33',
@@ -83,7 +83,7 @@ export function correctLegacyDeployFixture(source: string): string {
 }
 
 /** Only the disposable CI database may be used as a template. */
-export function compatibilityTemplate(value: string): URL {
+function compatibilityTemplate(value: string): URL {
   let url: URL;
   try {
     url = new URL(value);
@@ -120,18 +120,14 @@ export function compatibilityTestFiles(root: string): Array<string> {
 }
 
 /** Keep the deployed runtime/tests intact, with one upgraded database snapshot per file. */
-export async function runIsolatedCompatibilityTests(options: {
+async function runIsolatedCompatibilityTests(options: {
   templateUrl: string;
   files: ReadonlyArray<string>;
   query: (statement: string) => Promise<unknown>;
   runTest: (file: string, databaseUrl: string) => Promise<number>;
-  concurrency?: number;
 }): Promise<Array<string>> {
   const template = compatibilityTemplate(options.templateUrl);
-  const concurrency = options.concurrency ?? 2;
-  if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > 4) {
-    throw new Error('Compatibility concurrency must be between 1 and 4.');
-  }
+  const concurrency = 2;
   if (!options.files.length || new Set(options.files).size !== options.files.length) {
     throw new Error('Compatibility tests must contain unique test files.');
   }
diff --git a/.github/scripts/schema-fixture.mjs b/.github/scripts/schema-fixture.mjs
index 3984542c5..2562be322 100644
--- a/.github/scripts/schema-fixture.mjs
+++ b/.github/scripts/schema-fixture.mjs
@@ -9,7 +9,7 @@ const PROJECT_MODE_MIGRATION = {
   timestamp: 1790841384175,
 };
 
-export function isProjectModeMigrationApplied(rows) {
+function isProjectModeMigrationApplied(rows) {
   return (
     rows.length === 1 &&
     rows[0].hash === PROJECT_MODE_MIGRATION.hash &&
@@ -17,7 +17,7 @@ export function isProjectModeMigrationApplied(rows) {
   );
 }
 
-export function assertSchemaFixturePreserved(original, rows, projectModeMigrationApplied = false) {
+function assertSchemaFixturePreserved(original, rows, projectModeMigrationApplied = false) {
   for (const [table, row] of Object.entries(original)) {
     for (const [key, value] of Object.entries(row)) {
       // 0054 deliberately normalizes the obsolete Worker mode to the public
@@ -40,11 +40,11 @@ export function assertSchemaFixturePreserved(original, rows, projectModeMigratio
   }
 }
 
-export async function runSchemaFixture(command, env = process.env) {
+async function runSchemaFixture(command) {
   const snapshot =
-    env.COMPAT_FIXTURE_PATH ??
-    (env.RUNNER_TEMP ? `${env.RUNNER_TEMP}/void-schema-fixture.json` : undefined);
-  if (!snapshot || !env.COMPAT_DATABASE_URL) {
+    process.env.COMPAT_FIXTURE_PATH ??
+    (process.env.RUNNER_TEMP ? `${process.env.RUNNER_TEMP}/void-schema-fixture.json` : undefined);
+  if (!snapshot || !process.env.COMPAT_DATABASE_URL) {
     throw new Error('A disposable compatibility database and fixture path are required.');
   }
   if (command !== 'seed' && command !== 'verify') {
@@ -55,7 +55,7 @@ export async function runSchemaFixture(command, env = process.env) {
   const { Pool } = createRequire(
     pathToFileURL(`${process.cwd()}/platform/packages/api/package.json`),
   )('pg');
-  const pool = new Pool({ connectionString: env.COMPAT_DATABASE_URL });
+  const pool = new Pool({ connectionString: process.env.COMPAT_DATABASE_URL });
   try {
     if (command === 'seed') {
       await pool.query(
@@ -104,6 +104,4 @@ export async function runSchemaFixture(command, env = process.env) {
   }
 }
 
-if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
-  await runSchemaFixture(process.argv[2]);
-}
+await runSchemaFixture(process.argv[2]);
diff --git a/TESTING.md b/TESTING.md
index d1b2814ae..2706b96b6 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -51,9 +51,9 @@ The runner adds coverage that imports cannot describe:
 `--list` does not refresh builds, so built-export coverage can expand when the command executes.
 Affected selection is conservative, not a proof that all behavior is covered: computed imports,
 filesystem reads, generated artifacts, and external services can introduce additional dependencies.
-Explicitly run a known consumer when changing one of those boundaries, and add a selector regression
-when introducing a new fixture layout. Changes to packaging still need the packed checks below;
-changes to metaframework output still need `build:all` and the artifact check.
+Explicitly run a known consumer when changing one of those boundaries. Changes to packaging still
+need the packed checks below; changes to metaframework output still need `build:all` and the
+artifact check.
 
 For a leaf-module edit with known import-based consumers, Vitest's native related command is useful:
 
@@ -143,16 +143,14 @@ repeat those production builds. `vpr test:all` runs the same artifact check loca
 
 Integration sharding uses [measured duration estimates](test/integration-timings.ts), rather than
 filename hashes. [The sequencer](test/sequencer.ts) packs the longest files first and starts costly
-fixtures early. Estimates affect scheduling only: new files receive a fallback estimate, and
-membership tests ensure every discovered file appears exactly once. Refresh the estimates when
-the suite's costs change materially. Seeded file shuffling remains available for isolation checks.
+fixtures early. Estimates affect scheduling only: new files receive a fallback estimate. Refresh
+the estimates when the suite's costs change materially. Seeded file shuffling remains available
+for isolation checks.
 
 The four adapter suites share their client and island test definitions in `test/`. Each runs the
 full browser behavior contract against its production preview build, plus a dev-mode navigation,
 island hydration/interaction smoke check, SSR/protocol assertions, and HMR checks. This keeps both
-runtime modes covered without repeating the full browser matrix. Before integrations start,
-their sources are snapshotted so another test cloning a fixture cannot capture an in-flight HMR
-edit. Dependencies stay linked to the installed workspace, and snapshots are removed afterward.
+runtime modes covered without repeating the full browser matrix.
 
 Use production functions in unit tests. A copy of a hook's implementation inside a test cannot
 catch regressions in the real hook. Shared form-value equality has one direct suite, and actual
@@ -247,8 +245,7 @@ VOID_TEST_BROWSER=webkit vp test run packages/react/test/integration packages/vu
 Use `waitForIslandsHydrated` from `test/browser-helpers.ts` before asserting island state or
 interacting with islands. Pass the expected minimum count when checking a multi-island fixture.
 Each island imports and hydrates independently, so a selector matching one hydrated island does
-not establish that its siblings are ready. The helper rejects empty or partially hydrated pages;
-`packages/void/test/integration/browser-helpers.test.ts` covers these cases.
+not establish that its siblings are ready. The helper rejects empty or partially hydrated pages.
 
 For SPA navigation, wait for a client readiness signal before setting the document marker and
 clicking. The Nuxt and SvelteKit playgrounds expose `h1[data-hydrated="true"]` after client startup.
diff --git a/packages/create-void/src/pm.ts b/packages/create-void/src/pm.ts
index c6810bc03..76ced6ffa 100644
--- a/packages/create-void/src/pm.ts
+++ b/packages/create-void/src/pm.ts
@@ -4,7 +4,7 @@ import { join } from 'pathslash';
 
 export type PM = 'npm' | 'pnpm' | 'yarn' | 'bun';
 
-export const VOID_PNPM_ALLOWED_BUILDS = ['esbuild', 'sharp', 'workerd'] as const;
+const VOID_PNPM_ALLOWED_BUILDS = ['esbuild', 'sharp', 'workerd'] as const;
 
 /** Write the explicit build-script policy required by a new pnpm project. */
 export function writePnpmBuildPolicy(root: string, pm: PM): void {
diff --git a/packages/create-void/test/unit/pm.test.ts b/packages/create-void/test/unit/pm.test.ts
index 5b6309209..d0d1506fc 100644
--- a/packages/create-void/test/unit/pm.test.ts
+++ b/packages/create-void/test/unit/pm.test.ts
@@ -2,7 +2,7 @@ import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
-import { VOID_PNPM_ALLOWED_BUILDS, writePnpmBuildPolicy } from '../../src/pm.ts';
+import { writePnpmBuildPolicy } from '../../src/pm.ts';
 
 const temporaryDirectories: Array<string> = [];
 
@@ -20,7 +20,7 @@ describe('create-void package manager bootstrap', () => {
     writePnpmBuildPolicy(root, 'pnpm');
 
     expect(readFileSync(join(root, 'pnpm-workspace.yaml'), 'utf-8')).toBe(
-      `allowBuilds:\n  better-sqlite3: false\n${VOID_PNPM_ALLOWED_BUILDS.map((name) => `  ${name}: true`).join('\n')}\n`,
+      'allowBuilds:\n  better-sqlite3: false\n  esbuild: true\n  sharp: true\n  workerd: true\n',
     );
   });
 
@@ -34,20 +34,4 @@ describe('create-void package manager bootstrap', () => {
       expect(existsSync(join(root, 'pnpm-workspace.yaml'))).toBe(false);
     }
   });
-
-  it('stays aligned with the policy written by void init', () => {
-    const initSource = readFileSync(
-      join(import.meta.dirname, '../../../void/src/cli/init.ts'),
-      'utf-8',
-    );
-    const declaration = initSource.match(
-      /const PNPM_ALLOWED_BUILDS = \[([\s\S]*?)\] as const;/,
-    )?.[1];
-    if (!declaration) {
-      throw new Error('Could not find the void init pnpm build policy.');
-    }
-    const initAllowedBuilds = [...declaration.matchAll(/'([^']+)'/g)].map((match) => match[1]);
-
-    expect(VOID_PNPM_ALLOWED_BUILDS).toEqual(initAllowedBuilds);
-  });
 });
diff --git a/packages/deploy-cloudflare/src/config.ts b/packages/deploy-cloudflare/src/config.ts
index 2a8b88157..9add4f8f0 100644
--- a/packages/deploy-cloudflare/src/config.ts
+++ b/packages/deploy-cloudflare/src/config.ts
@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { parse as parseJsoncConfig, type ParseError } from 'jsonc-parser';
+import { applyEdits, modify, parse as parseJsoncConfig, type ParseError } from 'jsonc-parser';
 
 /** Parse a root Wrangler JSON/JSONC config without accepting a partial parse. */
 export function parseRootWranglerConfig(configPath: string): Record<string, unknown> {
@@ -21,6 +21,14 @@ export function parseRootWranglerConfig(configPath: string): Record<string, unkn
   return parsed as Record<string, unknown>;
 }
 
+/** Set one value in JSONC text, keeping comments and formatting elsewhere. */
+export function setJsoncValue(text: string, path: Array<string>, value: unknown): string {
+  return applyEdits(
+    text,
+    modify(text, path, value, { formattingOptions: { insertSpaces: true, tabSize: 2, eol: '\n' } }),
+  );
+}
+
 export function readWranglerTopLevelString(
   config: Record<string, unknown>,
   field: string,
diff --git a/packages/deploy-cloudflare/src/framework.ts b/packages/deploy-cloudflare/src/framework.ts
index acf9b8eb4..c12b462c9 100644
--- a/packages/deploy-cloudflare/src/framework.ts
+++ b/packages/deploy-cloudflare/src/framework.ts
@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { applyEdits, modify, parse } from 'jsonc-parser';
+import { parse } from 'jsonc-parser';
 import { dirname, join, relative } from 'pathslash';
+import { setJsoncValue } from './config.ts';
 
 export type CloudflareFrameworkDeployConfig = Readonly<{
   configPath: string;
@@ -33,12 +34,7 @@ export function writeCloudflareFrameworkDeployConfig(
     : '{}\n';
   let content = initial;
   const upsert = (path: Array<string>, value: unknown): void => {
-    content = applyEdits(
-      content,
-      modify(content, path, value, {
-        formattingOptions: { insertSpaces: true, tabSize: 2, eol: '\n' },
-      }),
-    );
+    content = setJsoncValue(content, path, value);
   };
 
   upsert(['name'], options.name);
diff --git a/packages/deploy-cloudflare/src/static.ts b/packages/deploy-cloudflare/src/static.ts
index cc02e25f7..f15900353 100644
--- a/packages/deploy-cloudflare/src/static.ts
+++ b/packages/deploy-cloudflare/src/static.ts
@@ -1,9 +1,7 @@
 import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import type { AssetConfig, HeaderRule, RedirectRule } from '@void/deploy-core';
 import {
-  applyEdits,
   createScanner,
-  modify,
   parse,
   parseTree,
   type Node,
@@ -11,6 +9,7 @@ import {
   SyntaxKind,
 } from 'jsonc-parser';
 import { dirname, join, relative, resolve } from 'pathslash';
+import { setJsoncValue } from './config.ts';
 
 export type CloudflareStaticDeployConfig = Readonly<{
   configPath: string;
@@ -100,10 +99,7 @@ export function writeCloudflareStaticDeployConfig(options: CloudflareStaticDeplo
   const originalComments = extractCommentTokens(source);
   let content = source;
   const upsert = (path: Array<string>, value: unknown): void => {
-    const edits = modify(content, path, value, {
-      formattingOptions: { insertSpaces: true, tabSize: 2, eol: '\n' },
-    });
-    content = applyEdits(content, edits);
+    content = setJsoncValue(content, path, value);
   };
 
   upsert(['name'], options.name);
diff --git a/packages/deploy-cloudflare/src/version.ts b/packages/deploy-cloudflare/src/version.ts
index 95457ff3a..1b980cd96 100644
--- a/packages/deploy-cloudflare/src/version.ts
+++ b/packages/deploy-cloudflare/src/version.ts
@@ -1,8 +1,9 @@
 import { createHash } from 'node:crypto';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { setTimeout as delay } from 'node:timers/promises';
 import { isDeepStrictEqual } from 'node:util';
-import { isRecord } from '@void/deploy-core';
+import { canonicalJson, isRecord } from '@void/deploy-core';
 import { join } from 'pathslash';
 import { parseRootWranglerConfig } from './config.ts';
 import { cloudflareCommandDiagnostic } from './diagnostics.ts';
@@ -343,7 +344,6 @@ export async function stabilizeCloudflareVersionTriggers(options: {
   manageRoutes?: boolean;
   attempts?: number;
 }): Promise<CloudflareTriggerStabilization> {
-  const configPath = options.configPath;
   let cleanupBaseline = mergeTriggerCleanupBaselines(
     options.previousTriggerConfig,
     options.targetTriggerConfig,
@@ -351,7 +351,7 @@ export async function stabilizeCloudflareVersionTriggers(options: {
   const attempts = Math.max(1, options.attempts ?? 4);
 
   for (let attempt = 0; attempt < attempts; attempt++) {
-    const owner = await readCurrentProductionVersion(options, configPath);
+    const owner = await readCurrentProductionVersion(options);
     if (owner.kind === 'failed') {
       return { ok: false, reason: 'status-failed', status: owner.status };
     }
@@ -368,7 +368,7 @@ export async function stabilizeCloudflareVersionTriggers(options: {
         ? options.targetTriggerConfig
         : options.knownTriggerConfigs?.[activeVersionId];
     if (!activeTriggerConfig && activeVersionId !== options.targetVersionId) {
-      const metadata = await readCloudflareVersionMetadata(options, configPath, activeVersionId);
+      const metadata = await readCloudflareVersionMetadata(options, activeVersionId);
       activeTriggerConfig = metadata?.schema === 2 ? metadata.triggerConfig : undefined;
     }
     if (!activeTriggerConfig) {
@@ -395,7 +395,7 @@ export async function stabilizeCloudflareVersionTriggers(options: {
     }
 
     cleanupBaseline = mergeTriggerCleanupBaselines(cleanupBaseline, activeTriggerConfig);
-    const after = await readCurrentProductionVersion(options, configPath);
+    const after = await readCurrentProductionVersion(options);
     if (after.kind === 'failed') {
       return { ok: false, reason: 'status-failed', status: after.status };
     }
@@ -440,13 +440,7 @@ function mergeTriggerCleanupBaselines(
       return true;
     });
   };
-  // The baseline is only ever the `previousTriggerConfig` of `deployCloudflareVersionTriggers`,
-  // which mines it for state the active version no longer wants (queue consumers, workflow
-  // schedules, custom domains); it is never replayed as a version's own config. Email Routing
-  // needs no such subtraction — Wrangler plans deletions from rule ownership, not from a previous
-  // list — so `addresses` here is inert today. Carry it the same way as the other lists (the union
-  // of every published plan) so the baseline stays a faithful record, and keep the key absent when
-  // no version carried a plan: an absent key and `[]` are different plans.
+  // Keep `addresses` absent when no config carried a plan (see CloudflareTriggerConfig).
   const withAddresses = present.filter((config) => config.addresses !== undefined);
   return {
     workers_dev: present.some((config) => config.workers_dev),
@@ -492,11 +486,7 @@ function triggerConfigWithQueueConsumerCleanup(
   if (queues.length === 0) {
     return previous;
   }
-  // This copy becomes the previous version's known trigger config, which
-  // `stabilizeCloudflareVersionTriggers` replays verbatim when a concurrent rollback returns
-  // traffic to that version. Spread `previous` so every snapshot field survives — including an
-  // optional one such as `addresses`, where an absent key and `[]` are different Email Routing
-  // plans — rather than re-listing fields and silently dropping a newer one.
+  // A concurrent rollback replays this copy verbatim, so spread every snapshot field.
   const base: CloudflareTriggerConfig = previous ?? {
     workers_dev: false,
     preview_urls: false,
@@ -629,20 +619,7 @@ function nonVersionedSettingsHash(config: Record<string, unknown>): string {
       .filter((key) => config[key] !== undefined)
       .map((key) => [key, config[key]]),
   );
-  return createHash('sha256').update(stableJson(settings)).digest('hex');
-}
-
-function stableJson(value: unknown): string {
-  if (Array.isArray(value)) {
-    return `[${value.map(stableJson).join(',')}]`;
-  }
-  if (isRecord(value)) {
-    return `{${Object.keys(value)
-      .sort()
-      .map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`)
-      .join(',')}}`;
-  }
-  return JSON.stringify(value);
+  return createHash('sha256').update(canonicalJson(settings)).digest('hex');
 }
 
 function parseTriggerConfig(value: unknown): CloudflareTriggerConfig | null {
@@ -700,12 +677,7 @@ function triggerWranglerConfig(
   if (manageRoutes && !triggerConfig.preserveRoutes) {
     config.routes = [...triggerConfig.routes];
   }
-  // Only a snapshot that carried `addresses` may reach Wrangler's Email Routing plan: an
-  // absent key skips the plan, so rolling back to a version recorded without the key leaves
-  // existing rules in place. Never send `[]` for that case: Wrangler plans deletion of every
-  // rule this Worker owns, confirms it in a TTY and refuses it in CI, which fails the rollback
-  // as `triggers-failed`. Whether a rollback should touch Email Routing is a product call
-  // (design doc 0078, decision 13); this code replays the snapshot verbatim.
+  // Replay only a recorded plan; `[]` would delete every Email Routing rule this Worker owns.
   if (triggerConfig.addresses !== undefined) {
     config.addresses = [...triggerConfig.addresses];
   }
@@ -742,9 +714,7 @@ function resolvePreservedTraffic(
     crons: desired.crons,
     queueConsumers: desired.queueConsumers,
     workflows: desired.workflows,
-    // Not a traffic surface, but this rebuild is on the path of every versioned
-    // deploy: dropping the key here would skip wrangler's Email Routing plan and
-    // record the version without its addresses.
+    // Not a traffic surface, but dropping it would skip Wrangler's Email Routing plan.
     ...(desired.addresses === undefined ? {} : { addresses: desired.addresses }),
   };
 }
@@ -866,12 +836,11 @@ export async function activateCloudflareVersion(
 async function activateCloudflareVersionWithSecretsFile(
   options: InternalCloudflareVersionActivationOptions,
 ): Promise<CloudflareVersionActivation> {
-  const configPath = options.configPath;
   if (!options.verifyUploader()) {
     return { ok: false, reason: 'uploader-changed' };
   }
   options.onProgress?.('Checking the current Worker deployment...');
-  const previous = await readCurrentProductionVersion(options, configPath);
+  const previous = await readCurrentProductionVersion(options);
   if (previous.kind === 'failed') {
     return { ok: false, reason: 'status-failed', status: previous.status };
   }
@@ -916,7 +885,7 @@ async function activateCloudflareVersionWithSecretsFile(
   let activeSecretsPinned = false;
   let pinnedActiveSecrets: Array<{ name: string; type: 'secret_key' | 'secret_text' }> | undefined;
   if (options.expectedPreviousVersionId !== undefined || options.verifyInheritedSecrets === true) {
-    const recent = await readRecentCloudflareVersionIds(options, configPath);
+    const recent = await readRecentCloudflareVersionIds(options);
     if (recent === null) {
       return { ok: false, reason: 'inheritance-source-unavailable' };
     }
@@ -956,7 +925,6 @@ async function activateCloudflareVersionWithSecretsFile(
     ) {
       const replacesAllRemoteSecrets = await candidateReplacesAllRemoteSecrets(
         options,
-        configPath,
         previous.versionId,
         latestVersionId,
       );
@@ -965,7 +933,7 @@ async function activateCloudflareVersionWithSecretsFile(
       }
       if (!replacesAllRemoteSecrets) {
         const activeSecrets = previous.versionId
-          ? await readCloudflareVersionSecretBindings(options, configPath, previous.versionId)
+          ? await readCloudflareVersionSecretBindings(options, previous.versionId)
           : null;
         if (
           !activeSecrets ||
@@ -991,7 +959,6 @@ async function activateCloudflareVersionWithSecretsFile(
     previousVersionId && desiredMetadata?.schema === 2
       ? await readCloudflareVersionInspection(
           options,
-          configPath,
           previousVersionId,
           inheritanceBaseline?.map((version) => version.inspection),
         )
@@ -1002,7 +969,6 @@ async function activateCloudflareVersionWithSecretsFile(
     }
     previousVersion ??= await readCloudflareVersionInspection(
       options,
-      configPath,
       previousVersionId,
       inheritanceBaseline?.map((version) => version.inspection),
     );
@@ -1084,11 +1050,7 @@ async function activateCloudflareVersionWithSecretsFile(
     if (bootstrapVoidDraft || (!activeSecretsPinned && options.pinActiveSecrets)) {
       let activeSecrets: Awaited<ReturnType<typeof readCloudflareVersionSecretBindings>>;
       try {
-        activeSecrets = await readCloudflareVersionSecretBindings(
-          options,
-          configPath,
-          previous.versionId,
-        );
+        activeSecrets = await readCloudflareVersionSecretBindings(options, previous.versionId);
       } catch {
         return { ok: false, reason: 'inheritance-source-unavailable' };
       }
@@ -1125,7 +1087,6 @@ async function activateCloudflareVersionWithSecretsFile(
     }
     return bootstrapFirstDeployment(
       { ...options, message },
-      configPath,
       previous.versionId,
       options.atomic === true,
       previousTriggerConfig,
@@ -1143,11 +1104,7 @@ async function activateCloudflareVersionWithSecretsFile(
   ) {
     let activeSecrets: Awaited<ReturnType<typeof readCloudflareVersionSecretBindings>>;
     try {
-      activeSecrets = await readCloudflareVersionSecretBindings(
-        options,
-        configPath,
-        previous.versionId,
-      );
+      activeSecrets = await readCloudflareVersionSecretBindings(options, previous.versionId);
     } catch {
       return { ok: false, reason: 'inheritance-source-unavailable' };
     }
@@ -1177,7 +1134,7 @@ async function activateCloudflareVersionWithSecretsFile(
     if (!options.verifyUploader()) {
       return { ok: false, reason: 'uploader-changed' };
     }
-    const owner = await readCurrentProductionVersion(options, configPath);
+    const owner = await readCurrentProductionVersion(options);
     if (owner.kind === 'failed') {
       return { ok: false, reason: 'status-failed', status: owner.status };
     }
@@ -1200,7 +1157,7 @@ async function activateCloudflareVersionWithSecretsFile(
   const upload = await options.runWrangler(
     {
       type: 'versions.upload',
-      configPath,
+      configPath: options.configPath,
       workerName: options.workerName,
       message,
       secretsFilePath: options.candidateSecretsFilePath,
@@ -1226,7 +1183,6 @@ async function activateCloudflareVersionWithSecretsFile(
     ) {
       return bootstrapFirstDeployment(
         { ...options, message },
-        configPath,
         previous.versionId,
         false,
         previousTriggerConfig,
@@ -1249,7 +1205,7 @@ async function activateCloudflareVersionWithSecretsFile(
   }
   options.onProgress?.('Verifying the uploaded Worker...');
   if (inheritanceBaseline) {
-    const recent = await readRecentCloudflareVersionIds(options, configPath);
+    const recent = await readRecentCloudflareVersionIds(options);
     const previousLatest = inheritanceBaseline.at(-1);
     const expected = [...inheritanceBaseline.map((version) => version.id), versionId].slice(-10);
     if (recent === null) {
@@ -1326,7 +1282,6 @@ async function activateCloudflareVersionWithSecretsFile(
     ) {
       return bootstrapFirstDeployment(
         { ...options, message },
-        configPath,
         previous.versionId,
         false,
         previousTriggerConfig,
@@ -1350,7 +1305,6 @@ async function activateCloudflareVersionWithSecretsFile(
     }
     const stagingFailure = await stageCandidateForReadiness(
       options,
-      configPath,
       previous.versionId,
       versionId,
       message,
@@ -1369,7 +1323,7 @@ async function activateCloudflareVersionWithSecretsFile(
       authenticatedWorkersDevSubdomain,
       stagedVersionOverride ? versionId : undefined,
       options.fetch ?? globalThis.fetch,
-      options.sleep ?? defaultSleep,
+      options.sleep ?? delay,
       options.readinessAttempts ?? 6,
       Number.POSITIVE_INFINITY,
       options.requireVersionMetadata ? versionId : undefined,
@@ -1399,7 +1353,6 @@ async function activateCloudflareVersionWithSecretsFile(
     if (stableReadinessUrl && stableReadinessUrl !== readinessUrl) {
       const stagingFailure = await stageCandidateForReadiness(
         options,
-        configPath,
         previous.versionId,
         versionId,
         message,
@@ -1421,13 +1374,9 @@ async function activateCloudflareVersionWithSecretsFile(
       versionId,
       previousVersionId: previous.versionId,
       rollback: stagedVersionOverride
-        ? await restorePreviousVersion(
-            options,
-            configPath,
-            previous.versionId,
-            'readiness failed',
-            [stagedVersionPercentages(previous.versionId, versionId)],
-          )
+        ? await restorePreviousVersion(options, previous.versionId, 'readiness failed', [
+            stagedVersionPercentages(previous.versionId, versionId),
+          ])
         : 'not-needed',
     };
   }
@@ -1440,7 +1389,6 @@ async function activateCloudflareVersionWithSecretsFile(
       rollback: stagedVersionOverride
         ? await restorePreviousVersion(
             options,
-            configPath,
             previous.versionId,
             'uploader verification failed',
             [stagedVersionPercentages(previous.versionId, versionId)],
@@ -1451,7 +1399,7 @@ async function activateCloudflareVersionWithSecretsFile(
 
   // Readiness can take long enough for another deploy or rollback to finish. Never flatten that
   // newer operation using the stale `previous` snapshot captured before this upload began.
-  const ownerBeforeActivation = await readCurrentProductionVersion(options, configPath);
+  const ownerBeforeActivation = await readCurrentProductionVersion(options);
   if (ownerBeforeActivation.kind === 'failed') {
     return {
       ok: false,
@@ -1493,12 +1441,7 @@ async function activateCloudflareVersionWithSecretsFile(
   }
 
   options.onProgress?.('Activating the Worker...');
-  const activate = await deployVersionPercentages(
-    options,
-    configPath,
-    [`${versionId}@100`],
-    message,
-  );
+  const activate = await deployVersionPercentages(options, [`${versionId}@100`], message);
   if (!isCleanCommandExit(activate)) {
     return {
       ok: false,
@@ -1507,16 +1450,10 @@ async function activateCloudflareVersionWithSecretsFile(
       versionId,
       previousVersionId: previous.versionId,
       rollback: stagedVersionOverride
-        ? await restorePreviousVersion(
-            options,
-            configPath,
-            previous.versionId,
-            'version activation failed',
-            [
-              stagedVersionPercentages(previous.versionId, versionId),
-              [{ versionId, percentage: 100 }],
-            ],
-          )
+        ? await restorePreviousVersion(options, previous.versionId, 'version activation failed', [
+            stagedVersionPercentages(previous.versionId, versionId),
+            [{ versionId, percentage: 100 }],
+          ])
         : 'not-needed',
     };
   }
@@ -1534,7 +1471,7 @@ async function activateCloudflareVersionWithSecretsFile(
     };
   }
   if (options.preserveTriggers) {
-    const owner = await readCurrentProductionVersion(options, configPath);
+    const owner = await readCurrentProductionVersion(options);
     if (owner.kind !== 'ok' || owner.versionId !== versionId) {
       return {
         ok: false,
@@ -1595,7 +1532,7 @@ async function activateCloudflareVersionWithSecretsFile(
         rollback: 'unsafe',
       };
     }
-    const ownerBeforeCompensation = await readCurrentProductionVersion(options, configPath);
+    const ownerBeforeCompensation = await readCurrentProductionVersion(options);
     if (ownerBeforeCompensation.kind !== 'ok' || ownerBeforeCompensation.versionId === null) {
       return {
         ok: false,
@@ -1631,7 +1568,6 @@ async function activateCloudflareVersionWithSecretsFile(
     }
     const rollback = await restorePreviousVersionAndTriggers(
       options,
-      configPath,
       previous.versionId,
       'trigger activation failed',
       desiredTriggerConfig,
@@ -1689,14 +1625,13 @@ async function restorePreviousVersionAndTriggers(
     | 'publishEmptyCustomDomains'
     | 'publishEmptyCrons'
   >,
-  configPath: string | undefined,
   previousVersionId: string | null,
   cause: string,
   failedTriggerConfig: CloudflareTriggerConfig,
   failedVersionId: string,
   capturedTriggerConfig?: CloudflareTriggerConfig,
 ): Promise<'succeeded' | 'failed' | 'unavailable' | 'unsafe'> {
-  const traffic = await restorePreviousVersion(options, configPath, previousVersionId, cause, [
+  const traffic = await restorePreviousVersion(options, previousVersionId, cause, [
     [{ versionId: failedVersionId, percentage: 100 }],
   ]);
   if (traffic !== 'succeeded' || !previousVersionId) {
@@ -1711,19 +1646,14 @@ async function restorePreviousVersionAndTriggers(
   // part of this target snapshot.
   let targetTriggerConfig = capturedTriggerConfig;
   if (!targetTriggerConfig) {
-    const metadata = await readCloudflareVersionMetadata(options, configPath, previousVersionId);
+    const metadata = await readCloudflareVersionMetadata(options, previousVersionId);
     if (metadata?.schema !== 2) {
       return 'unavailable';
     }
     targetTriggerConfig = metadata.triggerConfig;
   }
-  // A preserve marker records that the previous version inherited live trigger
-  // state; its routes, schedules, queue consumers, and workflows are therefore
-  // intentionally opaque. The traffic snapshot can restore workers.dev, preview
-  // visibility, and routes for version activation, but merging those fields into
-  // this marker does not turn the unknown trigger surfaces into a restorable
-  // snapshot. Traffic is already back on the previous version at this point, so
-  // report trigger recovery as unavailable without publishing invented state.
+  // A preserve marker leaves routes, schedules, queue consumers and workflows opaque, so there
+  // is no trigger snapshot to restore. Traffic is already back on the previous version.
   if (targetTriggerConfig.preserve) {
     return 'unavailable';
   }
@@ -1745,11 +1675,13 @@ async function restorePreviousVersionAndTriggers(
 }
 
 async function readCloudflareVersionMetadata(
-  options: Pick<Parameters<typeof activateCloudflareVersion>[0], 'runWrangler' | 'workerName'>,
-  configPath: string | undefined,
+  options: Pick<
+    Parameters<typeof activateCloudflareVersion>[0],
+    'configPath' | 'runWrangler' | 'workerName'
+  >,
   versionId: string,
 ): Promise<CloudflareVersionMetadata | null> {
-  return (await readCloudflareVersionInspection(options, configPath, versionId))?.metadata ?? null;
+  return (await readCloudflareVersionInspection(options, versionId))?.metadata ?? null;
 }
 
 type CloudflareVersionInspection = Readonly<{
@@ -1760,8 +1692,10 @@ type CloudflareVersionInspection = Readonly<{
 }>;
 
 async function readCloudflareVersionInspection(
-  options: Pick<Parameters<typeof activateCloudflareVersion>[0], 'runWrangler' | 'workerName'>,
-  configPath: string | undefined,
+  options: Pick<
+    Parameters<typeof activateCloudflareVersion>[0],
+    'configPath' | 'runWrangler' | 'workerName'
+  >,
   versionId: string,
   knownVersions?: ReadonlyArray<unknown>,
 ): Promise<CloudflareVersionInspection | null> {
@@ -1771,7 +1705,7 @@ async function readCloudflareVersionInspection(
     let versions = knownVersions;
     if (versions === undefined) {
       const result = await options.runWrangler(
-        { type: 'versions.list', configPath, workerName: options.workerName },
+        { type: 'versions.list', configPath: options.configPath, workerName: options.workerName },
         { capture: true },
       );
       if (!isCleanCommandExit(result)) {
@@ -1800,7 +1734,7 @@ async function readCloudflareVersionInspection(
           {
             type: 'versions.view',
             versionId,
-            configPath,
+            configPath: options.configPath,
             workerName: options.workerName,
             includeSource: true,
           },
@@ -1830,11 +1764,13 @@ async function readCloudflareVersionInspection(
 }
 
 async function readRecentCloudflareVersionIds(
-  options: Pick<Parameters<typeof activateCloudflareVersion>[0], 'runWrangler' | 'workerName'>,
-  configPath: string | undefined,
+  options: Pick<
+    Parameters<typeof activateCloudflareVersion>[0],
+    'configPath' | 'runWrangler' | 'workerName'
+  >,
 ): Promise<Array<RecentCloudflareVersion> | null> {
   const result = await options.runWrangler(
-    { type: 'versions.list', configPath, workerName: options.workerName },
+    { type: 'versions.list', configPath: options.configPath, workerName: options.workerName },
     { capture: true },
   );
   if (!isCleanCommandExit(result)) {
@@ -1870,9 +1806,8 @@ function arraysEqual(left: ReadonlyArray<string>, right: ReadonlyArray<string>):
 async function candidateReplacesAllRemoteSecrets(
   options: Pick<
     Parameters<typeof activateCloudflareVersion>[0],
-    'candidateSecrets' | 'runWrangler' | 'workerName'
+    'candidateSecrets' | 'configPath' | 'runWrangler' | 'workerName'
   >,
-  configPath: string | undefined,
   activeVersionId: string | null,
   latestVersionId: string | null,
 ): Promise<boolean | null> {
@@ -1881,7 +1816,7 @@ async function candidateReplacesAllRemoteSecrets(
   ] as Array<string>;
   const secretBindings: Array<Array<{ name: string; type: 'secret_key' | 'secret_text' }>> = [];
   for (const versionId of versionIds) {
-    const bindings = await readCloudflareVersionSecretBindings(options, configPath, versionId);
+    const bindings = await readCloudflareVersionSecretBindings(options, versionId);
     if (bindings === null) {
       return null;
     }
@@ -1897,12 +1832,19 @@ async function candidateReplacesAllRemoteSecrets(
 }
 
 async function readCloudflareVersionSecretBindings(
-  options: Pick<Parameters<typeof activateCloudflareVersion>[0], 'runWrangler' | 'workerName'>,
-  configPath: string | undefined,
+  options: Pick<
+    Parameters<typeof activateCloudflareVersion>[0],
+    'configPath' | 'runWrangler' | 'workerName'
+  >,
   versionId: string,
 ): Promise<Array<{ name: string; type: 'secret_key' | 'secret_text' }> | null> {
   const result = await options.runWrangler(
-    { type: 'versions.view', versionId, configPath, workerName: options.workerName },
+    {
+      type: 'versions.view',
+      versionId,
+      configPath: options.configPath,
+      workerName: options.workerName,
+    },
     { capture: true },
   );
   if (!isCleanCommandExit(result)) {
@@ -1937,7 +1879,6 @@ async function readCloudflareVersionSecretBindings(
  */
 async function bootstrapFirstDeployment(
   options: InternalCloudflareVersionActivationOptions,
-  configPath: string | undefined,
   previousVersionId: string | null,
   atomic = false,
   previousTriggerConfig?: CloudflareTriggerConfig,
@@ -1946,7 +1887,7 @@ async function bootstrapFirstDeployment(
     return { ok: false, reason: 'uploader-changed' };
   }
   {
-    const current = await readCurrentProductionVersion(options, configPath);
+    const current = await readCurrentProductionVersion(options);
     if (current.kind === 'failed') {
       return { ok: false, reason: 'status-failed', status: current.status };
     }
@@ -1972,7 +1913,7 @@ async function bootstrapFirstDeployment(
   const bootstrap = await options.runWrangler(
     {
       type: 'worker.deploy',
-      configPath,
+      configPath: options.configPath,
       workerName: options.workerName,
       message: options.message,
       secretsFilePath: options.candidateSecretsFilePath,
@@ -2034,7 +1975,7 @@ async function bootstrapFirstDeployment(
     publishEmptyCrons: options.publishEmptyCrons,
   };
   const verifyPublishedOwner = async (): Promise<CloudflareVersionActivation | null> => {
-    const owner = await readCurrentProductionVersion(options, configPath);
+    const owner = await readCurrentProductionVersion(options);
     if (owner.kind === 'failed') {
       return {
         ok: false,
@@ -2165,7 +2106,7 @@ async function bootstrapFirstDeployment(
     extractWorkersDevSubdomain(previewUrl),
     undefined,
     options.fetch ?? globalThis.fetch,
-    options.sleep ?? defaultSleep,
+    options.sleep ?? delay,
     // A first Custom Domain needs DNS and certificate propagation. Existing
     // previews and explicitly atomic releases retain their shorter window.
     // Keep an overall deadline even when requests time out individually.
@@ -2206,7 +2147,7 @@ async function bootstrapFirstDeployment(
   }
   // DNS propagation can outlast another deploy. A successful response alone
   // must not record this version as live after a newer owner took over.
-  const ownerAfterReadiness = await readCurrentProductionVersion(options, configPath);
+  const ownerAfterReadiness = await readCurrentProductionVersion(options);
   if (ownerAfterReadiness.kind === 'failed') {
     return {
       ok: false,
@@ -2294,11 +2235,13 @@ function isContainersUnavailable(result: CloudflareCommandResult): boolean {
 }
 
 async function readCurrentProductionVersion(
-  options: Pick<Parameters<typeof activateCloudflareVersion>[0], 'runWrangler' | 'workerName'>,
-  configPath: string | undefined,
+  options: Pick<
+    Parameters<typeof activateCloudflareVersion>[0],
+    'configPath' | 'runWrangler' | 'workerName'
+  >,
 ): Promise<CurrentProductionVersion> {
   const result = await options.runWrangler(
-    { type: 'deployments.status', configPath, workerName: options.workerName },
+    { type: 'deployments.status', configPath: options.configPath, workerName: options.workerName },
     { capture: true },
   );
   if (!isCleanCommandExit(result)) {
@@ -2372,7 +2315,6 @@ function stagedVersionPercentages(
 /** Stage the candidate at 0% beside the unchanged previous version so readiness can select it. */
 async function stageCandidateForReadiness(
   options: CloudflareVersionActivationOptions,
-  configPath: string | undefined,
   previousVersionId: string | null,
   versionId: string,
   message: string,
@@ -2386,18 +2328,12 @@ async function stageCandidateForReadiness(
       rollback: 'not-needed',
     };
   }
-  const ownerFailure = await verifyReadinessStagingOwner(
-    options,
-    configPath,
-    previousVersionId,
-    versionId,
-  );
+  const ownerFailure = await verifyReadinessStagingOwner(options, previousVersionId, versionId);
   if (ownerFailure) {
     return ownerFailure;
   }
   const staged = await deployVersionPercentages(
     options,
-    configPath,
     [`${previousVersionId}@100`, `${versionId}@0`],
     message,
   );
@@ -2418,12 +2354,14 @@ async function stageCandidateForReadiness(
 }
 
 async function verifyReadinessStagingOwner(
-  options: Pick<Parameters<typeof activateCloudflareVersion>[0], 'runWrangler' | 'workerName'>,
-  configPath: string | undefined,
+  options: Pick<
+    Parameters<typeof activateCloudflareVersion>[0],
+    'configPath' | 'runWrangler' | 'workerName'
+  >,
   previousVersionId: string | null,
   versionId: string,
 ): Promise<Extract<CloudflareVersionActivation, { ok: false }> | null> {
-  const owner = await readCurrentProductionVersion(options, configPath);
+  const owner = await readCurrentProductionVersion(options);
   if (owner.kind === 'failed') {
     return {
       ok: false,
@@ -2521,9 +2459,9 @@ async function probeReadiness(
       }
     }
     if (attempt + 1 < attempts) {
-      const delay = Math.min(250 * 2 ** attempt, 2_000, deadline - Date.now());
-      if (delay > 0) {
-        await sleep(delay);
+      const waitMs = Math.min(250 * 2 ** attempt, 2_000, deadline - Date.now());
+      if (waitMs > 0) {
+        await sleep(waitMs);
       }
     }
   }
@@ -2586,7 +2524,6 @@ async function deployVersionPercentages(
     Parameters<typeof activateCloudflareVersion>[0],
     'runWrangler' | 'workerName' | 'preserveTriggers' | 'configPath'
   >,
-  configPath: string | undefined,
   percentages: Array<string>,
   message: string,
 ): Promise<CloudflareCommandResult> {
@@ -2606,7 +2543,7 @@ async function deployVersionPercentages(
     {
       type: 'versions.deploy',
       versions: versionPercentages(percentages),
-      configPath,
+      configPath: options.configPath,
       workerName: options.workerName,
       message,
     },
@@ -2645,9 +2582,8 @@ export async function deployCloudflareVersionTraffic(options: {
 async function restorePreviousVersion(
   options: Pick<
     Parameters<typeof activateCloudflareVersion>[0],
-    'runWrangler' | 'verifyUploader' | 'workerName'
+    'configPath' | 'runWrangler' | 'verifyUploader' | 'workerName'
   >,
-  configPath: string | undefined,
   previousVersionId: string | null,
   cause: string,
   expectedOwnedTraffic: ReadonlyArray<ReadonlyArray<ProductionVersionPercentage>>,
@@ -2658,7 +2594,7 @@ async function restorePreviousVersion(
   if (!options.verifyUploader()) {
     return 'unsafe';
   }
-  const owner = await readCurrentProductionVersion(options, configPath);
+  const owner = await readCurrentProductionVersion(options);
   if (
     owner.kind !== 'ok' ||
     !expectedOwnedTraffic.some((expected) =>
@@ -2669,7 +2605,6 @@ async function restorePreviousVersion(
   }
   const result = await deployVersionPercentages(
     options,
-    configPath,
     [`${previousVersionId}@100`],
     `Void automatic rollback after ${cause}.`,
   );
@@ -2733,7 +2668,3 @@ function workersDevSubdomainResult(url: string): { workersDevSubdomain?: string
   const workersDevSubdomain = extractWorkersDevSubdomain(url);
   return workersDevSubdomain ? { workersDevSubdomain } : {};
 }
-
-function defaultSleep(milliseconds: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
diff --git a/packages/deploy-cloudflare/test/operation-fixture.ts b/packages/deploy-cloudflare/test/operation-fixture.ts
index 00fc57458..e4a1b057c 100644
--- a/packages/deploy-cloudflare/test/operation-fixture.ts
+++ b/packages/deploy-cloudflare/test/operation-fixture.ts
@@ -3,7 +3,7 @@ import { vi } from 'vite-plus/test';
 import type { CloudflareCommandResult } from '../src/execute.ts';
 import type { CloudflareOperation } from '../src/operations.ts';
 
-/** Replay the existing failure/race fixtures through the typed operation boundary. */
+/** Run an argv-style test callback behind the typed operation runner. */
 export function operationFixture<
   T extends (
     args: Array<string>,
@@ -295,7 +295,6 @@ export function operationFixtureArgs(operation: CloudflareOperation): Array<stri
   }
 }
 
-/** Convert old test input shorthand into an actual typed request. */
 export function operationFixtureRequest(args: Array<string>): CloudflareOperation {
   const value = (flag: string) => {
     const i = args.indexOf(flag);
diff --git a/packages/deploy-cloudflare/test/unit/existing.test.ts b/packages/deploy-cloudflare/test/unit/existing.test.ts
index a3b411665..439747dff 100644
--- a/packages/deploy-cloudflare/test/unit/existing.test.ts
+++ b/packages/deploy-cloudflare/test/unit/existing.test.ts
@@ -33,6 +33,32 @@ const config = {
   kv_namespaces: [{ binding: 'KV', id: 'existing-id' }],
 };
 
+async function withMigrationsConfig(
+  migrations: Array<Record<string, unknown>>,
+  run: (configPath: string) => Promise<void>,
+): Promise<void> {
+  const root = mkdtempSync(join(tmpdir(), 'void-do-lifecycle-'));
+  try {
+    const configPath = join(root, 'wrangler.jsonc');
+    writeFileSync(configPath, JSON.stringify({ migrations }));
+    await run(configPath);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function activeWorkerRunner(version: Record<string, unknown>) {
+  return vi.fn(async (operation: CloudflareOperation): Promise<CloudflareCommandResult> => ({
+    status: 0,
+    stdout: '',
+    stderr: '',
+    data:
+      operation.type === 'deployments.status'
+        ? { versions: [{ version_id: 'active', percentage: 100 }] }
+        : { id: 'active', ...version },
+  }));
+}
+
 it('preserves an existing authored version metadata binding without permitting additions', () => {
   const metadata = { type: 'version_metadata', name: 'APP_VERSION' };
   const existing = { ...worker, bindings: [...worker.bindings, metadata] };
@@ -358,7 +384,6 @@ describe('existing Worker preservation', () => {
       }),
     ).rejects.toThrow('production changed');
     expect(runWrangler.mock.calls[1]![0]).toContain('original');
-    expect(runWrangler.mock.calls.every(([args]) => args.includes('--json'))).toBe(true);
   });
 
   it('does not infer an active migration tag from an explicitly requested candidate', async () => {
@@ -397,34 +422,18 @@ describe('existing Worker preservation', () => {
   });
 
   it('rejects a pending class migration on an existing Worker', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-do-lifecycle-'));
-    const configPath = join(root, 'wrangler.jsonc');
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        migrations: [
-          { tag: 'v1', new_sqlite_classes: ['Room'] },
-          { tag: 'v2', new_sqlite_classes: ['Counter'] },
-        ],
-      }),
-    );
-    const runWrangler = operationFixture((args: Array<string>) => ({
-      status: 0,
-      stderr: '',
-      stdout: JSON.stringify(
-        args[0] === 'deployments'
-          ? { versions: [{ version_id: 'active', percentage: 100 }] }
-          : {
-              id: 'active',
-              resources: {
-                bindings: [],
-                script: { handlers: ['fetch'] },
-                script_runtime: { migration_tag: 'v1' },
-              },
-            },
-      ),
-    }));
-    try {
+    const migrations = [
+      { tag: 'v1', new_sqlite_classes: ['Room'] },
+      { tag: 'v2', new_sqlite_classes: ['Counter'] },
+    ];
+    const runWrangler = activeWorkerRunner({
+      resources: {
+        bindings: [],
+        script: { handlers: ['fetch'] },
+        script_runtime: { migration_tag: 'v1' },
+      },
+    });
+    await withMigrationsConfig(migrations, async (configPath) => {
       await expect(
         assertCloudflareDurableObjectLifecycleSupported({
           runWrangler,
@@ -447,73 +456,51 @@ describe('existing Worker preservation', () => {
         }),
       ).resolves.toBeUndefined();
       expect(runWrangler).toHaveBeenCalledTimes(12);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
+    });
   });
 
   it('allows first deployment and an already-active class migration', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-do-lifecycle-'));
-    const configPath = join(root, 'wrangler.jsonc');
-    writeFileSync(
-      configPath,
-      JSON.stringify({ migrations: [{ tag: 'v1', new_sqlite_classes: ['Room'] }] }),
-    );
     const missing = operationFixture(() => ({
       status: 1,
       stdout: '',
       stderr: 'This Worker does not exist. [code: 10007]',
     }));
-    const active = operationFixture((args: Array<string>) => ({
-      status: 0,
-      stderr: '',
-      stdout: JSON.stringify(
-        args[0] === 'deployments'
-          ? { versions: [{ version_id: 'active', percentage: 100 }] }
-          : {
-              id: 'active',
-              resources: {
-                bindings: [],
-                script: { handlers: ['fetch'] },
-                script_runtime: { migration_tag: 'v1' },
-              },
-            },
-      ),
-    }));
-    try {
-      await expect(
-        assertCloudflareDurableObjectLifecycleSupported({
-          runWrangler: missing,
-          configPath,
-          workerName: 'first',
-          accountId: 'account',
-          apiBaseUrl: 'https://api.cloudflare.test/client/v4',
-        }),
-      ).resolves.toBeUndefined();
-      await expect(
-        assertCloudflareDurableObjectLifecycleSupported({
-          runWrangler: active,
-          configPath,
-          workerName: 'app',
-          accountId: 'account',
-          apiBaseUrl: 'https://api.cloudflare.test/client/v4',
-          readMigrationTag: async () => 'v1',
-        }),
-      ).resolves.toBeUndefined();
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
+    const active = activeWorkerRunner({
+      resources: {
+        bindings: [],
+        script: { handlers: ['fetch'] },
+        script_runtime: { migration_tag: 'v1' },
+      },
+    });
+    await withMigrationsConfig(
+      [{ tag: 'v1', new_sqlite_classes: ['Room'] }],
+      async (configPath) => {
+        await expect(
+          assertCloudflareDurableObjectLifecycleSupported({
+            runWrangler: missing,
+            configPath,
+            workerName: 'first',
+            accountId: 'account',
+            apiBaseUrl: 'https://api.cloudflare.test/client/v4',
+          }),
+        ).resolves.toBeUndefined();
+        await expect(
+          assertCloudflareDurableObjectLifecycleSupported({
+            runWrangler: active,
+            configPath,
+            workerName: 'app',
+            accountId: 'account',
+            apiBaseUrl: 'https://api.cloudflare.test/client/v4',
+            readMigrationTag: async () => 'v1',
+          }),
+        ).resolves.toBeUndefined();
+      },
+    );
   });
 
   it.each(['placeholder', 'real-code', 'owner-drift'] as const)(
     'verifies immutable SDK secret-draft proof before its first DO migration: %s',
     async (scenario) => {
-      const root = mkdtempSync(join(tmpdir(), 'void-sdk-draft-lifecycle-'));
-      const configPath = join(root, 'wrangler.jsonc');
-      writeFileSync(
-        configPath,
-        JSON.stringify({ migrations: [{ tag: 'v1', new_sqlite_classes: ['Room'] }] }),
-      );
       const source = voidSecretDraftVersion();
       if (scenario === 'real-code') {
         source.modules[0]!.content_base64 = Buffer.from(
@@ -559,30 +546,31 @@ describe('existing Worker preservation', () => {
           throw new Error(`Unexpected read-only lifecycle operation: ${operation.type}`);
         },
       );
-      try {
-        const inspection = assertCloudflareDurableObjectLifecycleSupported({
-          runWrangler,
-          configPath,
-          workerName: 'app',
-          accountId: 'account',
-          apiBaseUrl: 'https://api.cloudflare.test/client/v4',
-          readMigrationTag: async () => null,
-        });
-        if (scenario === 'placeholder') {
-          await expect(inspection).resolves.toBeUndefined();
-        } else {
-          await expect(inspection).rejects.toThrow(
-            scenario === 'owner-drift' ? 'production changed' : 'atomic Cloudflare deployment',
-          );
-        }
-        expect(
-          runWrangler.mock.calls.filter(
-            ([operation]) => operation.type === 'versions.view' && operation.includeSource,
-          ),
-        ).toHaveLength(scenario === 'owner-drift' ? 1 : 2);
-      } finally {
-        rmSync(root, { recursive: true, force: true });
-      }
+      await withMigrationsConfig(
+        [{ tag: 'v1', new_sqlite_classes: ['Room'] }],
+        async (configPath) => {
+          const inspection = assertCloudflareDurableObjectLifecycleSupported({
+            runWrangler,
+            configPath,
+            workerName: 'app',
+            accountId: 'account',
+            apiBaseUrl: 'https://api.cloudflare.test/client/v4',
+            readMigrationTag: async () => null,
+          });
+          if (scenario === 'placeholder') {
+            await expect(inspection).resolves.toBeUndefined();
+          } else {
+            await expect(inspection).rejects.toThrow(
+              scenario === 'owner-drift' ? 'production changed' : 'atomic Cloudflare deployment',
+            );
+          }
+          expect(
+            runWrangler.mock.calls.filter(
+              ([operation]) => operation.type === 'versions.view' && operation.includeSource,
+            ),
+          ).toHaveLength(scenario === 'owner-drift' ? 1 : 2);
+        },
+      );
     },
   );
 
@@ -622,65 +610,44 @@ describe('existing Worker preservation', () => {
     { error: 'provider process failed' },
     { status: Number.NaN },
   ])('never treats an interrupted lifecycle probe as an absent Worker: %j', async (provenance) => {
-    const root = mkdtempSync(join(tmpdir(), 'void-do-interrupted-'));
-    const configPath = join(root, 'wrangler.jsonc');
-    writeFileSync(
-      configPath,
-      JSON.stringify({ migrations: [{ tag: 'v1', new_sqlite_classes: ['Room'] }] }),
-    );
-    try {
-      await expect(
-        assertCloudflareDurableObjectLifecycleSupported({
-          runWrangler: () => ({
-            status: 1,
-            stdout: '',
-            stderr: '',
-            errorCode: 10007,
-            failure: 'not-found',
-            ...provenance,
+    await withMigrationsConfig(
+      [{ tag: 'v1', new_sqlite_classes: ['Room'] }],
+      async (configPath) => {
+        await expect(
+          assertCloudflareDurableObjectLifecycleSupported({
+            runWrangler: () => ({
+              status: 1,
+              stdout: '',
+              stderr: '',
+              errorCode: 10007,
+              failure: 'not-found',
+              ...provenance,
+            }),
+            configPath,
+            workerName: 'app',
+            accountId: 'account',
+            apiBaseUrl: 'https://api.cloudflare.test/client/v4',
           }),
-          configPath,
-          workerName: 'app',
-          accountId: 'account',
-          apiBaseUrl: 'https://api.cloudflare.test/client/v4',
-        }),
-      ).rejects.toBeInstanceOf(CloudflareWorkerInspectionError);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
+        ).rejects.toBeInstanceOf(CloudflareWorkerInspectionError);
+      },
+    );
   });
 
   it('accepts an already-published declarative Durable Object state without a legacy tag', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-do-exports-'));
-    const configPath = join(root, 'wrangler.jsonc');
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        migrations: [
-          { tag: 'fate-v1', new_sqlite_classes: ['Fate'] },
-          { tag: 'live-v1', deleted_classes: ['Fate'], new_sqlite_classes: ['Live'] },
-        ],
-      }),
-    );
-    const runWrangler = operationFixture((args: Array<string>) => ({
-      status: 0,
-      stderr: '',
-      stdout: JSON.stringify(
-        args[0] === 'deployments'
-          ? { versions: [{ version_id: 'active', percentage: 100 }] }
-          : {
-              id: 'active',
-              resources: {
-                bindings: [],
-                script: { handlers: ['fetch'] },
-                script_runtime: {
-                  exports: { Live: { type: 'durable-object', storage: 'sqlite' } },
-                },
-              },
-            },
-      ),
-    }));
-    try {
+    const migrations = [
+      { tag: 'fate-v1', new_sqlite_classes: ['Fate'] },
+      { tag: 'live-v1', deleted_classes: ['Fate'], new_sqlite_classes: ['Live'] },
+    ];
+    const runWrangler = activeWorkerRunner({
+      resources: {
+        bindings: [],
+        script: { handlers: ['fetch'] },
+        script_runtime: {
+          exports: { Live: { type: 'durable-object', storage: 'sqlite' } },
+        },
+      },
+    });
+    await withMigrationsConfig(migrations, async (configPath) => {
       await expect(
         assertCloudflareDurableObjectLifecycleSupported({
           runWrangler,
@@ -691,19 +658,14 @@ describe('existing Worker preservation', () => {
           readMigrationTag: async () => null,
         }),
       ).resolves.toBeUndefined();
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
+    });
   });
 
   it('does not authenticate or read metadata without a class migration', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-do-lifecycle-'));
-    const configPath = join(root, 'wrangler.jsonc');
-    writeFileSync(configPath, JSON.stringify({ migrations: [{ tag: 'v1' }] }));
     const runWrangler = operationFixture(() => {
       throw new Error('must not run');
     });
-    try {
+    await withMigrationsConfig([{ tag: 'v1' }], async (configPath) => {
       await expect(
         assertCloudflareDurableObjectLifecycleSupported({
           runWrangler,
@@ -714,9 +676,7 @@ describe('existing Worker preservation', () => {
         }),
       ).resolves.toBeUndefined();
       expect(runWrangler).not.toHaveBeenCalled();
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
+    });
   });
 
   it.each([
@@ -747,30 +707,16 @@ describe('existing Worker preservation', () => {
   ])(
     'does not treat an established Worker as an initial-secret bootstrap: %j',
     async ({ tag, runtime, binding, annotation }) => {
-      const root = mkdtempSync(join(tmpdir(), 'void-do-existing-secret-'));
-      const configPath = join(root, 'wrangler.jsonc');
-      writeFileSync(
-        configPath,
-        JSON.stringify({ migrations: [{ tag: 'live-v1', new_sqlite_classes: ['Room'] }] }),
-      );
-      const runWrangler = operationFixture((args: Array<string>) => ({
-        status: 0,
-        stderr: '',
-        stdout: JSON.stringify(
-          args[0] === 'deployments'
-            ? { versions: [{ version_id: 'active', percentage: 100 }] }
-            : {
-                id: 'active',
-                annotations: { 'workers/triggered_by': annotation },
-                resources: {
-                  bindings: [binding],
-                  script: { handlers: ['fetch'] },
-                  script_runtime: runtime,
-                },
-              },
-        ),
-      }));
-      try {
+      const runWrangler = activeWorkerRunner({
+        annotations: { 'workers/triggered_by': annotation },
+        resources: {
+          bindings: [binding],
+          script: { handlers: ['fetch'] },
+          script_runtime: runtime,
+        },
+      });
+      const migrations = [{ tag: 'live-v1', new_sqlite_classes: ['Room'] }];
+      await withMigrationsConfig(migrations, async (configPath) => {
         await expect(
           assertCloudflareDurableObjectLifecycleSupported({
             runWrangler,
@@ -783,12 +729,11 @@ describe('existing Worker preservation', () => {
         ).rejects.toThrow(/atomic Cloudflare deployment[\s\S]*live-v1/);
         expect(
           runWrangler.mock.calls.every(
-            ([args]) => args[0] === 'deployments' || (args[0] === 'versions' && args[1] === 'view'),
+            ([operation]) =>
+              operation.type === 'deployments.status' || operation.type === 'versions.view',
           ),
         ).toBe(true);
-      } finally {
-        rmSync(root, { recursive: true, force: true });
-      }
+      });
     },
   );
 
@@ -844,47 +789,33 @@ describe('existing Worker preservation', () => {
   });
 
   it('rejects migration state that changes during lifecycle verification', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-do-lifecycle-'));
-    const configPath = join(root, 'wrangler.jsonc');
-    writeFileSync(
-      configPath,
-      JSON.stringify({ migrations: [{ tag: 'v1', new_sqlite_classes: ['Room'] }] }),
-    );
-    const runWrangler = operationFixture((args: Array<string>) => ({
-      status: 0,
-      stderr: '',
-      stdout: JSON.stringify(
-        args[0] === 'deployments'
-          ? { versions: [{ version_id: 'active', percentage: 100 }] }
-          : {
-              id: 'active',
-              annotations: { 'workers/triggered_by': 'secret' },
-              resources: {
-                bindings: [{ name: 'TOKEN', type: 'secret_text' }],
-                script: { handlers: ['fetch'] },
-                script_runtime: { usage_model: 'standard' },
-              },
-            },
-      ),
-    }));
+    const runWrangler = activeWorkerRunner({
+      annotations: { 'workers/triggered_by': 'secret' },
+      resources: {
+        bindings: [{ name: 'TOKEN', type: 'secret_text' }],
+        script: { handlers: ['fetch'] },
+        script_runtime: { usage_model: 'standard' },
+      },
+    });
     const readMigrationTag = vi
       .fn<() => Promise<string | null>>()
       .mockResolvedValueOnce(null)
       .mockResolvedValueOnce('v1');
-    try {
-      await expect(
-        assertCloudflareDurableObjectLifecycleSupported({
-          runWrangler,
-          configPath,
-          workerName: 'app',
-          accountId: 'account',
-          apiBaseUrl: 'https://api.cloudflare.test/client/v4',
-          readMigrationTag,
-        }),
-      ).rejects.toThrow('migration state changed');
-      expect(readMigrationTag).toHaveBeenCalledTimes(2);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
+    await withMigrationsConfig(
+      [{ tag: 'v1', new_sqlite_classes: ['Room'] }],
+      async (configPath) => {
+        await expect(
+          assertCloudflareDurableObjectLifecycleSupported({
+            runWrangler,
+            configPath,
+            workerName: 'app',
+            accountId: 'account',
+            apiBaseUrl: 'https://api.cloudflare.test/client/v4',
+            readMigrationTag,
+          }),
+        ).rejects.toThrow('migration state changed');
+        expect(readMigrationTag).toHaveBeenCalledTimes(2);
+      },
+    );
   });
 });
diff --git a/packages/deploy-cloudflare/test/unit/metadata.test.ts b/packages/deploy-cloudflare/test/unit/metadata.test.ts
index 2545423ca..f4489cf84 100644
--- a/packages/deploy-cloudflare/test/unit/metadata.test.ts
+++ b/packages/deploy-cloudflare/test/unit/metadata.test.ts
@@ -162,6 +162,10 @@ describe('Cloudflare metadata transport', () => {
     ['lower-case HTTPS proxy', { https_proxy: 'http://proxy.test:8080' }],
     ['upper-case HTTPS proxy', { HTTPS_PROXY: 'http://proxy.test:8080' }],
     ['HTTP proxy inherited for HTTPS', { HTTP_PROXY: 'http://proxy.test:8080' }],
+    [
+      'HTTPS proxy with a matching NO_PROXY',
+      { HTTPS_PROXY: 'http://proxy.test', NO_PROXY: 'api.example.com' },
+    ],
   ])('uses Wrangler before authentication with a configured %s', async (_name, env) => {
     const { run, runWrangler, getToken, verifyUploader, fetcher } = setup(
       vi.fn<typeof fetch>(),
@@ -187,21 +191,4 @@ describe('Cloudflare metadata transport', () => {
     expect(getToken).not.toHaveBeenCalled();
     expect(fetcher).not.toHaveBeenCalled();
   });
-
-  it.each([
-    ['exact host', { HTTPS_PROXY: 'http://proxy.test', NO_PROXY: 'api.example.com' }],
-    ['leading wildcard', { https_proxy: 'http://proxy.test', no_proxy: '*.example.com' }],
-    ['explicit port', { HTTPS_PROXY: 'http://proxy.test', NO_PROXY: 'api.example.com:443' }],
-    ['wildcard', { HTTPS_PROXY: 'http://proxy.test', NO_PROXY: '*' }],
-    ['non-matching host', { HTTPS_PROXY: 'http://proxy.test', NO_PROXY: 'other.example.com' }],
-  ])(
-    'leaves NO_PROXY %s semantics to Wrangler without an auth or HTTP read',
-    async (_name, env) => {
-      const { run, runWrangler, getToken, fetcher } = setup(vi.fn<typeof fetch>(), env);
-      expect(await run(statusArgs, capture)).toBe(fallbackResult);
-      expect(runWrangler).toHaveBeenCalledOnce();
-      expect(getToken).not.toHaveBeenCalled();
-      expect(fetcher).not.toHaveBeenCalled();
-    },
-  );
 });
diff --git a/packages/deploy-cloudflare/test/unit/version.test.ts b/packages/deploy-cloudflare/test/unit/version.test.ts
index 771f43430..9b53cf03e 100644
--- a/packages/deploy-cloudflare/test/unit/version.test.ts
+++ b/packages/deploy-cloudflare/test/unit/version.test.ts
@@ -13,6 +13,7 @@ import {
   readCloudflareTriggerConfig,
   type CloudflareCommandResult,
   type CloudflareOperation,
+  type CloudflareTriggerConfig,
 } from '../../src/index.ts';
 import { operationFixture } from '../operation-fixture.ts';
 import { voidSecretDraftVersion } from '../secret-draft-fixture.ts';
@@ -21,18 +22,34 @@ const CURRENT = '11111111-1111-4111-8111-111111111111';
 const NEXT = '22222222-2222-4222-8222-222222222222';
 const CONCURRENT = '33333333-3333-4333-8333-333333333333';
 
-function sdkDraftActivation(source: Record<string, unknown> = voidSecretDraftVersion()) {
-  const events: Array<string> = [];
-  const operations: Array<CloudflareOperation> = [];
-  const triggerConfig = {
+function triggersWith(overrides: Partial<CloudflareTriggerConfig> = {}): CloudflareTriggerConfig {
+  return {
     workers_dev: true,
     preview_urls: true,
     routes: [],
     crons: [],
     queueConsumers: [],
     workflows: [],
+    ...overrides,
   };
-  const message = encodeCloudflareVersionMessage([], triggerConfig);
+}
+
+function customDomainTriggers(pattern: string): CloudflareTriggerConfig {
+  return triggersWith({
+    workers_dev: false,
+    preview_urls: false,
+    routes: [{ pattern, custom_domain: true }],
+  });
+}
+
+function readConfigArg(args: Array<string>): Record<string, unknown> {
+  return JSON.parse(readFileSync(args[args.indexOf('-c') + 1]!, 'utf8')) as Record<string, unknown>;
+}
+
+function sdkDraftActivation(source: Record<string, unknown> = voidSecretDraftVersion()) {
+  const events: Array<string> = [];
+  const operations: Array<CloudflareOperation> = [];
+  const message = encodeCloudflareVersionMessage([], triggersWith());
   let traffic = [{ version_id: CURRENT, percentage: 100 }];
   let uploaded = false;
   let published = false;
@@ -158,10 +175,6 @@ function sdkDraftActivation(source: Record<string, unknown> = voidSecretDraftVer
 // The bundled uploader rejects locally without an API error code; keep its actual diagnostic.
 const LOCAL_DURABLE_MIGRATION_ERROR =
   'This Worker has a pending Durable Object migration, which cannot be applied by `wrangler versions upload`. Durable Object migrations must be applied with `wrangler deploy`. Run `wrangler deploy` to apply the migration, then retry `wrangler versions upload`.';
-const DURABLE_MIGRATION_ERRORS = [
-  'Durable Object migrations require deploy. [code: 10211]',
-  LOCAL_DURABLE_MIGRATION_ERROR,
-];
 
 function secretOnlyDraftVersion() {
   return {
@@ -253,14 +266,10 @@ function runner(overrides?: {
               id: CURRENT,
               number: 1,
               annotations: {
-                'workers/message': encodeCloudflareVersionMessage([], {
-                  workers_dev: true,
-                  preview_urls: true,
-                  routes: [],
-                  crons: ['0 * * * *'],
-                  queueConsumers: [],
-                  workflows: [],
-                }),
+                'workers/message': encodeCloudflareVersionMessage(
+                  [],
+                  triggersWith({ crons: ['0 * * * *'] }),
+                ),
               },
             },
             ...(uploaded ? [{ id: NEXT, number: 2, annotations: {} }] : []),
@@ -657,8 +666,9 @@ describe('Cloudflare version activation', () => {
     expect(fixture.fetcher).not.toHaveBeenCalled();
   });
 
-  it.each([
-    {
+  it('retains preview-first activation for a secret-triggered real app', async () => {
+    const fixture = sdkDraftActivation({
+      ...voidSecretDraftVersion(),
       modules: [
         {
           ...voidSecretDraftVersion().modules[0],
@@ -667,16 +677,7 @@ describe('Cloudflare version activation', () => {
           ).toString('base64'),
         },
       ],
-    },
-    {
-      bindings: [
-        ...voidSecretDraftVersion().bindings,
-        { name: 'KV', type: 'kv_namespace', namespace_id: 'foreign' },
-      ],
-    },
-    { assets: {} },
-  ])('retains preview-first activation for a secret-triggered real app with %j', async (patch) => {
-    const fixture = sdkDraftActivation({ ...voidSecretDraftVersion(), ...patch });
+    });
     expect(await activateCloudflareVersion(fixture.options)).toMatchObject({
       ok: true,
       versionId: NEXT,
@@ -795,14 +796,7 @@ describe('Cloudflare version activation', () => {
       workerName: 'my-worker',
       verifyUploader: () => true,
       verifyInheritedSecrets: true,
-      message: encodeCloudflareVersionMessage([], {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      }),
+      message: encodeCloudflareVersionMessage([], triggersWith()),
       fetch: async () => Response.json({ ready: true }),
     });
     expect(result).toMatchObject({ ok: true, versionId: NEXT });
@@ -832,8 +826,7 @@ describe('Cloudflare version activation', () => {
       const validateUploadedVersion = vi.fn().mockResolvedValue(undefined);
       const runWrangler = operationFixture((args: Array<string>) => {
         if (args[0] === 'versions' && args[1] === 'deploy') {
-          const config = JSON.parse(readFileSync(args[args.indexOf('-c') + 1]!, 'utf8'));
-          expect(config).toEqual({ account_id: 'account', name: 'my-worker' });
+          expect(readConfigArg(args)).toEqual({ account_id: 'account', name: 'my-worker' });
         }
         return base(args);
       });
@@ -1371,11 +1364,7 @@ describe('Cloudflare version activation', () => {
       let applied: Record<string, unknown> | undefined;
       await deployCloudflareVersionTriggers({
         runWrangler: operationFixture(async (args) => {
-          const configIndex = args.indexOf('-c');
-          applied = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf-8')) as Record<
-            string,
-            unknown
-          >;
+          applied = readConfigArg(args);
           return ok();
         }),
         workerName: 'app',
@@ -1420,17 +1409,12 @@ describe('Cloudflare version activation', () => {
         ]),
       ),
     });
-    const desired = {
+    const desired = triggersWith({
       preserveRoutes: true,
       preserveWorkersDev: true,
       preservePreviewUrls: true,
-      workers_dev: true,
-      preview_urls: true,
-      routes: [],
       crons: ['0 * * * *'],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
     await expect(
       activateCloudflareVersion({
         runWrangler,
@@ -1447,25 +1431,17 @@ describe('Cloudflare version activation', () => {
     const base = runner();
     const runWrangler = operationFixture((args: Array<string>) => {
       if (args[0] === 'triggers') {
-        applied = JSON.parse(readFileSync(args[args.indexOf('-c') + 1]!, 'utf8')) as Record<
-          string,
-          unknown
-        >;
+        applied = readConfigArg(args);
         return ok();
       }
       return base(args);
     });
-    const desired = {
+    const desired = triggersWith({
       preserveRoutes: true,
       preserveWorkersDev: true,
       preservePreviewUrls: true,
-      workers_dev: true,
-      preview_urls: true,
-      routes: [],
       crons: ['0 * * * *'],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
     await expect(
       activateCloudflareVersion({
         runWrangler,
@@ -1489,18 +1465,12 @@ describe('Cloudflare version activation', () => {
   });
 
   it('continues an opaque handoff for a later code-only deployment', async () => {
-    const preserved = {
+    const preserved = triggersWith({
       preserve: true,
       preserveRoutes: true,
       preserveWorkersDev: true,
       preservePreviewUrls: true,
-      workers_dev: true,
-      preview_urls: true,
-      routes: [],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
     const runWrangler = runner({
       versions: ok(
         JSON.stringify([
@@ -1526,17 +1496,14 @@ describe('Cloudflare version activation', () => {
 
   it('continues an opaque handoff with unchanged explicit routes', async () => {
     const route = { pattern: 'app.example.com', custom_domain: true };
-    const preserved = {
+    const preserved = triggersWith({
       preserve: true,
       preserveWorkersDev: true,
       preservePreviewUrls: true,
       workers_dev: false,
       preview_urls: false,
       routes: [route],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
     const runWrangler = runner({
       versions: ok(
         JSON.stringify([
@@ -1562,19 +1529,13 @@ describe('Cloudflare version activation', () => {
   });
 
   it('does not silently suppress changed settings after an opaque handoff', async () => {
-    const preserved = {
+    const preserved = triggersWith({
       preserve: true,
       preserveRoutes: true,
       preserveWorkersDev: true,
       preservePreviewUrls: true,
       settingsHash: 'before',
-      workers_dev: true,
-      preview_urls: true,
-      routes: [],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
     const runWrangler = runner({
       versions: ok(
         JSON.stringify([
@@ -1619,22 +1580,16 @@ describe('Cloudflare version activation', () => {
     await deployCloudflareVersionTriggers({
       manageRoutes: false,
       runWrangler: operationFixture(async (args) => {
-        const configIndex = args.indexOf('-c');
-        applied = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf-8')) as Record<
-          string,
-          unknown
-        >;
+        applied = readConfigArg(args);
         return ok();
       }),
       workerName: 'app',
-      triggerConfig: {
+      triggerConfig: triggersWith({
         workers_dev: false,
         preview_urls: false,
         routes: [{ pattern: 'apps.example.com/*', zone_name: 'example.com' }],
         crons: ['0 * * * *'],
-        queueConsumers: [],
-        workflows: [],
-      },
+      }),
     });
 
     expect(applied).not.toHaveProperty('routes');
@@ -1649,22 +1604,8 @@ describe('Cloudflare version activation', () => {
         return ok();
       }),
       workerName: 'app',
-      triggerConfig: {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      },
-      previousTriggerConfig: {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [{ queue: 'jobs' }],
-        workflows: [],
-      },
+      triggerConfig: triggersWith(),
+      previousTriggerConfig: triggersWith({ queueConsumers: [{ queue: 'jobs' }] }),
     });
 
     expect(result.status).toBe(0);
@@ -1684,30 +1625,14 @@ describe('Cloudflare version activation', () => {
     let applied: Record<string, unknown> | undefined;
     await deployCloudflareVersionTriggers({
       runWrangler: operationFixture(async (args) => {
-        const configIndex = args.indexOf('-c');
-        applied = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf-8')) as Record<
-          string,
-          unknown
-        >;
+        applied = readConfigArg(args);
         return ok();
       }),
       workerName: 'app',
-      triggerConfig: {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      },
-      previousTriggerConfig: {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [],
+      triggerConfig: triggersWith(),
+      previousTriggerConfig: triggersWith({
         workflows: [{ name: 'nightly', class_name: 'NightlyWorkflow', schedules: ['0 0 * * *'] }],
-      },
+      }),
     });
 
     expect(applied?.workflows).toEqual([
@@ -1720,22 +1645,8 @@ describe('Cloudflare version activation', () => {
     const result = await deployCloudflareVersionTriggers({
       runWrangler: operationFixture(async () => ok()),
       workerName: 'app',
-      triggerConfig: {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      },
-      previousTriggerConfig: {
-        workers_dev: false,
-        preview_urls: false,
-        routes: [{ pattern: 'app.example.com', custom_domain: true }],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      },
+      triggerConfig: triggersWith(),
+      previousTriggerConfig: customDomainTriggers('app.example.com'),
       publishEmptyCustomDomains,
     });
 
@@ -1752,22 +1663,8 @@ describe('Cloudflare version activation', () => {
     const result = await deployCloudflareVersionTriggers({
       runWrangler: operationFixture(async () => ok()),
       workerName: 'app',
-      triggerConfig: {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      },
-      previousTriggerConfig: {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: ['0 * * * *'],
-        queueConsumers: [],
-        workflows: [],
-      },
+      triggerConfig: triggersWith(),
+      previousTriggerConfig: triggersWith({ crons: ['0 * * * *'] }),
       publishEmptyCrons,
     });
 
@@ -1804,14 +1701,7 @@ describe('Cloudflare version activation', () => {
   });
 
   it('round-trips an upload digest only when it is a valid SHA-256 value', () => {
-    const triggers = {
-      workers_dev: true,
-      preview_urls: false,
-      routes: [],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    const triggers = triggersWith({ preview_urls: false });
     const digest = 'a'.repeat(64);
     expect(
       parseCloudflareVersionMessage(encodeCloudflareVersionMessage([], triggers, digest)),
@@ -1836,11 +1726,7 @@ describe('Cloudflare version activation', () => {
       let config: Record<string, unknown> | undefined;
       await deployCloudflareVersionTriggers({
         runWrangler: operationFixture(async (args) => {
-          const configIndex = args.indexOf('-c');
-          config = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf-8')) as Record<
-            string,
-            unknown
-          >;
+          config = readConfigArg(args);
           return ok();
         }),
         workerName: 'app',
@@ -1885,11 +1771,7 @@ describe('Cloudflare version activation', () => {
       let rollbackConfig: Record<string, unknown> | undefined;
       await deployCloudflareVersionTriggers({
         runWrangler: operationFixture(async (args) => {
-          const configIndex = args.indexOf('-c');
-          rollbackConfig = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf-8')) as Record<
-            string,
-            unknown
-          >;
+          rollbackConfig = readConfigArg(args);
           return ok();
         }),
         workerName: 'app',
@@ -1960,7 +1842,6 @@ describe('Cloudflare version activation', () => {
       ['triggers', 'deploy'],
       ['deployments', 'status'],
     ]);
-    expect(runWrangler.mock.calls[1]![0]).toContain('--strict');
     expect(runWrangler.mock.calls[1]![0]).toContain('--assets');
     expect(runWrangler.mock.calls[1]![0]).toContain('/app/.void/deploy/cloudflare/assets');
     expect(runWrangler.mock.calls[3]![0]).toContain(`${NEXT}@100`);
@@ -1980,14 +1861,10 @@ describe('Cloudflare version activation', () => {
     const activationStarted = deferred<void>();
     let activeVersionId = CURRENT;
     let appliedTriggerConfig: Record<string, unknown> | undefined;
-    const concurrentTriggerConfig = {
-      workers_dev: true,
-      preview_urls: true,
-      routes: [],
+    const concurrentTriggerConfig = triggersWith({
       crons: ['concurrent'],
       queueConsumers: [{ queue: 'concurrent-jobs' }],
-      workflows: [],
-    };
+    });
     const runWrangler = operationFixture(async (args: Array<string>) => {
       if (args[0] === 'deployments') {
         return ok(JSON.stringify({ versions: [{ version_id: activeVersionId, percentage: 100 }] }));
@@ -2015,11 +1892,7 @@ describe('Cloudflare version activation', () => {
         );
       }
       if (args[0] === 'triggers') {
-        const configIndex = args.indexOf('-c');
-        appliedTriggerConfig = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf8')) as Record<
-          string,
-          unknown
-        >;
+        appliedTriggerConfig = readConfigArg(args);
         return ok();
       }
       throw new Error(`Unexpected command: ${args.join(' ')}`);
@@ -2029,14 +1902,7 @@ describe('Cloudflare version activation', () => {
       runWrangler,
       verifyUploader: () => true,
       workerName: 'my-worker',
-      message: encodeCloudflareVersionMessage([], {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: ['deploy'],
-        queueConsumers: [],
-        workflows: [],
-      }),
+      message: encodeCloudflareVersionMessage([], triggersWith({ crons: ['deploy'] })),
       fetch: async () => Response.json({ ready: true }),
     });
     await activationStarted.promise;
@@ -2072,14 +1938,7 @@ describe('Cloudflare version activation', () => {
         runWrangler,
         verifyUploader: () => true,
         workerName: 'my-worker',
-        message: encodeCloudflareVersionMessage([], {
-          workers_dev: true,
-          preview_urls: true,
-          routes: [],
-          crons: [],
-          queueConsumers: [],
-          workflows: [],
-        }),
+        message: encodeCloudflareVersionMessage([], triggersWith()),
         queueConsumerCleanup: ['legacy-jobs'],
         fetch: async () => Response.json({ ready: true }),
       }),
@@ -2115,15 +1974,9 @@ describe('Cloudflare version activation', () => {
       const activationStarted = deferred<void>();
       let activeVersionId = CURRENT;
       let appliedTriggerConfig: Record<string, unknown> | undefined;
-      const previousTriggerConfig = {
-        workers_dev: true,
-        preview_urls: true,
-        routes: [],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-        ...(previousAddresses === undefined ? {} : { addresses: previousAddresses }),
-      };
+      const previousTriggerConfig = triggersWith(
+        previousAddresses === undefined ? {} : { addresses: previousAddresses },
+      );
       const runWrangler = operationFixture(async (args: Array<string>) => {
         if (args[0] === 'deployments') {
           return ok(
@@ -2153,11 +2006,7 @@ describe('Cloudflare version activation', () => {
           );
         }
         if (args[0] === 'triggers') {
-          const configIndex = args.indexOf('-c');
-          appliedTriggerConfig = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf8')) as Record<
-            string,
-            unknown
-          >;
+          appliedTriggerConfig = readConfigArg(args);
           return ok();
         }
         if (args[0] === 'queues') {
@@ -2170,15 +2019,10 @@ describe('Cloudflare version activation', () => {
         runWrangler,
         verifyUploader: () => true,
         workerName: 'my-worker',
-        message: encodeCloudflareVersionMessage([], {
-          workers_dev: true,
-          preview_urls: true,
-          routes: [],
-          crons: [],
-          queueConsumers: [],
-          workflows: [],
-          addresses: ['billing@mail.acme.com'],
-        }),
+        message: encodeCloudflareVersionMessage(
+          [],
+          triggersWith({ addresses: ['billing@mail.acme.com'] }),
+        ),
         queueConsumerCleanup: ['jobs'],
         fetch: async () => Response.json({ ready: true }),
       });
@@ -2210,14 +2054,7 @@ describe('Cloudflare version activation', () => {
     let activeVersionId = CURRENT;
     let triggerCalls = 0;
     let repairedConfig: Record<string, unknown> | undefined;
-    const configFor = (cron: string) => ({
-      workers_dev: true,
-      preview_urls: true,
-      routes: [],
-      crons: [cron],
-      queueConsumers: [],
-      workflows: [],
-    });
+    const configFor = (cron: string) => triggersWith({ crons: [cron] });
     const runWrangler = operationFixture(async (args: Array<string>) => {
       if (args[0] === 'deployments') {
         return ok(JSON.stringify({ versions: [{ version_id: activeVersionId, percentage: 100 }] }));
@@ -2255,11 +2092,7 @@ describe('Cloudflare version activation', () => {
           triggerStarted.resolve(undefined);
           return failedTriggers.promise;
         }
-        const configIndex = args.indexOf('-c');
-        repairedConfig = JSON.parse(readFileSync(args[configIndex + 1]!, 'utf8')) as Record<
-          string,
-          unknown
-        >;
+        repairedConfig = readConfigArg(args);
         return ok();
       }
       throw new Error(`Unexpected command: ${args.join(' ')}`);
@@ -2290,14 +2123,7 @@ describe('Cloudflare version activation', () => {
   });
 
   it('uses newer published traffic provenance instead of a stale version annotation', async () => {
-    const staleTriggerConfig = {
-      workers_dev: false,
-      preview_urls: false,
-      routes: [{ pattern: 'old.example.com', custom_domain: true }],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    const staleTriggerConfig = customDomainTriggers('old.example.com');
     const desiredTriggerConfig = {
       ...staleTriggerConfig,
       workers_dev: true,
@@ -2973,14 +2799,7 @@ describe('Cloudflare version activation', () => {
           verifyUploader: () => true,
           workerName: 'custom-app',
           atomic,
-          message: encodeCloudflareVersionMessage([], {
-            workers_dev: false,
-            preview_urls: false,
-            routes: [{ pattern: 'app.example.com', custom_domain: true }],
-            crons: [],
-            queueConsumers: [],
-            workflows: [],
-          }),
+          message: encodeCloudflareVersionMessage([], customDomainTriggers('app.example.com')),
           sleep: async (milliseconds) => {
             time += milliseconds;
           },
@@ -3039,14 +2858,10 @@ describe('Cloudflare version activation', () => {
   });
 
   it('restores live traffic changes made after the previous version upload', async () => {
-    const immutable = {
-      workers_dev: true,
-      preview_urls: true,
+    const immutable = triggersWith({
       routes: [{ pattern: 'old.example.com', custom_domain: true }],
       crons: ['0 * * * *'],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
     const liveTraffic = {
       workers_dev: false,
       preview_urls: false,
@@ -3069,7 +2884,7 @@ describe('Cloudflare version activation', () => {
     const publications: Array<Record<string, unknown>> = [];
     const runWrangler = operationFixture((args: Array<string>) => {
       if (args[0] === 'triggers') {
-        publications.push(JSON.parse(readFileSync(args[args.indexOf('-c') + 1]!, 'utf8')));
+        publications.push(readConfigArg(args));
       }
       return base(args);
     });
@@ -3099,18 +2914,12 @@ describe('Cloudflare version activation', () => {
   });
 
   it('does not claim opaque trigger recovery succeeded after restoring live traffic', async () => {
-    const opaque = {
+    const opaque = triggersWith({
       preserve: true,
       preserveRoutes: true,
       preserveWorkersDev: true,
       preservePreviewUrls: true,
-      workers_dev: true,
-      preview_urls: true,
-      routes: [],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
     const liveTraffic = {
       workers_dev: false,
       preview_urls: false,
@@ -3223,26 +3032,6 @@ describe('Cloudflare version activation', () => {
     ).resolves.toMatchObject({ ok: true, previousVersionId: null });
   });
 
-  it('accepts Wrangler error 10007 as a Worker that has not been created yet', async () => {
-    const runWrangler = runner({
-      status: {
-        stdout: '',
-        stderr: 'This Worker does not exist on your account. [code: 10007]',
-        status: 1,
-      },
-    });
-
-    await expect(
-      activateCloudflareVersion({
-        runWrangler,
-        verifyUploader: () => true,
-        workerName: 'first',
-        message: encodeCloudflareVersionMessage([]),
-        fetch: async () => Response.json({ ready: true }),
-      }),
-    ).resolves.toMatchObject({ ok: true, previousVersionId: null });
-  });
-
   it('treats a missing Worker version list as an empty inheritance baseline', async () => {
     const base = runner({
       status: {
@@ -3286,14 +3075,7 @@ describe('Cloudflare version activation', () => {
         workerName: 'private-app',
         requireVersionMetadata: true,
         readinessAttempts: 1,
-        message: encodeCloudflareVersionMessage([], {
-          workers_dev: false,
-          preview_urls: false,
-          routes: [{ pattern: 'app.example.com', custom_domain: true }],
-          crons: [],
-          queueConsumers: [],
-          workflows: [],
-        }),
+        message: encodeCloudflareVersionMessage([], customDomainTriggers('app.example.com')),
         fetch: async () => Response.json({ ready: true, versionId }),
       });
       expect(result).toMatchObject({
@@ -3323,14 +3105,7 @@ describe('Cloudflare version activation', () => {
       requireVersionMetadata: true,
       readinessAttempts: 2,
       readinessHeaders: { 'CF-Access-Client-Secret': 'must-not-leak' },
-      message: encodeCloudflareVersionMessage([], {
-        workers_dev: false,
-        preview_urls: false,
-        routes: [{ pattern: 'app.example.com', custom_domain: true }],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      }),
+      message: encodeCloudflareVersionMessage([], customDomainTriggers('app.example.com')),
       fetch: fetcher,
       sleep,
     });
@@ -3409,14 +3184,11 @@ describe('Cloudflare version activation', () => {
       upload: ok(`Worker Version ID: ${NEXT}`),
     });
     const fetcher = vi.fn(async () => Response.json({ ready: true }));
-    const triggerConfig = {
+    const triggerConfig = triggersWith({
       workers_dev: false,
       preview_urls: false,
       routes: [{ pattern: 'app.example.com/*', zone_name: 'example.com' }],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    });
 
     await expect(
       activateCloudflareVersion({
@@ -3468,14 +3240,7 @@ describe('Cloudflare version activation', () => {
   });
 
   it('probes a custom route after first-deployment bootstrap', async () => {
-    const triggerConfig = {
-      workers_dev: false,
-      preview_urls: false,
-      routes: [{ pattern: 'bootstrap.example.com', custom_domain: true }],
-      crons: [],
-      queueConsumers: [],
-      workflows: [],
-    };
+    const triggerConfig = customDomainTriggers('bootstrap.example.com');
     const runWrangler = runner({
       status: { stdout: '', stderr: 'This Worker does not exist. [code: 10007]', status: 1 },
       upload: {
@@ -3518,14 +3283,7 @@ describe('Cloudflare version activation', () => {
       runWrangler,
       verifyUploader: () => true,
       workerName: 'first-private',
-      message: encodeCloudflareVersionMessage([], {
-        workers_dev: false,
-        preview_urls: false,
-        routes: [{ pattern: 'app.example.com', custom_domain: true }],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      }),
+      message: encodeCloudflareVersionMessage([], customDomainTriggers('app.example.com')),
       fetch: fetcher,
     });
     expect(result).toMatchObject({
@@ -3541,14 +3299,7 @@ describe('Cloudflare version activation', () => {
   it.each([false, true])(
     'repairs a concurrent bootstrap owner (during readiness=%s)',
     async (duringReadiness) => {
-      const concurrentConfig = {
-        workers_dev: false,
-        preview_urls: false,
-        routes: [{ pattern: 'other.example.com', custom_domain: true }],
-        crons: [],
-        queueConsumers: [],
-        workflows: [],
-      };
+      const concurrentConfig = customDomainTriggers('other.example.com');
       const base = runner({
         status: { stdout: '', stderr: 'Worker not found. [code: 10007]', status: 1 },
         upload: { stdout: '', stderr: LOCAL_DURABLE_MIGRATION_ERROR, status: 1 },
@@ -3574,7 +3325,7 @@ describe('Cloudflare version activation', () => {
           );
         }
         if (args[0] === 'triggers') {
-          published.push(JSON.parse(readFileSync(args[args.indexOf('-c') + 1]!, 'utf8')));
+          published.push(readConfigArg(args));
         }
         const result = base(args);
         if (args[0] === 'deploy') {
@@ -3624,80 +3375,69 @@ describe('Cloudflare version activation', () => {
     },
   );
 
-  it.each(DURABLE_MIGRATION_ERRORS)(
-    'bootstraps first-deploy Durable Object migrations for %s',
-    async (error) => {
-      const base = runner({
-        status: { stdout: '', stderr: 'The Worker first has no deployments.', status: 1 },
-        upload: {
-          stdout: '',
-          stderr: error,
-          status: 1,
-        },
-        bootstrap: ok(
-          `Current Version ID: ${NEXT}\nVersion Preview URL: https://2e209d56-first.example.workers.dev`,
-        ),
-      });
-      const secretPayloads: Array<unknown> = [];
-      const secretPaths: Array<string> = [];
-      const runWrangler = operationFixture((args: Array<string>) => {
-        if (
-          (args[0] === 'deploy' || (args[0] === 'versions' && args[1] === 'upload')) &&
-          args.includes('--secrets-file')
-        ) {
-          const path = args[args.indexOf('--secrets-file') + 1]!;
-          secretPaths.push(path);
-          secretPayloads.push(JSON.parse(readFileSync(path, 'utf8')));
-        }
-        return base(args);
-      });
-      const fetcher = vi.fn(async () => Response.json({ ready: true }));
+  it('bootstraps first-deploy Durable Object migrations after Cloudflare error 10211', async () => {
+    const base = runner({
+      status: { stdout: '', stderr: 'The Worker first has no deployments.', status: 1 },
+      upload: { stdout: '', stderr: '', status: 1, errorCode: 10211 },
+      bootstrap: ok(
+        `Current Version ID: ${NEXT}\nVersion Preview URL: https://2e209d56-first.example.workers.dev`,
+      ),
+    });
+    const secretPayloads: Array<unknown> = [];
+    const secretPaths: Array<string> = [];
+    const runWrangler = operationFixture((args: Array<string>) => {
+      if (
+        (args[0] === 'deploy' || (args[0] === 'versions' && args[1] === 'upload')) &&
+        args.includes('--secrets-file')
+      ) {
+        const path = args[args.indexOf('--secrets-file') + 1]!;
+        secretPaths.push(path);
+        secretPayloads.push(JSON.parse(readFileSync(path, 'utf8')));
+      }
+      return base(args);
+    });
+    const fetcher = vi.fn(async () => Response.json({ ready: true }));
 
-      await expect(
-        activateCloudflareVersion({
-          runWrangler,
-          verifyUploader: () => true,
-          workerName: 'first',
-          configPath: '/app/wrangler.jsonc',
-          assetsDirectoryOverride: '/app/.void/deploy/cloudflare/assets',
-          message: encodeCloudflareVersionMessage(['0001_init.sql']),
-          candidateSecrets: { API_TOKEN: 'first-secret' },
-          fetch: fetcher,
-        }),
-      ).resolves.toEqual({
-        ok: true,
-        versionId: NEXT,
-        previewUrl: 'https://first.example.workers.dev',
-        previousVersionId: null,
-        workersDevSubdomain: 'example',
-      });
-      expect(runWrangler.mock.calls.map(([args]) => args.slice(0, 2))).toEqual([
-        ['deployments', 'status'],
-        ['versions', 'upload'],
-        ['deployments', 'status'],
-        ['deploy', '-c'],
-        ['deployments', 'status'],
-        ['deployments', 'status'],
-        ['triggers', 'deploy'],
-        ['deployments', 'status'],
-        ['deployments', 'status'],
-      ]);
-      const deployArgs = runWrangler.mock.calls.find(([args]) => args[0] === 'deploy')![0];
-      expect(deployArgs).toContain('--autoconfig=false');
-      expect(deployArgs).toContain('--assets');
-      expect(deployArgs).toContain('/app/.void/deploy/cloudflare/assets');
-      expect(secretPayloads).toEqual([
-        { API_TOKEN: 'first-secret' },
-        { API_TOKEN: 'first-secret' },
-      ]);
-      expect(new Set(secretPaths).size).toBe(1);
-      expect(secretPaths.every((path) => !existsSync(path))).toBe(true);
-      expect(fetcher).toHaveBeenCalledWith(
-        'https://first.example.workers.dev/__void/ready',
-        expect.objectContaining({ signal: expect.any(AbortSignal) }),
-      );
-    },
-  );
+    await expect(
+      activateCloudflareVersion({
+        runWrangler,
+        verifyUploader: () => true,
+        workerName: 'first',
+        configPath: '/app/wrangler.jsonc',
+        assetsDirectoryOverride: '/app/.void/deploy/cloudflare/assets',
+        message: encodeCloudflareVersionMessage(['0001_init.sql']),
+        candidateSecrets: { API_TOKEN: 'first-secret' },
+        fetch: fetcher,
+      }),
+    ).resolves.toEqual({
+      ok: true,
+      versionId: NEXT,
+      previewUrl: 'https://first.example.workers.dev',
+      previousVersionId: null,
+      workersDevSubdomain: 'example',
+    });
+    expect(runWrangler.mock.calls.map(([args]) => args.slice(0, 2))).toEqual([
+      ['deployments', 'status'],
+      ['versions', 'upload'],
+      ['deployments', 'status'],
+      ['deploy', '-c'],
+      ['deployments', 'status'],
+      ['deployments', 'status'],
+      ['triggers', 'deploy'],
+      ['deployments', 'status'],
+      ['deployments', 'status'],
+    ]);
+    const deployArgs = runWrangler.mock.calls.find(([args]) => args[0] === 'deploy')![0];
+    expect(deployArgs).toContain('--assets');
+    expect(deployArgs).toContain('/app/.void/deploy/cloudflare/assets');
+    expect(secretPayloads).toEqual([{ API_TOKEN: 'first-secret' }, { API_TOKEN: 'first-secret' }]);
+    expect(new Set(secretPaths).size).toBe(1);
+    expect(secretPaths.every((path) => !existsSync(path))).toBe(true);
+    expect(fetcher).toHaveBeenCalledWith(
+      'https://first.example.workers.dev/__void/ready',
+      expect.objectContaining({ signal: expect.any(AbortSignal) }),
+    );
+  });
 
   it('reports Access blocking the already-active first Worker bootstrap', async () => {
     const runWrangler = runner({
@@ -3992,23 +3732,17 @@ describe('Cloudflare version activation', () => {
     expect(runWrangler.mock.calls.some(([args]) => args[0] === 'deploy')).toBe(false);
   });
 
-  const firstSecretTriggers = {
+  const firstSecretTriggers = triggersWith({
     preserveRoutes: true,
     preserveWorkersDev: true,
     preservePreviewUrls: true,
-    workers_dev: true,
-    preview_urls: true,
-    routes: [],
-    crons: [],
-    queueConsumers: [],
-    workflows: [],
-  };
+  });
 
   function firstSecretRunner(
     inspection: CloudflareCommandResult,
     upload: CloudflareCommandResult = {
       stdout: '',
-      stderr: DURABLE_MIGRATION_ERRORS[0]!,
+      stderr: 'Durable Object migrations require deploy. [code: 10211]',
       status: 1,
     },
   ) {
@@ -4032,21 +3766,9 @@ describe('Cloudflare version activation', () => {
     });
   }
 
-  const uploadFailures = [
-    { stdout: '', stderr: DURABLE_MIGRATION_ERRORS[0]!, status: 1 },
-    { stdout: '', stderr: LOCAL_DURABLE_MIGRATION_ERROR, status: 1 },
-    { stdout: LOCAL_DURABLE_MIGRATION_ERROR, stderr: '', status: 1 },
-    {
-      stdout: '',
-      stderr: `\u001b[31m${LOCAL_DURABLE_MIGRATION_ERROR.replace('pending Durable', 'pending\n  Durable')}\u001b[0m`,
-      status: 1,
-    },
-  ];
-  it.each(
-    [{}, { limits: {} }].flatMap((limits) => uploadFailures.map((upload) => ({ limits, upload }))),
-  )(
-    'passes lifecycle preflight and retries a first secret-only deploy for %j',
-    async ({ limits, upload }) => {
+  it.each([{}, { limits: {} }])(
+    'passes lifecycle preflight and retries a first secret-only deploy for runtime %j',
+    async (limits) => {
       const draft = secretOnlyDraftVersion();
       const runWrangler = firstSecretRunner(
         ok(
@@ -4058,7 +3780,6 @@ describe('Cloudflare version activation', () => {
             },
           }),
         ),
-        upload,
       );
       const root = mkdtempSync(join(tmpdir(), 'void-secret-lifecycle-retry-'));
       const configPath = join(root, 'wrangler.jsonc');
diff --git a/packages/deploy-core/src/validate.ts b/packages/deploy-core/src/validate.ts
index 19d97806c..89e0a2c40 100644
--- a/packages/deploy-core/src/validate.ts
+++ b/packages/deploy-core/src/validate.ts
@@ -4,73 +4,130 @@ export const MANIFEST_REDIRECT_RULE_STATUSES: ReadonlySet<number> = new Set([
   200, 301, 302, 303, 307, 308,
 ]);
 
-// Caps on user-supplied routing rule lists. Each rule compiles a regex per
-// request in dispatch (see `routing-rules.ts`), so an unbounded list lets a
-// 100k-entry manifest exhaust CPU on every request to the project. The limit
-// is per-list (redirect + fallback are independent), well above what real
-// frameworks emit (Vercel/Netlify both ship in the low thousands at most),
-// and validated at deploy ingest so dispatch never sees an oversized list.
+// Each rule compiles a regex per request in dispatch, so cap every list at deploy ingest.
 export const MAX_ROUTING_RULES = 2000;
 export const MAX_REVALIDATE_QUERY_ALLOWLIST_ENTRIES: number = MAX_ROUTING_RULES;
 const MAX_PAGES = 5000;
-// Each distinct cron expression becomes one message on the platform's shared
-// cron queue, and one user-worker call, every minute it matches. The scheduler
-// dedupes only identical strings. 100 matches Vercel's per-project cap and is
-// far above what real apps declare.
+// Each distinct cron expression becomes one queue message and one Worker call per matching minute.
 const MAX_CRON_EXPRESSIONS = 100;
 // The scheduler parses every entry, shared expression or not, on each alarm.
 const MAX_SCHEDULES = 1000;
 
-/**
- * Strict literal-hostname regex used to validate `redirectRules[].host` /
- * `fallbackRules[].host` on the deploy manifest. Mirrors the regex in
- * `routes/domains.ts` (custom-domain create endpoint) — the source of truth
- * for what counts as a valid project-owned hostname. Rejects scheme prefixes,
- * ports, paths, whitespace, control chars, wildcards, single-label hosts,
- * IPv4 literals, and userinfo. Hostnames are lowercased before testing so
- * the same byte-exact form is what dispatch compares against `url.hostname`
- * (also lowercase per WHATWG).
- */
 const LITERAL_HOSTNAME_REGEX = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 
-/**
- * Validate and lowercase-normalize an optional `host` field on a redirect or
- * fallback rule. Mutates `ruleObject.host` in place so the persisted manifest carries
- * the canonical form. Returns an error message string on failure, or `null`
- * on success (including the absent-field case).
- */
+type RoutingRuleKind = 'redirectRules' | 'fallbackRules';
+
+// Lowercases `host` in place: dispatch compares the stored form with the lowercase `url.hostname`.
 function validateRuleHost(
-  ruleObject: Record<string, unknown>,
-  ruleKind: 'redirectRules' | 'fallbackRules',
+  rule: Record<string, unknown>,
+  kind: RoutingRuleKind,
   sourceRef: string,
 ): string | null {
-  if (ruleObject.host === undefined) {
+  if (rule.host === undefined) {
     return null;
   }
-  if (typeof ruleObject.host !== 'string') {
-    return `invalid manifest shape: ${ruleKind} entry ${sourceRef} host must be a string`;
+  if (typeof rule.host !== 'string') {
+    return `invalid manifest shape: ${kind} entry ${sourceRef} host must be a string`;
   }
-  const normalized = ruleObject.host.toLowerCase();
+  const normalized = rule.host.toLowerCase();
   if (!LITERAL_HOSTNAME_REGEX.test(normalized)) {
-    return `invalid manifest shape: ${ruleKind} entry ${sourceRef} host must be a literal hostname (e.g. "www.example.com"; no scheme, port, path, or wildcards): ${JSON.stringify(ruleObject.host)}`;
+    return `invalid manifest shape: ${kind} entry ${sourceRef} host must be a literal hostname (e.g. "www.example.com"; no scheme, port, path, or wildcards): ${JSON.stringify(rule.host)}`;
+  }
+  rule.host = normalized;
+  return null;
+}
+
+function validateRoutingRules(rules: unknown, kind: RoutingRuleKind): string | null {
+  if (rules === undefined) {
+    return null;
+  }
+  if (!Array.isArray(rules)) {
+    return `invalid manifest shape: ${kind} must be an array`;
+  }
+  if (rules.length > MAX_ROUTING_RULES) {
+    return `invalid manifest shape: ${kind} has ${rules.length} entries, exceeds the ${MAX_ROUTING_RULES} per-list limit`;
+  }
+  const rewritesOnly = kind === 'fallbackRules';
+  for (const rule of rules) {
+    if (!isRecord(rule)) {
+      return `invalid manifest shape: ${kind} entries must be objects`;
+    }
+    if (
+      typeof rule.source !== 'string' ||
+      typeof rule.destination !== 'string' ||
+      typeof rule.status !== 'number'
+    ) {
+      return `invalid manifest shape: ${kind} entries must have string source, string destination, and numeric status`;
+    }
+    const sourceRef = JSON.stringify(rule.source);
+    if (rewritesOnly && rule.status !== 200) {
+      return `invalid manifest shape: ${kind} entry ${sourceRef} status must be 200 (fallbacks are rewrites only)`;
+    }
+    if (!rewritesOnly && !MANIFEST_REDIRECT_RULE_STATUSES.has(rule.status)) {
+      return `invalid manifest shape: ${kind} entry ${sourceRef} status must be one of ${[...MANIFEST_REDIRECT_RULE_STATUSES].join(', ')} (200 = rewrite, 3xx = redirect)`;
+    }
+    // Rewrites (status 200) must stay internal: dispatch merges the request query itself, and
+    // `//evil.com/x` parses cross-origin. 3xx redirects may carry a query and external Location.
+    if (rule.status === 200) {
+      const condition = rewritesOnly ? '' : ' when status is 200';
+      if (rule.destination.includes('?')) {
+        return `invalid manifest shape: ${kind} entry ${sourceRef} destination must not contain a query string${condition}`;
+      }
+      if (!rule.destination.startsWith('/')) {
+        return `invalid manifest shape: ${kind} entry ${sourceRef} destination must be path-absolute (start with "/")${condition}`;
+      }
+      if (rule.destination.startsWith('//')) {
+        return `invalid manifest shape: ${kind} entry ${sourceRef} destination must not start with "//" (protocol-relative URLs parse cross-origin; use a single-slash path-absolute destination)`;
+      }
+    }
+    const hostError = validateRuleHost(rule, kind, sourceRef);
+    if (hostError) {
+      return hostError;
+    }
+  }
+  return null;
+}
+
+function validateClassMigrations(
+  path: string,
+  migrations: unknown,
+  fields: ReadonlyArray<string>,
+  requireNonEmptyTag = false,
+): string | null {
+  if (migrations === undefined) {
+    return null;
+  }
+  if (!Array.isArray(migrations)) {
+    return `invalid manifest shape: ${path} must be an array`;
+  }
+  for (const migration of migrations) {
+    if (!isRecord(migration)) {
+      return `invalid manifest shape: ${path} entries must be objects`;
+    }
+    if (typeof migration.tag !== 'string' || (requireNonEmptyTag && migration.tag.length === 0)) {
+      return `invalid manifest shape: ${path} entries must have a ${requireNonEmptyTag ? 'non-empty ' : ''}string tag`;
+    }
+    for (const field of fields) {
+      const value = migration[field];
+      if (
+        value !== undefined &&
+        (!Array.isArray(value) || !value.every((className) => typeof className === 'string'))
+      ) {
+        return `invalid manifest shape: ${path} ${field} must be an array of strings`;
+      }
+    }
   }
-  ruleObject.host = normalized;
   return null;
 }
 
 /**
- * Runtime shape validation for incoming deploy manifests. Downstream code
- * indexes deeply into the manifest (bindings.d1, queues[i].name,
- * websocket.classes, etc.) without re-guarding, so a malformed-but-JSON-valid
- * payload would otherwise crash with a 500 — sometimes after a deployment row
- * or CF resources were created. Everything the deploy pipeline reads must be
- * validated here BEFORE createDeployment runs.
+ * Check the shape of an incoming deploy manifest. Returns an error message, or `null` when valid.
+ * Deploy code reads the manifest without re-checking, so run this before creating any deploy state.
  */
-export function validateManifestShape(parsed: unknown): string | null {
-  if (!isRecord(parsed)) {
+export function validateManifestShape(manifest: unknown): string | null {
+  if (!isRecord(manifest)) {
     return 'invalid manifest shape: expected a JSON object';
   }
-  const manifest = parsed;
   if (manifest.emailProtocolVersion !== undefined && manifest.emailProtocolVersion !== 1) {
     return 'invalid manifest shape: emailProtocolVersion must be 1';
   }
@@ -97,8 +154,7 @@ export function validateManifestShape(parsed: unknown): string | null {
       if (!isRecord(queue)) {
         return 'invalid manifest shape: queues entries must be objects';
       }
-      const queueObject = queue;
-      if (typeof queueObject.name !== 'string' || typeof queueObject.bindingName !== 'string') {
+      if (typeof queue.name !== 'string' || typeof queue.bindingName !== 'string') {
         return 'invalid manifest shape: queues entries must have string name and bindingName';
       }
       for (const tuning of [
@@ -107,7 +163,7 @@ export function validateManifestShape(parsed: unknown): string | null {
         'maxRetries',
         'retryDelay',
       ] as const) {
-        const tuningValue = queueObject[tuning];
+        const tuningValue = queue[tuning];
         if (tuningValue === undefined) {
           continue;
         }
@@ -130,11 +186,10 @@ export function validateManifestShape(parsed: unknown): string | null {
       if (!isRecord(schedule)) {
         return 'invalid manifest shape: schedules entries must be objects';
       }
-      const scheduleObject = schedule;
-      if (typeof scheduleObject.name !== 'string' || typeof scheduleObject.cron !== 'string') {
+      if (typeof schedule.name !== 'string' || typeof schedule.cron !== 'string') {
         return 'invalid manifest shape: schedules entries must have string name and cron';
       }
-      cronExpressions.add(scheduleObject.cron);
+      cronExpressions.add(schedule.cron);
     }
     if (cronExpressions.size > MAX_CRON_EXPRESSIONS) {
       return `invalid manifest shape: schedules has ${cronExpressions.size} distinct cron expressions, exceeds the ${MAX_CRON_EXPRESSIONS} per-project limit`;
@@ -283,16 +338,13 @@ export function validateManifestShape(parsed: unknown): string | null {
     }
   }
 
-  if (manifest.revalidate !== undefined) {
-    if (typeof manifest.revalidate === 'number') {
-      // ok
-    } else if (!isRecord(manifest.revalidate)) {
+  if (manifest.revalidate !== undefined && typeof manifest.revalidate !== 'number') {
+    if (!isRecord(manifest.revalidate)) {
       return 'invalid manifest shape: revalidate must be a number or object';
-    } else {
-      for (const [pathname, value] of Object.entries(manifest.revalidate)) {
-        if (typeof value !== 'number') {
-          return `invalid manifest shape: revalidate.${pathname} must be a number`;
-        }
+    }
+    for (const [pathname, value] of Object.entries(manifest.revalidate)) {
+      if (typeof value !== 'number') {
+        return `invalid manifest shape: revalidate.${pathname} must be a number`;
       }
     }
   }
@@ -305,14 +357,13 @@ export function validateManifestShape(parsed: unknown): string | null {
       if (!isRecord(rule)) {
         return 'invalid manifest shape: headerRules entries must be objects';
       }
-      const ruleObject = rule;
-      if (typeof ruleObject.pattern !== 'string') {
+      if (typeof rule.pattern !== 'string') {
         return 'invalid manifest shape: headerRules entries must have a string pattern';
       }
-      if (!Array.isArray(ruleObject.headers)) {
+      if (!Array.isArray(rule.headers)) {
         return 'invalid manifest shape: headerRules entries must have a headers array';
       }
-      for (const pair of ruleObject.headers) {
+      for (const pair of rule.headers) {
         if (
           !Array.isArray(pair) ||
           pair.length !== 2 ||
@@ -325,60 +376,11 @@ export function validateManifestShape(parsed: unknown): string | null {
     }
   }
 
-  // redirectRules is the pre-asset rule list. `status: 200` means a force
-  // rewrite (internal URL rewrite, no Location header); `status: 3xx` means a
-  // redirect. Destinations may not contain `?` — request query is merged
-  // separately at dispatch time (see `mergeQueryIntoLocation`).
-  if (manifest.redirectRules !== undefined) {
-    if (!Array.isArray(manifest.redirectRules)) {
-      return 'invalid manifest shape: redirectRules must be an array';
-    }
-    if (manifest.redirectRules.length > MAX_ROUTING_RULES) {
-      return `invalid manifest shape: redirectRules has ${manifest.redirectRules.length} entries, exceeds the ${MAX_ROUTING_RULES} per-list limit`;
-    }
-    for (const rule of manifest.redirectRules) {
-      if (!isRecord(rule)) {
-        return 'invalid manifest shape: redirectRules entries must be objects';
-      }
-      const ruleObject = rule;
-      if (
-        typeof ruleObject.source !== 'string' ||
-        typeof ruleObject.destination !== 'string' ||
-        typeof ruleObject.status !== 'number'
-      ) {
-        return 'invalid manifest shape: redirectRules entries must have string source, string destination, and numeric status';
-      }
-      const sourceRef = JSON.stringify(ruleObject.source as string);
-      if (!MANIFEST_REDIRECT_RULE_STATUSES.has(ruleObject.status)) {
-        return `invalid manifest shape: redirectRules entry ${sourceRef} status must be one of ${[...MANIFEST_REDIRECT_RULE_STATUSES].join(', ')} (200 = rewrite, 3xx = redirect)`;
-      }
-      // Rewrites (status=200) must stay internal: no query string, path-absolute,
-      // and not protocol-relative (`//evil.com/x` parses cross-origin). 3xx
-      // redirects may include query strings and external Location values.
-      const destination = ruleObject.destination as string;
-      const isRewrite = ruleObject.status === 200;
-      if (isRewrite && destination.includes('?')) {
-        return `invalid manifest shape: redirectRules entry ${sourceRef} destination must not contain a query string when status is 200`;
-      }
-      if (isRewrite && !destination.startsWith('/')) {
-        return `invalid manifest shape: redirectRules entry ${sourceRef} destination must be path-absolute (start with "/") when status is 200`;
-      }
-      if (isRewrite && destination.startsWith('//')) {
-        return `invalid manifest shape: redirectRules entry ${sourceRef} destination must not start with "//" (protocol-relative URLs parse cross-origin; use a single-slash path-absolute destination)`;
-      }
-      const hostError = validateRuleHost(ruleObject, 'redirectRules', sourceRef);
-      if (hostError) {
-        return hostError;
-      }
-    }
+  const redirectRulesError = validateRoutingRules(manifest.redirectRules, 'redirectRules');
+  if (redirectRulesError) {
+    return redirectRulesError;
   }
 
-  // revalidateQueryAllowlist gates which query params participate in the
-  // ISR variant key on a rewrite. Shape: `{ "<pathPattern>": ["param", …] }`.
-  // The default (no entry / no allowlist) drops every param so a fanout
-  // attack via `?utm=…`/`?cb=…` can't multiply cache slots. The validator
-  // only enforces shape; semantic correctness (does the pattern match a
-  // real route?) is the user's responsibility.
   if (manifest.revalidateQueryAllowlist !== undefined) {
     if (!isRecord(manifest.revalidateQueryAllowlist)) {
       return 'invalid manifest shape: revalidateQueryAllowlist must be an object';
@@ -402,10 +404,6 @@ export function validateManifestShape(parsed: unknown): string | null {
     }
   }
 
-  // pages is the ordered route table (`[{ pattern, revalidate? }]`) the
-  // framework emits so dispatch can resolve a per-route ISR TTL by segment
-  // pattern. Validator only enforces shape; the framework owns the ordering
-  // and pattern semantics.
   if (manifest.pages !== undefined) {
     if (!Array.isArray(manifest.pages)) {
       return 'invalid manifest shape: pages must be an array';
@@ -417,20 +415,15 @@ export function validateManifestShape(parsed: unknown): string | null {
       if (!isRecord(entry)) {
         return 'invalid manifest shape: each pages entry must be an object';
       }
-      const e = entry;
-      if (typeof e.pattern !== 'string' || e.pattern === '') {
+      if (typeof entry.pattern !== 'string' || entry.pattern === '') {
         return 'invalid manifest shape: pages entry pattern must be a string';
       }
-      if (e.revalidate !== undefined && typeof e.revalidate !== 'number') {
+      if (entry.revalidate !== undefined && typeof entry.revalidate !== 'number') {
         return 'invalid manifest shape: pages entry revalidate must be a number';
       }
     }
   }
 
-  // pathRevalidate is the RAW per-path OBJECT config shipped alongside `pages`
-  // so dispatch can resolve an inherit-eligible page (a pages entry with no
-  // baked revalidate) against the real request path. Same shape as the object
-  // form of `revalidate`: a map of pattern → number.
   if (manifest.pathRevalidate !== undefined) {
     if (!isRecord(manifest.pathRevalidate)) {
       return 'invalid manifest shape: pathRevalidate must be an object';
@@ -442,47 +435,9 @@ export function validateManifestShape(parsed: unknown): string | null {
     }
   }
 
-  // fallbackRules fire after the static asset resolver 404s. Rewrites only,
-  // so every entry carries the same internal-destination constraints as a
-  // status=200 redirectRule.
-  if (manifest.fallbackRules !== undefined) {
-    if (!Array.isArray(manifest.fallbackRules)) {
-      return 'invalid manifest shape: fallbackRules must be an array';
-    }
-    if (manifest.fallbackRules.length > MAX_ROUTING_RULES) {
-      return `invalid manifest shape: fallbackRules has ${manifest.fallbackRules.length} entries, exceeds the ${MAX_ROUTING_RULES} per-list limit`;
-    }
-    for (const rule of manifest.fallbackRules) {
-      if (!isRecord(rule)) {
-        return 'invalid manifest shape: fallbackRules entries must be objects';
-      }
-      const ruleObject = rule;
-      if (
-        typeof ruleObject.source !== 'string' ||
-        typeof ruleObject.destination !== 'string' ||
-        typeof ruleObject.status !== 'number'
-      ) {
-        return 'invalid manifest shape: fallbackRules entries must have string source, string destination, and numeric status';
-      }
-      const sourceRef = JSON.stringify(ruleObject.source as string);
-      if (ruleObject.status !== 200) {
-        return `invalid manifest shape: fallbackRules entry ${sourceRef} status must be 200 (fallbacks are rewrites only)`;
-      }
-      const destination = ruleObject.destination as string;
-      if (destination.includes('?')) {
-        return `invalid manifest shape: fallbackRules entry ${sourceRef} destination must not contain a query string`;
-      }
-      if (!destination.startsWith('/')) {
-        return `invalid manifest shape: fallbackRules entry ${sourceRef} destination must be path-absolute (start with "/")`;
-      }
-      if (destination.startsWith('//')) {
-        return `invalid manifest shape: fallbackRules entry ${sourceRef} destination must not start with "//" (protocol-relative URLs parse cross-origin; use a single-slash path-absolute destination)`;
-      }
-      const hostError = validateRuleHost(ruleObject, 'fallbackRules', sourceRef);
-      if (hostError) {
-        return hostError;
-      }
-    }
+  const fallbackRulesError = validateRoutingRules(manifest.fallbackRules, 'fallbackRules');
+  if (fallbackRulesError) {
+    return fallbackRulesError;
   }
 
   if (manifest.websocket !== undefined) {
@@ -497,11 +452,10 @@ export function validateManifestShape(parsed: unknown): string | null {
       if (!isRecord(route)) {
         return 'invalid manifest shape: websocket.routes entries must be objects';
       }
-      const routeObject = route;
-      if (typeof routeObject.className !== 'string') {
+      if (typeof route.className !== 'string') {
         return 'invalid manifest shape: websocket.routes entries must have a string className';
       }
-      if (routeObject.bindingName !== undefined && typeof routeObject.bindingName !== 'string') {
+      if (route.bindingName !== undefined && typeof route.bindingName !== 'string') {
         return 'invalid manifest shape: websocket.routes entry bindingName must be a string';
       }
     }
@@ -511,38 +465,19 @@ export function validateManifestShape(parsed: unknown): string | null {
     ) {
       return 'invalid manifest shape: websocket.classes must be an array of strings';
     }
-    if (websocket.migrations !== undefined) {
-      if (!Array.isArray(websocket.migrations)) {
-        return 'invalid manifest shape: websocket.migrations must be an array';
-      }
-      for (const migration of websocket.migrations) {
-        if (!isRecord(migration)) {
-          return 'invalid manifest shape: websocket.migrations entries must be objects';
-        }
-        const migrationObject = migration;
-        if (typeof migrationObject.tag !== 'string' || migrationObject.tag.length === 0) {
-          return 'invalid manifest shape: websocket.migrations entries must have a non-empty string tag';
-        }
-        for (const field of ['newClasses', 'newSqliteClasses', 'deletedClasses'] as const) {
-          const value = migrationObject[field];
-          if (
-            value !== undefined &&
-            (!Array.isArray(value) || !value.every((className) => typeof className === 'string'))
-          ) {
-            return `invalid manifest shape: websocket.migrations ${field} must be an array of strings`;
-          }
-        }
-      }
+    const migrationsError = validateClassMigrations(
+      'websocket.migrations',
+      websocket.migrations,
+      ['newClasses', 'newSqliteClasses', 'deletedClasses'],
+      true,
+    );
+    if (migrationsError) {
+      return migrationsError;
     }
   }
 
   if (manifest.sandbox !== undefined) {
-    // sandbox is meaningless without a user worker. Static/SPA deploys are
-    // served straight from KV/R2 by dispatch — no script is created, so a
-    // `sandbox` block can't be wired to anything. Reject up-front rather
-    // than silently dropping the block; a stale manifest carrying `sandbox`
-    // after the project type flips would otherwise surface as a confusing
-    // runtime no-op rather than a clear deploy-time error.
+    // Static and SPA deploys create no Worker script, so a sandbox could never be wired.
     if (manifest.type === 'static' || manifest.type === 'spa') {
       return 'sandbox is not supported for static/spa deployments';
     }
@@ -569,33 +504,12 @@ export function validateManifestShape(parsed: unknown): string | null {
     ) {
       return 'invalid manifest shape: sandbox.maxInstances must be a positive integer';
     }
-    if (sandbox.migrations !== undefined) {
-      if (!Array.isArray(sandbox.migrations)) {
-        return 'invalid manifest shape: sandbox.migrations must be an array';
-      }
-      for (const migration of sandbox.migrations) {
-        if (!isRecord(migration)) {
-          return 'invalid manifest shape: sandbox.migrations entries must be objects';
-        }
-        const migrationObject = migration;
-        if (typeof migrationObject.tag !== 'string') {
-          return 'invalid manifest shape: sandbox.migrations entries must have a string tag';
-        }
-        if (
-          migrationObject.newSqliteClasses !== undefined &&
-          (!Array.isArray(migrationObject.newSqliteClasses) ||
-            !migrationObject.newSqliteClasses.every((value) => typeof value === 'string'))
-        ) {
-          return 'invalid manifest shape: sandbox.migrations newSqliteClasses must be an array of strings';
-        }
-        if (
-          migrationObject.deletedClasses !== undefined &&
-          (!Array.isArray(migrationObject.deletedClasses) ||
-            !migrationObject.deletedClasses.every((value) => typeof value === 'string'))
-        ) {
-          return 'invalid manifest shape: sandbox.migrations deletedClasses must be an array of strings';
-        }
-      }
+    const migrationsError = validateClassMigrations('sandbox.migrations', sandbox.migrations, [
+      'newSqliteClasses',
+      'deletedClasses',
+    ]);
+    if (migrationsError) {
+      return migrationsError;
     }
   }
 
@@ -615,26 +529,11 @@ export function validateManifestShape(parsed: unknown): string | null {
     if (!Array.isArray(live.classes) || !live.classes.every((x) => typeof x === 'string')) {
       return 'invalid manifest shape: live.classes must be an array of strings';
     }
-    if (live.migrations !== undefined) {
-      if (!Array.isArray(live.migrations)) {
-        return 'invalid manifest shape: live.migrations must be an array';
-      }
-      for (const migration of live.migrations) {
-        if (!isRecord(migration)) {
-          return 'invalid manifest shape: live.migrations entries must be objects';
-        }
-        const migrationObject = migration;
-        if (typeof migrationObject.tag !== 'string') {
-          return 'invalid manifest shape: live.migrations entries must have a string tag';
-        }
-        if (
-          migrationObject.newSqliteClasses !== undefined &&
-          (!Array.isArray(migrationObject.newSqliteClasses) ||
-            !migrationObject.newSqliteClasses.every((value) => typeof value === 'string'))
-        ) {
-          return 'invalid manifest shape: live.migrations newSqliteClasses must be an array of strings';
-        }
-      }
+    const migrationsError = validateClassMigrations('live.migrations', live.migrations, [
+      'newSqliteClasses',
+    ]);
+    if (migrationsError) {
+      return migrationsError;
     }
   }
 
diff --git a/packages/deploy-core/test/unit/canonical-json.test.ts b/packages/deploy-core/test/unit/canonical-json.test.ts
index 97509d3b6..6fad929fe 100644
--- a/packages/deploy-core/test/unit/canonical-json.test.ts
+++ b/packages/deploy-core/test/unit/canonical-json.test.ts
@@ -1,4 +1,25 @@
-import { defineCanonicalJsonTests } from '../../../../test/canonical-json-contract.ts';
+import { describe, expect, it } from 'vite-plus/test';
 import { canonicalJson } from '../../src/index.ts';
 
-defineCanonicalJsonTests(canonicalJson);
+describe('canonicalJson', () => {
+  it('sorts object keys recursively while preserving array order', () => {
+    expect(
+      canonicalJson({
+        z: 1,
+        a: { b: true, a: 'x' },
+        list: [{ y: 2, x: 1 }, 'tail'],
+      }),
+    ).toBe('{"a":{"a":"x","b":true},"list":[{"x":1,"y":2},"tail"],"z":1}');
+  });
+
+  it('omits undefined object fields and preserves JSON string escaping', () => {
+    expect(canonicalJson({ b: undefined, a: 'quote " slash \\\\ newline\n' })).toBe(
+      '{"a":"quote \\" slash \\\\\\\\ newline\\n"}',
+    );
+  });
+
+  it('throws for unsupported values instead of silently hashing them', () => {
+    expect(() => canonicalJson(undefined)).toThrow('Unsupported canonical JSON value');
+    expect(() => canonicalJson({ a: () => undefined })).toThrow('Unsupported canonical JSON value');
+  });
+});
diff --git a/packages/edge/src/headers.ts b/packages/edge/src/headers.ts
index 79d74baf4..9bf93801e 100644
--- a/packages/edge/src/headers.ts
+++ b/packages/edge/src/headers.ts
@@ -12,20 +12,10 @@ export type HeaderRulePolicy = Readonly<{
 }>;
 
 /**
- * Headers that user header rules may not set at all, because they are always a
- * cookie operation. On the shared *.void.app domain (not on the PSL) void.app
- * is the registrable domain, so a `Set-Cookie` with `Domain=.void.app` is
- * readable by every tenant's subdomain. Dropped wholesale.
- *
- * `Clear-Site-Data` is the other cookie trust-boundary header, but it is NOT a
- * blanket block — see {@link sanitizeClearSiteData}: only its cookie-clearing
- * directives are stripped, since its other directives are origin-scoped.
- *
- * HSTS and other per-host headers are safe — they don't cross subdomain
- * boundaries (includeSubDomains scopes to the responding host's subtree).
- *
- * TODO: Once void.app is registered on the Public Suffix List, these defenses
- * can be removed — browsers will scope cross-subdomain cookies automatically.
+ * Headers that rules may never set on a shared domain. void.app is not on the
+ * Public Suffix List, so a `Set-Cookie` with `Domain=.void.app` reaches every
+ * tenant. `Clear-Site-Data` is filtered per directive by
+ * {@link sanitizeClearSiteData}; per-host headers such as HSTS stay allowed.
  */
 const BLOCKED_HEADERS = new Set(['set-cookie']);
 
@@ -162,13 +152,8 @@ export function applyHeaderRules(
   }
 
   const newResponse = new Response(response.body, response);
-  // Fallback for a Clear-Site-Data rule that sanitizes to nothing: last-match-wins
-  // means such a rule discards an earlier rule's value, so we fall back to the
-  // origin's own Clear-Site-Data rather than leaving the earlier rule's value
-  // behind. It is sanitized too, so rule processing never *resurfaces* a
-  // cross-tenant cookie directive — not from a rule, and not from the origin
-  // response either. (The origin's own header is otherwise ungated here; gating
-  // it across the board is a separate dispatch-layer concern.)
+  // A Clear-Site-Data rule that sanitizes to nothing falls back to the origin's
+  // own value (also sanitized) instead of keeping an earlier rule's value.
   const isolateSharedDomainCookies = policy?.cookieIsolation !== 'origin';
   const rawOriginClearSiteData = isolateSharedDomainCookies
     ? response.headers.get('clear-site-data')
diff --git a/packages/edge/src/pattern.ts b/packages/edge/src/pattern.ts
index 1060fd48e..a3f465b04 100644
--- a/packages/edge/src/pattern.ts
+++ b/packages/edge/src/pattern.ts
@@ -1,27 +1,46 @@
 /**
- * Shared path-pattern compiler used by header rules and routing rules.
+ * Path-pattern matchers shared by routing, header, and revalidate rules.
  *
- * Syntax:
+ * Each pattern is parsed once into tokens, and matching walks those tokens
+ * over the pathname. No RegExp is built from pattern text, so a pattern cannot
+ * hit engine size limits or backtrack: a match costs at most
+ * (steps) x (path length - pattern minimum + 1).
+ *
+ * `compilePattern` syntax:
  *   `:name`   — single path segment, captured as `name`
  *   `:name*`  — zero or more path segments, captured as `name`
  *   `*`       — zero or more path segments, captured as `splat` (legacy)
  *
  * When a legacy pattern contains multiple anonymous `*`, the first captures
- * as `splat` and later wildcards are non-capturing. Boolean matching remains
- * backward compatible for existing header/revalidate patterns.
+ * as `splat` and later wildcards are non-capturing.
  */
 
 const MAX_CACHE = 256;
 
 export type CompiledPattern = Readonly<{
+  /**
+   * @deprecated Built on first read for older callers; Void does not use it.
+   * It can backtrack and fails past engine size limits. Use `matchPattern` or
+   * `matchPatternCaptures`.
+   */
   regex: RegExp;
   paramNames: ReadonlyArray<string>;
 }>;
 
-const compileCache = new Map<string, CompiledPattern>();
+// `text` matches itself. The others match a run of UTF-16 code units:
+//   seg  — 1 or more, none is '/'                          (regex `[^/]+`)
+//   any  — 0 or more, none is \n \r U+2028 U+2029          (regex `.*`)
+//   plus — 1 or more, same units as `any`                  (regex `.+`)
+type Token = { kind: 'text'; text: string } | { kind: 'seg' | 'any' | 'plus'; name?: string };
+
+type Prepared = Readonly<{ steps: ReadonlyArray<Token>; starts: Int32Array; minLength: number }>;
 
-const REGEX_SPECIAL = /[.+?^${}()|[\]\\]/;
-const PARAM_CHAR = /[A-Za-z0-9_]/;
+type Compiled = CompiledPattern &
+  Prepared & {
+    error: string | undefined;
+    /** Index in `steps` of the last named step, or -1. */
+    lastNamed: number;
+  };
 
 /** LRU read: re-inserting a hit moves it to the most-recently-used end of Map order. */
 function lruGet<V>(cache: Map<string, V>, key: string): V | undefined {
@@ -44,83 +63,399 @@ function lruSet<V>(cache: Map<string, V>, key: string, value: V): void {
   cache.set(key, value);
 }
 
-export function compilePattern(source: string): CompiledPattern {
-  const cached = lruGet(compileCache, source);
-  if (cached) {
-    return cached;
+/** `[A-Za-z0-9_]` */
+function isNameChar(code: number): boolean {
+  return (
+    (code >= 48 && code <= 57) ||
+    (code >= 65 && code <= 90) ||
+    (code >= 97 && code <= 122) ||
+    code === 95
+  );
+}
+
+/** Whether a wildcard of this kind may take the code unit. */
+function accepts(kind: Token['kind'], code: number): boolean {
+  if (kind === 'seg') {
+    return code !== 47; // '/'
   }
+  return code !== 10 && code !== 13 && code !== 0x2028 && code !== 0x2029;
+}
 
+function pushText(tokens: Array<Token>, text: string): void {
+  if (!text) {
+    return;
+  }
+  const last = tokens[tokens.length - 1];
+  if (last?.kind === 'text') {
+    last.text += text;
+  } else {
+    tokens.push({ kind: 'text', text });
+  }
+}
+
+/** `compilePattern` syntax, read left to right. */
+function parseCapture(source: string): { tokens: Array<Token>; paramNames: Array<string> } {
+  const tokens: Array<Token> = [];
   const paramNames: Array<string> = [];
-  let legacySplatCaptured = false;
-  let pattern = '';
+  let splatTaken = false;
   let index = 0;
   while (index < source.length) {
     const character = source[index]!;
     if (character === ':') {
-      let nameEnd = index + 1;
-      while (nameEnd < source.length && PARAM_CHAR.test(source[nameEnd]!)) {
-        nameEnd++;
+      let end = index + 1;
+      while (end < source.length && isNameChar(source.charCodeAt(end))) {
+        end++;
       }
-      const name = source.slice(index + 1, nameEnd);
-      if (!name) {
-        pattern += '\\:';
+      if (end === index + 1) {
+        // No name follows, so the colon is literal.
+        pushText(tokens, ':');
         index++;
         continue;
       }
+      const name = source.slice(index + 1, end);
       paramNames.push(name);
-      if (source[nameEnd] === '*') {
-        pattern += `(?<${name}>.*)`;
-        index = nameEnd + 1;
-      } else {
-        pattern += `(?<${name}>[^/]+)`;
-        index = nameEnd;
-      }
+      const rest = source[end] === '*';
+      tokens.push({ kind: rest ? 'any' : 'seg', name });
+      index = rest ? end + 1 : end;
     } else if (character === '*') {
-      if (legacySplatCaptured) {
-        pattern += `.*`;
+      if (splatTaken) {
+        tokens.push({ kind: 'any' });
       } else {
         paramNames.push('splat');
-        pattern += `(?<splat>.*)`;
-        legacySplatCaptured = true;
+        tokens.push({ kind: 'any', name: 'splat' });
+        splatTaken = true;
       }
       index++;
     } else {
-      if (REGEX_SPECIAL.test(character)) {
-        pattern += '\\';
+      let end = index + 1;
+      while (end < source.length && source[end] !== ':' && source[end] !== '*') {
+        end++;
       }
-      pattern += character;
-      index++;
+      pushText(tokens, source.slice(index, end));
+      index = end;
+    }
+  }
+  return { tokens, paramNames };
+}
+
+/** Text in which only `*` is special. */
+function parseStars(tokens: Array<Token>, text: string): void {
+  const parts = text.split('*');
+  pushText(tokens, parts[0]!);
+  for (let k = 1; k < parts.length; k++) {
+    tokens.push({ kind: 'any' });
+    pushText(tokens, parts[k]!);
+  }
+}
+
+/** `routing.revalidate` / page syntax: params are whole segments. */
+function parseSegments(source: string): Array<Token> {
+  const tokens: Array<Token> = [];
+  const segments = source.split('/');
+  for (let k = 0; k < segments.length; k++) {
+    const segment = segments[k]!;
+    if (k > 0) {
+      pushText(tokens, '/');
+    }
+    const name = segment.slice(1, -4);
+    if (segment[0] !== ':' || segment.length < 2) {
+      parseStars(tokens, segment);
+    } else if (
+      segment.length > 5 &&
+      segment.endsWith('{.+}') &&
+      !name.includes('{') &&
+      !name.includes('}')
+    ) {
+      tokens.push({ kind: 'plus' });
+    } else {
+      // Whatever follows the ':' only names the param.
+      tokens.push({ kind: 'seg' });
+    }
+  }
+  return tokens;
+}
+
+/**
+ * Drop an `any` that directly follows another `any`: the first takes every
+ * unit the pair could take, so the second always matches ''. Every other step
+ * needs at least one unit, so a path of length m faces at most 2m + 1 steps.
+ */
+function prepare(tokens: ReadonlyArray<Token>): Prepared {
+  const steps: Array<Token> = [];
+  for (const token of tokens) {
+    if (!(token.kind === 'any' && steps[steps.length - 1]?.kind === 'any')) {
+      steps.push(token);
+    }
+  }
+  // starts[i]: the fewest units the steps before i consume, i.e. the earliest
+  // position where step i can begin.
+  const starts = new Int32Array(steps.length + 1);
+  steps.forEach((step, i) => {
+    const shortest = step.kind === 'text' ? step.text.length : step.kind === 'any' ? 0 : 1;
+    starts[i + 1] = starts[i]! + shortest;
+  });
+  return { steps, starts, minLength: starts[steps.length]! };
+}
+
+/*
+ * Rows. Step i can only begin at a position p in [starts[i], starts[i] + slack],
+ * where slack = path.length - minLength: earlier and the steps before it could
+ * not fit, later and the steps after it could not. So every row has
+ * slack + 1 entries and row[d] is about position starts[i] + d.
+ *
+ * row[d] is 1 when steps i..n-1 can match path from that position to the end.
+ * A text step of length L moves both the position and starts[] by L, and a
+ * one-unit wildcard moves both by 1, so the index d lines up between a row and
+ * the next one:
+ *
+ *   text      row[d] = next[d] && path has the text at p
+ *   seg/plus  row[d] = path[p] allowed && (next[d] || row[d + 1])
+ *   any       row[d] = next[d] || (path[p] allowed && row[d + 1])
+ *
+ * (row[slack + 1] counts as 0.) Returns whether any entry is 1.
+ */
+function stepBack(
+  step: Token,
+  path: string,
+  start: number,
+  next: Uint8Array,
+  row: Uint8Array,
+): boolean {
+  let found = 0;
+  if (step.kind === 'text') {
+    for (let d = row.length - 1; d >= 0; d--) {
+      const value = next[d] === 1 && path.startsWith(step.text, start + d) ? 1 : 0;
+      row[d] = value;
+      found |= value;
+    }
+    return found === 1;
+  }
+  const kind = step.kind;
+  let after = 0; // row[d + 1]; 0 past the window
+  for (let d = row.length - 1; d >= 0; d--) {
+    // Path reads stay inside the path: seg/plus need a unit at every p in the
+    // window, and `any` reads only when after === 1, i.e. p is not the last slot.
+    const value =
+      kind === 'any'
+        ? next[d] === 1 || (after === 1 && accepts(kind, path.charCodeAt(start + d)))
+        : (next[d] === 1 || after === 1) && accepts(kind, path.charCodeAt(start + d));
+    row[d] = value ? 1 : 0;
+    after = row[d]!;
+    found |= after;
+  }
+  return found === 1;
+}
+
+/** The row after the last step: only the end of the path (d = slack) finishes. */
+function endRow(width: number): Uint8Array {
+  const row = new Uint8Array(width);
+  row[width - 1] = 1;
+  return row;
+}
+
+/** Checks that reject most paths before any row is built. */
+function quickReject({ steps, minLength }: Prepared, path: string): boolean {
+  const first = steps[0];
+  const last = steps[steps.length - 1];
+  return (
+    path.length < minLength ||
+    (first?.kind === 'text' && !path.startsWith(first.text)) ||
+    (last?.kind === 'text' && !path.endsWith(last.text))
+  );
+}
+
+/** Whether the steps match the whole path. Keeps two rows. */
+function matches(prepared: Prepared, path: string): boolean {
+  if (quickReject(prepared, path)) {
+    return false;
+  }
+  const { steps, starts, minLength } = prepared;
+  let next: Uint8Array = endRow(path.length - minLength + 1);
+  let row: Uint8Array = new Uint8Array(next.length);
+  // quickReject proved a leading text step, and only position 0 matters for it.
+  const first = steps[0]?.kind === 'text' ? 1 : 0;
+  for (let i = steps.length - 1; i >= first; i--) {
+    if (!stepBack(steps[i]!, path, starts[i]!, next, row)) {
+      return false;
+    }
+    const done = next;
+    next = row;
+    row = done;
+  }
+  return next[0] === 1;
+}
+
+/**
+ * Where a step that begins at p (row index d) ends: the longest choice after
+ * which the rest still matches. `next` is the row of the following step.
+ */
+function greedyEnd(step: Token, path: string, p: number, d: number, next: Uint8Array): number {
+  if (step.kind === 'text') {
+    return p + step.text.length;
+  }
+  const shortest = step.kind === 'any' ? 0 : 1;
+  const longest = next.length - 1 - d + shortest; // keeps d + k - shortest inside `next`
+  let k = 0;
+  while (k < longest && accepts(step.kind, path.charCodeAt(p + k))) {
+    k++;
+  }
+  while (k > shortest && next[d + k - shortest] !== 1) {
+    k--;
+  }
+  return p + k;
+}
+
+/**
+ * End positions of steps 0..upTo in the match that JS backtracking returns
+ * (each wildcard, left to right, takes the longest run that still lets the
+ * rest match), or null. The backward pass keeps a copy of every `size`-th
+ * row; the forward pass rebuilds one block of rows at a time into a fixed
+ * pool. About 2 * sqrt(n) rows are alive at once, and each row is computed at
+ * most twice.
+ */
+function greedyEnds(prepared: Prepared, path: string, upTo: number): Int32Array | null {
+  if (quickReject(prepared, path)) {
+    return null;
+  }
+  const { steps, starts, minLength } = prepared;
+  const n = steps.length;
+  const width = path.length - minLength + 1;
+  // Small tables keep every row (size 1), so the forward pass rebuilds nothing.
+  const size = n * width <= 1 << 16 ? 1 : Math.ceil(Math.sqrt(n));
+  const saved = new Map<number, Uint8Array>([[n, endRow(width)]]);
+  let next: Uint8Array = endRow(width);
+  let row: Uint8Array = new Uint8Array(width);
+  const first = steps[0]?.kind === 'text' ? 1 : 0;
+  for (let i = n - 1; i >= first; i--) {
+    if (!stepBack(steps[i]!, path, starts[i]!, next, row)) {
+      return null;
+    }
+    if (i % size === 0) {
+      saved.set(i, row.slice());
+    }
+    const done = next;
+    next = row;
+    row = done;
+  }
+  if (next[0] !== 1) {
+    return null;
+  }
+  const pool = Array.from({ length: size }, () => new Uint8Array(width));
+  let top = 0;
+  const rowAt = (r: number) => (r === top ? saved.get(r)! : pool[r % size]!);
+  const ends = new Int32Array(upTo + 1);
+  let p = 0;
+  for (let i = 0; i <= upTo; i++) {
+    if (i + 1 > top) {
+      // Blocks are entered in order at their first row, so each is rebuilt once.
+      top = Math.min(n, Math.ceil((i + 1) / size) * size);
+      for (let r = top - 1; r > i; r--) {
+        stepBack(steps[r]!, path, starts[r]!, rowAt(r + 1), pool[r % size]!);
+      }
+    }
+    p = greedyEnd(steps[i]!, path, p, p - starts[i]!, rowAt(i + 1));
+    ends[i] = p;
+  }
+  return ends;
+}
+
+/** The regex the earlier string-building compiler produced, for the deprecated `regex` view. */
+function toRegExp(tokens: ReadonlyArray<Token>): RegExp {
+  let body = '';
+  for (const token of tokens) {
+    if (token.kind === 'text') {
+      body += token.text.replace(/[.+?^${}()|[\]\\:]/g, '\\$&');
+    } else if (token.kind === 'seg') {
+      body += `(?<${token.name}>[^/]+)`;
+    } else {
+      body += token.name ? `(?<${token.name}>.*)` : '.*';
     }
   }
+  return new RegExp(`^${body}$`);
+}
 
-  const compiled: CompiledPattern = { regex: new RegExp(`^${pattern}$`), paramNames };
+const compileCache = new Map<string, Compiled>();
+
+function compile(source: string): Compiled {
+  const cached = lruGet(compileCache, source);
+  if (cached) {
+    return cached;
+  }
+  const { tokens, paramNames } = parseCapture(source);
+  let error: string | undefined;
+  const seen = new Set<string>();
+  for (const name of paramNames) {
+    if (seen.has(name)) {
+      error ??= `Duplicate capture group name "${name}"`;
+    } else if (name.charCodeAt(0) >= 48 && name.charCodeAt(0) <= 57) {
+      // A JS group name cannot start with a digit; keep rejecting those.
+      error ??= `Invalid capture group name "${name}"`;
+    }
+    seen.add(name);
+  }
+  const prepared = prepare(tokens);
+  let lastNamed = -1;
+  prepared.steps.forEach((step, i) => {
+    if (step.kind !== 'text' && step.name) {
+      lastNamed = i;
+    }
+  });
+  let regex: RegExp | undefined;
+  const compiled: Compiled = {
+    ...prepared,
+    paramNames,
+    error,
+    lastNamed,
+    get regex() {
+      return (regex ??= toRegExp(parseCapture(source).tokens));
+    },
+  };
   lruSet(compileCache, source, compiled);
   return compiled;
 }
 
+/**
+ * Parse a capture pattern. Throws a SyntaxError for a malformed one: a repeated
+ * name (`/:id/:id`, `/:splat/*`) or a name that starts with a digit (`/:1`).
+ */
+export function compilePattern(source: string): CompiledPattern {
+  const compiled = compile(source);
+  if (compiled.error) {
+    throw new SyntaxError(compiled.error);
+  }
+  return compiled;
+}
+
 /**
  * Match a pattern against a pathname. Returns captured params, or null.
- *
- * Returns null (rather than throwing) when the pattern itself is malformed —
- * e.g. multiple `*` producing duplicate `splat` capture names. Framework and
- * API ingest both reject those, but a hand-crafted manifest could still reach
- * the edge, and a single bad rule shouldn't 500 unrelated traffic.
+ * A malformed pattern (e.g. a repeated name like `/:splat/*`) also returns
+ * null, so one bad rule cannot fail unrelated requests.
  */
 export function matchPatternCaptures(
   pattern: string,
   pathname: string,
 ): Record<string, string> | null {
-  let compiled: CompiledPattern;
-  try {
-    compiled = compilePattern(pattern);
-  } catch {
+  const compiled = compile(pattern);
+  if (compiled.error) {
     return null;
   }
-  const match = compiled.regex.exec(pathname);
-  if (!match) {
+  const { steps, lastNamed } = compiled;
+  const ends = lastNamed === -1 ? undefined : greedyEnds(compiled, pathname, lastNamed);
+  if (ends === null || (ends === undefined && !matches(compiled, pathname))) {
     return null;
   }
-  return match.groups ?? {};
+  // Every name gets a value, in source order; one dropped by `prepare` matched ''.
+  const params: Record<string, string> = Object.create(null);
+  for (const name of compiled.paramNames) {
+    params[name] = '';
+  }
+  for (let i = 0; ends && i <= lastNamed; i++) {
+    const step = steps[i]!;
+    if (step.kind !== 'text' && step.name) {
+      params[step.name] = pathname.slice(i === 0 ? 0 : ends[i - 1], ends[i]);
+    }
+  }
+  return params;
 }
 
 /**
@@ -128,14 +463,11 @@ export function matchPatternCaptures(
  * `false` rather than throwing (see `matchPatternCaptures`).
  */
 export function matchPattern(pattern: string, pathname: string): boolean {
-  try {
-    return compilePattern(pattern).regex.test(pathname);
-  } catch {
-    return false;
-  }
+  const compiled = compile(pattern);
+  return compiled.error === undefined && matches(compiled, pathname);
 }
 
-const literalRegexCache = new Map<string, RegExp>();
+const literalCache = new Map<string, Prepared>();
 
 /**
  * Match a pattern against a pathname using LITERAL semantics — no named
@@ -148,87 +480,34 @@ const literalRegexCache = new Map<string, RegExp>();
  * (`redirects`/`rewrites`/`fallbacks`) use the capture-aware `compilePattern`.
  */
 export function matchLiteralPattern(pattern: string, pathname: string): boolean {
-  let regex = lruGet(literalRegexCache, pattern);
-  if (!regex) {
-    try {
-      const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replaceAll('*', '.*');
-      regex = new RegExp(`^${escaped}$`);
-    } catch {
-      return false;
-    }
-    lruSet(literalRegexCache, pattern, regex);
-  }
-  try {
-    return regex.test(pathname);
-  } catch {
-    return false;
+  let prepared = lruGet(literalCache, pattern);
+  if (!prepared) {
+    const tokens: Array<Token> = [];
+    parseStars(tokens, pattern);
+    prepared = prepare(tokens);
+    lruSet(literalCache, pattern, prepared);
   }
+  return matches(prepared, pathname);
 }
 
-const segmentRegexCache = new Map<string, RegExp>();
+const segmentCache = new Map<string, Prepared>();
 
 /**
- * Match a REVALIDATE ROUTE pattern against a pathname using SEGMENT-ANCHORED
- * semantics. Like `matchLiteralPattern` except a WHOLE-SEGMENT `:name` (a `:`
- * right after `/` or at the start of the pattern, whose name is any non-empty
- * run of non-`/` characters — NOT just JS-identifier chars, so `:post-id`,
- * `:post.id`, etc. all anchor — running up to the next `/` or end of string)
- * matches exactly ONE non-empty path segment (`[^/]+`). A whole-segment NAMED
- * CATCH-ALL `:name{.+}` (a named catch-all page `[...path]` → `/docs/:path{.+}`)
- * matches ONE-OR-MORE characters that MAY cross `/` (`.+`, so `/docs/a` and
- * `/docs/a/b` both match, but bare `/docs` / `/docs/` do NOT). Only the exact
- * `{.+}` constraint widens — a REGEX-constrained param like `:path{[0-9]+}`
- * keeps its single-segment `[^/]+` meaning. `*` still expands to a catch-all
- * that crosses `/`. A mid-segment `:` (e.g. `/api/v1:health`,
- * `/api/documents:batchGet`) stays a LITERAL — only whole-segment `:name` /
- * `:name{.+}` anchors.
- *
- * This is for `routing.revalidate` keys ONLY. Those keys are machine-generated
- * from page routes on the deploy write side (`[slug]` → `/blog/:slug`,
- * `[...path]` → `/docs/:path{.+}`), so the `:name` here is a real route param
- * and MUST bind the same way the framework's own client route matcher
- * (`patternToRegex` in `pages/manifest.ts`) binds it.
- *
- * It is intentionally NOT used for user-authored header rules
- * (`applyHeaderRules`) or `revalidateQueryAllowlist` keys
- * (`buildVariantOriginalUrl`), where `:name` must stay a literal — those keep
- * using `matchLiteralPattern`. Sharing the segment behaviour there would make a
- * user rule like `/:batchGet` over-match every single-segment path.
- *
- * NOTE: this matcher has its OWN regex cache — the same pattern string compiles
- * to a DIFFERENT regex than `matchLiteralPattern` produces, so the caches must
- * not be shared or they would cross-contaminate.
+ * Match a `routing.revalidate` key or page pattern against a pathname. Like
+ * `matchLiteralPattern`, except for whole-segment params:
+ *   `:name`      — exactly one non-empty path segment (any non-`/` name)
+ *   `:name{.+}`  — one or more characters that may cross `/`
+ * A mid-segment `:` (`/api/v1:health`) stays literal, and any other `{...}`
+ * constraint keeps the single-segment meaning. Has its own cache because the
+ * same source parses differently here.
  */
 export function matchSegmentPattern(pattern: string, pathname: string): boolean {
-  let regex = lruGet(segmentRegexCache, pattern);
-  if (!regex) {
-    try {
-      // Two private-use sentinels stand in for route params so the regex-special
-      // escape step below can't touch the classes we swap in last:
-      //   \uE000 - a whole-segment `:name`       -> one path segment (`[^/]+`)
-      //   \uE001 - a named catch-all `:name{.+}`  -> >=1 char, crosses `/` (`.+`)
-      // The named-catch-all rule runs FIRST so `:name{.+}` is consumed as a unit
-      // before the plain `:name` rule can grab `:name` and strand the `{.+}`. The
-      // `{.+}` name class is `[^/{}]+` (excludes braces) so a REGEX-constrained
-      // param like `:path{[0-9]+}` does NOT match and stays a single segment.
-      const escaped = pattern
-        .replace(/(^|\/):[^/{}]+\{\.\+\}(?=\/|$)/g, '$1\uE001') // named catch-all :name{.+} -> catch-all sentinel
-        .replace(/(^|\/):[^/]+(?=\/|$)/g, '$1\uE000') // whole-segment :name -> segment sentinel
-        .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // escape regex specials
-        .replaceAll('*', '.*') // legacy `*` crosses '/'
-        .replaceAll('\uE000', '[^/]+') // segment sentinel -> one segment
-        .replaceAll('\uE001', '.+'); // catch-all sentinel -> >=1 char, crosses '/'
-      regex = new RegExp(`^${escaped}$`);
-    } catch {
-      return false;
-    }
-    lruSet(segmentRegexCache, pattern, regex);
-  }
-  try {
-    return regex.test(pathname);
-  } catch {
-    return false;
+  let prepared = lruGet(segmentCache, pattern);
+  if (!prepared) {
+    prepared = prepare(parseSegments(pattern));
+    lruSet(segmentCache, pattern, prepared);
   }
+  return matches(prepared, pathname);
 }
 
 /**
diff --git a/packages/edge/src/routing-rules.ts b/packages/edge/src/routing-rules.ts
index 8b9655f3b..b52206184 100644
--- a/packages/edge/src/routing-rules.ts
+++ b/packages/edge/src/routing-rules.ts
@@ -1,5 +1,5 @@
 import type { RedirectRule } from '@void/deploy-core';
-import { compilePattern, substituteParams } from './pattern.ts';
+import { compilePattern, matchPatternCaptures, substituteParams } from './pattern.ts';
 
 export type { RedirectRule } from '@void/deploy-core';
 
@@ -37,25 +37,24 @@ export function applyRoutingRules(
     if (rule.host && rule.host !== requestHost) {
       continue;
     }
-    let regex: RegExp;
     try {
-      ({ regex } = compilePattern(rule.source));
+      compilePattern(rule.source);
     } catch (err) {
-      // A malformed `source` (e.g. duplicate named params) throws inside
-      // `new RegExp`. Framework validation rejects those at build, but a
-      // hand-crafted manifest could still reach the edge. Skip the offending
-      // rule and continue rather than 500ing the whole request.
+      // A malformed `source` (e.g. duplicate named params) throws here.
+      // Framework validation rejects those at build, but a hand-crafted
+      // manifest could still reach the edge. Skip the offending rule and
+      // continue rather than 500ing the whole request.
       console.warn(
         `[dispatch] skipping routing rule with invalid source ${JSON.stringify(rule.source)}: ${err instanceof Error ? err.message : String(err)}`,
       );
       continue;
     }
-    const match = regex.exec(pathname);
-    if (!match) {
+    const params = matchPatternCaptures(rule.source, pathname);
+    if (!params) {
       continue;
     }
 
-    const destination = substituteParams(rule.destination, match.groups ?? {});
+    const destination = substituteParams(rule.destination, params);
 
     if (rule.status === 200) {
       return { type: 'rewrite', destination };
diff --git a/packages/edge/src/runtime.ts b/packages/edge/src/runtime.ts
index 7dff960ca..4b8316f21 100644
--- a/packages/edge/src/runtime.ts
+++ b/packages/edge/src/runtime.ts
@@ -101,8 +101,7 @@ function rewriteUrl(url: URL, destination: string): URL {
 }
 
 function rewriteRequest(request: Request, url: URL, originalUrl: string): Request {
-  const headers = new Headers(request.headers);
-  headers.set('X-Void-Original-URL', originalUrl);
   const rewritten = new Request(url.toString(), request);
-  return new Request(rewritten, { headers });
+  rewritten.headers.set('X-Void-Original-URL', originalUrl);
+  return rewritten;
 }
diff --git a/packages/isr/src/core.ts b/packages/isr/src/core.ts
index 2f238d2ba..ccb94da5c 100644
--- a/packages/isr/src/core.ts
+++ b/packages/isr/src/core.ts
@@ -18,6 +18,10 @@ export function hasCurrentSharedCachePolicy(response: Response): boolean {
   return response.headers.get(SHARED_CACHE_POLICY_HEADER) === String(SHARED_CACHE_POLICY_VERSION);
 }
 
+/**
+ * KV metadata stored with every ISR cache entry. Writers should annotate it with
+ * `satisfies IsrCacheMetadata` so a renamed field fails typecheck.
+ */
 export type IsrCacheMetadata = Readonly<{
   /** HTTP status code. */
   s: number;
diff --git a/packages/isr/src/index.ts b/packages/isr/src/index.ts
index a9b161f8f..4d1fc7808 100644
--- a/packages/isr/src/index.ts
+++ b/packages/isr/src/index.ts
@@ -1,48 +1,20 @@
 /**
- * Shared ISR key/URL helpers used by both the API (purge) and the dispatch
- * worker (read/write). These functions MUST produce byte-identical output:
- * the API purges KV keys and edge URLs that dispatch writes and reads.
+ * ISR cache keys and edge-cache URLs. Writers, readers, and purgers must build
+ * byte-identical keys, so all of them use these helpers.
  *
- * Dispatch derives the deployment id for its keys via
- * `routing.version ?? 'legacy'`, which allows any non-nullish value —
- * including the empty string — to pass through unchanged. The helpers below
- * preserve that shape so the API can compute the exact same key for purge.
+ * Key shapes: `v3` = `<proj>/isr/v3/<D>/<host>/<path>[#rw=<token>]`;
+ * `v2` = hostless `<proj>/isr/v2/<D>/<path>`, kept only to purge old entries.
  */
 
 const ISR_CACHE_KEY_VERSION = 'v3';
 
 /**
- * Previous key version. `v3` keys are ALWAYS host-scoped
- * (`<proj>/isr/v3/<D>/<host>/<path>`); `v2` keys are ALWAYS hostless
- * (`<proj>/isr/v2/<D>/<path>`) — the `<host>` segment did not exist yet.
- *
- * The bump to `v3` was forced by a real aliasing hazard: under a single
- * version, a host-scoped key `<D>/<host>/<path>` and a legacy hostless key
- * `<D>/<host>/<path>` are byte-identical whenever the legacy path's leading
- * segment happens to look like a hostname. Dotted leading path segments are
- * legal (`[domain]` → `:domain`, `[...slug]` → `(.+)`), so a hostless key for
- * the page `/example.com/about` collides exactly with the host-scoped key for
- * `(host=example.com, /about)`. The stored metadata is only `{s,c,t}` (no
- * path/host), so a reader cannot tell them apart and could serve one page's
- * body for the other. Encoding the shape in the version removes the ambiguity:
- * the version alone determines whether a `<host>` segment is present, so no
- * runtime heuristic (e.g. "is the first segment an attached hostname?") is
- * needed to classify a key. Package-internal, like `ISR_CACHE_KEY_VERSION`.
+ * Hostless key version. Host scoping needed a new version: otherwise a hostless
+ * key for `/example.com/about` would equal the host-scoped key for
+ * (`example.com`, `/about`).
  */
 const ISR_LEGACY_CACHE_KEY_VERSION = 'v2';
 
-/**
- * KV metadata stored alongside every ISR cache entry. This is the single
- * canonical shape shared by the dispatch worker (which writes it on a live
- * miss and reads it back on a hit — see `dispatch/src/isr.ts`) AND the API
- * prerender-warm path (`api/src/deploy/publish-worker.ts`), which pre-populates the
- * same KV keys during deploy. Both writers MUST use these exact field names:
- * the reader requires `c` (createdAt) and `t` (ttl) and returns null without
- * them, so a writer that drifts (e.g. writes `context` instead of `c`) produces
- * a permanent cold miss that no typecheck would catch unless it is annotated
- * `satisfies IsrCacheMetadata`. Keep the fields terse — this is stored on every
- * KV entry.
- */
 export type { IsrCacheMetadata } from './core.ts';
 
 /**
@@ -54,9 +26,7 @@ export function normalizeIsrPath(pathname: string): string {
   if (normalized === '/') {
     normalized = '__index__';
   } else {
-    // Strip leading slash
     normalized = normalized.startsWith('/') ? normalized.slice(1) : normalized;
-    // Strip trailing slash
     if (normalized.endsWith('/')) {
       normalized = normalized.slice(0, -1);
     }
@@ -93,61 +63,33 @@ function versionedIsrCachePrefix(
 }
 
 /**
- * Prefix for listing/purging ISR keys.
- *
- * `deploymentId === ''` must still produce the versioned prefix with an
- * empty segment (`<projectId>/isr/v3//`) because dispatch uses
- * `routing.version ?? 'legacy'`, which allows empty strings and writes
- * keys at `<projectId>/isr/v3//<path>`. Only `undefined` selects the
- * legacy scan-all prefix (`<projectId>/isr/`).
+ * Prefix for listing/purging ISR keys. An empty `deploymentId` still yields the
+ * versioned prefix (`<projectId>/isr/v3//`), because writers may use an empty
+ * id. Only `undefined` selects every key (`<projectId>/isr/`).
  */
 export function isrCachePrefix(projectId: string, deploymentId?: string): string {
   return versionedIsrCachePrefix(projectId, ISR_CACHE_KEY_VERSION, deploymentId);
 }
 
 /**
- * Prefix for listing/purging LEGACY (pre-host-scoping) ISR keys — the `v2`
- * namespace `<projectId>/isr/v2/<deploymentId>/`. Mirrors `isrCachePrefix`'s
- * optional-`deploymentId` behavior exactly (empty string yields the versioned
- * prefix with an empty segment; only `undefined` selects the scan-all
- * `<projectId>/isr/` prefix).
- *
- * Exists SOLELY for the host-scoping rollout: the purger sweeps this namespace
- * to reap orphaned `v2` KV keys and purge their edge URLs. Current dispatch
- * neither reads nor writes `v2` keys. Transition-only — remove once `v2`
- * entries have aged out.
+ * Like `isrCachePrefix`, for hostless `v2` keys. The `isrLegacy*` helpers exist
+ * only to purge `v2` entries; remove them once those entries have aged out.
  */
 export function isrLegacyCachePrefix(projectId: string, deploymentId?: string): string {
   return versionedIsrCachePrefix(projectId, ISR_LEGACY_CACHE_KEY_VERSION, deploymentId);
 }
 
-/**
- * Separator that marks the rewrite-variant suffix on an ISR cache key or
- * the corresponding edge-cache URL parameter. `#` cannot appear in
- * `url.pathname` (fragments are stripped before the request reaches the
- * server) and does not survive `normalizeIsrPath`, so it unambiguously
- * identifies the variant suffix.
- */
+/** `#` never appears in a request pathname, so it unambiguously marks the variant suffix. */
 const ISR_VARIANT_SEPARATOR = '#rw=';
 
 /**
- * Build the cache key for an ISR-cached page.
- * ISR is deployment-scoped so cached HTML cannot outlive the hashed assets
- * referenced by the deployment that produced it, and host-scoped (`<host>`
- * segment after the deployment id) so the same path served under different
- * hostnames — e.g. a project slug and a custom domain, or two custom
- * domains — never share a cache slot. `host` is the request hostname the
- * dispatch worker saw (`new URL(request.url).hostname`).
+ * KV key for an ISR-cached page: `<proj>/isr/v3/<D>/<host>/<path>`. Deployment
+ * scoping keeps cached HTML from outliving its hashed assets; host scoping keeps
+ * different hostnames apart. `host` is the request hostname.
  *
- * Host-scoping is a `v3` key format: `<proj>/isr/v3/<D>/<host>/<path>`. The
- * version bump is load-bearing, not cosmetic — see `ISR_LEGACY_CACHE_KEY_VERSION`.
- *
- * When `originalUrl` is provided, the request was served via a dispatch-side
- * rewrite (`redirectRules`/`fallbackRules` with status 200). The original
- * request URL is mixed into the key so a direct hit to `/en/docs` and a
- * rewrite from `/docs` to `/en/docs` do not collide — user code can branch
- * on `c.isRewritten()` / `c.originalUrl()`, and the cache must honor that.
- * A missing `originalUrl` means "direct hit" and produces the unsuffixed key.
+ * Pass `originalUrl` for a rewritten request (or a query variant). It adds a
+ * `#rw=<token>` suffix, so a rewrite from `/docs` to `/en/docs` does not share
+ * an entry with a direct hit on `/en/docs`.
  */
 export function isrCacheKey(
   projectId: string,
@@ -163,10 +105,7 @@ export function isrCacheKey(
   return `${base}${ISR_VARIANT_SEPARATOR}${hashOriginalUrl(originalUrl)}`;
 }
 
-/**
- * Prefix used to list/purge every variant of a given pathname under a
- * deployment — both the direct-hit key and any rewrite-variant keys.
- */
+/** Prefix for listing/purging the `#rw=` variant keys of a pathname (not its direct-hit key). */
 export function isrCacheVariantPrefix(
   projectId: string,
   deploymentId: string,
@@ -176,16 +115,7 @@ export function isrCacheVariantPrefix(
   return `${isrCachePrefix(projectId, deploymentId)}${host}/${normalizeIsrPath(pathname)}${ISR_VARIANT_SEPARATOR}`;
 }
 
-/**
- * Build the exact LEGACY (pre-host-scoping) direct-hit key for a pathname under
- * a deployment: `<projectId>/isr/v2/<deploymentId>/<normalizedPath>` — the
- * hostless counterpart of `isrCacheKey` with no `<host>/` segment and no
- * rewrite-variant suffix. Used by the purger to reap the orphaned `v2`
- * direct-hit KV key for a requested path.
- *
- * Exists SOLELY for the host-scoping rollout — current dispatch neither writes
- * nor reads hostless keys. Transition-only. Do not use it on the hot path.
- */
+/** Hostless `v2` direct-hit key for a pathname (purge only; see `isrLegacyCachePrefix`). */
 export function isrLegacyCacheKey(
   projectId: string,
   deploymentId: string,
@@ -194,23 +124,7 @@ export function isrLegacyCacheKey(
   return `${isrLegacyCachePrefix(projectId, deploymentId)}${normalizeIsrPath(pathname)}`;
 }
 
-/**
- * Prefix used to list/purge the pre-host-scoped ("legacy") rewrite variants of
- * a given pathname under a deployment. Before ISR keys grew a `<host>` segment,
- * variant keys were written as
- * `<projectId>/isr/v2/<deploymentId>/<normalizedPath>#rw=<token>` — identical to
- * `isrCacheVariantPrefix` but with NO `<host>/` segment. Those entries still
- * persist during the host-scoping rollout (ISR puts set no `expirationTtl`),
- * so the purger must scan this hostless `v2` prefix in addition to the
- * host-scoped `v3` one to recover their variant tokens and purge the matching
- * edge URLs.
- *
- * Built off `isrLegacyCachePrefix` (the `v2` namespace), NOT `isrCachePrefix`
- * (now `v3`), so it targets the legacy hostless keys it is meant to sweep.
- *
- * Exists SOLELY for that rollout cleanup — current dispatch neither writes nor
- * reads hostless keys. Transition-only. Do not use it on the hot path.
- */
+/** Hostless `v2` rewrite-variant prefix for a pathname (purge only; see `isrLegacyCachePrefix`). */
 export function isrLegacyCacheVariantPrefix(
   projectId: string,
   deploymentId: string,
@@ -219,28 +133,16 @@ export function isrLegacyCacheVariantPrefix(
   return `${isrLegacyCachePrefix(projectId, deploymentId)}${normalizeIsrPath(pathname)}${ISR_VARIANT_SEPARATOR}`;
 }
 
-/**
- * Hash an original-URL value into a fixed-length, opaque variant token.
- * Used as both the KV-key suffix and the `__void_orig` query value, so the
- * writer and purger paths see byte-identical tokens for the same URL.
- *
- * Properties:
- *   - Sync (Workers `crypto.subtle.digest` is async; we don't want to push
- *     async through every read/write path for this).
- *   - 16 hex chars (64 bits) — bounds the KV key length regardless of input.
- *   - Non-recoverable: KV is operator-readable, so the token must not reveal
- *     original URLs (including sensitive query strings like `?token=…`).
- *   - Not cryptographic: collision resistance is ~2^32 (birthday). Fine for
- *     the per-deployment, per-pathname variant set we ever store in one slot.
- *
- * Implementation: FNV-1a 64-bit over UTF-8 bytes. BigInt arithmetic for the
- * multiply (no native u64 in JS), but inputs are short (URLs, sub-1KB) and
- * this only runs once per ISR-touched request.
- */
 const FNV_OFFSET_BASIS = 0xcbf29ce484222325n;
 const FNV_PRIME = 0x100000001b3n;
 const FNV_MASK = 0xffffffffffffffffn;
 
+/**
+ * Hash an original URL into a 16-hex-char variant token (FNV-1a 64-bit), used
+ * as both the KV-key suffix and the `__void_orig` edge-cache parameter. It is
+ * sync so it fits every read/write path, and opaque so KV never exposes
+ * original URLs or their query strings. Not cryptographic.
+ */
 export function hashOriginalUrl(originalUrl: string): string {
   const bytes = new TextEncoder().encode(originalUrl);
   let h = FNV_OFFSET_BASIS;
@@ -252,13 +154,9 @@ export function hashOriginalUrl(originalUrl: string): string {
 }
 
 /**
- * Split a fully-qualified ISR KV key into the normalized pathname segment
- * and the optional rewrite-variant token. Returns `null` token when the
- * key has no `#rw=` suffix (direct hit).
- *
- * The token is opaque (a hash); the original URL it was derived from is not
- * recoverable. Callers that need to reproduce the matching edge-cache URL
- * pass the token through `isrEdgeCacheUrlForToken`.
+ * Split an ISR KV key into its normalized path and its `#rw=` variant token
+ * (`null` for a direct hit). Pass the token to `isrEdgeCacheUrlForToken` to
+ * rebuild the matching edge-cache URL.
  */
 export function splitIsrCacheKey(fullKey: string): {
   normalizedPath: string;
@@ -275,15 +173,9 @@ export function splitIsrCacheKey(fullKey: string): {
 }
 
 /**
- * Build the edge cache URL that dispatch uses as its `caches.default` key
- * (wrapped in a GET `Request`). The public URL stays clean; the internal
- * cache key carries the deployment id so a new deploy never reads HTML
- * produced by an older deploy. The `json` variant separates pages-protocol
- * JSON responses from HTML for the same path+deployment.
- *
- * This MUST match the URL dispatch writes. Dispatch builds the URL from
- * `new URL(request.url).hostname`; for standard-port HTTPS traffic (all CF
- * edge traffic) that yields the same origin as the one produced here.
+ * Edge-cache (`caches.default`) URL for an ISR page. It carries the deployment
+ * id so a new deploy never reads older HTML, and the `json` variant keeps
+ * Pages-protocol JSON apart from HTML for the same path.
  */
 export function isrEdgeCacheUrl(
   hostname: string,
@@ -301,11 +193,7 @@ export function isrEdgeCacheUrl(
   );
 }
 
-/**
- * Like `isrEdgeCacheUrl`, but takes a pre-hashed variant token (from
- * `splitIsrCacheKey`). Used by the purger, which only knows the hashed
- * token: the original URL is not recoverable from a KV key.
- */
+/** Like `isrEdgeCacheUrl`, but takes a variant token from `splitIsrCacheKey`. */
 export function isrEdgeCacheUrlForToken(
   hostname: string,
   pathname: string,
diff --git a/packages/isr/src/runtime.ts b/packages/isr/src/runtime.ts
index 0c6e81787..734c4ea69 100644
--- a/packages/isr/src/runtime.ts
+++ b/packages/isr/src/runtime.ts
@@ -49,41 +49,14 @@ export { matchSegmentPattern as matchLiteralPattern };
 export { canonicalIsrPathname, denormalizeIsrPath, normalizeIsrPath } from './index.ts';
 
 /**
- * Single-tenant ISR (incremental static regeneration) cache ladder for the
- * direct Cloudflare Worker (Void apps and framework deploy wrappers).
- *
- * On managed Void, ISR lives in the dispatch worker that sits IN FRONT of the
- * user worker. Self-host has no dispatch worker, so this module ports that
- * caching ladder INTO the user worker, collapsed from multi-tenant to a single
- * deployment:
- *
- *   - No `projectId`, no cross-tenant metering.
- *   - No `#rw=` rewrite variant, no query-string variant fanout, no variant cap.
- *   - The deployment id is baked at build time as a compile-time literal and
- *     surfaced on `env.__VOID_ISR_DEPLOYMENT_ID`. The KV helpers read
- *     it from `env` (matching the `revalidate()` purge path in `runtime/isr.ts`),
- *     while `handleIsr` uses the `deploymentId` option for the edge-cache keys —
- *     the two are the same value.
- *
- * Fail-open contract: every `env.ISR_CACHE` (KV) and `caches.default` operation
- * is wrapped so a misconfigured or erroring cache degrades to a live render,
- * never a 500. Read/hit-path failures bail (caller renders live); write-path
- * failures are swallowed.
- *
- * Worker-only: no `lib.dom` types — globals come from `@cloudflare/workers-types`.
- *
- * Ported from the hosted dispatch runtime and the shared `@void/isr` contract.
+ * Single-tenant ISR cache for a direct Cloudflare Worker (Void apps and
+ * framework deploy wrappers). Every `ISR_CACHE` (KV) and `caches.default`
+ * operation fails open: read errors render live, write errors are ignored.
+ * KV helpers read the deployment id from `env.__VOID_ISR_DEPLOYMENT_ID`;
+ * edge-cache keys use the `deploymentId` option. Both hold the same value.
  */
 
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-/**
- * Minimal env surface this module needs. Both fields are optional so a worker
- * with no ISR binding (or a caller that only knows the deployment id) still
- * typechecks and fails open at runtime.
- */
+/** Env fields ISR reads. Both are optional: without them ISR fails open. */
 export interface IsrCacheEnv {
   ISR_CACHE?: KVNamespace;
   __VOID_ISR_DEPLOYMENT_ID?: string;
@@ -100,14 +73,12 @@ export type HandleIsrOptions = Readonly<{
   queryAllowlist?: QueryAllowlist;
 }>;
 
+// Caps rewrite-variant entries per path, so random values of an allowlisted
+// query param cannot grow KV without bound. Existing variants still update.
 export const MAX_ISR_VARIANTS_PER_PATH = 200;
 // Match managed ISR: tolerate removal responses for 24 hours after expiry.
 const ISR_STALE_EVICT_GRACE_MS = 86_400_000;
 
-// ---------------------------------------------------------------------------
-// Collapsed single-tenant cache keys
-// ---------------------------------------------------------------------------
-
 const DIRECT_ISR_PROJECT_ID = '__void_direct__';
 
 /** Prefix for the current direct deployment's host-scoped cache entries. */
@@ -116,11 +87,8 @@ export function isrPrefix(deploymentId: string): string {
 }
 
 /**
- * KV cache key for an ISR-cached page. Deployment- AND host-scoped: cached HTML
- * cannot outlive the hashed assets of the deployment that produced it (a fresh
- * `wrangler deploy` mints a new deployment id → cold cache), and one host's
- * cached content never bleeds into another host served by the same worker
- * (custom domain + workers.dev, apex + www, etc.).
+ * KV key for an ISR-cached page, scoped by deployment (a new deploy starts with
+ * a cold cache) and by host (custom domain, workers.dev, apex, and www stay apart).
  */
 export function isrKey(
   deploymentId: string,
@@ -136,10 +104,9 @@ export function isrVariantPrefix(deploymentId: string, host: string, pathname: s
 }
 
 /**
- * Host-registry key. Every host that has written cached content registers itself
- * under `void-isr-hosts/<id>/<host>` (value `''`) so a purge with no request host
- * (cron / queue `revalidate({ paths })`) can enumerate the hosts to purge.
- * Scoped by deployment id so registrations from an old deploy do not leak.
+ * Host-registry key. Every host that writes cached content registers here, so a
+ * purge without a request host (cron or queue `revalidate({ paths })`) can find
+ * the hosts to purge.
  */
 export function hostRegistryKey(deploymentId: string, host: string): string {
   return `void-isr-hosts/${deploymentId}/${host}`;
@@ -172,16 +139,7 @@ export function jsonEdgeKey(
   return isrEdgeCacheUrl(host, pathname, id, 'json', variantUrl);
 }
 
-// ---------------------------------------------------------------------------
-// KV cache (single-tenant; fail-open on every ISR_CACHE op)
-// ---------------------------------------------------------------------------
-
-/**
- * Read an ISR cache entry from KV. Returns null on cache miss, malformed
- * metadata, or ANY KV error (fail-open → caller renders live). The KV key is
- * deployment-scoped via `env.__VOID_ISR_DEPLOYMENT_ID` (see module header) and
- * host-scoped via `host` so one host never reads another host's cached bytes.
- */
+/** Read an ISR entry from KV. Returns null on a miss, a malformed entry, or any KV error. */
 export async function readIsrCache(
   env: IsrCacheEnv,
   host: string,
@@ -200,17 +158,14 @@ export async function readIsrCache(
     value = result.value;
     metadata = result.metadata;
   } catch {
-    // Fail open — a broken ISR_CACHE must degrade to a live render, never 500.
     return null;
   }
   return decodeIsrCacheEntry(value, metadata);
 }
 
 /**
- * Write an ISR cache entry to KV. The `response.clone()` is taken SYNCHRONOUSLY
- * before any `await` so a caller that consumes `response.body` for the client
- * response (after kicking us off via `ctx.waitUntil`) cannot race the body
- * away. Any KV error is swallowed (fail-open on the write path).
+ * Write an ISR entry to KV. The response is cloned before any `await`, so the
+ * caller can stream the original body to the client. KV errors are ignored.
  */
 export async function writeIsrCache(
   env: IsrCacheEnv,
@@ -246,11 +201,8 @@ export async function writeIsrCache(
       } satisfies IsrCacheMetadata,
     });
   } catch {
-    // Fail open — swallow write errors so a broken ISR_CACHE never 500s.
+    // Fail open.
   }
-  // Register this host so a host-less purge (cron / queue) can find it. Guarded
-  // by an in-isolate Set so it costs one KV write per (isolate, id, host), not
-  // one per page write. Fail-open — a registry write error never 500s a render.
   await registerIsrHost(kv, id, host);
 }
 
@@ -271,11 +223,7 @@ async function isVariantWriteAllowed(
   );
 }
 
-/**
- * In-isolate guard: `${id}/${host}` values whose host-registry key this isolate
- * has already written (or attempted). Bounds host registration to ~one KV write
- * per (isolate, deployment, host) instead of one per page write.
- */
+/** `${id}/${host}` pairs this isolate has registered: one registry write per pair, not per page. */
 const registeredHosts = new Set<string>();
 
 async function registerIsrHost(kv: KVNamespace, deploymentId: string, host: string): Promise<void> {
@@ -283,26 +231,19 @@ async function registerIsrHost(kv: KVNamespace, deploymentId: string, host: stri
   if (registeredHosts.has(guardKey)) {
     return;
   }
-  // Mark BEFORE the await so concurrent page writes in this isolate don't all
-  // fire the registry put. On failure, CLEAR the guard so a later write in this
-  // same (possibly long-lived) isolate retries — otherwise one transient error
-  // would permanently drop this host from `listIsrHosts()`, and a cron/queue
-  // `revalidate()` (which has no request host) could never purge it.
+  // Mark before the await so concurrent writes skip the put; clear on failure so
+  // a later write retries instead of leaving the host out of `listIsrHosts()`.
   registeredHosts.add(guardKey);
   try {
     await kv.put(hostRegistryKey(deploymentId, host), '');
   } catch {
-    // Fail open — a registry write failure must never 500 a page render — but
-    // allow a retry on a subsequent write instead of skipping this host forever.
     registeredHosts.delete(guardKey);
   }
 }
 
 /**
- * List every host that has registered cached content for a deployment. Used by
- * the on-demand `revalidate({ paths })` purge when there is no request host
- * (cron / queue). Fail-open: a registry read error yields the hosts collected so
- * far (or none) rather than throwing — degraded purge coverage, never a 500.
+ * List every host registered for a deployment. A registry read error returns
+ * the hosts collected so far instead of throwing.
  */
 export async function listIsrHosts(kv: KVNamespace, deploymentId: string): Promise<Array<string>> {
   const prefix = `void-isr-hosts/${deploymentId}/`;
@@ -317,15 +258,12 @@ export async function listIsrHosts(kv: KVNamespace, deploymentId: string): Promi
       cursor = list.list_complete ? undefined : list.cursor;
     } while (cursor);
   } catch {
-    // Fail open — a broken registry degrades purge coverage, never throws.
+    // Fail open.
   }
   return hosts;
 }
 
-/**
- * Delete an ISR cache entry from KV. Used when a worker permanently opts out
- * via `x-revalidate: 0`. Any KV error is swallowed (fail-open).
- */
+/** Delete an ISR entry from KV (for example after `x-revalidate: 0`). KV errors are ignored. */
 export async function deleteIsrCache(
   env: IsrCacheEnv,
   host: string,
@@ -343,10 +281,6 @@ export async function deleteIsrCache(
   }
 }
 
-// ---------------------------------------------------------------------------
-// Response builders
-// ---------------------------------------------------------------------------
-
 const CLIENT_REVALIDATE_CACHE_CONTROL = 'public, max-age=0, must-revalidate';
 
 export function clientRevalidateResponse(response: Response): Response {
@@ -396,11 +330,8 @@ function jsonCacheResponse(pageData: string, ttl: number, state: 'HIT' | 'MISS')
   const response = new Response(pageData, {
     headers: {
       'content-type': 'application/json',
-      // Mirror the live JSON responder `pageJsonResponse` (pages/protocol.ts):
-      // it stamps `X-VoidPages: true` + `Vary: X-VoidPages`. The Pages client
-      // gates JSON parsing on `X-VoidPages` (navigation-engine.ts) — a cached
-      // JSON variant served on a later navigation without it is treated as
-      // non-JSON and hard-reloads the whole page. Keep name/value/casing exact.
+      // Match the live Pages JSON response: the client parses JSON only when
+      // `X-VoidPages` is present, and otherwise reloads the whole page.
       'X-VoidPages': 'true',
       Vary: 'X-VoidPages',
       'Cache-Control': `public, s-maxage=${ttl}, max-age=0, must-revalidate`,
@@ -412,10 +343,9 @@ function jsonCacheResponse(pageData: string, ttl: number, state: 'HIT' | 'MISS')
 }
 
 /**
- * Populate the JSON edge cache from a response's embedded page data (the
- * `x-void-page-data` header or the `__VOID_PAGE_DATA__` inline script). No-ops
- * when there is no extractable page data. Any cache error is swallowed
- * (fail-open) so this is always safe to fire inside `ctx.waitUntil`.
+ * Fill the JSON edge cache from a response's page data (the `x-void-page-data`
+ * header or the `__VOID_PAGE_DATA__` script). Does nothing without page data;
+ * cache errors are ignored.
  */
 export async function populateJsonEdgeCache(
   cache: Cache | undefined,
@@ -437,30 +367,14 @@ export async function populateJsonEdgeCache(
     }
     await cache.put(cacheKey, jsonCacheResponse(pageData, ttl, state));
   } catch {
-    // Fail open — a broken edge cache must never 500.
+    // Fail open.
   }
 }
 
-// ---------------------------------------------------------------------------
-// Fail-open edge-cache wrappers
-// ---------------------------------------------------------------------------
-
-/**
- * The per-colo edge cache (`caches.default`), or `undefined` when the Cache API
- * is absent/degraded. Accessed through a cast because this package has both
- * `@types/node` and `@cloudflare/workers-types` in scope, and Node's ambient
- * `CacheStorage` (which lacks `.default`) otherwise shadows the Workers one on
- * the `caches` global.
- *
- * Non-throwing by contract: dereferencing `caches.default` can throw if the
- * Cache API is missing (e.g. a non-worker runtime) or degraded. We swallow that
- * here and return `undefined` so `handleIsr` never rejects before its fail-open
- * guards run — the serving invariant is a degraded cache must render live, never
- * 500. Every call site guards `undefined` (via `if (!cache)` or `cache?.`).
- */
+/** `caches.default`, or `undefined` when reading it throws (for example, with no Cache API). */
 function edgeCache(): Cache | undefined {
   try {
-    return (caches as unknown as { default: Cache }).default;
+    return caches.default;
   } catch {
     return undefined;
   }
@@ -505,31 +419,18 @@ async function deleteSharedIsrVariants(
   await safeCacheDelete(cache, keys.jsonKey);
 }
 
-// ---------------------------------------------------------------------------
-// Background revalidation (single-tenant: re-renders through `render`)
-// ---------------------------------------------------------------------------
-
-/**
- * Build a new Request with the `X-VoidPages` header removed. Headers on an
- * existing Request are immutable, so we must clone into a fresh Request. ISR
- * only runs for GET, so there is no body to preserve.
- */
+/** Copy a request without its `X-VoidPages` header. */
 export function cloneWithoutVoidPages(request: Request): Request {
   const headers = new Headers(request.headers);
   headers.delete('X-VoidPages');
-  // Construct from the Request OBJECT (not a string URL): workerd copies the
-  // `cf` blob from the input Request, so `request.cf` is preserved on the clone.
-  // Do not "simplify" this into `new Request(request.url, { headers })` — the
-  // string-URL form drops `cf`.
+  // Construct from the Request, not its URL string, so workerd keeps `request.cf`.
   return new Request(request, { headers });
 }
 
 /**
- * Revalidate an ISR page in the background. Re-renders as HTML (X-VoidPages
- * stripped), writes fresh HTML to KV + HTML edge cache, and populates the JSON
- * edge cache from embedded page data. Errors are caught and logged — serve
- * stale, don't retry. An explicit cache opt-out (including `ttl === 0`)
- * deletes the KV entry and both edge variants.
+ * Re-render a stale page in the background and refresh KV and the edge cache.
+ * Errors are logged and the stale entry keeps serving. An explicit cache
+ * opt-out (including `ttl === 0`) deletes the KV entry and both edge variants.
  */
 async function revalidateInBackground(
   env: IsrCacheEnv,
@@ -544,8 +445,7 @@ async function revalidateInBackground(
   staleSinceMs: number,
 ): Promise<void> {
   try {
-    const cleanRequest = cloneWithoutVoidPages(request);
-    const response = await render(cleanRequest);
+    const response = await render(request);
     const ttl = resolveRevalidateTtl(response, defaultTtl);
     const cache = edgeCache();
     if (response.status === 200 && isEventStreamResponse(response)) {
@@ -564,7 +464,9 @@ async function revalidateInBackground(
           headers: sharedHtmlCacheHeaders(response, ttl, 'HIT'),
         }),
       );
-      await populateJsonEdgeCache(cache, keys.jsonKey, response, ttl, 'HIT');
+      if (!htmlOnly) {
+        await populateJsonEdgeCache(cache, keys.jsonKey, response, ttl, 'HIT');
+      }
     } else if (
       isUncacheableRender(response, ttl, htmlOnly) ||
       ((response.status === 404 || response.status === 410) &&
@@ -579,10 +481,6 @@ async function revalidateInBackground(
   }
 }
 
-// ---------------------------------------------------------------------------
-// Orchestrator
-// ---------------------------------------------------------------------------
-
 /** Cache only framework document HTML; leave client data requests and other response types live. */
 export async function handleFrameworkIsr(
   request: Request,
@@ -598,24 +496,16 @@ export async function handleFrameworkIsr(
 }
 
 /**
- * Run the ISR caching ladder for a request.
+ * Run the ISR cache ladder for a request. Returns the response to send, or
+ * `null` when the caller should render live: the request is not eligible
+ * (not GET, `/api`, Range, `shouldBypassIsr`, or no TTL), a cache read failed,
+ * or a miss carries query params outside the allowlist.
  *
- * Returns a cached/rendered `Response` when ISR applies, or `null` when the
- * caller should render live itself (request not ISR-eligible, a read/hit
- * cache op failed open, or a cache miss for a URL carrying query params
- * outside the allowlist).
- *
- * Ladder:
- *   - Bail (`null`) if not GET, an API path, a Range request, `shouldBypassIsr`,
- *     or the path has no ISR TTL. Range requests bail BEFORE any cache read/write so they
- *     render live (correct 206) and never touch the shared full-response entry.
- *   - JSON (X-VoidPages) path: edge match → hit serves `clientRevalidateResponse`;
- *     miss renders live JSON and returns it — the JSON path never writes the edge
- *     cache. The JSON edge variant is warmed only as a side-effect of the HTML
- *     render path (cold colo re-renders JSON).
- *   - HTML path: L1 edge match → L2 KV. Hit serves `isrCacheResponse`
- *     (stale hits also queue a background revalidation). Miss renders live and,
- *     when cacheable, writes KV + JSON edge + HTML edge in the background.
+ * Pages-protocol (`X-VoidPages`) requests read only the JSON edge cache, and a
+ * miss renders live without caching; HTML renders fill the JSON variant. HTML
+ * requests read the edge cache, then KV. A stale hit is served while it
+ * revalidates in the background, and a cacheable miss fills KV and the edge
+ * cache in the background.
  */
 export async function handleIsr(
   request: Request,
@@ -640,12 +530,7 @@ async function handleIsrInternal(
   if (request.method !== 'GET') {
     return null;
   }
-  // Range requests must render LIVE so the origin produces a correct partial
-  // response (`206 Partial Content`) for the requested byte range. They must
-  // never read or write the shared ISR entry: reading would serve a full-body
-  // entry for a partial request, and writing would poison the shared (host,path)
-  // key with a truncated 206 that a later full request would then be served.
-  // Return null here (→ caller renders live) BEFORE any cache read or write.
+  // A partial 206 must never read or replace the shared full-response entry.
   if (request.headers.has('range')) {
     return null;
   }
@@ -663,10 +548,8 @@ async function handleIsrInternal(
     return null;
   }
 
-  // Keep the KV helpers (which derive the deployment id from env — matching the
-  // `revalidate()` purge path) aligned with the edge keys built here. The worker
-  // entry usually sets this already; the `??=` covers callers that only pass
-  // the option.
+  // KV helpers and `revalidate()` read the id from env; fill it for callers
+  // that pass only the option.
   env.__VOID_ISR_DEPLOYMENT_ID ??= deploymentId;
 
   const host = url.hostname;
@@ -683,8 +566,6 @@ async function handleIsrInternal(
   if (request.headers.has('X-VoidPages')) {
     let jsonCached: Response | undefined;
     try {
-      // `cache?.` — an absent/degraded Cache API (edgeCache() → undefined) is a
-      // miss, not a throw, so we fall through to a live JSON render.
       jsonCached = await cache?.match(jsonKey);
     } catch {
       return null; // fail open → caller renders live
@@ -695,10 +576,6 @@ async function handleIsrInternal(
     if (jsonCached) {
       await safeCacheDelete(cache, jsonKey);
     }
-    // Miss — render live JSON and return it. The JSON path never writes the edge
-    // cache: a pages-protocol JSON response carries no embedded page data, so the
-    // JSON edge variant is warmed only as a side-effect of the HTML render path
-    // (cold colo re-renders JSON). Matches the platform dispatch behavior.
     const response = await render(request);
     const ttl = resolveRevalidateTtl(response, isrTtl);
     if (isUncacheableRender(response, ttl, false)) {
@@ -714,9 +591,6 @@ async function handleIsrInternal(
   // L1: edge cache (per-colo, sub-ms).
   let edgeCached: Response | undefined;
   try {
-    // `cache?.` — an absent/degraded Cache API (edgeCache() → undefined) is an
-    // L1 miss, not a throw, so we fall through to the L2 KV read below (KV still
-    // serves cached content even with no per-colo edge cache).
     edgeCached = await cache?.match(htmlKey);
   } catch {
     return null; // fail open → caller renders live
@@ -731,10 +605,6 @@ async function handleIsrInternal(
   // L2: KV (global, authoritative). `readIsrCache` fails open to null.
   const cached = await readIsrCache(env, host, pathname, variantUrl);
   if (cached) {
-    // Belt-and-suspenders: `readIsrCache` already validates the entry so the
-    // Response constructors below can't throw, but the never-500 fail-open
-    // contract must hold even if a future change slips a throwable past that
-    // choke point. On any throw, fall open (null → caller renders live).
     try {
       const stale = isStale(cached);
       if (stale) {
@@ -787,7 +657,9 @@ async function handleIsrInternal(
     // Every clone below is taken synchronously (before `response.body` is read
     // for the client) so no consumer races the body away.
     ctx.waitUntil(writeIsrCache(env, host, pathname, response, ttl, variantUrl));
-    ctx.waitUntil(populateJsonEdgeCache(cache, jsonKey, response, ttl, 'HIT'));
+    if (!htmlOnly) {
+      ctx.waitUntil(populateJsonEdgeCache(cache, jsonKey, response, ttl, 'HIT'));
+    }
 
     const cacheResponse = new Response(response.clone().body, {
       status: response.status,
diff --git a/packages/isr/test/unit/variant-hash.test.ts b/packages/isr/test/unit/variant-hash.test.ts
index ce8da9d1d..57813a853 100644
--- a/packages/isr/test/unit/variant-hash.test.ts
+++ b/packages/isr/test/unit/variant-hash.test.ts
@@ -9,20 +9,8 @@ import {
   isrLegacyCacheKey,
   isrLegacyCachePrefix,
   isrLegacyCacheVariantPrefix,
-  splitIsrCacheKey,
 } from '../../src/index.ts';
 
-/**
- * Hashing the variant token (instead of base64url-encoding the original URL)
- * meets two operational concerns:
- *
- *   1. KV is operator-readable. A reversible token (`btoa(originalUrl)`) lets
- *      anyone with KV list access recover the URL — including any sensitive
- *      query strings (`?token=…`, `?email=…`) that produced the variant.
- *   2. Variant tokens are used as KV-key suffixes. KV's 512-byte name limit
- *      can be approached if a deployment serves long URLs; a fixed-length
- *      hash bounds key length irrespective of input.
- */
 describe('ISR variant token hashing', () => {
   function variantSuffix(key: string): string {
     const idx = key.indexOf('#rw=');
@@ -47,17 +35,6 @@ describe('ISR variant token hashing', () => {
     expect(a.length).toBeLessThanOrEqual(64); // bounded, not URL-length-dependent
   });
 
-  it('does not embed any portion of the original URL in the token', () => {
-    // Sentinel chosen so any base64url/identity scheme would surface it.
-    const sentinel = 'leaky-secret-fragment';
-    const key = isrCacheKey('p', 'd', 'h', '/x', `https://h/page?token=${sentinel}`);
-    const token = variantSuffix(key);
-    expect(token.toLowerCase()).not.toContain(sentinel.toLowerCase());
-    // base64url of the URL would also contain the sentinel encoded — guard
-    // against that too by checking a few likely encodings.
-    expect(token).not.toContain('bGVha3k='.replace('=', '')); // partial b64
-  });
-
   it('is deterministic — same URL produces the same token', () => {
     const a = isrCacheKey('p', 'd', 'h', '/x', 'https://h/foo');
     const b = isrCacheKey('p', 'd', 'h', '/x', 'https://h/foo');
@@ -70,16 +47,7 @@ describe('ISR variant token hashing', () => {
     expect(a).not.toBe(b);
   });
 
-  it('splitIsrCacheKey returns the (opaque) variant token, not a URL', () => {
-    const fullKey = isrCacheKey('p', 'd', 'h', '/x', 'https://h/foo');
-    // splitIsrCacheKey consumes the suffix after the deployment+host prefix.
-    const split = splitIsrCacheKey(fullKey.slice(`p/isr/v3/d/h/`.length));
-    expect(split.variantToken).toMatch(/^[0-9a-f]+$/);
-    expect(split.variantToken).not.toContain('https://');
-  });
-
   it('current (v3) key strings are host-scoped', () => {
-    // Direct hit and prefixes all live under the `v3` (host-scoped) namespace.
     expect(isrCacheKey('p', 'd', 'h', '/about')).toBe('p/isr/v3/d/h/about');
     expect(isrCacheKey('p', 'd', 'h', '/')).toBe('p/isr/v3/d/h/__index__');
     expect(isrCachePrefix('p', 'd')).toBe('p/isr/v3/d/');
@@ -87,65 +55,19 @@ describe('ISR variant token hashing', () => {
   });
 
   it('legacy (v2) helpers produce hostless isr/v2 strings', () => {
-    // Legacy (pre-host-scoping) keys have no `<host>` segment and live under the
-    // `v2` namespace: `<proj>/isr/v2/<D>/<normalizedPath>[#rw=]`.
     expect(isrLegacyCachePrefix('p', 'd')).toBe('p/isr/v2/d/');
     expect(isrLegacyCacheKey('p', 'd', '/en/docs')).toBe('p/isr/v2/d/en/docs');
     expect(isrLegacyCacheKey('p', 'd', '/')).toBe('p/isr/v2/d/__index__');
     expect(isrLegacyCacheKey('p', 'd', '/about/')).toBe('p/isr/v2/d/about');
     expect(isrLegacyCacheVariantPrefix('p', 'd', '/en/docs')).toBe('p/isr/v2/d/en/docs#rw=');
-    // Root and trailing slashes normalize identically to the host-scoped form.
     expect(isrLegacyCacheVariantPrefix('p', 'd', '/')).toBe('p/isr/v2/d/__index__#rw=');
     expect(isrLegacyCacheVariantPrefix('p', 'd', '/about/')).toBe('p/isr/v2/d/about#rw=');
-    // The legacy variant prefix is the host-scoped one with BOTH the version
-    // bumped down (v3→v2) and the `<host>/` segment removed.
-    const hostScoped = isrCacheVariantPrefix('p', 'd', 'h', '/en/docs');
-    expect(isrLegacyCacheVariantPrefix('p', 'd', '/en/docs')).toBe(
-      hostScoped.replace('/v3/', '/v2/').replace('/h/', '/'),
-    );
-  });
-
-  it('legacy (v2) prefix matches a v2 hostless key but never a v3 host-scoped one', () => {
-    const legacyPrefix = isrLegacyCacheVariantPrefix('p', 'd', '/en/docs');
-    const legacyKey = 'p/isr/v2/d/en/docs#rw=deadbeefdeadbeef';
-    expect(legacyKey.startsWith(legacyPrefix)).toBe(true);
-    // A v3 host-scoped variant key is never under the v2 legacy prefix — the
-    // version segment (`v3` vs `v2`) alone keeps the two namespaces disjoint.
-    const hostScopedKey = isrCacheKey(
-      'p',
-      'd',
-      'app.void.app',
-      '/en/docs',
-      'https://app.void.app/docs',
-    );
-    expect(hostScopedKey.startsWith(legacyPrefix)).toBe(false);
-  });
-
-  it('v3 host-scoped key does NOT collide with the v2 legacy key of a dotted path', () => {
-    // The bug the v3 bump fixes: `normalizeIsrPath` does not escape `/` or `.`,
-    // so a host-scoped key for `(host=example.com, /about)` and a legacy hostless
-    // key for the page `/example.com/about` would be byte-identical under a
-    // single version. The version segment now keeps them apart.
-    const hostScoped = isrCacheKey('p', 'D', 'example.com', '/about');
-    const legacy = isrLegacyCacheKey('p', 'D', '/example.com/about');
-    expect(hostScoped).toBe('p/isr/v3/D/example.com/about');
-    expect(legacy).toBe('p/isr/v2/D/example.com/about');
-    // Byte-inequality is the whole point — a reader keying on either must not
-    // read the other's slot.
-    expect(hostScoped).not.toBe(legacy);
-    // Concretely: they differ ONLY in the version segment.
-    expect(hostScoped.replace('/isr/v3/', '/isr/v2/')).toBe(legacy);
-    expect(isrCachePrefix('p', 'D')).toContain('/isr/v3/');
-    expect(isrLegacyCachePrefix('p', 'D')).toContain('/isr/v2/');
   });
 
   it('isrEdgeCacheUrl and isrEdgeCacheUrlForToken agree for the same URL', () => {
-    // The purger only knows the hashed token (URL is gone after hashing).
-    // It must still reproduce the exact edge-cache URL the writer wrote.
+    // The purger knows only the hashed token, not the original URL.
     const original = 'https://app.void.app/docs?utm=x';
     const fromUrl = isrEdgeCacheUrl('app.void.app', '/en/docs', 'dpl_1', 'html', original);
-    // Pull the token out of the writer's URL and feed it to the by-token
-    // builder — they must produce byte-identical strings.
     const m = /__void_orig=([^&]+)/.exec(fromUrl);
     expect(m).not.toBeNull();
     const token = m![1]!;
diff --git a/packages/md/package.json b/packages/md/package.json
index 0ab736f58..742545173 100644
--- a/packages/md/package.json
+++ b/packages/md/package.json
@@ -58,8 +58,7 @@
     "@types/node": "catalog:",
     "vite": "catalog:",
     "vite-plus": "catalog:",
-    "void": "workspace:*",
-    "vue": "^3.5.43"
+    "void": "workspace:*"
   },
   "peerDependencies": {
     "vite": "^8.0.0",
diff --git a/packages/md/src/codegen/md-types.ts b/packages/md/src/codegen/md-types.ts
deleted file mode 100644
index 473f974b3..000000000
--- a/packages/md/src/codegen/md-types.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/**
- * Generate .void/md.d.ts content.
- *
- * Declares the `@void/md/pages` virtual module so TypeScript can resolve it
- * from anywhere in the project (pages/, routes/, etc.) without @ts-ignore.
- */
-export function generateMdTypes(): string {
-  return [
-    '// Auto-generated by @void/md — do not edit',
-    '',
-    'export type VoidMdPage = Readonly<{',
-    '  path: string;',
-    '  title: string;',
-    '  frontmatter: Record<string, unknown>;',
-    '  headings: ReadonlyArray<{ depth: number; slug: string; text: string }>;',
-    '}>;',
-    '',
-    'declare const pages: ReadonlyArray<VoidMdPage>;',
-    'export default pages;',
-    '',
-  ].join('\n');
-}
diff --git a/packages/md/src/compile.ts b/packages/md/src/compile.ts
index 303155203..84b7c135c 100644
--- a/packages/md/src/compile.ts
+++ b/packages/md/src/compile.ts
@@ -100,26 +100,14 @@ async function createCompiler(options?: CompileOptions): Promise<MarkdownExit> {
   // Code block wrapping (must come after shiki, before line-numbers)
   markdown.use(preWrapperPlugin);
 
-  // Container blocks: :::tip, :::warning, etc.
   markdown.use(containerPlugin);
-
-  // Image path normalization + lazy loading
   markdown.use(imagePlugin, { lazyLoading: true });
-
-  // Link handling: external attrs, .md normalization
   markdown.use(linkPlugin);
-
-  // Line numbers (opt-in per code block by default)
-  markdown.use(lineNumberPlugin, false);
-
-  // GitHub alerts: > [!NOTE], > [!TIP], etc.
+  markdown.use(lineNumberPlugin);
   markdown.use(gitHubAlertsPlugin);
 
-  // Preserve the raw fence info string (e.g. `ts {1,3-5}`) on the token before
-  // `markdown-it-attrs` consumes the `{…}` as an attribute block. Anchored
-  // after `block` so fence tokens exist, and before `curly_attributes` (which
-  // runs after `inline`), so the fence renderer can still feed the ranges to
-  // Shiki's `transformerMetaHighlight` via `meta.__raw`.
+  // Save the raw fence info (e.g. `ts {1,3-5}`) before `markdown-it-attrs` strips the
+  // `{…}`, so `transformerMetaHighlight` still gets the line ranges via `meta.__raw`.
   const stashFenceInfo: RuleCore = (state) => {
     for (const token of state.tokens) {
       if (token.type === 'fence') {
@@ -129,24 +117,18 @@ async function createCompiler(options?: CompileOptions): Promise<MarkdownExit> {
   };
   markdown.core.ruler.after('block', 'stash_fence_info', stashFenceInfo);
 
-  // Attribute syntax: {.class #id}
   markdown.use(attrs);
-
-  // Emoji shortcodes
   markdown.use(emoji);
 
-  // Footnotes: `text[^1]` refs with matching `[^1]: definition` blocks.
-  // Registered after emoji and before anchor so footnote back-reference
-  // markers are not themselves treated as heading-anchor targets.
+  // After emoji and before anchor, so footnote markers are not treated as
+  // heading-anchor targets.
   markdown.use(footnote);
 
-  // Heading anchors
   // @ts-expect-error markdown-it-anchor types reference @types/markdown-it, structurally incompatible with markdown-exit
   markdown.use(anchor, {
     permalink: anchor.permalink.ariaHidden({ placement: 'before' }),
   });
 
-  // [[toc]] directive
   markdown.use(tocPlugin);
 
   return markdown;
@@ -156,16 +138,10 @@ export async function compile(source: string, options?: CompileOptions): Promise
   const { data: frontmatter, content } = matter(source);
   const compiler = await getCompiler(options);
 
-  // Each markdown-it call gets its OWN fresh env. `renderAsync` re-parses
-  // internally, so sharing one env across `parse` and `renderAsync` makes
-  // stateful plugins double-accumulate — markdown-it-footnote would append its
-  // footnote refs/defs to the same `env.footnotes` twice, producing duplicated
-  // footnote lists and wrong fn/fnref ids. A fresh env per call keeps the two
-  // parses independent. Heading/TOC extraction is unaffected: anchor ids are
-  // derived per-parse from the (identical) content, not from shared env state.
-  const tokens = compiler.parse(content, {});
+  const env = {};
+  const tokens = compiler.parse(content, env);
   const headings = extractHeadings(tokens);
-  const html = await compiler.renderAsync(content, {});
+  const html = await compiler.renderer.renderAsync(tokens, compiler.options, env);
 
   const title =
     (frontmatter.title as string) ?? headings.find((heading) => heading.depth === 1)?.text ?? '';
diff --git a/packages/md/src/emit-react.ts b/packages/md/src/emit-react.ts
index def2df45f..c7602a9ec 100644
--- a/packages/md/src/emit-react.ts
+++ b/packages/md/src/emit-react.ts
@@ -1,32 +1,9 @@
 import type { CompileResult } from './compile.ts';
-import { buildRenderChunks, toIslandId } from './emit-shared.ts';
-import type { IslandImport } from './extract-script.ts';
+import { buildRenderChunks, type ResolvedIsland } from './emit-shared.ts';
 
-export function emitReactComponent(result: CompileResult): string {
-  return `
-import React from "react";
-import { FrontmatterContext } from "@void/md";
-
-const __frontmatter = ${JSON.stringify(result.frontmatter)};
-const __headings = ${JSON.stringify(result.headings)};
-const __html = ${JSON.stringify(result.html)};
-
-export const frontmatter = __frontmatter;
-export const headings = __headings;
-
-export default function MarkdownPage() {
-  return React.createElement(
-    FrontmatterContext.Provider,
-    { value: __frontmatter },
-    React.createElement("div", { dangerouslySetInnerHTML: { __html: __html } })
-  );
-}
-`;
-}
-
-export function emitReactComponentWithIslands(
+export function emitReactComponent(
   result: CompileResult,
-  islandImports: ReadonlyArray<IslandImport>,
+  islandImports: ReadonlyArray<ResolvedIsland>,
 ): string {
   const chunks = buildRenderChunks(result.html, islandImports);
 
@@ -44,7 +21,7 @@ export function emitReactComponentWithIslands(
   return React.createElement(
     "div",
     {
-      "data-island": ${JSON.stringify(toIslandId(islandImport))},
+      "data-island": ${JSON.stringify(islandImport.islandId)},
       "data-props": JSON.stringify(props),
       "data-hydrate": ${JSON.stringify(islandImport.strategy)}
     },
diff --git a/packages/md/src/emit-shared.ts b/packages/md/src/emit-shared.ts
index d7fcb6915..eaa788939 100644
--- a/packages/md/src/emit-shared.ts
+++ b/packages/md/src/emit-shared.ts
@@ -1,5 +1,7 @@
 import type { IslandImport } from './extract-script.ts';
 
+export type ResolvedIsland = IslandImport & Readonly<{ islandId: string }>;
+
 // Match self-closing uppercase tags: <Counter />, <Counter attr="val" />
 // and paired uppercase tags: <Counter>...</Counter>
 const ISLAND_TAG_RE =
@@ -19,7 +21,7 @@ type HtmlChunk = {
 
 type IslandChunk = {
   type: 'island';
-  islandImport: IslandImport;
+  islandImport: ResolvedIsland;
   props: Record<string, string>;
 };
 
@@ -53,14 +55,14 @@ function parseAttrs(attrStr: string): Record<string, string> {
   return result;
 }
 
-export function toIslandId(imp: IslandImport): string {
-  return imp.islandId ?? imp.specifier.replace(/\.[^.]+$/, '');
-}
-
 export function buildRenderChunks(
   html: string,
-  islandImports: ReadonlyArray<IslandImport>,
+  islandImports: ReadonlyArray<ResolvedIsland>,
 ): ReadonlyArray<RenderChunk> {
+  // Pages without islands render the whole body, even when it is empty.
+  if (islandImports.length === 0) {
+    return [{ type: 'html', html }];
+  }
   const islandByName = new Map(islandImports.map((item) => [item.name, item]));
   const tags = findIslandTags(html, new Set(islandByName.keys()));
 
diff --git a/packages/md/src/emit-solid.ts b/packages/md/src/emit-solid.ts
index 9e8ab43dc..d2dac3de1 100644
--- a/packages/md/src/emit-solid.ts
+++ b/packages/md/src/emit-solid.ts
@@ -1,31 +1,9 @@
 import type { CompileResult } from './compile.ts';
-import { buildRenderChunks, toIslandId } from './emit-shared.ts';
-import type { IslandImport } from './extract-script.ts';
+import { buildRenderChunks, type ResolvedIsland } from './emit-shared.ts';
 
-export function emitSolidComponent(result: CompileResult): string {
-  return `
-import { FrontmatterContext } from "@void/md";
-
-const __frontmatter = ${JSON.stringify(result.frontmatter)};
-const __headings = ${JSON.stringify(result.headings)};
-const __html = ${JSON.stringify(result.html)};
-
-export const frontmatter = __frontmatter;
-export const headings = __headings;
-
-export default function MarkdownPage() {
-  return (
-    <FrontmatterContext.Provider value={__frontmatter}>
-      <div innerHTML={__html} />
-    </FrontmatterContext.Provider>
-  );
-}
-`;
-}
-
-export function emitSolidComponentWithIslands(
+export function emitSolidComponent(
   result: CompileResult,
-  islandImports: ReadonlyArray<IslandImport>,
+  islandImports: ReadonlyArray<ResolvedIsland>,
 ): string {
   const chunks = buildRenderChunks(result.html, islandImports);
   const importAliasByName = new Map<string, string>();
@@ -63,7 +41,7 @@ export const headings = __headings;
     const propsLiteral = Object.keys(chunk.props).length > 0 ? JSON.stringify(chunk.props) : '{}';
     code += `\nconst ${propsName} = ${propsLiteral};`;
     bodyLines.push(
-      `<div data-island=${JSON.stringify(toIslandId(chunk.islandImport))} data-props={JSON.stringify(${propsName})} data-hydrate=${JSON.stringify(chunk.islandImport.strategy)}><${importAlias} {...${propsName}} /></div>`,
+      `<div data-island=${JSON.stringify(chunk.islandImport.islandId)} data-props={JSON.stringify(${propsName})} data-hydrate=${JSON.stringify(chunk.islandImport.strategy)}><${importAlias} {...${propsName}} /></div>`,
     );
   }
 
diff --git a/packages/md/src/emit-svelte.ts b/packages/md/src/emit-svelte.ts
index 461124b93..07b4ae1c6 100644
--- a/packages/md/src/emit-svelte.ts
+++ b/packages/md/src/emit-svelte.ts
@@ -1,35 +1,13 @@
 import type { CompileResult } from './compile.ts';
-import { buildRenderChunks, toIslandId } from './emit-shared.ts';
-import type { IslandImport } from './extract-script.ts';
+import { buildRenderChunks, type ResolvedIsland } from './emit-shared.ts';
 
 function toSvelteLiteral(value: unknown): string {
   return JSON.stringify(value).replace(/<\//g, '<\\/');
 }
 
-export function emitSvelteComponent(result: CompileResult): string {
-  const frontmatter = toSvelteLiteral(result.frontmatter);
-  const headings = toSvelteLiteral(result.headings);
-  const html = toSvelteLiteral(result.html);
-
-  return `<script context="module">
-export const frontmatter = ${frontmatter};
-export const headings = ${headings};
-</script>
-
-<script>
-import { setFrontmatter } from "@void/md";
-
-const __frontmatter = ${frontmatter};
-setFrontmatter(__frontmatter);
-</script>
-
-{@html ${html}}
-`;
-}
-
-export function emitSvelteComponentWithIslands(
+export function emitSvelteComponent(
   result: CompileResult,
-  islandImports: ReadonlyArray<IslandImport>,
+  islandImports: ReadonlyArray<ResolvedIsland>,
 ): string {
   const chunks = buildRenderChunks(result.html, islandImports);
 
@@ -74,7 +52,7 @@ setFrontmatter(__frontmatter);
     source += `const ${propsName} = ${propsLiteral};
 `;
     body.push(
-      `<div data-island="${toIslandId(chunk.islandImport)}" data-props={JSON.stringify(${propsName})} data-hydrate="${chunk.islandImport.strategy}"><${alias} {...${propsName}} /></div>`,
+      `<div data-island="${chunk.islandImport.islandId}" data-props={JSON.stringify(${propsName})} data-hydrate="${chunk.islandImport.strategy}"><${alias} {...${propsName}} /></div>`,
     );
   }
 
diff --git a/packages/md/src/emit-vue.ts b/packages/md/src/emit-vue.ts
index f85e0bfe6..6dff22617 100644
--- a/packages/md/src/emit-vue.ts
+++ b/packages/md/src/emit-vue.ts
@@ -1,30 +1,9 @@
 import type { CompileResult } from './compile.ts';
-import { buildRenderChunks, toIslandId } from './emit-shared.ts';
-import type { IslandImport } from './extract-script.ts';
+import { buildRenderChunks, type ResolvedIsland } from './emit-shared.ts';
 
-export function emitVueComponent(result: CompileResult): string {
-  return `
-import { defineComponent, createStaticVNode, provide } from "vue";
-
-const __frontmatter = ${JSON.stringify(result.frontmatter)};
-const __headings = ${JSON.stringify(result.headings)};
-const __html = ${JSON.stringify(result.html)};
-
-export const frontmatter = __frontmatter;
-export const headings = __headings;
-
-export default defineComponent({
-  setup() {
-    provide("__void_frontmatter", __frontmatter);
-    return () => createStaticVNode(__html, 1);
-  }
-});
-`;
-}
-
-export function emitVueComponentWithIslands(
+export function emitVueComponent(
   result: CompileResult,
-  islandImports: ReadonlyArray<IslandImport>,
+  islandImports: ReadonlyArray<ResolvedIsland>,
 ): string {
   const chunks = buildRenderChunks(result.html, islandImports);
 
@@ -40,7 +19,7 @@ export function emitVueComponentWithIslands(
     code += `const ${islandImport.name} = { inheritAttrs: false, render() {
   const props = this.$attrs;
   return h("div", {
-    "data-island": ${JSON.stringify(toIslandId(islandImport))},
+    "data-island": ${JSON.stringify(islandImport.islandId)},
     "data-props": JSON.stringify(props),
     "data-hydrate": ${JSON.stringify(islandImport.strategy)}
   }, h(_raw_island_${islandIndex}, props));
@@ -58,6 +37,9 @@ export function emitVueComponentWithIslands(
     }
   }
 
+  // A single root keeps SSR output free of fragment markers on pages without islands.
+  const root = islandImports.length > 0 ? `[\n      ${vnodes.join(',\n      ')}\n    ]` : vnodes[0];
+
   code += `
 const __frontmatter = ${JSON.stringify(result.frontmatter)};
 const __headings = ${JSON.stringify(result.headings)};
@@ -68,9 +50,7 @@ export const headings = __headings;
 export default defineComponent({
   setup() {
     provide("__void_frontmatter", __frontmatter);
-    return () => [
-      ${vnodes.join(',\n      ')}
-    ];
+    return () => ${root};
   }
 });
 `;
diff --git a/packages/md/src/env.d.ts b/packages/md/src/env.d.ts
index cbad8236a..5139b70e6 100644
--- a/packages/md/src/env.d.ts
+++ b/packages/md/src/env.d.ts
@@ -16,9 +16,3 @@ declare module 'markdown-it-footnote' {
   const plugin: (md: unknown, ...args: ReadonlyArray<unknown>) => void;
   export default plugin;
 }
-
-declare module '*.vue' {
-  import type { DefineComponent } from 'vue';
-  const component: DefineComponent<{}, {}, unknown>;
-  export default component;
-}
diff --git a/packages/md/src/plugin.ts b/packages/md/src/plugin.ts
index 6586f340e..2c7c6fc04 100644
--- a/packages/md/src/plugin.ts
+++ b/packages/md/src/plugin.ts
@@ -1,15 +1,14 @@
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'pathslash';
 import { glob } from 'tinyglobby';
 import { normalizePath, type Plugin, type ResolvedConfig, type ViteDevServer } from 'vite';
 import { resolvePagesDir } from 'void/pages';
-import { generateMdTypes } from './codegen/md-types.ts';
 import type { CompileOptions } from './compile.ts';
-import { emitReactComponent, emitReactComponentWithIslands } from './emit-react.ts';
-import { emitSolidComponent, emitSolidComponentWithIslands } from './emit-solid.ts';
-import { emitSvelteComponent, emitSvelteComponentWithIslands } from './emit-svelte.ts';
-import { emitVueComponent, emitVueComponentWithIslands } from './emit-vue.ts';
+import { emitReactComponent } from './emit-react.ts';
+import { emitSolidComponent } from './emit-solid.ts';
+import { emitSvelteComponent } from './emit-svelte.ts';
+import { emitVueComponent } from './emit-vue.ts';
 import { extractScript } from './extract-script.ts';
 import { extractMetadata } from './metadata.ts';
 
@@ -125,12 +124,6 @@ export function voidMarkdown(options?: MarkdownOptions): Array<Plugin> {
     return pages.sort((leftPage, rightPage) => leftPage.path.localeCompare(rightPage.path));
   }
 
-  function writeMdTypes() {
-    const outDir = join(root, '.void');
-    mkdirSync(outDir, { recursive: true });
-    writeFileSync(join(outDir, 'md.d.ts'), generateMdTypes());
-  }
-
   return [
     {
       name: 'void-md',
@@ -189,7 +182,6 @@ export function voidMarkdown(options?: MarkdownOptions): Array<Plugin> {
         solidModules.clear();
         clientScripts.clear();
         mdPages = await scanMdPages();
-        writeMdTypes();
       },
 
       configureServer(server: ViteDevServer) {
@@ -326,42 +318,26 @@ export function useFrontmatter() { return useContext(FrontmatterContext) ?? {};
             const componentId = stripPageSuffix(_id.slice(pagesPrefix.length)) || 'index';
             clientScripts.set(componentId, clientCode);
           }
-          for (const imp of islandImports) {
+          const islands = islandImports.map((imp) => {
             const absPath = resolve(dirname(_id), imp.specifier);
-            imp.islandId = normalizePath(relative(root, absPath)).replace(/\.[^.]+$/, '');
-          }
+            const islandId = normalizePath(relative(root, absPath)).replace(/\.[^.]+$/, '');
+            return { ...imp, islandId };
+          });
 
           const { compile } = await import('./compile.ts');
           const result = await compile(body, { shiki: options?.shiki });
 
           if (adapter === 'vue') {
-            if (islandImports.length > 0) {
-              return {
-                code: emitVueComponentWithIslands(result, islandImports),
-                map: null,
-              };
-            }
-            return { code: emitVueComponent(result), map: null };
+            return { code: emitVueComponent(result, islands), map: null };
           }
 
           if (adapter === 'react') {
-            if (islandImports.length > 0) {
-              return {
-                code: emitReactComponentWithIslands(result, islandImports),
-                map: null,
-              };
-            }
-            return { code: emitReactComponent(result), map: null };
+            return { code: emitReactComponent(result, islands), map: null };
           }
 
           if (adapter === 'svelte') {
             const virtualId = createVirtualModuleId(SVELTE_VIRTUAL_PREFIX, _id, code, 'svelte');
-            svelteModules.set(
-              virtualId,
-              islandImports.length > 0
-                ? emitSvelteComponentWithIslands(result, islandImports)
-                : emitSvelteComponent(result),
-            );
+            svelteModules.set(virtualId, emitSvelteComponent(result, islands));
             return {
               code: `export { default, frontmatter, headings } from ${JSON.stringify(virtualId)};`,
               map: null,
@@ -370,12 +346,7 @@ export function useFrontmatter() { return useContext(FrontmatterContext) ?? {};
 
           if (adapter === 'solid') {
             const virtualId = createVirtualModuleId(SOLID_VIRTUAL_PREFIX, _id, code, 'tsx');
-            solidModules.set(
-              virtualId,
-              islandImports.length > 0
-                ? emitSolidComponentWithIslands(result, islandImports)
-                : emitSolidComponent(result),
-            );
+            solidModules.set(virtualId, emitSolidComponent(result, islands));
             return {
               code: `export { default, frontmatter, headings } from ${JSON.stringify(virtualId)};`,
               map: null,
diff --git a/packages/md/src/plugins/containers.ts b/packages/md/src/plugins/containers.ts
index 514851d2f..3fb8d2d5d 100644
--- a/packages/md/src/plugins/containers.ts
+++ b/packages/md/src/plugins/containers.ts
@@ -2,14 +2,6 @@ import type MarkdownExit from 'markdown-exit';
 import type { Token } from 'markdown-exit';
 import container from 'markdown-it-container';
 
-export type ContainerOptions = Readonly<{
-  tipLabel?: string;
-  infoLabel?: string;
-  warningLabel?: string;
-  dangerLabel?: string;
-  detailsLabel?: string;
-}>;
-
 type MarkdownEnv = {
   references?: Record<string, { title: string; href: string }>;
   [key: string]: unknown;
@@ -49,10 +41,10 @@ function createContainer(
  * Custom container blocks: :::tip, :::info, :::warning, :::danger, :::details
  * Ported from VitePress.
  */
-export function containerPlugin(md: MarkdownExit, options?: ContainerOptions): void {
-  md.use(...createContainer(md, 'tip', options?.tipLabel ?? 'TIP'))
-    .use(...createContainer(md, 'info', options?.infoLabel ?? 'INFO'))
-    .use(...createContainer(md, 'warning', options?.warningLabel ?? 'WARNING'))
-    .use(...createContainer(md, 'danger', options?.dangerLabel ?? 'DANGER'))
-    .use(...createContainer(md, 'details', options?.detailsLabel ?? 'Details'));
+export function containerPlugin(md: MarkdownExit): void {
+  md.use(...createContainer(md, 'tip', 'TIP'))
+    .use(...createContainer(md, 'info', 'INFO'))
+    .use(...createContainer(md, 'warning', 'WARNING'))
+    .use(...createContainer(md, 'danger', 'DANGER'))
+    .use(...createContainer(md, 'details', 'Details'));
 }
diff --git a/packages/md/src/plugins/github-alerts.ts b/packages/md/src/plugins/github-alerts.ts
index 10c22d558..18039048f 100644
--- a/packages/md/src/plugins/github-alerts.ts
+++ b/packages/md/src/plugins/github-alerts.ts
@@ -3,39 +3,25 @@ import type { RuleCore, Token } from 'markdown-exit';
 
 const markerRE = /^\[!(TIP|NOTE|INFO|IMPORTANT|WARNING|CAUTION|DANGER)\]([^\n\r]*)/i;
 
-export type GitHubAlertsOptions = Readonly<{
-  tipLabel?: string;
-  noteLabel?: string;
-  infoLabel?: string;
-  importantLabel?: string;
-  warningLabel?: string;
-  cautionLabel?: string;
-  dangerLabel?: string;
-}>;
+const titleMark: Record<string, string> = {
+  tip: 'TIP',
+  note: 'NOTE',
+  info: 'INFO',
+  important: 'IMPORTANT',
+  warning: 'WARNING',
+  caution: 'CAUTION',
+  danger: 'DANGER',
+};
 
 type AlertToken = Token & {
   meta?: { title: string; type: string };
 };
 
-function capitalize(str: string): string {
-  return str.charAt(0).toUpperCase() + str.slice(1);
-}
-
 /**
  * GitHub-flavored alerts: > [!NOTE], > [!TIP], > [!WARNING], etc.
  * Ported from VitePress.
  */
-export function gitHubAlertsPlugin(md: MarkdownExit, options?: GitHubAlertsOptions): void {
-  const titleMark: Record<string, string> = {
-    tip: options?.tipLabel ?? 'TIP',
-    note: options?.noteLabel ?? 'NOTE',
-    info: options?.infoLabel ?? 'INFO',
-    important: options?.importantLabel ?? 'IMPORTANT',
-    warning: options?.warningLabel ?? 'WARNING',
-    caution: options?.cautionLabel ?? 'CAUTION',
-    danger: options?.dangerLabel ?? 'DANGER',
-  };
-
+export function gitHubAlertsPlugin(md: MarkdownExit): void {
   const rule: RuleCore = (state) => {
     const tokens = state.tokens as ReadonlyArray<AlertToken>;
     for (let tokenIndex = 0; tokenIndex < tokens.length; tokenIndex++) {
@@ -64,7 +50,7 @@ export function gitHubAlertsPlugin(md: MarkdownExit, options?: GitHubAlertsOptio
           continue;
         }
         const type = match[1].toLowerCase();
-        const title = match[2].trim() || titleMark[type] || capitalize(type);
+        const title = match[2].trim() || titleMark[type];
         firstContent.content = firstContent.content.slice(match[0].length).trimStart();
         open.type = 'github_alert_open';
         open.tag = 'div';
diff --git a/packages/md/src/plugins/line-numbers.ts b/packages/md/src/plugins/line-numbers.ts
index 194570b21..b55fe5324 100644
--- a/packages/md/src/plugins/line-numbers.ts
+++ b/packages/md/src/plugins/line-numbers.ts
@@ -11,18 +11,18 @@ type FenceRender = (
 ) => string | Promise<string>;
 
 /**
- * Adds line number gutter to code blocks.
- * Supports `:line-numbers` / `:no-line-numbers` per-block control and `{=N}` start line.
+ * Adds a line number gutter to code blocks that opt in with `:line-numbers`.
+ * `{=N}` sets the start line.
  * Ported from VitePress.
  */
-export function lineNumberPlugin(md: MarkdownExit, enable = false): void {
+export function lineNumberPlugin(md: MarkdownExit): void {
   const fence = md.renderer.rules.fence as FenceRender;
   md.renderer.rules.fence = async (...args: Parameters<FenceRender>) => {
     const rawCode = await fence(...args);
     const [tokens, idx] = args;
     const info = tokens[idx].info;
 
-    if ((!enable && !/:line-numbers\b/.test(info)) || (enable && /:no-line-numbers\b/.test(info))) {
+    if (!/:line-numbers\b/.test(info)) {
       return rawCode;
     }
 
diff --git a/packages/md/src/plugins/link.ts b/packages/md/src/plugins/link.ts
index 84ecd93ff..a181b3d6e 100644
--- a/packages/md/src/plugins/link.ts
+++ b/packages/md/src/plugins/link.ts
@@ -3,21 +3,17 @@ import type MarkdownExit from 'markdown-exit';
 
 const EXTERNAL_URL_RE = /^[a-z]+:/i;
 
-export type LinkOptions = Readonly<{
-  externalAttrs?: Record<string, string>;
-}>;
+const EXTERNAL_ATTRS: Record<string, string> = {
+  target: '_blank',
+  rel: 'noreferrer',
+};
 
 /**
  * Adds target="_blank" and rel="noreferrer" to external links.
  * Normalizes internal .md links to route paths.
  * Ported from VitePress.
  */
-export function linkPlugin(md: MarkdownExit, options?: LinkOptions): void {
-  const externalAttrs = options?.externalAttrs ?? {
-    target: '_blank',
-    rel: 'noreferrer',
-  };
-
+export function linkPlugin(md: MarkdownExit): void {
   md.renderer.rules.link_open = (
     tokens: Array<Token>,
     idx: number,
@@ -40,7 +36,7 @@ export function linkPlugin(md: MarkdownExit, options?: LinkOptions): void {
 
     if (EXTERNAL_URL_RE.test(url)) {
       // External link — add target/rel attributes
-      for (const [key, val] of Object.entries(externalAttrs)) {
+      for (const [key, val] of Object.entries(EXTERNAL_ATTRS)) {
         token.attrSet(key, val);
       }
     } else {
diff --git a/packages/md/src/plugins/pre-wrapper.ts b/packages/md/src/plugins/pre-wrapper.ts
index 2a8b8028d..09e90bbd7 100644
--- a/packages/md/src/plugins/pre-wrapper.ts
+++ b/packages/md/src/plugins/pre-wrapper.ts
@@ -20,16 +20,11 @@ function extractLang(info: string): string {
   );
 }
 
-export type PreWrapperOptions = Readonly<{
-  codeCopyButtonTitle?: string;
-}>;
-
 /**
  * Wraps fenced code blocks with a language label and copy button.
  * Ported from VitePress.
  */
-export function preWrapperPlugin(md: MarkdownExit, options?: PreWrapperOptions): void {
-  const title = options?.codeCopyButtonTitle ?? 'Copy Code';
+export function preWrapperPlugin(md: MarkdownExit): void {
   const fence = md.renderer.rules.fence as FenceRender;
   md.renderer.rules.fence = async (...args: Parameters<FenceRender>) => {
     const [tokens, idx] = args;
@@ -43,7 +38,7 @@ export function preWrapperPlugin(md: MarkdownExit, options?: PreWrapperOptions):
     const highlighted = await fence(...args);
     return (
       `<div class="language-${lang}${active}">` +
-      `<button title="${title}" class="copy"></button>` +
+      '<button title="Copy Code" class="copy"></button>' +
       `<span class="lang">${lang}</span>` +
       highlighted +
       `</div>`
diff --git a/packages/md/src/plugins/toc.ts b/packages/md/src/plugins/toc.ts
index 84d18809e..cbba33fd6 100644
--- a/packages/md/src/plugins/toc.ts
+++ b/packages/md/src/plugins/toc.ts
@@ -3,24 +3,19 @@ import type MarkdownExit from 'markdown-exit';
 import type { Heading } from '../compile.ts';
 import { extractHeadings } from '../metadata.ts';
 
-export type TocOptions = Readonly<{
-  pattern?: RegExp;
-  level?: ReadonlyArray<number>;
-  containerTag?: string;
-  containerClass?: string;
-  listTag?: string;
-}>;
+const TOC_RE = /^\[\[toc\]\]$/i;
+const TOC_LEVELS: ReadonlyArray<number> = [2, 3];
 
-function renderHeaders(headers: ReadonlyArray<Heading>, listTag: string): string {
+function renderHeaders(headers: ReadonlyArray<Heading>): string {
   if (headers.length === 0) {
     return '';
   }
 
-  let result = `<${listTag}>`;
+  let result = '<ul>';
   for (const h of headers) {
     result += `<li><a href="#${h.slug}">${h.text}</a></li>`;
   }
-  result += `</${listTag}>`;
+  result += '</ul>';
   return result;
 }
 
@@ -28,13 +23,7 @@ function renderHeaders(headers: ReadonlyArray<Heading>, listTag: string): string
  * [[toc]] directive — renders inline table of contents.
  * Ported from VitePress.
  */
-export function tocPlugin(md: MarkdownExit, options?: TocOptions): void {
-  const pattern = options?.pattern ?? /^\[\[toc\]\]$/i;
-  const containerTag = options?.containerTag ?? 'nav';
-  const containerClass = options?.containerClass ?? 'table-of-contents';
-  const listTag = options?.listTag ?? 'ul';
-  const level = options?.level ?? [2, 3];
-
+export function tocPlugin(md: MarkdownExit): void {
   md.block.ruler.before(
     'heading',
     'toc',
@@ -43,7 +32,7 @@ export function tocPlugin(md: MarkdownExit, options?: TocOptions): void {
       const max = state.eMarks[startLine];
       const content = state.src.slice(pos, max).trim();
 
-      if (!pattern.test(content)) {
+      if (!TOC_RE.test(content)) {
         return false;
       }
       if (silent) {
@@ -51,14 +40,14 @@ export function tocPlugin(md: MarkdownExit, options?: TocOptions): void {
       }
 
       state.line = startLine + 1;
-      const openToken = state.push('toc_open', containerTag, 1);
+      const openToken = state.push('toc_open', 'nav', 1);
       openToken.markup = content;
-      openToken.attrSet('class', containerClass);
+      openToken.attrSet('class', 'table-of-contents');
 
       const bodyToken = state.push('toc_body', '', 0);
       bodyToken.markup = content;
 
-      const closeToken = state.push('toc_close', containerTag, -1);
+      const closeToken = state.push('toc_close', 'nav', -1);
       closeToken.markup = content;
 
       return true;
@@ -67,7 +56,7 @@ export function tocPlugin(md: MarkdownExit, options?: TocOptions): void {
   );
 
   md.renderer.rules.toc_body = (tokens: Array<Token>) => {
-    const headers = extractHeadings(tokens).filter((heading) => level.includes(heading.depth));
-    return renderHeaders(headers, listTag);
+    const headers = extractHeadings(tokens).filter((heading) => TOC_LEVELS.includes(heading.depth));
+    return renderHeaders(headers);
   };
 }
diff --git a/packages/md/test/compile-result-fixture.ts b/packages/md/test/compile-result-fixture.ts
new file mode 100644
index 000000000..fbe827220
--- /dev/null
+++ b/packages/md/test/compile-result-fixture.ts
@@ -0,0 +1,11 @@
+import type { CompileResult } from '../src/compile.ts';
+
+export function makeResult(overrides?: Partial<CompileResult>): CompileResult {
+  return {
+    html: '<h1>Hello</h1>\n<p>World</p>\n',
+    frontmatter: { title: 'Test' },
+    headings: [{ depth: 1, slug: 'hello', text: 'Hello' }],
+    title: 'Test',
+    ...overrides,
+  };
+}
diff --git a/packages/md/test/integration/markdown-blog.test.ts b/packages/md/test/integration/markdown-blog.test.ts
index 11f3d91bd..dd37873ac 100644
--- a/packages/md/test/integration/markdown-blog.test.ts
+++ b/packages/md/test/integration/markdown-blog.test.ts
@@ -32,36 +32,13 @@ function defineMdClientEntryTests(getBase: () => string) {
     BASE = getBase();
   });
 
-  it('md page with client script has data-md-script attribute', async () => {
-    const res = await fetch(`${BASE}/posts/client-script-test`);
-    expect(res.status).toBe(200);
-    const html = await res.text();
-
-    // data-md-script should be present on the app container
-    expect(html).toMatch(/<div id="app" data-md-script="/);
-  });
-
   it('static md page without script has no data-md-script attribute', async () => {
     const res = await fetch(`${BASE}/posts/getting-started`);
     expect(res.status).toBe(200);
     const html = await res.text();
 
-    // No data-md-script on pages without client scripts
     expect(html).not.toContain('data-md-script');
   });
-
-  it('md page with client script includes script tags in body', async () => {
-    const res = await fetch(`${BASE}/posts/client-script-test`);
-    expect(res.status).toBe(200);
-    const html = await res.text();
-
-    const bodyMatch = html.match(/<body[^>]*>([\s\S]*)<\/body>/);
-    expect(bodyMatch).not.toBeNull();
-    const body = bodyMatch![1];
-
-    // Page with client scripts SHOULD have script tags
-    expect(body).toMatch(/<script\s+type="module"/);
-  });
 }
 
 function defineClientScriptTests(getBase: () => string) {
@@ -94,13 +71,11 @@ function defineClientScriptTests(getBase: () => string) {
     try {
       await page.goto(`${BASE}/posts/mixed-test`);
 
-      // Client script should execute
       await page.waitForFunction(
         () => document.getElementById('mixed-target')?.textContent?.startsWith('hydrated'),
         { timeout: 5000 },
       );
 
-      // Island component should be SSR'd (data-island marker present)
       const island = await page.$('[data-island]');
       expect(island).not.toBeNull();
 
@@ -163,7 +138,6 @@ function defineSidebarTests(getBase: () => string) {
       await page.goto(`${BASE}/posts/getting-started`);
       await page.waitForSelector('aside');
 
-      // Click the "Code Examples" link in the sidebar
       await page.click('aside a[href="/posts/code-examples"]');
       await page.waitForSelector('h1');
 
@@ -195,7 +169,6 @@ function defineSidebarTests(getBase: () => string) {
 describe('markdown-blog playground', () => {
   describe('dev', () => {
     let child: ReturnType<typeof spawn>;
-    let stderr = '';
 
     beforeAll(async () => {
       const server = await startServer((port) => {
@@ -221,10 +194,6 @@ describe('markdown-blog playground', () => {
             },
           },
         );
-        stderr = '';
-        child.stderr!.on('data', (chunk: Buffer) => {
-          stderr += String(chunk);
-        });
         return child;
       }, 20_000);
       DEV_BASE = server.base;
@@ -234,9 +203,6 @@ describe('markdown-blog playground', () => {
       if (child) {
         await killChild(child);
       }
-      if (stderr.includes('error when starting dev server')) {
-        throw new Error(stderr);
-      }
     });
 
     it('injects style for @void/md/theme.css in dev mode', async () => {
@@ -244,10 +210,8 @@ describe('markdown-blog playground', () => {
       expect(res.status).toBe(200);
       const html = await res.text();
 
-      // Dev mode includes Vite client
       expect(html).toContain('/@vite/client');
 
-      // Theme CSS is injected (either inline <style> or CSS link referencing md/theme)
       const hasThemeStyle =
         html.includes('void-md') || html.includes('md/theme') || html.includes('md/dist/theme');
       expect(hasThemeStyle).toBe(true);
@@ -258,38 +222,16 @@ describe('markdown-blog playground', () => {
       expect(res.status).toBe(200);
       const html = await res.text();
 
-      // titleTemplate from void.json + frontmatter title
       expect(html).toContain('<title>Getting Started | MD Blog</title>');
-      // frontmatter description → <meta name="description">
       expect(html).toContain('<meta name="description" content="Learn how to use Void">');
-      // htmlAttrs from void.json config
       expect(html).toContain('<html lang="en"');
-      // meta from void.json config
       expect(html).toContain('<meta charset="utf-8">');
 
-      // Different post has its own title
       const res2 = await fetch(`${DEV_BASE}/posts/code-examples`);
       const html2 = await res2.text();
       expect(html2).toContain('<title>Code Examples | MD Blog</title>');
     });
 
-    it('renders markdown content correctly', async () => {
-      const res = await fetch(`${DEV_BASE}/posts/getting-started`);
-      expect(res.status).toBe(200);
-      const html = await res.text();
-
-      // Rendered heading
-      expect(html).toContain('Getting Started');
-
-      // Container blocks (tip/warning custom blocks)
-      expect(html).toMatch(/custom-block|tip|warning/);
-
-      // Code blocks with Shiki highlighting
-      expect(html).toContain('<pre');
-      expect(html).toContain('<code');
-      expect(html).toContain('<span');
-    });
-
     defineSidebarTests(() => DEV_BASE);
     defineMdClientEntryTests(() => DEV_BASE);
     defineClientScriptTests(() => DEV_BASE);
@@ -297,7 +239,6 @@ describe('markdown-blog playground', () => {
 
   describe('production (build + preview)', () => {
     let child: ReturnType<typeof spawn>;
-    let stderr = '';
 
     beforeAll(async () => {
       execSync('vp run --filter ./playground/markdown-blog build', {
@@ -328,10 +269,6 @@ describe('markdown-blog playground', () => {
             },
           },
         );
-        stderr = '';
-        child.stderr!.on('data', (chunk: Buffer) => {
-          stderr += String(chunk);
-        });
         return child;
       }, 20_000);
       PREVIEW_BASE = server.base;
@@ -341,9 +278,6 @@ describe('markdown-blog playground', () => {
       if (child) {
         await killChild(child);
       }
-      if (stderr.includes('error when starting preview server')) {
-        throw new Error(stderr);
-      }
     });
 
     it('serves pre-rendered markdown pages', async () => {
@@ -351,11 +285,8 @@ describe('markdown-blog playground', () => {
       expect(res.status).toBe(200);
       const html = await res.text();
 
-      // Contains rendered markdown content
       expect(html).toContain('Getting Started');
       expect(html).toContain('<pre');
-
-      // No Vite client script in production
       expect(html).not.toContain('/@vite/client');
     });
 
@@ -377,7 +308,6 @@ describe('markdown-blog playground', () => {
       const res = await fetch(`${PREVIEW_BASE}/posts/getting-started`);
       const html = await res.text();
 
-      // Production should have theme CSS inlined or as a linked stylesheet
       const hasThemeCSS =
         html.includes('void-md') || html.includes('<link') || html.includes('<style');
       expect(hasThemeCSS).toBe(true);
@@ -388,12 +318,9 @@ describe('markdown-blog playground', () => {
       const html = await res.text();
       const body = html.match(/<body[^>]*>([\s\S]*)<\/body>/)![1];
       const tags = body.match(/<script\s+type="module"\s+src="[^"]+"><\/script>/g);
-
-      // Should have at least 2 script tags: islands-client + md-client
       expect(tags).not.toBeNull();
       expect(tags!.length).toBeGreaterThanOrEqual(2);
 
-      // One should be the islands client, another the md client (separate entries)
       const srcs = tags!.map((t) => t.match(/src="([^"]+)"/)?.[1] ?? '');
       const hasIslands = srcs.some((s) => s.includes('islands-client'));
       const hasMdClient = srcs.some((s) => s.includes('md-client'));
diff --git a/packages/md/test/unit/compile.test.ts b/packages/md/test/unit/compile.test.ts
index 4b87928f8..9292056a8 100644
--- a/packages/md/test/unit/compile.test.ts
+++ b/packages/md/test/unit/compile.test.ts
@@ -30,14 +30,6 @@ describe('compile', () => {
     expect(result.headings[3]).toMatchObject({ depth: 2, text: 'Section 2' });
   });
 
-  it('applies shiki highlighting to code blocks', async () => {
-    const result = await compile('```ts\nconst x = 1;\n```');
-    // Shiki produces <pre> with <code> containing <span> elements
-    expect(result.html).toContain('<pre');
-    expect(result.html).toContain('<code');
-    expect(result.html).toContain('<span');
-  });
-
   // The 0-based indices of code lines that carry the shiki `highlighted` class.
   // (Shiki emits one `<span class="line">` per line plus a trailing empty line,
   // so we compare highlighted positions rather than a fixed line count.)
@@ -92,17 +84,6 @@ describe('compile', () => {
     expect(result.html).toContain('The footnote body.');
   });
 
-  it('keeps heading extraction intact alongside footnotes', async () => {
-    const result = await compile('# Title\n\n## Section\n\nBody with a note.[^n]\n\n[^n]: note');
-    // Fresh-env fix must not regress TOC/heading ids.
-    expect(result.headings).toMatchObject([
-      { depth: 1, text: 'Title' },
-      { depth: 2, text: 'Section', slug: 'section' },
-    ]);
-    expect(result.html).toContain('id="section"');
-    expect(result.html.match(/class="footnotes"/g)).toHaveLength(1);
-  });
-
   it('handles empty source', async () => {
     const result = await compile('');
     expect(result.html).toBe('');
diff --git a/packages/md/test/unit/emit-react.test.ts b/packages/md/test/unit/emit-react.test.ts
index 642623a5d..49a40c400 100644
--- a/packages/md/test/unit/emit-react.test.ts
+++ b/packages/md/test/unit/emit-react.test.ts
@@ -1,39 +1,30 @@
 import { describe, expect, it } from 'vite-plus/test';
-import type { CompileResult } from '../../src/compile.ts';
-import { emitReactComponent, emitReactComponentWithIslands } from '../../src/emit-react.ts';
-
-function makeResult(overrides?: Partial<CompileResult>): CompileResult {
-  return {
-    html: '<h1>Hello</h1>\n<p>World</p>\n',
-    frontmatter: { title: 'Test' },
-    headings: [{ depth: 1, slug: 'hello', text: 'Hello' }],
-    title: 'Test',
-    ...overrides,
-  };
-}
+import { emitReactComponent } from '../../src/emit-react.ts';
+import { makeResult } from '../compile-result-fixture.ts';
 
 describe('emitReactComponent', () => {
   it('emits valid React component code', () => {
-    const code = emitReactComponent(makeResult());
+    const code = emitReactComponent(makeResult(), []);
     expect(code).toContain('import React from "react"');
     expect(code).toContain('FrontmatterContext');
     expect(code).toContain('dangerouslySetInnerHTML');
-  });
-
-  it('exports frontmatter and headings', () => {
-    const code = emitReactComponent(makeResult());
     expect(code).toContain('export const frontmatter = __frontmatter');
     expect(code).toContain('export const headings = __headings');
   });
 });
 
-describe('emitReactComponentWithIslands', () => {
+describe('emitReactComponent with islands', () => {
   it('emits island imports and wrappers', () => {
     const result = makeResult({
       html: '<h1>Hello</h1>\n<Counter />\n<p>More</p>\n',
     });
-    const code = emitReactComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.tsx', strategy: 'visible' },
+    const code = emitReactComponent(result, [
+      {
+        name: 'Counter',
+        specifier: './Counter.tsx',
+        strategy: 'visible',
+        islandId: 'pages/Counter',
+      },
     ]);
 
     expect(code).toContain('import _raw_island_0 from "./Counter.tsx"');
@@ -42,16 +33,4 @@ describe('emitReactComponentWithIslands', () => {
     expect(code).toContain('"visible"');
     expect(code).toContain('React.createElement(Counter');
   });
-
-  it('exports frontmatter and headings', () => {
-    const result = makeResult({
-      html: '<Counter />\n',
-    });
-    const code = emitReactComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.tsx', strategy: 'load' },
-    ]);
-
-    expect(code).toContain('export const frontmatter = __frontmatter');
-    expect(code).toContain('export const headings = __headings');
-  });
 });
diff --git a/packages/md/test/unit/emit-solid.test.ts b/packages/md/test/unit/emit-solid.test.ts
index e5968100e..c28ff1548 100644
--- a/packages/md/test/unit/emit-solid.test.ts
+++ b/packages/md/test/unit/emit-solid.test.ts
@@ -1,20 +1,10 @@
 import { describe, expect, it } from 'vite-plus/test';
-import type { CompileResult } from '../../src/compile.ts';
-import { emitSolidComponent, emitSolidComponentWithIslands } from '../../src/emit-solid.ts';
-
-function makeResult(overrides?: Partial<CompileResult>): CompileResult {
-  return {
-    html: '<h1>Hello</h1>\n<p>World</p>\n',
-    frontmatter: { title: 'Test' },
-    headings: [{ depth: 1, slug: 'hello', text: 'Hello' }],
-    title: 'Test',
-    ...overrides,
-  };
-}
+import { emitSolidComponent } from '../../src/emit-solid.ts';
+import { makeResult } from '../compile-result-fixture.ts';
 
 describe('emitSolidComponent', () => {
   it('emits valid Solid component code', () => {
-    const code = emitSolidComponent(makeResult());
+    const code = emitSolidComponent(makeResult(), []);
     expect(code).toContain('FrontmatterContext.Provider');
     expect(code).toContain('innerHTML');
     expect(code).toContain('export const frontmatter = __frontmatter');
@@ -22,30 +12,23 @@ describe('emitSolidComponent', () => {
   });
 });
 
-describe('emitSolidComponentWithIslands', () => {
+describe('emitSolidComponent with islands', () => {
   it('emits island imports and wrapper markup', () => {
     const result = makeResult({
       html: '<h1>Hello</h1>\n<Counter />\n<p>More</p>\n',
     });
-    const code = emitSolidComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.tsx', strategy: 'visible' },
+    const code = emitSolidComponent(result, [
+      {
+        name: 'Counter',
+        specifier: './Counter.tsx',
+        strategy: 'visible',
+        islandId: 'pages/Counter',
+      },
     ]);
 
     expect(code).toContain('import RawIsland0 from "./Counter.tsx"');
-    expect(code).toContain('data-island="./Counter"');
+    expect(code).toContain('data-island="pages/Counter"');
     expect(code).toContain('data-hydrate="visible"');
     expect(code).toContain('<RawIsland0');
   });
-
-  it('exports frontmatter and headings', () => {
-    const result = makeResult({
-      html: '<Counter />\n',
-    });
-    const code = emitSolidComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.tsx', strategy: 'load' },
-    ]);
-
-    expect(code).toContain('export const frontmatter = __frontmatter');
-    expect(code).toContain('export const headings = __headings');
-  });
 });
diff --git a/packages/md/test/unit/emit-svelte.test.ts b/packages/md/test/unit/emit-svelte.test.ts
index 64b96ab64..6db8b774f 100644
--- a/packages/md/test/unit/emit-svelte.test.ts
+++ b/packages/md/test/unit/emit-svelte.test.ts
@@ -1,53 +1,37 @@
 import { describe, expect, it } from 'vite-plus/test';
-import type { CompileResult } from '../../src/compile.ts';
-import { emitSvelteComponent, emitSvelteComponentWithIslands } from '../../src/emit-svelte.ts';
-
-function makeResult(overrides?: Partial<CompileResult>): CompileResult {
-  return {
-    html: '<h1>Hello</h1>\n<p>World</p>\n',
-    frontmatter: { title: 'Test' },
-    headings: [{ depth: 1, slug: 'hello', text: 'Hello' }],
-    title: 'Test',
-    ...overrides,
-  };
-}
+import { emitSvelteComponent } from '../../src/emit-svelte.ts';
+import { makeResult } from '../compile-result-fixture.ts';
 
 describe('emitSvelteComponent', () => {
   it('emits module exports and runtime frontmatter setup', () => {
-    const code = emitSvelteComponent(makeResult());
+    const code = emitSvelteComponent(makeResult(), []);
     expect(code).toContain('<script context="module">');
     expect(code).toContain('export const frontmatter');
+    expect(code).toContain('export const headings');
     expect(code).toContain('import { setFrontmatter } from "@void/md"');
     expect(code).toContain('setFrontmatter(__frontmatter)');
     expect(code).toContain('{@html');
   });
 });
 
-describe('emitSvelteComponentWithIslands', () => {
+describe('emitSvelteComponent with islands', () => {
   it('emits island imports and wrapper markup', () => {
     const result = makeResult({
       html: '<h1>Hello</h1>\n<Counter />\n<p>More</p>\n',
     });
-    const code = emitSvelteComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.svelte', strategy: 'idle' },
+    const code = emitSvelteComponent(result, [
+      {
+        name: 'Counter',
+        specifier: './Counter.svelte',
+        strategy: 'idle',
+        islandId: 'pages/Counter',
+      },
     ]);
 
     expect(code).toContain('import RawIsland0 from "./Counter.svelte"');
-    expect(code).toContain('data-island="./Counter"');
+    expect(code).toContain('data-island="pages/Counter"');
     expect(code).toContain('data-hydrate="idle"');
     expect(code).toContain('<RawIsland0');
     expect(code).toContain('{@html');
   });
-
-  it('exports frontmatter and headings', () => {
-    const result = makeResult({
-      html: '<Counter />\n',
-    });
-    const code = emitSvelteComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.svelte', strategy: 'load' },
-    ]);
-
-    expect(code).toContain('export const frontmatter');
-    expect(code).toContain('export const headings');
-  });
 });
diff --git a/packages/md/test/unit/emit-vue.test.ts b/packages/md/test/unit/emit-vue.test.ts
index 06f3b3494..74f7d44bb 100644
--- a/packages/md/test/unit/emit-vue.test.ts
+++ b/packages/md/test/unit/emit-vue.test.ts
@@ -1,51 +1,37 @@
 import { describe, expect, it } from 'vite-plus/test';
-import type { CompileResult } from '../../src/compile.ts';
-import { emitVueComponent, emitVueComponentWithIslands } from '../../src/emit-vue.ts';
-
-function makeResult(overrides?: Partial<CompileResult>): CompileResult {
-  return {
-    html: '<h1>Hello</h1>\n<p>World</p>\n',
-    frontmatter: { title: 'Test' },
-    headings: [{ depth: 1, slug: 'hello', text: 'Hello' }],
-    title: 'Test',
-    ...overrides,
-  };
-}
+import { emitVueComponent } from '../../src/emit-vue.ts';
+import { makeResult } from '../compile-result-fixture.ts';
 
 describe('emitVueComponent', () => {
   it('emits valid Vue component code', () => {
-    const code = emitVueComponent(makeResult());
+    const code = emitVueComponent(
+      makeResult({ html: '<h1>My Title</h1>', frontmatter: { title: 'Page', draft: true } }),
+      [],
+    );
     expect(code).toContain('defineComponent');
     expect(code).toContain('createStaticVNode');
     expect(code).toContain('provide');
     expect(code).toContain('__void_frontmatter');
-  });
-
-  it('exports frontmatter and headings', () => {
-    const code = emitVueComponent(makeResult());
-    expect(code).toContain('export const frontmatter = __frontmatter');
-    expect(code).toContain('export const headings = __headings');
-  });
-
-  it('includes HTML in static vnode', () => {
-    const code = emitVueComponent(makeResult({ html: '<h1>My Title</h1>' }));
     expect(code).toContain('My Title');
-  });
-
-  it('serializes frontmatter as JSON', () => {
-    const code = emitVueComponent(makeResult({ frontmatter: { title: 'Page', draft: true } }));
     expect(code).toContain('"title":"Page"');
     expect(code).toContain('"draft":true');
+    expect(code).toContain('export const frontmatter = __frontmatter');
+    expect(code).toContain('export const headings = __headings');
   });
 });
 
-describe('emitVueComponentWithIslands', () => {
+describe('emitVueComponent with islands', () => {
   it('emits island wrapper components', () => {
     const result = makeResult({
       html: '<h1>Hello</h1>\n<Counter />\n<p>More content</p>\n',
     });
-    const code = emitVueComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.vue', strategy: 'visible' },
+    const code = emitVueComponent(result, [
+      {
+        name: 'Counter',
+        specifier: './Counter.vue',
+        strategy: 'visible',
+        islandId: 'pages/Counter',
+      },
     ]);
     expect(code).toContain('import _raw_island_0 from "./Counter.vue"');
     expect(code).toContain('data-island');
@@ -58,9 +44,9 @@ describe('emitVueComponentWithIslands', () => {
     const result = makeResult({
       html: '<Counter />\n<Widget />\n',
     });
-    const code = emitVueComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.vue', strategy: 'load' },
-      { name: 'Widget', specifier: './Widget.vue', strategy: 'idle' },
+    const code = emitVueComponent(result, [
+      { name: 'Counter', specifier: './Counter.vue', strategy: 'load', islandId: 'pages/Counter' },
+      { name: 'Widget', specifier: './Widget.vue', strategy: 'idle', islandId: 'pages/Widget' },
     ]);
     expect(code).toContain('import _raw_island_0 from "./Counter.vue"');
     expect(code).toContain('import _raw_island_1 from "./Widget.vue"');
@@ -72,22 +58,11 @@ describe('emitVueComponentWithIslands', () => {
     const result = makeResult({
       html: '<h1>Title</h1>\n<Counter />\n<p>After</p>\n',
     });
-    const code = emitVueComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.vue', strategy: 'load' },
+    const code = emitVueComponent(result, [
+      { name: 'Counter', specifier: './Counter.vue', strategy: 'load', islandId: 'pages/Counter' },
     ]);
     // Should have createStaticVNode for content before and after the island
     const staticCount = (code.match(/createStaticVNode/g) || []).length;
     expect(staticCount).toBeGreaterThanOrEqual(2);
   });
-
-  it('exports frontmatter and headings', () => {
-    const result = makeResult({
-      html: '<Counter />\n',
-    });
-    const code = emitVueComponentWithIslands(result, [
-      { name: 'Counter', specifier: './Counter.vue', strategy: 'load' },
-    ]);
-    expect(code).toContain('export const frontmatter = __frontmatter');
-    expect(code).toContain('export const headings = __headings');
-  });
 });
diff --git a/packages/md/test/unit/extract-script.test.ts b/packages/md/test/unit/extract-script.test.ts
index 69acaed81..c6a11086f 100644
--- a/packages/md/test/unit/extract-script.test.ts
+++ b/packages/md/test/unit/extract-script.test.ts
@@ -42,21 +42,6 @@ import CodePlayground from "../components/CodePlayground.vue" with { island: "id
     });
   });
 
-  it('handles single-quoted imports', () => {
-    const source = `<script>
-import Widget from './Widget.vue' with { island: 'load' }
-</script>
-
-# Page`;
-    const result = extractScript(source);
-    expect(result.islandImports).toHaveLength(1);
-    expect(result.islandImports[0]).toEqual({
-      name: 'Widget',
-      specifier: './Widget.vue',
-      strategy: 'load',
-    });
-  });
-
   it('handles <script> before frontmatter', () => {
     const source = `<script>
 import A from "./A.vue" with { island: "load" }
@@ -73,16 +58,6 @@ title: Test
     expect(result.body).toContain('# Hello');
   });
 
-  it('handles media strategy', () => {
-    const source = `<script>
-import Sidebar from "./Sidebar.vue" with { island: "media:(min-width: 768px)" }
-</script>
-
-# Page`;
-    const result = extractScript(source);
-    expect(result.islandImports[0].strategy).toBe('media:(min-width: 768px)');
-  });
-
   it('returns clientCode as null when script has only island imports', () => {
     const source = `<script>
 import Counter from "./Counter.vue" with { island: "visible" }
@@ -130,35 +105,6 @@ const count = ref(0)
     expect(result.clientCode).toBe(`import { ref } from "vue"\n\nconst count = ref(0)`);
   });
 
-  it('extracts island imports with a trailing comma in the attributes', () => {
-    const source = `<script>
-import Counter from "./Counter.vue" with { island: "load", }
-</script>
-
-# Hello`;
-    const result = extractScript(source);
-    expect(result.islandImports).toHaveLength(1);
-    expect(result.islandImports[0]).toEqual({
-      name: 'Counter',
-      specifier: './Counter.vue',
-      strategy: 'load',
-    });
-    // the island import line is stripped from client code (not leaked as an orphan import)
-    expect(result.clientCode).toBeNull();
-  });
-
-  it('extracts island imports whose component name starts with $ or _', () => {
-    const source = `<script>
-import $Counter from "./Counter.vue" with { island: "load" }
-</script>
-
-# Hello`;
-    const result = extractScript(source);
-    expect(result.islandImports).toHaveLength(1);
-    expect(result.islandImports[0].name).toBe('$Counter');
-    expect(result.clientCode).toBeNull();
-  });
-
   it('keeps commented island imports in client code', () => {
     const result = extractScript(`<script>
 // import Fake from "./Fake.vue" with { island: "load" };
@@ -168,7 +114,8 @@ const ready = true;
     expect(result.islandImports).toEqual([
       { name: 'Counter', specifier: './Counter.vue', strategy: 'load' },
     ]);
-    expect(result.clientCode).toContain('// import Fake');
-    expect(result.clientCode).toContain('const ready = true;');
+    expect(result.clientCode).toBe(
+      `// import Fake from "./Fake.vue" with { island: "load" };\n\nconst ready = true;`,
+    );
   });
 });
diff --git a/packages/md/test/unit/md-types.test.ts b/packages/md/test/unit/md-types.test.ts
deleted file mode 100644
index b8695fba0..000000000
--- a/packages/md/test/unit/md-types.test.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vite-plus/test';
-import { generateMdTypes } from '../../src/codegen/md-types.ts';
-
-/**
- * Tests for the md type declaration generation.
- *
- * The md plugin generates .void/md.d.ts during buildStart, providing
- * TypeScript type information for the @void/md/pages virtual module.
- * ensureProjectTsconfig then auto-detects this file and adds a paths
- * override so TypeScript resolves the generated types instead of the package stub.
- */
-
-describe('md type declarations', () => {
-  let root: string;
-
-  beforeEach(() => {
-    root = join(
-      tmpdir(),
-      `void-md-types-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-    );
-    mkdirSync(join(root, '.void'), { recursive: true });
-  });
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-  });
-
-  it('generates a valid TypeScript declaration', () => {
-    const dts = generateMdTypes();
-    expect(dts).toContain('type VoidMdPage');
-    expect(dts).toContain('path: string');
-    expect(dts).toContain('title: string');
-    expect(dts).toContain('frontmatter: Record<string, unknown>');
-    expect(dts).toContain('headings: ReadonlyArray<{ depth: number; slug: string; text: string }>');
-    expect(dts).toContain('declare const pages: ReadonlyArray<VoidMdPage>');
-    expect(dts).toContain('export default pages');
-  });
-
-  it('can be written to .void/md.d.ts', () => {
-    const dtsPath = join(root, '.void', 'md.d.ts');
-    writeFileSync(dtsPath, generateMdTypes());
-    expect(existsSync(dtsPath)).toBe(true);
-    const content = readFileSync(dtsPath, 'utf-8');
-    expect(content).toContain('VoidMdPage');
-  });
-
-  it('pages.d.ts package stub matches the generated declaration shape', () => {
-    // The package export stub (pages.d.ts) and the generated .void/md.d.ts
-    // must declare the same type shape so the paths override is compatible.
-    const stubPath = join(__dirname, '../../pages.d.ts');
-    const stub = readFileSync(stubPath, 'utf-8');
-    const generated = generateMdTypes();
-
-    // Both should declare VoidMdPage with the same fields
-    expect(stub).toContain('path: string');
-    expect(stub).toContain('title: string');
-    expect(stub).toContain('frontmatter: Record<string, unknown>');
-    expect(stub).toContain(
-      'headings: ReadonlyArray<{ depth: number; slug: string; text: string }>',
-    );
-    expect(generated).toContain('path: string');
-    expect(generated).toContain('title: string');
-    expect(generated).toContain('frontmatter: Record<string, unknown>');
-    expect(generated).toContain(
-      'headings: ReadonlyArray<{ depth: number; slug: string; text: string }>',
-    );
-
-    // Both should export pages as default
-    expect(stub).toContain('export default pages');
-    expect(generated).toContain('export default pages');
-  });
-});
diff --git a/packages/md/vite.config.ts b/packages/md/vite.config.ts
index 9daf31c6b..79ca21a0e 100644
--- a/packages/md/vite.config.ts
+++ b/packages/md/vite.config.ts
@@ -7,7 +7,7 @@ export default defineConfig({
     format: 'esm',
     dts: true,
     clean: true,
-    deps: { resolveDepSubpath: true, neverBundle: ['vite', 'void', 'vue'] },
+    deps: { resolveDepSubpath: true, neverBundle: ['vite', 'void'] },
     onSuccess() {
       cpSync('src/theme', 'dist/theme', { recursive: true });
     },
diff --git a/packages/platform/scripts/build-runtime.mjs b/packages/platform/scripts/build-runtime.mjs
index 45bb19987..39804b3ac 100644
--- a/packages/platform/scripts/build-runtime.mjs
+++ b/packages/platform/scripts/build-runtime.mjs
@@ -186,28 +186,15 @@ function buildDatabaseManifest() {
   if (compatibility.schemaVersion !== 1) {
     throw new Error('Void Platform database compatibility schemaVersion must be 1.');
   }
-  if (typeof compatibility.lineage !== 'string' || compatibility.lineage.trim() === '') {
-    throw new Error('Void Platform database compatibility lineage must be a non-empty string.');
-  }
   if (!Array.isArray(compatibility.rollbackSafeFrom)) {
     throw new Error('Void Platform rollbackSafeFrom must be an array.');
   }
-  const migrations = journal.entries.map((value, position) => {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-      throw new Error(`Void Platform migration journal entry ${position} must be an object.`);
-    }
-    const { idx, tag, when } = value;
-    if (!Number.isSafeInteger(idx) || idx < 0) {
-      throw new Error(`Void Platform migration journal entry ${position} has an invalid index.`);
-    }
-    if (typeof tag !== 'string' || !/^[0-9]{4}_[a-z0-9_]+$/.test(tag)) {
+  // parsePlatformRuntimeManifest validates these values, their order, and the rollback lineage.
+  const migrations = journal.entries.map((entry, position) => {
+    const tag = entry?.tag;
+    if (typeof tag !== 'string') {
       throw new Error(`Void Platform migration journal entry ${position} has an invalid tag.`);
     }
-    if (!Number.isSafeInteger(when) || when < 0) {
-      throw new Error(
-        `Void Platform migration journal entry ${position} has an invalid timestamp.`,
-      );
-    }
     const sqlPath = join(drizzleRoot, `${tag}.sql`);
     let sql;
     try {
@@ -218,32 +205,18 @@ function buildDatabaseManifest() {
       );
     }
     return {
-      index: idx,
+      index: entry.idx,
       sha256: sha256(sql),
       tag,
-      timestampMillis: when,
+      timestampMillis: entry.when,
     };
   });
-  // parsePlatformRuntimeManifest enforces migration order, uniqueness, and rollback lineage.
-  const rollbackSafeFrom = compatibility.rollbackSafeFrom.map((value, position) => {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-      throw new Error(`Void Platform compatibility entry ${position} must be an object.`);
-    }
-    const { platformVersion, schemaDigest } = value;
-    if (typeof platformVersion !== 'string' || platformVersion.trim() === '') {
-      throw new Error(`Void Platform compatibility entry ${position} has an invalid version.`);
-    }
-    if (typeof schemaDigest !== 'string' || !/^[0-9a-f]{64}$/.test(schemaDigest)) {
-      throw new Error(`Void Platform compatibility entry ${position} has an invalid digest.`);
-    }
-    return { platformVersion, schemaDigest };
-  });
   return {
     journalSha256: sha256(journalContents),
     lineage: compatibility.lineage,
     migrations,
     protocolVersion: 1,
-    rollbackSafeFrom,
+    rollbackSafeFrom: compatibility.rollbackSafeFrom,
     schemaDigest: platformDatabaseSchemaDigest(compatibility.lineage, migrations),
   };
 }
diff --git a/packages/platform/scripts/source-revision.mjs b/packages/platform/scripts/source-revision.mjs
index b4715b836..969f1daa4 100644
--- a/packages/platform/scripts/source-revision.mjs
+++ b/packages/platform/scripts/source-revision.mjs
@@ -1,11 +1,7 @@
 import { spawnSync } from 'node:child_process';
 
-export function resolvePlatformSourceRevision({
-  environment = process.env,
-  repositoryRoot,
-  runGit = defaultRunGit,
-}) {
-  const explicit = environment.VOID_PLATFORM_SOURCE_REVISION;
+export function resolvePlatformSourceRevision({ repositoryRoot }) {
+  const explicit = process.env.VOID_PLATFORM_SOURCE_REVISION;
   if (explicit) {
     return explicit;
   }
@@ -28,7 +24,7 @@ export function resolvePlatformSourceRevision({
   return status.stdout.trim() ? `${sourceRevision}-dirty` : sourceRevision;
 }
 
-function defaultRunGit(args, cwd) {
+function runGit(args, cwd) {
   const result = spawnSync('git', args, {
     cwd,
     encoding: 'utf8',
diff --git a/packages/platform/src/application.ts b/packages/platform/src/application.ts
index c519a25b7..bbde205a0 100644
--- a/packages/platform/src/application.ts
+++ b/packages/platform/src/application.ts
@@ -1,3 +1,5 @@
+import { createPlatformDeploymentManifest } from './manifest.ts';
+
 /** Public application addressing, independent of the platform API's origin. */
 export type PlatformApplication = Readonly<{
   baseDomain: string;
@@ -28,10 +30,15 @@ export function readPlatformApplication(
   if (!env.PLATFORM_APPLICATION) {
     return { baseDomain, zoneName: baseDomain, dedicatedZone: false };
   }
+  return parsePlatformApplication(JSON.parse(env.PLATFORM_APPLICATION));
+}
+
+/** Applies the deployment manifest's application rules to a parsed value. */
+export function parsePlatformApplication(value: unknown): PlatformApplication {
   return createPlatformDeploymentManifest({
     installationSlug: 'runtime',
     displayName: 'Runtime',
-    application: JSON.parse(env.PLATFORM_APPLICATION) as PlatformApplication,
+    application: value as PlatformApplication,
   }).application;
 }
 
@@ -138,4 +145,3 @@ export function platformProjectHostnames(
     ]),
   ];
 }
-import { createPlatformDeploymentManifest } from './manifest.ts';
diff --git a/packages/platform/src/authentication.ts b/packages/platform/src/authentication.ts
index e5114ee2a..f1981580c 100644
--- a/packages/platform/src/authentication.ts
+++ b/packages/platform/src/authentication.ts
@@ -1,3 +1,5 @@
+import { isPrintableText, record } from './validate.ts';
+
 /** Platform login and perimeter configuration are independent of app authentication. */
 export const PLATFORM_LOGIN_KINDS = ['github', 'google', 'oidc', 'cloudflare-access'] as const;
 export type PlatformLoginKind = (typeof PLATFORM_LOGIN_KINDS)[number];
@@ -209,22 +211,8 @@ export const DEFAULT_PLATFORM_SESSION_SECONDS: number = 30 * 24 * 60 * 60;
 export const GOOGLE_OIDC_ISSUER = 'https://accounts.google.com';
 export const PLATFORM_AUTH_SETUP_PROOF_PREFIX = 'void.platform.auth.setup.v1';
 
-function record(value: unknown, name: string): Record<string, unknown> {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(`${name} must be an object.`);
-  }
-  return value as Record<string, unknown>;
-}
-
 function string(value: unknown, name: string, maximum = 512): string {
-  if (
-    typeof value !== 'string' ||
-    !value.trim() ||
-    value.length > maximum ||
-    Array.from(value).some(
-      (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127,
-    )
-  ) {
+  if (!isPrintableText(value, maximum)) {
     throw new Error(`${name} must be a nonempty string of at most ${maximum} characters.`);
   }
   return value.trim();
diff --git a/packages/platform/src/discovery.ts b/packages/platform/src/discovery.ts
index e3cdbc631..2b9219b7e 100644
--- a/packages/platform/src/discovery.ts
+++ b/packages/platform/src/discovery.ts
@@ -1,4 +1,4 @@
-import { readPlatformApplication, type PlatformApplication } from './application.ts';
+import { parsePlatformApplication, type PlatformApplication } from './application.ts';
 import {
   parsePlatformLoginDescriptor,
   parsePlatformLoginId,
@@ -10,6 +10,7 @@ import {
   normalizePlatformDashboardUrl,
   type PlatformCapabilities,
 } from './manifest.ts';
+import { assertRecord, record } from './validate.ts';
 
 export const PLATFORM_DISCOVERY_SCHEMA_VERSION = 1 as const;
 
@@ -65,9 +66,7 @@ export function createPlatformDiscoveryDocument(
     throw new Error('platformVersion must not be empty.');
   }
   if (input.applicationRouting) {
-    const application = readPlatformApplication({
-      PLATFORM_APPLICATION: JSON.stringify(input.applicationRouting),
-    });
+    const application = parsePlatformApplication(input.applicationRouting);
     if (
       !application.workersDev ||
       application.baseDomain !== input.applicationDomain ||
@@ -132,10 +131,7 @@ export function createPlatformDiscoveryDocument(
 }
 
 export function parsePlatformDiscoveryDocument(value: unknown): PlatformDiscoveryDocument {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error('Platform discovery document must be an object.');
-  }
-  const document = value as Record<string, unknown>;
+  const document = record(value, 'Platform discovery document');
   if (
     document.schemaVersion !== PLATFORM_DISCOVERY_SCHEMA_VERSION &&
     document.schemaVersion !== 2 &&
@@ -152,9 +148,7 @@ export function parsePlatformDiscoveryDocument(value: unknown): PlatformDiscover
   if (document.schemaVersion === 2 && document.applicationRouting === undefined) {
     throw new Error('Discovery schema version 2 requires application routing.');
   }
-  if (!capabilities || typeof capabilities !== 'object' || Array.isArray(capabilities)) {
-    throw new Error('capabilities must be an object.');
-  }
+  assertRecord(capabilities, 'capabilities');
   const capabilityNames: Array<keyof PlatformCapabilities> = [
     'ai',
     'customDomains',
@@ -167,7 +161,7 @@ export function parsePlatformDiscoveryDocument(value: unknown): PlatformDiscover
   ];
   const parsedCapabilities = {} as Record<keyof PlatformCapabilities, boolean>;
   for (const name of capabilityNames) {
-    const enabled = (capabilities as Record<string, unknown>)[name];
+    const enabled = capabilities[name];
     if (typeof enabled !== 'boolean') {
       throw new Error(`capabilities.${name} must be a boolean.`);
     }
@@ -206,9 +200,7 @@ export function parsePlatformDiscoveryDocument(value: unknown): PlatformDiscover
     applicationDomain: string('applicationDomain'),
     ...(document.applicationRouting !== undefined
       ? {
-          applicationRouting: readPlatformApplication({
-            PLATFORM_APPLICATION: JSON.stringify(document.applicationRouting),
-          }),
+          applicationRouting: parsePlatformApplication(document.applicationRouting),
         }
       : {}),
     authenticationProviders: providers as Array<string>,
@@ -224,10 +216,7 @@ export function parsePlatformDiscoveryDocument(value: unknown): PlatformDiscover
 }
 
 function parseAuthentication(value: unknown): PlatformAuthenticationDiscovery {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error('Authentication discovery must be an object.');
-  }
-  const authentication = value as Record<string, unknown>;
+  const authentication = record(value, 'Authentication discovery');
   if (
     !Array.isArray(authentication.methods) ||
     authentication.methods.length > 32 ||
diff --git a/packages/platform/src/installation.ts b/packages/platform/src/installation.ts
index ba1e4685a..40093eeb5 100644
--- a/packages/platform/src/installation.ts
+++ b/packages/platform/src/installation.ts
@@ -3,6 +3,13 @@ import {
   parsePlatformDeploymentManifest,
   type PlatformDeploymentManifest,
 } from './manifest.ts';
+import {
+  assertRecord,
+  isSandboxDrainProtocol,
+  isSourceRevision,
+  isUsageProtocolVersion,
+  requiredString,
+} from './validate.ts';
 
 export const PLATFORM_INSTALLATION_SCHEMA_VERSION = 1 as const;
 export const PLATFORM_DISABLED_KEY = '__void/platform/disabled/v1';
@@ -218,19 +225,6 @@ const STATUS_TRANSITIONS: Readonly<Record<InstallationStatus, ReadonlyArray<Inst
     failed: ['planned', 'provisioning', 'deploying', 'verifying', 'disabling', 'uninstalling'],
   };
 
-function assertRecord(value: unknown, label: string): asserts value is Record<string, unknown> {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(`${label} must be an object.`);
-  }
-}
-
-function requiredString(value: unknown, label: string): string {
-  if (typeof value !== 'string' || value.trim() === '') {
-    throw new Error(`${label} must be a non-empty string.`);
-  }
-  return value;
-}
-
 function isInstallationStatus(value: unknown): value is InstallationStatus {
   return typeof value === 'string' && Object.hasOwn(STATUS_TRANSITIONS, value);
 }
@@ -610,16 +604,13 @@ function parseAuthenticationResources(
 }
 
 export function parseUsageProtocolVersion(value: unknown): 0 | 1 | 2 {
-  if (value === undefined || value === 0) {
+  if (value === undefined) {
     return 0;
   }
-  if (value === 1) {
-    return 1;
-  }
-  if (value === 2) {
-    return 2;
+  if (!isUsageProtocolVersion(value)) {
+    throw new Error('usageProtocolVersion must be 0, 1, or 2.');
   }
-  throw new Error('usageProtocolVersion must be 0, 1, or 2.');
+  return value;
 }
 
 function parseSafetyProtocols(value: unknown): PlatformInstallationManifest['safetyProtocols'] {
@@ -627,12 +618,7 @@ function parseSafetyProtocols(value: unknown): PlatformInstallationManifest['saf
     return { sandboxDrain: 0 };
   }
   assertRecord(value, 'safetyProtocols');
-  if (
-    value.sandboxDrain !== 0 &&
-    value.sandboxDrain !== 1 &&
-    value.sandboxDrain !== 2 &&
-    value.sandboxDrain !== 3
-  ) {
+  if (!isSandboxDrainProtocol(value.sandboxDrain)) {
     throw new Error('safetyProtocols.sandboxDrain must be 0, 1, 2, or 3.');
   }
   return { sandboxDrain: value.sandboxDrain };
@@ -654,10 +640,7 @@ function parsePlatformRuntimeProvenance(value: unknown): PlatformRuntimeProvenan
     value.sourceRevision === null || value.sourceRevision === undefined
       ? null
       : requiredString(value.sourceRevision, 'runtime.sourceRevision');
-  if (
-    sourceRevision !== null &&
-    (sourceRevision.length > 200 || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(sourceRevision))
-  ) {
+  if (sourceRevision !== null && !isSourceRevision(sourceRevision)) {
     throw new Error('runtime.sourceRevision is invalid.');
   }
   return { manifestSha256, source: value.source, sourceRevision };
diff --git a/packages/platform/src/installer.ts b/packages/platform/src/installer.ts
index 65302f986..5b756fa16 100644
--- a/packages/platform/src/installer.ts
+++ b/packages/platform/src/installer.ts
@@ -2,6 +2,12 @@ import { createHash } from 'node:crypto';
 import { readFileSync, realpathSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, isAbsolute, join, resolve } from 'pathslash';
+import {
+  isRecord,
+  isSandboxDrainProtocol,
+  isSourceRevision,
+  isUsageProtocolVersion,
+} from './validate.ts';
 
 export type PlatformRuntimeArtifact = Readonly<{
   path: string;
@@ -248,29 +254,21 @@ function parseSafetyProtocols(value: unknown): PlatformRuntimeManifest['safetyPr
   if (value === undefined) {
     return { sandboxDrain: 0 };
   }
-  const protocols = record(value, 'runtime manifest safetyProtocols');
-  if (
-    protocols.sandboxDrain !== 0 &&
-    protocols.sandboxDrain !== 1 &&
-    protocols.sandboxDrain !== 2 &&
-    protocols.sandboxDrain !== 3
-  ) {
+  const { sandboxDrain } = record(value, 'runtime manifest safetyProtocols');
+  if (!isSandboxDrainProtocol(sandboxDrain)) {
     throw new Error('runtime manifest safetyProtocols.sandboxDrain must be 0, 1, 2, or 3');
   }
-  return { sandboxDrain: protocols.sandboxDrain };
+  return { sandboxDrain };
 }
 
 function usageProtocolVersion(value: unknown): 0 | 1 | 2 {
-  if (value === undefined || value === 0) {
+  if (value === undefined) {
     return 0;
   }
-  if (value === 1) {
-    return 1;
-  }
-  if (value === 2) {
-    return 2;
+  if (!isUsageProtocolVersion(value)) {
+    throw new Error('runtime manifest usageProtocolVersion must be 0, 1, or 2');
   }
-  throw new Error('runtime manifest usageProtocolVersion must be 0, 1, or 2');
+  return value;
 }
 
 export function getPlatformRuntimeDirectory(): string {
@@ -280,14 +278,7 @@ export function getPlatformRuntimeDirectory(): string {
 export function readPlatformRuntimeManifest(
   runtimeDirectory: string = getPlatformRuntimeDirectory(),
 ): PlatformRuntimeManifest {
-  const path = join(runtimeDirectory, 'manifest.json');
-  try {
-    return parsePlatformRuntimeManifest(JSON.parse(readFileSync(path, 'utf8')));
-  } catch (error) {
-    throw new Error(
-      `Void Platform deployment artifacts are missing or invalid at ${path}: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  }
+  return readRuntimeManifestFile(join(runtimeDirectory, 'manifest.json')).manifest;
 }
 
 export function resolvePlatformRuntime(
@@ -311,25 +302,32 @@ export function resolvePlatformRuntime(
       `Void Platform runtime directory is unavailable at ${requestedDirectory}: ${error instanceof Error ? error.message : String(error)}`,
     );
   }
-  const manifestPath = join(directory, 'manifest.json');
-  let manifestContents: Buffer;
-  let manifest: PlatformRuntimeManifest;
-  try {
-    manifestContents = readFileSync(manifestPath);
-    manifest = parsePlatformRuntimeManifest(JSON.parse(manifestContents.toString('utf8')));
-  } catch (error) {
-    throw new Error(
-      `Void Platform deployment artifacts are missing or invalid at ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  }
+  const { contents, manifest } = readRuntimeManifestFile(join(directory, 'manifest.json'));
   return {
     directory,
     manifest,
-    manifestSha256: createHash('sha256').update(manifestContents).digest('hex'),
+    manifestSha256: createHash('sha256').update(contents).digest('hex'),
     source,
   };
 }
 
+function readRuntimeManifestFile(path: string): {
+  contents: Buffer;
+  manifest: PlatformRuntimeManifest;
+} {
+  try {
+    const contents = readFileSync(path);
+    return {
+      contents,
+      manifest: parsePlatformRuntimeManifest(JSON.parse(contents.toString('utf8'))),
+    };
+  } catch (error) {
+    throw new Error(
+      `Void Platform deployment artifacts are missing or invalid at ${path}: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}
+
 function parseArtifact(value: unknown, name: string): PlatformRuntimeArtifact {
   const artifact = record(value, `runtime manifest artifact ${name}`);
   const path = nonemptyString(artifact.path, `runtime manifest artifact ${name} path`);
@@ -370,10 +368,10 @@ function parseMigration(value: unknown, position: number): PlatformRuntimeMigrat
 }
 
 function record(value: unknown, name: string): Record<string, unknown> {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+  if (!isRecord(value)) {
     throw new Error(`${name} must be an object`);
   }
-  return value as Record<string, unknown>;
+  return value;
 }
 
 function array(value: unknown, name: string): ReadonlyArray<unknown> {
@@ -392,7 +390,7 @@ function nonemptyString(value: unknown, name: string): string {
 
 function sourceRevision(value: unknown): string {
   const revision = nonemptyString(value, 'runtime manifest sourceRevision');
-  if (revision.length > 200 || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(revision)) {
+  if (!isSourceRevision(revision)) {
     throw new Error('runtime manifest sourceRevision is invalid');
   }
   return revision;
diff --git a/packages/platform/src/manifest.ts b/packages/platform/src/manifest.ts
index f1bd1772c..5fd8814ee 100644
--- a/packages/platform/src/manifest.ts
+++ b/packages/platform/src/manifest.ts
@@ -1,5 +1,6 @@
 import type { PlatformApplication } from './application.ts';
 import { PLATFORM_LOGIN_KINDS, type PlatformLoginKind } from './authentication.ts';
+import { assertRecord, requiredString } from './validate.ts';
 
 export const PLATFORM_DEPLOYMENT_SCHEMA_VERSION = 1 as const;
 
@@ -111,19 +112,6 @@ const CONTROL_PLANE_DEFAULTS: PlatformControlPlane = {
   proxyHostname: null,
 };
 
-function assertRecord(value: unknown, label: string): asserts value is Record<string, unknown> {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(`${label} must be an object.`);
-  }
-}
-
-function requiredString(value: unknown, label: string): string {
-  if (typeof value !== 'string' || value.trim() === '') {
-    throw new Error(`${label} must be a non-empty string.`);
-  }
-  return value;
-}
-
 export function normalizeInstallationSlug(value: string): string {
   const slug = value
     .trim()
diff --git a/packages/platform/src/plans.ts b/packages/platform/src/plans.ts
index 39fe37f47..cb15d3881 100644
--- a/packages/platform/src/plans.ts
+++ b/packages/platform/src/plans.ts
@@ -1,3 +1,5 @@
+import { isPrintableText, record } from './validate.ts';
+
 /** Installation-defined plan IDs are stable even when a display name changes. */
 export type PlanId = string;
 export type BuiltinPlanId = 'free' | 'solo' | 'pro' | 'sponsored' | 'custom';
@@ -193,28 +195,14 @@ export function parsePlatformPlanId(value: unknown): PlanId {
 }
 
 export function parsePlanName(value: unknown): string {
-  if (
-    typeof value !== 'string' ||
-    !value.trim() ||
-    value.length > 80 ||
-    Array.from(value).some(
-      (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127,
-    )
-  ) {
+  if (!isPrintableText(value, 80)) {
     throw new Error('Plan names must contain 1 to 80 printable characters.');
   }
   return value.trim();
 }
 
-function object(value: unknown, label: string): Record<string, unknown> {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(label + ' must be an object.');
-  }
-  return value as Record<string, unknown>;
-}
-
 export function parsePlanLimitsPatch(value: unknown): PlanLimitsPatch {
-  const input = object(value, 'Plan limits');
+  const input = record(value, 'Plan limits');
   for (const [key, limit] of Object.entries(input)) {
     if (!(PLAN_EDITABLE_LIMIT_KEYS as ReadonlyArray<string>).includes(key)) {
       throw new Error('Unknown or unenforced plan limit: ' + key + '.');
@@ -261,7 +249,7 @@ export function parseBuildInstanceType(value: unknown): BuildInstanceType {
 
 /** Strict saved-state validation: invalid configuration must not silently lift quotas. */
 export function parsePlatformPlanCatalog(value: unknown): PlatformPlanCatalog {
-  const input = object(value, 'Plan catalog');
+  const input = record(value, 'Plan catalog');
   if (!Number.isSafeInteger(input.revision) || (input.revision as number) < 0) {
     throw new Error('Invalid plan catalog revision.');
   }
@@ -270,7 +258,7 @@ export function parsePlatformPlanCatalog(value: unknown): PlatformPlanCatalog {
   }
   const ids = new Set<string>();
   const plans = input.plans.map((value) => {
-    const plan = object(value, 'Plan');
+    const plan = record(value, 'Plan');
     const id = parsePlatformPlanId(plan.id);
     if (ids.has(id)) {
       throw new Error('Duplicate plan ID: ' + id + '.');
@@ -282,7 +270,7 @@ export function parsePlatformPlanCatalog(value: unknown): PlatformPlanCatalog {
     if (typeof plan.allowShortSlugs !== 'boolean') {
       throw new Error('allowShortSlugs must be a boolean.');
     }
-    const limits = object(plan.limits, 'Plan limits');
+    const limits = record(plan.limits, 'Plan limits');
     const keys = Object.keys(PLAN_LIMITS.free);
     if (
       Object.keys(limits).length !== keys.length ||
@@ -306,7 +294,7 @@ export function parsePlatformPlanCatalog(value: unknown): PlatformPlanCatalog {
   }
   let reconciliation: PlatformPlanReconciliation | null = null;
   if (input.reconciliation !== null) {
-    const operation = object(input.reconciliation, 'Plan reconciliation');
+    const operation = record(input.reconciliation, 'Plan reconciliation');
     if (
       operation.revision !== input.revision ||
       typeof operation.complete !== 'boolean' ||
@@ -322,7 +310,7 @@ export function parsePlatformPlanCatalog(value: unknown): PlatformPlanCatalog {
     }
     let error: PlatformPlanReconciliation['error'];
     if (operation.error !== undefined) {
-      const failure = object(operation.error, 'Plan reconciliation failure');
+      const failure = record(operation.error, 'Plan reconciliation failure');
       if (
         typeof failure.accountId !== 'string' ||
         typeof failure.message !== 'string' ||
diff --git a/packages/platform/src/validate.ts b/packages/platform/src/validate.ts
new file mode 100644
index 000000000..4cd88adea
--- /dev/null
+++ b/packages/platform/src/validate.ts
@@ -0,0 +1,48 @@
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+export function record(value: unknown, label: string): Record<string, unknown> {
+  if (!isRecord(value)) {
+    throw new Error(`${label} must be an object.`);
+  }
+  return value;
+}
+
+export function assertRecord(
+  value: unknown,
+  label: string,
+): asserts value is Record<string, unknown> {
+  record(value, label);
+}
+
+export function requiredString(value: unknown, label: string): string {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  return value;
+}
+
+/** Nonblank text of at most `maximum` characters, without control characters. */
+export function isPrintableText(value: unknown, maximum: number): value is string {
+  return (
+    typeof value === 'string' &&
+    value.trim() !== '' &&
+    value.length <= maximum &&
+    !Array.from(value).some(
+      (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127,
+    )
+  );
+}
+
+export function isSandboxDrainProtocol(value: unknown): value is 0 | 1 | 2 | 3 {
+  return value === 0 || value === 1 || value === 2 || value === 3;
+}
+
+export function isUsageProtocolVersion(value: unknown): value is 0 | 1 | 2 {
+  return value === 0 || value === 1 || value === 2;
+}
+
+export function isSourceRevision(value: string): boolean {
+  return value.length <= 200 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value);
+}
diff --git a/packages/platform/src/worker-config.ts b/packages/platform/src/worker-config.ts
index a4ecc27ad..8ad47ac4c 100644
--- a/packages/platform/src/worker-config.ts
+++ b/packages/platform/src/worker-config.ts
@@ -239,7 +239,6 @@ export function createPlatformWorkerConfigs(input: {
     proxy,
     emailGateway: {
       ...common,
-      workers_dev: publicEndpoints,
       preview_urls: false,
       name: names.emailGatewayWorker,
       main: runtimeEntrypoints.emailGateway,
diff --git a/packages/platform/test/unit/dashboard.test.ts b/packages/platform/test/unit/dashboard.test.ts
index 5b657827c..69eee5e4d 100644
--- a/packages/platform/test/unit/dashboard.test.ts
+++ b/packages/platform/test/unit/dashboard.test.ts
@@ -14,43 +14,14 @@ import {
   parsePlatformDeploymentManifest,
   platformDashboardUrl,
 } from '../../src/manifest.ts';
-import { createPlatformWorkerConfigs } from '../../src/worker-config.ts';
-
-const deploymentInput = {
-  application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-  displayName: 'Example',
-  installationSlug: 'example',
-};
+import { deploymentInput, workerConfigs } from '../worker-config-fixture.ts';
 
 function configs(dashboardUrl?: string) {
-  const deployment = createPlatformDeploymentManifest({
-    ...deploymentInput,
-    ...(dashboardUrl ? { controlPlane: { dashboardUrl } } : {}),
-  });
-  return createPlatformWorkerConfigs({
-    accountId: 'account',
-    apiUrl: 'https://api.example.com',
-    proxyUrl: 'https://proxy.example.com',
-    emailGatewayUrl: 'https://email.account.workers.dev',
-    deployment,
-    healthProbeToken: 'probe',
-    installationId: 'example-installation',
-    ownershipNonce: 'ownership',
-    platformVersion: '1.0.0',
-    resources: {
-      hyperdrive: 'db',
-      isrCacheKv: 'isr',
-      legacyAssetsKv: 'assets',
-      routingKv: 'routing',
-      zone: 'zone',
-    },
-    runtimeEntrypoints: {
-      api: 'api.mjs',
-      proxy: 'proxy.mjs',
-      emailGateway: 'email.mjs',
-      tail: 'tail.mjs',
-      dispatch: 'dispatch.mjs',
-    },
+  return workerConfigs({
+    deployment: createPlatformDeploymentManifest({
+      ...deploymentInput,
+      ...(dashboardUrl ? { controlPlane: { dashboardUrl } } : {}),
+    }),
   });
 }
 
diff --git a/packages/platform/test/unit/deployment-execution.test.ts b/packages/platform/test/unit/deployment-execution.test.ts
index 57d9b9255..ac9576454 100644
--- a/packages/platform/test/unit/deployment-execution.test.ts
+++ b/packages/platform/test/unit/deployment-execution.test.ts
@@ -7,38 +7,16 @@ import {
   createPlatformDeploymentManifest,
   parsePlatformDeploymentManifest,
 } from '../../src/manifest.ts';
-import { createPlatformWorkerConfigs } from '../../src/worker-config.ts';
+import { workerConfigs } from '../worker-config-fixture.ts';
 
 function configs(deploymentExecution?: 1) {
-  return createPlatformWorkerConfigs({
-    accountId: 'account',
-    apiUrl: 'https://api.example.com',
-    proxyUrl: 'https://proxy.example.com',
-    emailGatewayUrl: 'https://mail.example.com',
+  return workerConfigs({
     deployment: createPlatformDeploymentManifest({
       application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
       displayName: 'Team',
       installationSlug: 'team',
     }),
     deploymentExecution,
-    installationId: 'team-12345678',
-    ownershipNonce: 'ownership',
-    healthProbeToken: 'probe',
-    platformVersion: '1.0.0',
-    resources: {
-      hyperdrive: 'db',
-      isrCacheKv: 'isr',
-      legacyAssetsKv: 'assets',
-      routingKv: 'routing',
-      zone: 'zone',
-    },
-    runtimeEntrypoints: {
-      api: 'api.mjs',
-      dispatch: 'dispatch.mjs',
-      proxy: 'proxy.mjs',
-      tail: 'tail.mjs',
-      emailGateway: 'mail.mjs',
-    },
   });
 }
 
diff --git a/packages/platform/test/unit/email-protocol.test.ts b/packages/platform/test/unit/email-protocol.test.ts
index 7853cd39d..2e49e4f5c 100644
--- a/packages/platform/test/unit/email-protocol.test.ts
+++ b/packages/platform/test/unit/email-protocol.test.ts
@@ -159,14 +159,6 @@ describe('bounded email receipt protocol', () => {
     ).rejects.toThrow('email response too large');
   });
 
-  it('bounds stalled tenant and envelope streams by deadline', async () => {
-    await expect(readEmailActions(new ReadableStream<Uint8Array>(), 5)).rejects.toThrow(
-      'email response timeout',
-    );
-    const envelope = new ReadableStream<Uint8Array>();
-    await expect(readEmailEnvelope(envelope, 5)).rejects.toThrow('email envelope timeout');
-  });
-
   it('does not extend protocol deadlines while an uncooperative stream cancels', async () => {
     const uncooperative = () =>
       new ReadableStream<Uint8Array>({
diff --git a/packages/platform/test/unit/source-revision.test.ts b/packages/platform/test/unit/source-revision.test.ts
deleted file mode 100644
index 342d6f934..000000000
--- a/packages/platform/test/unit/source-revision.test.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import { describe, expect, it, vi } from 'vite-plus/test';
-// The runtime builder is a Node script rather than a published package entrypoint.
-// @ts-expect-error The JavaScript build helper intentionally has no declaration output.
-import { resolvePlatformSourceRevision } from '../../scripts/source-revision.mjs';
-
-describe('platform runtime source revision', () => {
-  it('prefers an explicit build-system revision', () => {
-    const runGit = vi.fn();
-
-    expect(
-      resolvePlatformSourceRevision({
-        environment: { VOID_PLATFORM_SOURCE_REVISION: 'release-123' },
-        repositoryRoot: '/repo',
-        runGit,
-      }),
-    ).toBe('release-123');
-    expect(runGit).not.toHaveBeenCalled();
-  });
-
-  it('records the checked-out commit automatically', () => {
-    const runGit = vi
-      .fn()
-      .mockReturnValueOnce({ ok: true, stdout: '0123456789abcdef\n' })
-      .mockReturnValueOnce({ ok: true, stdout: '' });
-
-    expect(
-      resolvePlatformSourceRevision({ environment: {}, repositoryRoot: '/repo', runGit }),
-    ).toBe('0123456789abcdef');
-    expect(runGit).toHaveBeenNthCalledWith(1, ['rev-parse', '--verify', 'HEAD'], '/repo');
-    expect(runGit).toHaveBeenNthCalledWith(
-      2,
-      ['status', '--porcelain', '--untracked-files=normal'],
-      '/repo',
-    );
-  });
-
-  it('does not claim that a dirty checkout exactly matches its commit', () => {
-    const runGit = vi
-      .fn()
-      .mockReturnValueOnce({ ok: true, stdout: '0123456789abcdef\n' })
-      .mockReturnValueOnce({ ok: true, stdout: ' M platform/packages/api/src/index.ts\n' });
-
-    expect(
-      resolvePlatformSourceRevision({ environment: {}, repositoryRoot: '/repo', runGit }),
-    ).toBe('0123456789abcdef-dirty');
-  });
-
-  it('leaves provenance unrecorded when Git metadata is unavailable', () => {
-    expect(
-      resolvePlatformSourceRevision({
-        environment: {},
-        repositoryRoot: '/source-archive',
-        runGit: () => ({ ok: false, stdout: '' }),
-      }),
-    ).toBeNull();
-  });
-
-  it('leaves provenance unrecorded when checkout cleanliness cannot be verified', () => {
-    const runGit = vi
-      .fn()
-      .mockReturnValueOnce({ ok: true, stdout: '0123456789abcdef\n' })
-      .mockReturnValueOnce({ ok: false, stdout: '' });
-
-    expect(
-      resolvePlatformSourceRevision({ environment: {}, repositoryRoot: '/repo', runGit }),
-    ).toBeNull();
-  });
-});
diff --git a/packages/platform/test/unit/worker-config.test.ts b/packages/platform/test/unit/worker-config.test.ts
index 245fa0f5f..52ba5fe02 100644
--- a/packages/platform/test/unit/worker-config.test.ts
+++ b/packages/platform/test/unit/worker-config.test.ts
@@ -3,19 +3,13 @@ import {
   createPlatformDeploymentManifest,
   parsePlatformDeploymentManifest,
 } from '../../src/manifest.ts';
-import { createPlatformWorkerConfigs } from '../../src/worker-config.ts';
+import { deployment, deploymentInput, workerConfigs } from '../worker-config-fixture.ts';
 
 describe('platform email deployment manifest', () => {
-  const input = {
-    application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-    displayName: 'Example',
-    installationSlug: 'example',
-  };
-
   it.each([{ emailSharedZoneId: 'mail-zone-id' }, { emailSenderDomain: 'mail.example.org' }])(
     'rejects incomplete shared email settings from the factory',
     (email) => {
-      expect(() => createPlatformDeploymentManifest({ ...input, ...email })).toThrow(
+      expect(() => createPlatformDeploymentManifest({ ...deploymentInput, ...email })).toThrow(
         'requires both emailSenderDomain and emailSharedZoneId',
       );
     },
@@ -23,7 +17,7 @@ describe('platform email deployment manifest', () => {
 
   it('rejects either incomplete shared email setting while parsing', () => {
     const complete = createPlatformDeploymentManifest({
-      ...input,
+      ...deploymentInput,
       emailSharedZoneId: 'mail-zone-id',
       emailSenderDomain: 'mail.example.org',
     });
@@ -48,90 +42,51 @@ describe('platform usage queue bindings', () => {
   ])(
     'attaches private proxy health only at enabled cutover: $trafficState / $publicEndpoints',
     ({ trafficState, publicEndpoints, bound }) => {
-      const deployment = createPlatformDeploymentManifest({
-        application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      });
-      const configs = createPlatformWorkerConfigs({
-        accountId: 'account',
-        apiUrl: 'https://api.example.com',
-        proxyUrl: 'https://proxy.example.com',
-        emailGatewayUrl: 'https://email.example.com',
-        deployment,
-        healthProbeToken: 'probe',
-        installationId: 'example',
-        ownershipNonce: 'ownership',
-        platformVersion: '1.0.0',
-        proxyHealthBinding: true,
-        trafficState,
-        publicEndpoints,
-        resources: {
-          hyperdrive: 'db',
-          isrCacheKv: 'isr',
-          legacyAssetsKv: 'assets',
-          routingKv: 'routing',
-          zone: 'zone',
-        },
-        runtimeEntrypoints: {
-          api: 'api.mjs',
-          proxy: 'proxy.mjs',
-          dispatch: 'dispatch.mjs',
-          tail: 'tail.mjs',
-          emailGateway: 'email.mjs',
-        },
-      });
+      const configs = workerConfigs({ proxyHealthBinding: true, trafficState, publicEndpoints });
       expect(configs.api.services).toEqual(
         bound
           ? [{ binding: 'PLATFORM_PROXY', service: deployment.resources.proxyWorker }]
           : undefined,
       );
-      expect(configs.proxy.services).toEqual([
-        { binding: 'API', service: deployment.resources.apiWorker },
-      ]);
     },
   );
 
+  it('adds no bootstrap service dependencies, assets or email bindings by default', () => {
+    const configs = workerConfigs();
+    expect(configs.api.services).toBeUndefined();
+    expect(configs.api.assets).toBeUndefined();
+    expect(configs.proxy.compatibility_flags).toEqual(['nodejs_compat']);
+    expect(configs.proxy.services).toEqual([
+      { binding: 'API', service: deployment.resources.apiWorker },
+    ]);
+    expect(configs.api).not.toHaveProperty('send_email');
+    expect(configs.proxy).not.toHaveProperty('send_email');
+    expect(configs.emailGateway).not.toHaveProperty('send_email');
+    expect(Object.keys(configs).sort()).toEqual([
+      'api',
+      'dispatch',
+      'emailGateway',
+      'proxy',
+      'tail',
+    ]);
+  });
+
   it('routes shared mail through its configured zone, independent of the application zone', () => {
-    const deployment = createPlatformDeploymentManifest({
-      application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
+    const mailDeployment = createPlatformDeploymentManifest({
+      ...deploymentInput,
       emailSharedZoneId: 'mail-zone-id',
       emailSenderDomain: 'mail.example.org',
       authentication: { accessProtection: true },
       capabilities: { email: true },
-      displayName: 'Example',
-      installationSlug: 'example',
     });
-    const configs = createPlatformWorkerConfigs({
-      accountId: 'account',
-      apiUrl: 'https://api.example.com',
-      proxyUrl: 'https://proxy.example.com',
-      emailGatewayUrl: 'https://email-gateway.account.workers.dev',
-      deployment,
-      healthProbeToken: 'probe',
-      installationId: 'installation',
-      ownershipNonce: 'ownership',
-      platformVersion: '1.0.0',
-      resources: {
-        hyperdrive: 'db',
-        isrCacheKv: 'isr',
-        legacyAssetsKv: 'assets',
-        routingKv: 'routing',
-        zone: 'app-zone-id',
-      },
-      runtimeEntrypoints: {
-        api: 'api.mjs',
-        proxy: 'proxy.mjs',
-        emailGateway: 'email-gateway.mjs',
-        tail: 'tail.mjs',
-        dispatch: 'dispatch.mjs',
-      },
+    const configs = workerConfigs({
+      deployment: mailDeployment,
       runtimeApiAssetsDirectory: '/runtime/api/assets',
     });
     const expected = {
       EMAIL_SHARED_ACCOUNT_ID: 'account',
       EMAIL_SHARED_ZONE_ID: 'mail-zone-id',
-      EMAIL_SHARED_INGRESS_NAME: deployment.resources.emailGatewayWorker,
+      EMAIL_SHARED_INGRESS_NAME: mailDeployment.resources.emailGatewayWorker,
     };
     expect(configs.api.vars).toMatchObject(expected);
     expect(configs.emailGateway.vars).toMatchObject(expected);
@@ -180,98 +135,33 @@ describe('platform usage queue bindings', () => {
       publicFetch: true,
     },
   ])(
-    'supports public health probes without adding bootstrap service dependencies: $apiUrl, $proxyUrl, workersDev=$workersDev',
+    'adds global_fetch_strictly_public only for workers.dev probes: $apiUrl, $proxyUrl, workersDev=$workersDev',
     ({ apiUrl, proxyUrl, workersDev, publicFetch }) => {
-      const deployment = createPlatformDeploymentManifest({
-        application: workersDev
-          ? {
-              baseDomain: 'account.workers.dev',
-              zoneName: '',
-              workersDev: { subdomain: 'account', installationId: 'example-123456abcdef' },
-            }
-          : { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      });
-      const configs = createPlatformWorkerConfigs({
-        accountId: 'account',
+      const configs = workerConfigs({
         apiUrl,
         proxyUrl,
-        emailGatewayUrl: 'https://email-gateway.account.workers.dev',
-        deployment,
-        healthProbeToken: 'probe',
-        installationId: 'example-123456abcdef',
-        ownershipNonce: 'ownership',
-        platformVersion: '1.0.0',
-        resources: {
-          hyperdrive: 'db',
-          isrCacheKv: 'isr',
-          legacyAssetsKv: 'assets',
-          routingKv: 'routing',
-          zone: workersDev ? '' : 'zone',
-        },
-        runtimeEntrypoints: {
-          api: 'api.mjs',
-          proxy: 'proxy.mjs',
-          emailGateway: 'email-gateway.mjs',
-          dispatch: 'dispatch.mjs',
-          tail: 'tail.mjs',
-        },
+        ...(workersDev
+          ? {
+              deployment: createPlatformDeploymentManifest({
+                ...deploymentInput,
+                application: {
+                  baseDomain: 'account.workers.dev',
+                  zoneName: '',
+                  workersDev: { subdomain: 'account', installationId: 'example-123456abcdef' },
+                },
+              }),
+            }
+          : {}),
       });
       expect(configs.api.compatibility_flags).toEqual([
         'nodejs_compat',
         ...(publicFetch ? ['global_fetch_strictly_public'] : []),
       ]);
-      expect(configs.api.services).toBeUndefined();
-      expect(configs.api.assets).toBeUndefined();
-      expect(configs.proxy.compatibility_flags).toEqual(['nodejs_compat']);
-      expect(configs.proxy.services).toEqual([
-        { binding: 'API', service: deployment.resources.apiWorker },
-      ]);
-      expect(configs.api).not.toHaveProperty('send_email');
-      expect(configs.proxy).not.toHaveProperty('send_email');
-      expect(configs.emailGateway).not.toHaveProperty('send_email');
-      expect(Object.keys(configs).sort()).toEqual([
-        'api',
-        'dispatch',
-        'emailGateway',
-        'proxy',
-        'tail',
-      ]);
     },
   );
 
   it('binds the existing queue only to trusted platform producers', () => {
-    const deployment = createPlatformDeploymentManifest({
-      application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-      displayName: 'Example',
-      installationSlug: 'example',
-    });
-    const configs = createPlatformWorkerConfigs({
-      accountId: 'account',
-      apiUrl: 'https://api.example.com',
-      deployment,
-      healthProbeToken: 'probe',
-      installationId: 'installation',
-      ownershipNonce: 'ownership',
-      platformVersion: '1.0.0',
-      proxyUrl: 'https://proxy.example.com',
-      emailGatewayUrl: 'https://email-gateway.account.workers.dev',
-      resources: {
-        hyperdrive: 'hyperdrive-id',
-        isrCacheKv: 'isr-id',
-        legacyAssetsKv: 'assets-id',
-        routingKv: 'routing-id',
-        zone: 'zone-id',
-      },
-      runtimeEntrypoints: {
-        api: 'api.mjs',
-        dispatch: 'dispatch.mjs',
-        proxy: 'proxy.mjs',
-        emailGateway: 'email-gateway.mjs',
-        tail: 'tail.mjs',
-      },
-    });
+    const configs = workerConfigs();
 
     expect((configs.api.queues as { producers: Array<unknown> }).producers).toContainEqual({
       binding: 'USAGE_EVENTS_QUEUE',
@@ -286,37 +176,10 @@ describe('platform usage queue bindings', () => {
   });
 
   it('keeps the tail worker off workers.dev and preview URLs when endpoints are public', () => {
-    const deployment = createPlatformDeploymentManifest({
-      application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-      displayName: 'Example',
-      installationSlug: 'example',
-    });
-    const configs = createPlatformWorkerConfigs({
-      accountId: 'account',
+    const configs = workerConfigs({
       apiUrl: 'https://api.account.workers.dev',
-      deployment,
-      healthProbeToken: 'probe',
-      installationId: 'installation',
-      ownershipNonce: 'ownership',
-      platformVersion: '1.0.0',
       proxyUrl: 'https://proxy.account.workers.dev',
-      emailGatewayUrl: 'https://email-gateway.account.workers.dev',
       publicEndpoints: true,
-      trafficState: 'enabled',
-      resources: {
-        hyperdrive: 'hyperdrive-id',
-        isrCacheKv: 'isr-id',
-        legacyAssetsKv: 'assets-id',
-        routingKv: 'routing-id',
-        zone: 'zone-id',
-      },
-      runtimeEntrypoints: {
-        api: 'api.mjs',
-        dispatch: 'dispatch.mjs',
-        proxy: 'proxy.mjs',
-        emailGateway: 'email-gateway.mjs',
-        tail: 'tail.mjs',
-      },
     });
 
     expect(configs.api.workers_dev).toBe(true);
@@ -325,38 +188,7 @@ describe('platform usage queue bindings', () => {
   });
 
   it('creates core Durable Objects with SQLite while preserving migration tags', () => {
-    const deployment = createPlatformDeploymentManifest({
-      application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-      displayName: 'Example',
-      installationSlug: 'example',
-    });
-    const configs = createPlatformWorkerConfigs({
-      accountId: 'account',
-      apiUrl: 'https://api.example.com',
-      deployment,
-      healthProbeToken: 'probe',
-      installationId: 'installation',
-      ownershipNonce: 'ownership',
-      platformVersion: '1.0.0',
-      proxyUrl: 'https://proxy.example.com',
-      emailGatewayUrl: 'https://email-gateway.account.workers.dev',
-      resources: {
-        hyperdrive: 'hyperdrive-id',
-        isrCacheKv: 'isr-id',
-        legacyAssetsKv: 'assets-id',
-        routingKv: 'routing-id',
-        zone: 'zone-id',
-      },
-      runtimeEntrypoints: {
-        api: 'api.mjs',
-        dispatch: 'dispatch.mjs',
-        proxy: 'proxy.mjs',
-        emailGateway: 'email-gateway.mjs',
-        tail: 'tail.mjs',
-      },
-    });
-
-    expect(configs.api.migrations).toEqual([
+    expect(workerConfigs().api.migrations).toEqual([
       { tag: 'v1', new_sqlite_classes: ['UsageCounter'] },
       { tag: 'v2', new_sqlite_classes: ['CronScheduler'] },
       { tag: 'v3', new_sqlite_classes: ['ErrorAlertMonitor'] },
diff --git a/packages/platform/test/worker-config-fixture.ts b/packages/platform/test/worker-config-fixture.ts
new file mode 100644
index 000000000..f3c3ec791
--- /dev/null
+++ b/packages/platform/test/worker-config-fixture.ts
@@ -0,0 +1,41 @@
+import { createPlatformDeploymentManifest } from '../src/manifest.ts';
+import { createPlatformWorkerConfigs } from '../src/worker-config.ts';
+
+export const deploymentInput = {
+  application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
+  displayName: 'Example',
+  installationSlug: 'example',
+};
+
+export const deployment = createPlatformDeploymentManifest(deploymentInput);
+
+export function workerConfigs(
+  overrides: Partial<Parameters<typeof createPlatformWorkerConfigs>[0]> = {},
+): ReturnType<typeof createPlatformWorkerConfigs> {
+  return createPlatformWorkerConfigs({
+    accountId: 'account',
+    apiUrl: 'https://api.example.com',
+    proxyUrl: 'https://proxy.example.com',
+    emailGatewayUrl: 'https://email-gateway.account.workers.dev',
+    deployment,
+    healthProbeToken: 'probe',
+    installationId: 'installation',
+    ownershipNonce: 'ownership',
+    platformVersion: '1.0.0',
+    resources: {
+      hyperdrive: 'db',
+      isrCacheKv: 'isr',
+      legacyAssetsKv: 'assets',
+      routingKv: 'routing',
+      zone: 'zone',
+    },
+    runtimeEntrypoints: {
+      api: 'api.mjs',
+      dispatch: 'dispatch.mjs',
+      emailGateway: 'email-gateway.mjs',
+      proxy: 'proxy.mjs',
+      tail: 'tail.mjs',
+    },
+    ...overrides,
+  });
+}
diff --git a/packages/react/src/plugin-islands.ts b/packages/react/src/plugin-islands.ts
index 4bc7d2beb..e062522bf 100644
--- a/packages/react/src/plugin-islands.ts
+++ b/packages/react/src/plugin-islands.ts
@@ -6,7 +6,6 @@ import type { PageScanResult } from 'void/pages';
 import {
   resolveSpecifier,
   needsIslandClientBundle,
-  extractCssImports,
   computePagesNeedingClientJS,
   watchPagesForRescan,
   rewriteCssImportForVirtualModule,
@@ -18,6 +17,7 @@ import {
   type IslandSourceEdit,
 } from 'void/pages-islands-plugin';
 import type { IslandEntry } from 'void/pages-islands-plugin';
+import { REACT_REFRESH_PREAMBLE } from './plugin-pages.ts';
 
 const COMPONENT_EXTENSIONS = ['.tsx', '.jsx', '.ts', '.js'];
 type MdPluginWithApi = Plugin & {
@@ -36,7 +36,6 @@ export function islandsPlugin(
   const root = options?.root ?? dirname(pagesDir);
   const islandManifest = new Map<string, IslandEntry>();
   const islandCssFiles = new Set<string>();
-  let viteRoot = '';
   let resolvedConfig: ResolvedConfig | null = null;
 
   /** Resolve an island import and record it in the client manifest. */
@@ -60,7 +59,6 @@ export function islandsPlugin(
 
       configResolved(config) {
         resolvedConfig = config;
-        viteRoot = config.root;
         isDev = config.command === 'serve';
       },
 
@@ -124,31 +122,17 @@ export function islandsPlugin(
       },
 
       resolveId: {
-        filter: { id: /^virtual:void-islands-(renderer|client)$|\.(tsx|jsx)\.css$/ },
+        filter: { id: /^virtual:void-islands-(renderer|client)$/ },
         handler(source) {
           if (source === ISLANDS_RENDERER_ID || source === ISLANDS_CLIENT_ENTRY_ID) {
             return '\0' + source;
           }
-          // Virtual island CSS modules — no \0 prefix so Vite CSS pipeline processes them.
-          // Return absolute path so CSS @import resolution uses the correct directory.
-          if (source.endsWith('.css')) {
-            const srcPath = normalizePath(source.slice(0, -4));
-            if (islandCssFiles.has(srcPath)) {
-              return srcPath + '.css';
-            }
-            if (srcPath.startsWith('/')) {
-              const absPath = normalizePath(resolve(viteRoot, srcPath.slice(1)));
-              if (islandCssFiles.has(absPath)) {
-                return absPath + '.css';
-              }
-            }
-          }
         },
       },
 
       load: {
         // eslint-disable-next-line no-control-regex -- Vite virtual module null-byte prefix
-        filter: { id: /^\0virtual:void-islands-(renderer|client)$|\.(tsx|jsx)\.css$/ },
+        filter: { id: /^\0virtual:void-islands-(renderer|client)$/ },
         handler(id) {
           if (id === '\0' + ISLANDS_RENDERER_ID) {
             if (!pageScan) {
@@ -169,13 +153,6 @@ export function islandsPlugin(
             }
             return generateIslandClientEntry(islandManifest, islandCssFiles, isDev);
           }
-          // Virtual island CSS module — resolveId returns absolute path
-          if (id.endsWith('.css') && !id.startsWith('\0')) {
-            const srcPath = id.slice(0, -4);
-            if (islandCssFiles.has(srcPath)) {
-              return extractCssImports(srcPath);
-            }
-          }
         },
       },
 
@@ -264,16 +241,7 @@ function generateIslandRenderer(
   mdScriptIds: Set<string>,
   pagesNeedingClientJS: Set<string>,
 ): string {
-  const preambleScript = isDev
-    ? `
-<script type="module">
-  import RefreshRuntime from "/@react-refresh"
-  RefreshRuntime.injectIntoGlobalHook(window)
-  window.$RefreshReg$ = () => {}
-  window.$RefreshSig$ = () => (type) => type
-  window.__vite_plugin_react_preamble_installed__ = true
-</script>`
-    : '';
+  const preambleScript = isDev ? REACT_REFRESH_PREAMBLE : '';
 
   const mdScriptIdsCode = `const __mdClientScriptIds = new Set(${JSON.stringify([...mdScriptIds])});`;
   const needsJSCode = `const __pagesNeedingClientJS = new Set(${JSON.stringify([...pagesNeedingClientJS])});`;
diff --git a/packages/react/src/plugin-pages.ts b/packages/react/src/plugin-pages.ts
index 5660ea550..6315ff9b3 100644
--- a/packages/react/src/plugin-pages.ts
+++ b/packages/react/src/plugin-pages.ts
@@ -22,6 +22,17 @@ const REACT_OPTIMIZE_DEPS = [
 ];
 const WORKER_OPTIMIZE_DEPS = [...REACT_OPTIMIZE_DEPS, 'void/live/client'];
 
+// SSR HTML bypasses transformIndexHtml, so @vitejs/plugin-react cannot inject
+// its Fast Refresh preamble. Without it, the dev client entry fails to load.
+export const REACT_REFRESH_PREAMBLE = `
+<script type="module">
+  import RefreshRuntime from "/@react-refresh"
+  RefreshRuntime.injectIntoGlobalHook(window)
+  window.$RefreshReg$ = () => {}
+  window.$RefreshSig$ = () => (type) => type
+  window.__vite_plugin_react_preamble_installed__ = true
+</script>`;
+
 export type PrefetchConfig = {
   hoverDelay?: number;
   cacheFor?: number | string | [string, string];
@@ -217,20 +228,7 @@ export function pagesPlugin(pagesDir: string, options?: PagesPluginOptions): Plu
 }
 
 function generateRendererModule(scan: PageScanResult, pagesDir: string, isDev: boolean): string {
-  // In dev mode, inject the React Refresh preamble as an inline script.
-  // SSR-generated HTML bypasses Vite's transformIndexHtml, so @vitejs/plugin-react
-  // can't inject it automatically. Without this, React Fast Refresh breaks and
-  // the client entry module fails to load.
-  const preambleScript = isDev
-    ? `
-<script type="module">
-  import RefreshRuntime from "/@react-refresh"
-  RefreshRuntime.injectIntoGlobalHook(window)
-  window.$RefreshReg$ = () => {}
-  window.$RefreshSig$ = () => (type) => type
-  window.__vite_plugin_react_preamble_installed__ = true
-</script>`
-    : '';
+  const preambleScript = isDev ? REACT_REFRESH_PREAMBLE : '';
 
   return `
 import { renderReactPage } from "@void/react/pages-server";
diff --git a/packages/react/src/runtime/link.tsx b/packages/react/src/runtime/link.tsx
index 5bdc09a58..7d674a196 100644
--- a/packages/react/src/runtime/link.tsx
+++ b/packages/react/src/runtime/link.tsx
@@ -13,7 +13,7 @@ import { RouterContext } from './context.ts';
 
 type PrefetchStrategy = 'hover' | 'click' | 'mount' | 'visible';
 type LinkMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-type PrefetchOptions = { cacheFor?: LinkProps['cacheFor']; method?: LinkMethod };
+type PrefetchOptions = { cacheFor?: LinkProps['cacheFor'] };
 
 type CommonProps = {
   href: string;
@@ -33,10 +33,6 @@ export type LinkProps = CommonProps &
   Omit<AnchorHTMLAttributes<HTMLAnchorElement>, keyof CommonProps> &
   Omit<ButtonHTMLAttributes<HTMLButtonElement>, keyof CommonProps>;
 
-function hasPrefetch(prefetch: LinkProps['prefetch']): boolean {
-  return prefetch !== false;
-}
-
 export function Link({
   href,
   method = 'GET',
@@ -82,7 +78,7 @@ export function Link({
   }, [prefetchProp, reloadDocument]);
   const hoverDelay = router?._hoverDelay ?? 75;
 
-  if (hasPrefetch(prefetchProp) && !isGet) {
+  if (prefetchProp !== false && !isGet) {
     throw new Error(
       'Link: prefetch only supports GET links. Remove `prefetch` or use method="GET".',
     );
@@ -103,11 +99,8 @@ export function Link({
     if (cacheFor !== undefined) {
       options.cacheFor = cacheFor;
     }
-    if (normalizedMethod) {
-      options.method = normalizedMethod;
-    }
     router.prefetch(hrefWithData, options);
-  }, [cacheFor, hrefWithData, normalizedMethod, router]);
+  }, [cacheFor, hrefWithData, router]);
 
   const shouldHandleClick = useCallback(
     (event: MouseEvent): boolean => {
diff --git a/packages/react/src/runtime/use-navigation.ts b/packages/react/src/runtime/use-navigation.ts
index 1dde6ebaf..e967641bd 100644
--- a/packages/react/src/runtime/use-navigation.ts
+++ b/packages/react/src/runtime/use-navigation.ts
@@ -2,8 +2,6 @@ import { useContext } from 'react';
 import type { NavigationState } from 'void/pages-client';
 import { NavigationContext } from './context.ts';
 
-export type { NavigationState } from 'void/pages-client';
-
 export function useNavigation(): NavigationState {
   return useContext(NavigationContext);
 }
diff --git a/packages/react/src/runtime/use-router.ts b/packages/react/src/runtime/use-router.ts
index a04aa1776..628386504 100644
--- a/packages/react/src/runtime/use-router.ts
+++ b/packages/react/src/runtime/use-router.ts
@@ -3,8 +3,6 @@ import { ssrProxy } from 'void/pages-client';
 import type { VoidRouter } from 'void/pages-client';
 import { RouterContext } from './context.ts';
 
-export type { VoidRouter } from 'void/pages-client';
-
 export function useRouter(): VoidRouter {
   return useContext(RouterContext) ?? ssrProxy;
 }
diff --git a/packages/react/test/integration/react-pages-client.test.ts b/packages/react/test/integration/react-pages-client.test.ts
index 62bf107ec..f40d9baf4 100644
--- a/packages/react/test/integration/react-pages-client.test.ts
+++ b/packages/react/test/integration/react-pages-client.test.ts
@@ -1,28 +1,33 @@
-import { execSync } from 'node:child_process';
+import { execSync, type ChildProcess } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import spawn from 'cross-spawn';
 import { type Browser, type Page } from 'playwright';
 import { describe, expect, it, beforeAll, afterAll } from 'vite-plus/test';
-import { waitForIslandsHydrated } from '../../../../test/browser-helpers.ts';
-import { killChild, startServer, waitForServer } from '../../../../test/integration-helpers.ts';
+import {
+  killChild,
+  spawnPlaygroundServer,
+  startServer,
+  waitForServer,
+} from '../../../../test/integration-helpers.ts';
 import { launchPagesBrowser } from '../../../../test/pages-browser.ts';
-import { registerSharedClientTests } from '../../../../test/pages-client-contract.ts';
-import { defineSharedIslandTests } from '../../../../test/pages-island-contract.ts';
+import {
+  registerSharedClientTests,
+  registerSharedDevSsrTest,
+} from '../../../../test/pages-client-contract.ts';
+import {
+  defineSharedIslandHmrTests,
+  defineSharedIslandTests,
+} from '../../../../test/pages-island-contract.ts';
 
 declare global {
   interface Window {
     __SPA_MARKER?: boolean;
     __visitAwaitObserved?: string | null;
-    __linkOnClick?: boolean;
-    __preventedClick?: boolean;
-    __preventedNavigate?: boolean;
     __hashNavigationReady?: boolean;
     __headRefs?: {
       font: Element | null;
       stylesheet: Element | null;
     };
-    __hmr_marker?: boolean;
   }
 }
 
@@ -329,7 +334,6 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
       await page.goto(BASE + '/');
       await waitForHydration(page);
 
-      // Stamp the nav element
       await page.evaluate(() => {
         (document.querySelector('nav') as NavElement | null)!.__stamp = 1;
       });
@@ -466,10 +470,8 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
       await page.goto(BASE + '/');
       await waitForHydration(page);
 
-      // Home page title from head() + titleTemplate
       expect(await page.title()).toBe('Home | React Pages Demo');
 
-      // Navigate to user detail — title should update
       await page.click('a[href="/users"]');
       await page.waitForFunction(() =>
         document.querySelector('h1')?.textContent?.includes('Users'),
@@ -480,7 +482,6 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
       );
       expect(await page.title()).toBe('Alice | React Pages Demo');
 
-      // Go back — title should restore
       await page.goBack();
       await page.waitForFunction(() =>
         document.querySelector('h1')?.textContent?.includes('Users'),
@@ -596,7 +597,7 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
 }
 
 describe('react-pages client (dev)', () => {
-  let child: ReturnType<typeof spawn>;
+  let child: ChildProcess | undefined;
   let stderr = '';
   let originalLayout: string | undefined;
   const coldStartResponses: Array<{ path: string; status: number; body: string }> = [];
@@ -610,28 +611,7 @@ describe('react-pages client (dev)', () => {
 
       const serverTimeout = process.platform === 'win32' ? 45_000 : 20_000;
       const server = await startServer((port) => {
-        child = spawn(
-          'vp',
-          [
-            'run',
-            '--filter',
-            './playground/react-pages',
-            'dev',
-            '--host',
-            '127.0.0.1',
-            '--port',
-            String(port),
-            '--strictPort',
-          ],
-          {
-            cwd: ROOT,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            env: {
-              ...process.env,
-              VOID_INSPECTOR_PORT: 'false',
-            },
-          },
-        );
+        child = spawnPlaygroundServer(ROOT, 'react-pages', 'dev', port);
         stderr = '';
         child.stderr!.on('data', (chunk: Buffer) => {
           stderr += String(chunk);
@@ -669,9 +649,6 @@ describe('react-pages client (dev)', () => {
       await killChild(child);
     }
     rmSync(LATE_WORKER_DEPS_ROOT, { recursive: true, force: true });
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
   it('dev: cold SSR startup does not hit invalid React hook calls', () => {
@@ -710,57 +687,19 @@ describe('react-pages client (dev)', () => {
     }
   });
 
-  it('dev: SSR pages, Inertia protocol, form handling, API coexistence', async () => {
-    // 1. Initial page load returns SSR HTML with embedded page data
-    const rootRes = await fetch(`${DEV_BASE}/`);
-    expect(rootRes.status).toBe(200);
-    const rootHtml = await rootRes.text();
-    expect(rootHtml).toContain('__VOID_PAGE_DATA__');
-    expect(rootHtml).toContain('Welcome');
-    expect(rootHtml).toContain('React Pages Demo'); // shared data from middleware
-
-    // Inline page-data must round-trip through the <script> tag without
-    // truncation. If serializePageData ever regresses (e.g. via another
-    // template-literal backslash-collapse), the </script> in scriptProbe
-    // closes the inline tag early, the regex below captures truncated
-    // text, and JSON.parse throws.
-    const probe = '</script><script>alert(1)</script>\u2028\u2029&';
-    const probeMatch = rootHtml.match(/<script id="__VOID_PAGE_DATA__"[^>]*>([\s\S]*?)<\/script>/);
-    expect(probeMatch).not.toBeNull();
-    const probeJson = probeMatch![1];
-    expect(probeJson).not.toMatch(/<\/script/i);
-    expect(JSON.parse(probeJson).shared.scriptProbe).toBe(probe);
-
-    // 1b. Head management — SSR HTML contains head tags from void.json + page head()
+  registerSharedDevSsrTest({ getBase: () => DEV_BASE, framework: 'React' });
+
+  it('dev: head tags, pages protocol, form handling, API coexistence', async () => {
+    const rootHtml = await (await fetch(`${DEV_BASE}/`)).text();
     expect(rootHtml).toContain('<title>Home | React Pages Demo</title>');
     expect(rootHtml).toContain('<meta charset="utf-8">');
     expect(rootHtml).toContain('<meta name="description" content="React Pages playground home">');
     expect(rootHtml).toContain('<html lang="en"');
 
-    // 2. SSR content contains server-rendered props
-    expect(rootHtml).toContain('This is the React Pages playground.');
-
-    // 3. Users page SSR — server-rendered user list
-    const usersRes = await fetch(`${DEV_BASE}/users`);
-    expect(usersRes.status).toBe(200);
-    const usersHtml = await usersRes.text();
-    expect(usersHtml).toContain('__VOID_PAGE_DATA__');
-    expect(usersHtml).toContain('Alice');
-    expect(usersHtml).toContain('Bob');
-    expect(usersHtml).toContain('React Pages Demo'); // layout with shared data
-
-    // 4. User detail page SSR
-    const userRes = await fetch(`${DEV_BASE}/users/1`);
-    expect(userRes.status).toBe(200);
-    const userHtml = await userRes.text();
-    expect(userHtml).toContain('Alice');
-    expect(userHtml).toContain('alice@example.com');
-
-    // 4b. User detail head — dynamic title from head() export
+    const userHtml = await (await fetch(`${DEV_BASE}/users/1`)).text();
     expect(userHtml).toContain('<title>Alice | React Pages Demo</title>');
     expect(userHtml).toContain('<meta property="og:title" content="Alice">');
 
-    // 5. Inertia navigation — GET / with X-VoidPages header returns JSON page object
     const inertiaRoot = await fetch(`${DEV_BASE}/`, {
       headers: { 'X-VoidPages': 'true' },
     });
@@ -777,7 +716,6 @@ describe('react-pages client (dev)', () => {
     expect(rootPage.props).toHaveProperty('title', 'Home');
     expect(rootPage.shared).toHaveProperty('appName', 'React Pages Demo');
     expect(rootPage.url).toBe('/');
-    // Head in Inertia JSON
     expect(rootPage.head).toBeDefined();
     expect(rootPage.head.title).toBe('Home | React Pages Demo');
     expect(rootPage.head.meta).toEqual(
@@ -786,7 +724,6 @@ describe('react-pages client (dev)', () => {
       ]),
     );
 
-    // 6. Inertia navigation — GET /users returns user list in props
     const inertiaUsers = await fetch(`${DEV_BASE}/users`, {
       headers: { 'X-VoidPages': 'true' },
     });
@@ -799,13 +736,11 @@ describe('react-pages client (dev)', () => {
     expect(usersPage.props.users).toHaveLength(2);
     expect(usersPage.props.users[0].name).toBe('Alice');
 
-    // 7. API coexistence — /api/health returns JSON (not a page object)
     const healthRes = await fetch(`${DEV_BASE}/api/health`);
     expect(healthRes.status).toBe(200);
     const healthBody = (await healthRes.json()) as { status: string };
     expect(healthBody.status).toBe('ok');
 
-    // 8. Form submission — POST /users with valid data
     const postValid = await fetch(`${DEV_BASE}/users`, {
       method: 'POST',
       headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
@@ -821,7 +756,6 @@ describe('react-pages client (dev)', () => {
     expect(validPage.props.users).toHaveLength(3);
     expect(validPage.props.users[2].name).toBe('Charlie');
 
-    // 9. Form submission — POST /users with invalid data returns validation errors
     const postInvalid = await fetch(`${DEV_BASE}/users`, {
       method: 'POST',
       headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
@@ -836,10 +770,8 @@ describe('react-pages client (dev)', () => {
     expect(invalidPage.errors).not.toBeNull();
     expect(invalidPage.errors!.name).toBe('Name is required');
     expect(invalidPage.errors!.email).toBe('Email is required');
-    // Props should still be populated (re-ran GET)
     expect(invalidPage.props.users.length).toBeGreaterThanOrEqual(2);
 
-    // 10. User detail via Inertia
     const inertiaUser = await fetch(`${DEV_BASE}/users/1`, {
       headers: { 'X-VoidPages': 'true' },
     });
@@ -851,10 +783,8 @@ describe('react-pages client (dev)', () => {
     };
     expect(userPage.component).toBe('users/[id]');
     expect(userPage.props.user.name).toBe('Alice');
-    // Head in user detail Inertia JSON
     expect(userPage.head.title).toBe('Alice | React Pages Demo');
 
-    // 11. Newly added user is accessible via detail page
     const inertiaCharlie = await fetch(`${DEV_BASE}/users/3`, {
       headers: { 'X-VoidPages': 'true' },
     });
@@ -867,21 +797,6 @@ describe('react-pages client (dev)', () => {
     expect(charliePage.props.user.name).toBe('Charlie');
     expect(charliePage.props.user.email).toBe('charlie@example.com');
 
-    // --- Island pages ---
-
-    // 12. Island page SSR — HTML with data-island markers, NOT embedded page data
-    const blogRes = await fetch(`${DEV_BASE}/blog`);
-    expect(blogRes.status).toBe(200);
-    const blogHtml = await blogRes.text();
-    expect(blogHtml).toContain('data-island=');
-    expect(blogHtml).toContain('data-props=');
-    expect(blogHtml).toContain('data-hydrate=');
-    expect(blogHtml).not.toContain('__VOID_PAGE_DATA__');
-    expect(blogHtml).toContain('Hello World');
-    expect(blogHtml).toContain('Second Post');
-    expect(blogHtml).toContain('Count:');
-
-    // 13. Island page always returns HTML even with X-VoidPages header
     const inertiaBlog = await fetch(`${DEV_BASE}/blog`, {
       headers: { 'X-VoidPages': 'true' },
     });
@@ -891,7 +806,6 @@ describe('react-pages client (dev)', () => {
     const inertiaBlogHtml = await inertiaBlog.text();
     expect(inertiaBlogHtml).toContain('data-island=');
 
-    // 14. Island mutation — validation errors return JSON 422
     const blogPostInvalid = await fetch(`${DEV_BASE}/blog`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
@@ -902,7 +816,6 @@ describe('react-pages client (dev)', () => {
     expect(invalidBlog.errors.title).toBe('Title is required');
     expect(invalidBlog.errors.body).toBe('Body is required');
 
-    // 15. Island mutation — success returns JSON 200
     const blogPostValid = await fetch(`${DEV_BASE}/blog`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
@@ -912,17 +825,6 @@ describe('react-pages client (dev)', () => {
     const validBlog = (await blogPostValid.json()) as { success: boolean };
     expect(validBlog.success).toBe(true);
 
-    // 16. Island detail page with dynamic param
-    const detailRes = await fetch(`${DEV_BASE}/blog/hello-world`);
-    expect(detailRes.status).toBe(200);
-    const detailHtml = await detailRes.text();
-    expect(detailHtml).toContain('Hello World');
-    expect(detailHtml).toContain('First post');
-    expect(detailHtml).not.toContain('__VOID_PAGE_DATA__');
-
-    // --- Deferred props ---
-
-    // 17. Deferred props: SPA navigation streams NDJSON
     const deferredInertia = await fetch(`${DEV_BASE}/deferred`, {
       headers: { 'X-VoidPages': 'true' },
     });
@@ -938,15 +840,10 @@ describe('react-pages client (dev)', () => {
     expect(deferredLine.__deferred).toBe('stats');
     expect(deferredLine.data).toEqual({ count: 42 });
 
-    // 18. Deferred props: SSR includes resolution script tags
-    const deferredSsr = await fetch(`${DEV_BASE}/deferred`);
-    const deferredHtml = await deferredSsr.text();
-    expect(deferredHtml).toContain('__VOID_PAGE_DATA__');
+    const deferredHtml = await (await fetch(`${DEV_BASE}/deferred`)).text();
     expect(deferredHtml).toContain('Deferred Page');
     expect(deferredHtml).not.toContain('Switched to client rendering');
     expect(deferredHtml).not.toContain('server rendering aborted');
-    expect(deferredHtml).toContain('window.__resolveDeferred("stats"');
-    expect(deferredHtml).toContain('"count":42');
   });
 
   defineClientTests(() => DEV_BASE, 'smoke');
@@ -991,95 +888,17 @@ describe('react-pages client (dev)', () => {
     }
   });
 
-  it('island component HMR updates without full page reload', { retry: 2 }, async () => {
-    const counterFile = join(ROOT, 'playground/react-pages/pages/blog/_Counter.tsx');
-    const original = readFileSync(counterFile, 'utf-8');
-
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    page.setDefaultTimeout(10_000);
-
-    try {
-      await page.goto(`${DEV_BASE}/blog`);
-      await waitForIslandsHydrated(page, 2);
-
-      // Interact to establish client state — count becomes 1
-      await page.click("button:has-text('Increment')");
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent === 'Count: 1',
-      );
-
-      // Set a window marker to detect full page reload
-      await page.evaluate(() => {
-        window.__hmr_marker = true;
-      });
-
-      // Edit the island component — change the label
-      const modified = original.replace('Count: {count}', 'Total: {count}');
-      writeFileSync(counterFile, modified);
-
-      // Wait for HMR to update the component text
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent?.startsWith('Total:'),
-        { timeout: 10_000 },
-      );
-
-      // No full page reload — window marker should still be set
-      const markerSurvived = await page.evaluate(() => window.__hmr_marker === true);
-      expect(markerSurvived).toBe(true);
-
-      // React Fast Refresh preserves state — count should still be 1
-      const text = await page.textContent('[data-testid="count"]');
-      expect(text).toBe('Total: 1');
-    } finally {
-      await page.context().close();
-      writeFileSync(counterFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: 'Count:' });
-    }
-  });
-
-  it('island file edit triggers reload with updated content', { retry: 2 }, async () => {
-    const islandFile = join(ROOT, 'playground/react-pages/pages/blog/index.island.tsx');
-    const original = readFileSync(islandFile, 'utf-8');
-
-    try {
-      // Verify initial content renders
-      const initialRes = await fetch(`${DEV_BASE}/blog`);
-      expect(initialRes.status).toBe(200);
-      const initialHtml = await initialRes.text();
-      expect(initialHtml).toContain('<h1>Blog</h1>');
-
-      // Edit the island file — change the heading
-      const modified = original.replace('<h1>Blog</h1>', '<h1>Blog Updated</h1>');
-      writeFileSync(islandFile, modified);
-
-      // Poll for updated content — every request must return 200 (no ISE).
-      // The previous bug: sending full-reload to the workerd triggered a
-      // program reload that caused React dual-instance errors (500s).
-      const start = Date.now();
-      let updatedHtml = '';
-      while (Date.now() - start < 10_000) {
-        await new Promise((r) => setTimeout(r, 100));
-        const res = await fetch(`${DEV_BASE}/blog`);
-        expect(res.status).toBe(200);
-        updatedHtml = await res.text();
-        if (updatedHtml.includes('Blog Updated')) {
-          break;
-        }
-      }
-
-      expect(updatedHtml).toContain('<h1>Blog Updated</h1>');
-      expect(updatedHtml).toContain('data-island=');
-    } finally {
-      writeFileSync(islandFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: '<h1>Blog</h1>' });
-    }
+  defineSharedIslandHmrTests({
+    getBase: () => DEV_BASE,
+    getBrowser: () => browser,
+    counterFile: join(REACT_PAGES_ROOT, 'pages/blog/_Counter.tsx'),
+    islandFile: join(REACT_PAGES_ROOT, 'pages/blog/index.island.tsx'),
+    hmrKeepsState: true,
   });
 });
 
 describe('react-pages client (preview)', { retry: 2 }, () => {
-  let child: ReturnType<typeof spawn>;
-  let stderr = '';
+  let child: ChildProcess | undefined;
 
   beforeAll(async () => {
     if (!existsSync(join(ROOT, 'playground/react-pages/dist'))) {
@@ -1089,35 +908,10 @@ describe('react-pages client (preview)', { retry: 2 }, () => {
       });
     }
 
-    const server = await startServer((port) => {
-      child = spawn(
-        'vp',
-        [
-          'run',
-          '--filter',
-          './playground/react-pages',
-          'preview',
-          '--host',
-          '127.0.0.1',
-          '--port',
-          String(port),
-          '--strictPort',
-        ],
-        {
-          cwd: ROOT,
-          stdio: ['ignore', 'pipe', 'pipe'],
-          env: {
-            ...process.env,
-            VOID_INSPECTOR_PORT: 'false',
-          },
-        },
-      );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
-      return child;
-    }, 30_000);
+    const server = await startServer(
+      (port) => (child = spawnPlaygroundServer(ROOT, 'react-pages', 'preview', port)),
+      30_000,
+    );
     PREVIEW_BASE = server.base;
   });
 
@@ -1125,9 +919,6 @@ describe('react-pages client (preview)', { retry: 2 }, () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting preview server')) {
-      throw new Error(stderr);
-    }
   });
 
   defineClientTests(() => PREVIEW_BASE);
diff --git a/packages/react/test/unit/link.test.ts b/packages/react/test/unit/link.test.ts
index b52eaeadb..dfb864f5e 100644
--- a/packages/react/test/unit/link.test.ts
+++ b/packages/react/test/unit/link.test.ts
@@ -4,27 +4,6 @@ import { describe, expect, it } from 'vite-plus/test';
 import { Link } from '../../src/runtime/link.tsx';
 
 describe('Link', () => {
-  it('merges GET data into the rendered href', () => {
-    const markup = renderToStaticMarkup(
-      createElement(
-        Link,
-        {
-          href: '/users',
-          data: {
-            tag: ['a', 'b'],
-            page: 2,
-            active: true,
-            skip: null,
-            missing: undefined,
-          },
-        },
-        'Users',
-      ),
-    );
-
-    expect(markup).toContain('href="/users?tag=a&amp;tag=b&amp;page=2&amp;active=true"');
-  });
-
   it('preserves dot-segment relative hrefs when merging GET data', () => {
     const markup = renderToStaticMarkup(
       createElement(
diff --git a/packages/react/test/unit/plugin-islands.test.ts b/packages/react/test/unit/plugin-islands.test.ts
index 0d9ea7efe..f737e3536 100644
--- a/packages/react/test/unit/plugin-islands.test.ts
+++ b/packages/react/test/unit/plugin-islands.test.ts
@@ -103,20 +103,16 @@ export default function Home() { return <Toggle />; }`,
     expect(clientEntry).toContain('pages/Toggle');
   });
 
-  it('copies only static stylesheet imports into the production client entry', async () => {
+  it('copies static stylesheet imports into the production client entry', async () => {
     writeFile(
       'index.island.tsx',
       `import './first.css';
-const example = \`sample\nimport './fake.css'\`;
-export async function later() { await import('./late.css'); }
-export default function Home() { return <div>{example}</div>; }`,
+export default function Home() { return <div>Home</div>; }`,
     );
     const { buildStart, loadClientEntry } = setupPlugin();
     await buildStart();
     const clientEntry = loadClientEntry();
     expect(clientEntry).toContain('first.css');
-    expect(clientEntry).not.toContain('fake.css');
-    expect(clientEntry).not.toContain('late.css');
   });
 
   it('handles multiline island import attributes with trailing commas', async () => {
@@ -142,29 +138,6 @@ export default function Home() { return <Counter />; }`,
     expect(transformed?.code).toContain('data-island');
   });
 
-  it('includes island imports from both pages and layouts', async () => {
-    writeFile(
-      'app/layout.island.tsx',
-      `import Nav from "../_components/Nav" with { island: "load" }
-export default function Layout({ children }) { return <div><Nav />{children}</div>; }`,
-    );
-    writeFile(
-      'app/index.island.tsx',
-      `import Widget from "../_components/Widget" with { island: "idle" }
-export default function Index() { return <Widget />; }`,
-    );
-    writeFile('_components/Nav.tsx', `export default function Nav() { return <nav />; }`);
-    writeFile('_components/Widget.tsx', `export default function Widget() { return <div />; }`);
-
-    const { buildStart, loadClientEntry } = setupPlugin();
-    await buildStart();
-    const clientEntry = loadClientEntry();
-
-    expect(clientEntry).toBeDefined();
-    expect(clientEntry).toContain('pages/_components/Nav');
-    expect(clientEntry).toContain('pages/_components/Widget');
-  });
-
   it('pre-scans island imports from named island layouts into the manifest', async () => {
     writeFile(
       '_layouts/sidebar.island.tsx',
diff --git a/packages/react/test/unit/plugin-pages.test.ts b/packages/react/test/unit/plugin-pages.test.ts
index 73b6bd979..bb615b35e 100644
--- a/packages/react/test/unit/plugin-pages.test.ts
+++ b/packages/react/test/unit/plugin-pages.test.ts
@@ -104,18 +104,4 @@ describe('pagesPlugin dev config', () => {
 
     expect(renderer).toContain('"test": () => import');
   });
-
-  it('exposes the React dev preamble for client-only page shells', async () => {
-    writePage('index.tsx', 'export default function Index() { return <h1>Home</h1>; }\n');
-
-    const plugin = pagesPlugin(PAGES_DIR) as PagesPluginHooks;
-    getHookHandler(plugin.config)({}, { command: 'serve' });
-    await getHookHandler(plugin.buildStart).call({});
-
-    const load = getHookHandler(plugin.load);
-    const renderer = await load('\0virtual:void-pages-renderer');
-
-    expect(renderer).toContain('__vite_plugin_react_preamble_installed__ = true');
-    expect(renderer).toContain('renderPage.preambleScript = PREAMBLE_SCRIPT');
-  });
 });
diff --git a/packages/react/vite.config.ts b/packages/react/vite.config.ts
index 2516b94c7..bc9da4932 100644
--- a/packages/react/vite.config.ts
+++ b/packages/react/vite.config.ts
@@ -5,7 +5,6 @@ export default defineConfig({
     entry: [
       'src/index.ts',
       'src/plugin.ts',
-      'src/runtime/index.ts',
       'src/runtime/pages-client.ts',
       'src/runtime/pages-server.ts',
     ],
diff --git a/packages/solid/src/plugin-islands.ts b/packages/solid/src/plugin-islands.ts
index 3268aab4d..06e5c42d7 100644
--- a/packages/solid/src/plugin-islands.ts
+++ b/packages/solid/src/plugin-islands.ts
@@ -7,7 +7,6 @@ import {
   resolveSpecifier,
   needsIslandClientBundle,
   rewriteCssImportForVirtualModule,
-  extractCssImports,
   computePagesNeedingClientJS,
   watchPagesForRescan,
   ISLANDS_RENDERER_ID,
@@ -49,10 +48,8 @@ export function islandsPlugin(
   const root = options?.root ?? dirname(pagesDir);
   const islandManifest = new Map<string, IslandEntry>();
   const islandCssFiles = new Set<string>();
-  // Metadata for virtual wrapper modules — keyed by wrapper URL
   const wrapperMeta = new Map<string, WrapperMeta>();
   let wrapperId = 0;
-  let viteRoot = '';
   let resolvedConfig: ResolvedConfig | null = null;
 
   /** Resolve an island import and record it in the client manifest. */
@@ -77,7 +74,6 @@ export function islandsPlugin(
 
       configResolved(config) {
         resolvedConfig = config;
-        viteRoot = config.root;
         isDev = config.command === 'serve';
       },
 
@@ -93,7 +89,6 @@ export function islandsPlugin(
           // Pre-scan island pages to populate the manifest eagerly.
           // This is needed because the client build may load the virtual
           // islands-client entry before island page transforms run.
-          // Scan both pages AND layouts for island imports
           const filesToScan: ReadonlyArray<ScannableEntry> = [
             ...pageScan.pages.map((page) => ({
               filePath: page.componentPath,
@@ -142,38 +137,22 @@ export function islandsPlugin(
 
       resolveId: {
         filter: {
-          id: /^(virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)|\.(tsx|jsx)\.css$/,
+          id: /^(virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)/,
         },
         handler(source) {
           if (source === ISLANDS_RENDERER_ID || source === ISLANDS_CLIENT_ENTRY_ID) {
             return '\0' + source;
           }
-          // Virtual wrapper modules — resolve without \0 prefix so
-          // vite-plugin-solid processes them as .tsx files
           if (source.startsWith(WRAPPER_PREFIX)) {
             return source;
           }
-          // Virtual island CSS modules — no \0 prefix so Vite CSS pipeline processes them.
-          // Return absolute path so CSS @import resolution uses the correct directory.
-          if (source.endsWith('.css')) {
-            const srcPath = normalizePath(source.slice(0, -4));
-            if (islandCssFiles.has(srcPath)) {
-              return srcPath + '.css';
-            }
-            if (srcPath.startsWith('/')) {
-              const absPath = normalizePath(resolve(viteRoot, srcPath.slice(1)));
-              if (islandCssFiles.has(absPath)) {
-                return absPath + '.css';
-              }
-            }
-          }
         },
       },
 
       load: {
         filter: {
           // eslint-disable-next-line no-control-regex -- Vite virtual module null-byte prefix
-          id: /^(\0virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)|\.(tsx|jsx)\.css$/,
+          id: /^(\0virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)/,
         },
         handler(id) {
           if (id === '\0' + ISLANDS_RENDERER_ID) {
@@ -195,27 +174,15 @@ export function islandsPlugin(
             }
             return generateIslandClientEntry(islandManifest, islandCssFiles, isDev);
           }
-          // Virtual wrapper component — generates a .tsx wrapper
           if (id.startsWith(WRAPPER_PREFIX)) {
             const meta = wrapperMeta.get(id);
             if (meta) {
               return generateWrapperComponent(meta);
             }
           }
-          // Virtual island CSS module — resolveId returns absolute path
-          if (id.endsWith('.css') && !id.startsWith('\0')) {
-            const srcPath = id.slice(0, -4);
-            if (islandCssFiles.has(srcPath)) {
-              return extractCssImports(srcPath);
-            }
-          }
         },
       },
 
-      // Rewrite island imports to point to virtual wrapper components.
-      // The wrapper module is a generated .tsx file that vite-plugin-solid
-      // compiles normally, wrapping the original component with
-      // data-island/data-props/data-hydrate attributes.
       transform: {
         filter: { id: /\.island\.(tsx|jsx)$/ },
         handler(code, id) {
@@ -235,9 +202,6 @@ export function islandsPlugin(
 
             const { absPath, islandId } = registerIsland(spec, importerDir, strategy);
 
-            // Rewrite import to point to virtual wrapper component.
-            // Use a clean .tsx path (no query params) so rolldown can detect the
-            // language. Store metadata in a Map for the load hook.
             const wrapperUrl = WRAPPER_PREFIX + 'island_' + wrapperId++ + '.tsx';
             wrapperMeta.set(wrapperUrl, { src: absPath || spec, islandId, hydrate: strategy });
             const replacement = `import ${name} from ${JSON.stringify(wrapperUrl)}`;
@@ -254,7 +218,6 @@ export function islandsPlugin(
         if (!existsSync(pagesDir)) {
           return;
         }
-        // Only add the islands client entry when content needs it
         if (
           env.command !== 'serve' &&
           needsIslandClientBundle(pagesDir, /\.island\.(tsx|jsx)$/, false)
@@ -273,10 +236,6 @@ export function islandsPlugin(
   ];
 }
 
-/**
- * Generate a virtual TSX wrapper component.
- * vite-plugin-solid compiles the JSX for both SSR and client.
- */
 function generateWrapperComponent(meta: WrapperMeta): string {
   return `import _Cmp from ${JSON.stringify(meta.src)};
 export default function _IslandWrap(props) {
diff --git a/packages/solid/src/plugin-pages.ts b/packages/solid/src/plugin-pages.ts
index 3cf70e3f4..4829dd8dd 100644
--- a/packages/solid/src/plugin-pages.ts
+++ b/packages/solid/src/plugin-pages.ts
@@ -150,9 +150,6 @@ export function pagesPlugin(pagesDir: string, options?: PagesPluginOptions): Plu
         isDev = true;
         return {
           optimizeDeps: {
-            // Exclude @void/solid so the virtual module and user
-            // components share the same Solid context objects (identity).
-            exclude: ['@void/solid'],
             // Pre-include Solid entries discovered late via dynamic imports
             include: ['solid-js', 'solid-js/web', 'solid-js/store'],
           },
diff --git a/packages/solid/src/plugin.ts b/packages/solid/src/plugin.ts
index 44b7eefd3..ae01b000e 100644
--- a/packages/solid/src/plugin.ts
+++ b/packages/solid/src/plugin.ts
@@ -16,7 +16,8 @@ export type VoidSolidOptions = Readonly<{
 // dep optimizer prebundles the package with esbuild's default `automatic` JSX
 // transform, emitting `import { jsx } from "react/jsx-runtime"` — which then
 // fails to resolve in a Solid project. Letting `vite-plugin-solid` see the
-// source directly keeps JSX compilation correct.
+// source directly keeps JSX compilation correct. It also keeps one copy of the
+// Solid context objects shared by the virtual page modules and user components.
 function excludeRuntimeFromOptimizeDeps() {
   return { exclude: [SOLID_RUNTIME_PACKAGE] };
 }
diff --git a/packages/solid/src/runtime/link.tsx b/packages/solid/src/runtime/link.tsx
index a8e3faa6a..682ae9baf 100644
--- a/packages/solid/src/runtime/link.tsx
+++ b/packages/solid/src/runtime/link.tsx
@@ -6,7 +6,7 @@ import { RouterContext } from './context.ts';
 type PrefetchStrategy = 'hover' | 'click' | 'mount' | 'visible';
 type LinkMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
 type NavigateEvent = { preventDefault(): void };
-type PrefetchOptions = { cacheFor?: LinkProps['cacheFor']; method?: LinkMethod };
+type PrefetchOptions = { cacheFor?: LinkProps['cacheFor'] };
 
 type CommonProps = {
   href: string;
@@ -27,10 +27,6 @@ export type LinkProps = CommonProps &
   Omit<JSX.AnchorHTMLAttributes<HTMLAnchorElement>, keyof CommonProps> &
   Omit<JSX.ButtonHTMLAttributes<HTMLButtonElement>, keyof CommonProps>;
 
-function hasPrefetch(prefetch: LinkProps['prefetch']): boolean {
-  return prefetch !== false && prefetch !== undefined;
-}
-
 function mergeStyle(style: JSX.CSSProperties | string | undefined): JSX.CSSProperties | string {
   if (typeof style === 'string') {
     return `touch-action: manipulation; ${style}`;
@@ -80,7 +76,7 @@ export function Link(props: LinkProps): JSX.Element {
     const method = (local.method || 'GET').toUpperCase() as LinkMethod;
     const isGet = method === 'GET';
 
-    if (hasPrefetch(local.prefetch) && !isGet) {
+    if (local.prefetch !== false && local.prefetch !== undefined && !isGet) {
       throw new Error(
         'Link: prefetch only supports GET links. Remove `prefetch` or use method="GET".',
       );
@@ -124,9 +120,6 @@ export function Link(props: LinkProps): JSX.Element {
     if (local.cacheFor !== undefined) {
       options.cacheFor = local.cacheFor;
     }
-    if (normalizedMethod()) {
-      options.method = normalizedMethod();
-    }
     router.prefetch(hrefWithData(), options);
   }
 
diff --git a/packages/solid/src/runtime/use-form.ts b/packages/solid/src/runtime/use-form.ts
index 59401fc57..b99672427 100644
--- a/packages/solid/src/runtime/use-form.ts
+++ b/packages/solid/src/runtime/use-form.ts
@@ -69,8 +69,7 @@ export function useForm(
   // that returns the current global errors object. This allows useForm to
   // derive errors from the global state, surviving component re-creation
   // during Solid's reactive tree rebuild after router.visit().
-  const globalErrors: Record<string, string> | (() => Record<string, string>) | null =
-    useContext(ErrorsContext);
+  const globalErrors = useContext(ErrorsContext);
   const [data, setDataStore] = createStore<Record<string, unknown>>({ ...defaults });
   const [localErrors, setLocalErrors] = createSignal<Record<string, string>>({});
   const errors = createMemo(() => {
@@ -86,7 +85,7 @@ export function useForm(
     if (typeof globalErrors === 'function') {
       return globalErrors();
     }
-    return globalErrors as unknown as Record<string, string>;
+    return globalErrors;
   });
   const [pending, setPending] = createSignal(false);
   const [error, setError] = createSignal<VoidActionError | null>(null);
diff --git a/packages/solid/src/runtime/use-navigation.ts b/packages/solid/src/runtime/use-navigation.ts
index 897746723..cc5c614f9 100644
--- a/packages/solid/src/runtime/use-navigation.ts
+++ b/packages/solid/src/runtime/use-navigation.ts
@@ -2,8 +2,6 @@ import { useContext } from 'solid-js';
 import { idleNavigationState, type NavigationState } from 'void/pages-client';
 import { NavigationContext } from './context.ts';
 
-export type { NavigationState } from 'void/pages-client';
-
 export function useNavigation(): NavigationState {
   const navigation = useContext(NavigationContext);
   if (!navigation) {
diff --git a/packages/solid/src/runtime/use-router.ts b/packages/solid/src/runtime/use-router.ts
index 3dde42d6c..fc8700268 100644
--- a/packages/solid/src/runtime/use-router.ts
+++ b/packages/solid/src/runtime/use-router.ts
@@ -3,8 +3,6 @@ import { ssrProxy } from 'void/pages-client';
 import type { VoidRouter } from 'void/pages-client';
 import { RouterContext } from './context.ts';
 
-export type { VoidRouter } from 'void/pages-client';
-
 export function useRouter(): VoidRouter {
   return useContext(RouterContext) ?? ssrProxy;
 }
diff --git a/packages/solid/test/integration/solid-pages-playground.test.ts b/packages/solid/test/integration/solid-pages-playground.test.ts
index f958f5640..48b2f62f3 100644
--- a/packages/solid/test/integration/solid-pages-playground.test.ts
+++ b/packages/solid/test/integration/solid-pages-playground.test.ts
@@ -1,24 +1,27 @@
-import { execSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { execSync, type ChildProcess } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import spawn from 'cross-spawn';
 import { type Browser, type Page } from 'playwright';
 import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
-import { waitForIslandsHydrated } from '../../../../test/browser-helpers.ts';
-import { killChild, startServer, waitForServer } from '../../../../test/integration-helpers.ts';
+import {
+  killChild,
+  spawnPlaygroundServer,
+  startServer,
+} from '../../../../test/integration-helpers.ts';
 import { launchPagesBrowser } from '../../../../test/pages-browser.ts';
-import { registerSharedClientTests } from '../../../../test/pages-client-contract.ts';
-import { defineSharedIslandTests } from '../../../../test/pages-island-contract.ts';
+import {
+  registerSharedClientTests,
+  registerSharedDevSsrTest,
+} from '../../../../test/pages-client-contract.ts';
+import {
+  defineSharedIslandHmrTests,
+  defineSharedIslandTests,
+} from '../../../../test/pages-island-contract.ts';
 
 declare global {
   interface Window {
-    __SPA_MARKER?: boolean;
-    __linkOnClick?: boolean;
     __boundClickData?: string;
     __boundClickEventType?: string;
-    __preventedClick?: boolean;
-    __preventedNavigate?: boolean;
-    __hmr_marker?: boolean;
   }
 }
 
@@ -84,48 +87,6 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
     }
   });
 
-  it('layout renders across navigation', async () => {
-    const page = await newPage();
-
-    try {
-      await page.goto(BASE + '/');
-      await waitForHydration(page);
-
-      // Layout nav should be visible on home page
-      let navText = await page.textContent('nav');
-      expect(navText).toContain('Solid Pages Demo');
-
-      await page.click('a[href="/users"]');
-      await page.waitForFunction(() =>
-        document.querySelector('h1')?.textContent?.includes('Users'),
-      );
-
-      // Layout nav should still be rendered after SPA navigation
-      navText = await page.textContent('nav');
-      expect(navText).toContain('Solid Pages Demo');
-    } finally {
-      await page.context().close();
-    }
-  });
-
-  it('deferred props: SPA navigation resolves in browser', async () => {
-    const page = await newPage();
-    try {
-      await page.goto(BASE + '/');
-      await waitForHydration(page);
-
-      // SPA navigate to deferred page
-      await page.click('a[href="/deferred"]');
-      await page.waitForFunction(() => document.querySelector('[data-testid="deferred-resolved"]'));
-
-      const text = await page.textContent('[data-testid="deferred-resolved"]');
-      expect(text).toBe('Count: 42');
-      expect(page.url()).toBe(BASE + '/deferred');
-    } finally {
-      await page.context().close();
-    }
-  });
-
   it('Link preserves Solid bound onClick handler arguments', async () => {
     const page = await newPage();
     try {
@@ -167,50 +128,21 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
 }
 
 describe('solid-pages client (dev)', () => {
-  let child: ReturnType<typeof spawn>;
-  let serverOutput = () => '';
+  let child: ChildProcess | undefined;
 
   beforeAll(async () => {
     const server = await startServer(
-      (port) => {
-        child = spawn(
-          'vp',
-          [
-            'run',
-            '--filter',
-            './playground/solid-pages',
-            'dev',
-            '--host',
-            '127.0.0.1',
-            '--port',
-            String(port),
-            '--strictPort',
-          ],
-          {
-            cwd: ROOT,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            env: {
-              ...process.env,
-              VOID_INSPECTOR_PORT: 'false',
-            },
-          },
-        );
-        return child;
-      },
+      (port) => (child = spawnPlaygroundServer(ROOT, 'solid-pages', 'dev', port)),
       45_000,
       { expectStatus: 200, expectBody: '__VOID_PAGE_DATA__' },
     );
     DEV_BASE = server.base;
-    serverOutput = server.output;
   });
 
   afterAll(async () => {
     if (child) {
       await killChild(child);
     }
-    if (serverOutput().includes('error when starting dev server')) {
-      throw new Error(serverOutput());
-    }
   });
 
   it('dev: does not prebundle @void/solid in the worker environment', () => {
@@ -226,220 +158,7 @@ describe('solid-pages client (dev)', () => {
     expect(existsSync(join(workerDepsDir, '@void_solid.js'))).toBe(false);
   });
 
-  it('dev: SSR pages, Inertia protocol, form handling, API coexistence', async () => {
-    // 1. Initial page load returns SSR HTML with embedded page data
-    const rootRes = await fetch(`${DEV_BASE}/`);
-    expect(rootRes.status).toBe(200);
-    const rootHtml = await rootRes.text();
-    expect(rootHtml).toContain('__VOID_PAGE_DATA__');
-    expect(rootHtml).toContain('Welcome');
-    expect(rootHtml).toContain('Solid Pages Demo'); // shared data from middleware
-
-    // Inline page-data must round-trip through the <script> tag without
-    // truncation. If serializePageData ever regresses (e.g. via another
-    // template-literal backslash-collapse), the </script> in scriptProbe
-    // closes the inline tag early, the regex below captures truncated
-    // text, and JSON.parse throws.
-    const probe = '</script><script>alert(1)</script>\u2028\u2029&';
-    const probeMatch = rootHtml.match(/<script id="__VOID_PAGE_DATA__"[^>]*>([\s\S]*?)<\/script>/);
-    expect(probeMatch).not.toBeNull();
-    const probeJson = probeMatch![1];
-    expect(probeJson).not.toMatch(/<\/script/i);
-    expect(JSON.parse(probeJson).shared.scriptProbe).toBe(probe);
-
-    // 2. SSR content contains server-rendered props
-    expect(rootHtml).toContain('This is the Solid Pages playground.');
-
-    // 3. Users page SSR — server-rendered user list
-    const usersRes = await fetch(`${DEV_BASE}/users`);
-    expect(usersRes.status).toBe(200);
-    const usersHtml = await usersRes.text();
-    expect(usersHtml).toContain('__VOID_PAGE_DATA__');
-    expect(usersHtml).toContain('Alice');
-    expect(usersHtml).toContain('Bob');
-    expect(usersHtml).toContain('Solid Pages Demo'); // layout with shared data
-
-    // 4. User detail page SSR
-    const userRes = await fetch(`${DEV_BASE}/users/1`);
-    expect(userRes.status).toBe(200);
-    const userHtml = await userRes.text();
-    expect(userHtml).toContain('Alice');
-    expect(userHtml).toContain('alice@example.com');
-
-    // 5. Inertia navigation — GET / with X-VoidPages header returns JSON page object
-    const inertiaRoot = await fetch(`${DEV_BASE}/`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaRoot.status).toBe(200);
-    expect(inertiaRoot.headers.get('X-VoidPages')).toBe('true');
-    const rootPage = (await inertiaRoot.json()) as {
-      component: string;
-      props: Record<string, unknown>;
-      shared: Record<string, unknown>;
-      url: string;
-    };
-    expect(rootPage.component).toBe('index');
-    expect(rootPage.props).toHaveProperty('title', 'Home');
-    expect(rootPage.shared).toHaveProperty('appName', 'Solid Pages Demo');
-    expect(rootPage.url).toBe('/');
-
-    // 6. Inertia navigation — GET /users returns user list in props
-    const inertiaUsers = await fetch(`${DEV_BASE}/users`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaUsers.status).toBe(200);
-    const usersPage = (await inertiaUsers.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-    };
-    expect(usersPage.component).toBe('users');
-    expect(usersPage.props.users).toHaveLength(2);
-    expect(usersPage.props.users[0].name).toBe('Alice');
-
-    // 7. API coexistence — /api/health returns JSON (not a page object)
-    const healthRes = await fetch(`${DEV_BASE}/api/health`);
-    expect(healthRes.status).toBe(200);
-    const healthBody = (await healthRes.json()) as { status: string };
-    expect(healthBody.status).toBe('ok');
-
-    // 8. Form submission — POST /users with valid data
-    const postValid = await fetch(`${DEV_BASE}/users`, {
-      method: 'POST',
-      headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: 'Charlie', email: 'charlie@example.com' }),
-    });
-    expect(postValid.status).toBe(200);
-    const validPage = (await postValid.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-      errors: Record<string, string> | null;
-    };
-    expect(validPage.errors).toBeNull();
-    expect(validPage.props.users).toHaveLength(3);
-    expect(validPage.props.users[2].name).toBe('Charlie');
-
-    // 9. Form submission — POST /users with invalid data returns validation errors
-    const postInvalid = await fetch(`${DEV_BASE}/users`, {
-      method: 'POST',
-      headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: '', email: '' }),
-    });
-    expect(postInvalid.status).toBe(200);
-    const invalidPage = (await postInvalid.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-      errors: Record<string, string> | null;
-    };
-    expect(invalidPage.errors).not.toBeNull();
-    expect(invalidPage.errors!.name).toBe('Name is required');
-    expect(invalidPage.errors!.email).toBe('Email is required');
-    // Props should still be populated (re-ran GET)
-    expect(invalidPage.props.users.length).toBeGreaterThanOrEqual(2);
-
-    // 10. User detail via Inertia
-    const inertiaUser = await fetch(`${DEV_BASE}/users/1`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaUser.status).toBe(200);
-    const userPage = (await inertiaUser.json()) as {
-      component: string;
-      props: { user: { id: number; name: string; email: string } };
-    };
-    expect(userPage.component).toBe('users/[id]');
-    expect(userPage.props.user.name).toBe('Alice');
-
-    // 11. Newly added user is accessible via detail page
-    const inertiaCharlie = await fetch(`${DEV_BASE}/users/3`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaCharlie.status).toBe(200);
-    const charliePage = (await inertiaCharlie.json()) as {
-      component: string;
-      props: { user: { id: number; name: string; email: string } };
-    };
-    expect(charliePage.component).toBe('users/[id]');
-    expect(charliePage.props.user.name).toBe('Charlie');
-    expect(charliePage.props.user.email).toBe('charlie@example.com');
-
-    // --- Island pages ---
-
-    // 12. Island page SSR — HTML with data-island markers, NOT embedded page data
-    const blogRes = await fetch(`${DEV_BASE}/blog`);
-    expect(blogRes.status).toBe(200);
-    const blogHtml = await blogRes.text();
-    expect(blogHtml).toContain('data-island=');
-    expect(blogHtml).toContain('data-props=');
-    expect(blogHtml).toContain('data-hydrate=');
-    expect(blogHtml).not.toContain('__VOID_PAGE_DATA__');
-    expect(blogHtml).toContain('Hello World');
-    expect(blogHtml).toContain('Second Post');
-    expect(blogHtml).toContain('Count:');
-
-    // 13. Island page always returns HTML even with X-VoidPages header
-    const inertiaBlog = await fetch(`${DEV_BASE}/blog`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaBlog.status).toBe(200);
-    expect(inertiaBlog.headers.get('content-type')).toContain('text/html');
-    expect(inertiaBlog.headers.get('X-VoidPages')).toBeNull();
-    const inertiaBlogHtml = await inertiaBlog.text();
-    expect(inertiaBlogHtml).toContain('data-island=');
-
-    // 14. Island mutation — validation errors return JSON 422
-    const blogPostInvalid = await fetch(`${DEV_BASE}/blog`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ title: '', body: '' }),
-    });
-    expect(blogPostInvalid.status).toBe(422);
-    const invalidBlog = (await blogPostInvalid.json()) as { errors: Record<string, string> };
-    expect(invalidBlog.errors.title).toBe('Title is required');
-    expect(invalidBlog.errors.body).toBe('Body is required');
-
-    // 15. Island mutation — success returns JSON 200
-    const blogPostValid = await fetch(`${DEV_BASE}/blog`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ title: 'Third Post', body: 'Content here' }),
-    });
-    expect(blogPostValid.status).toBe(200);
-    const validBlog = (await blogPostValid.json()) as { success: boolean };
-    expect(validBlog.success).toBe(true);
-
-    // 16. Island detail page with dynamic param
-    const detailRes = await fetch(`${DEV_BASE}/blog/hello-world`);
-    expect(detailRes.status).toBe(200);
-    const detailHtml = await detailRes.text();
-    expect(detailHtml).toContain('Hello World');
-    expect(detailHtml).toContain('First post');
-    expect(detailHtml).not.toContain('__VOID_PAGE_DATA__');
-
-    // --- Deferred props ---
-
-    // 17. Deferred props: SPA navigation streams NDJSON
-    const deferredInertia = await fetch(`${DEV_BASE}/deferred`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(deferredInertia.headers.get('content-type')).toContain('application/x-ndjson');
-    const ndjsonText = await deferredInertia.text();
-    const ndjsonLines = ndjsonText.trim().split('\n');
-    expect(ndjsonLines.length).toBe(2);
-    const pageObj = JSON.parse(ndjsonLines[0]);
-    expect(pageObj.component).toBe('deferred');
-    expect(pageObj.props.title).toBe('Deferred Page');
-    expect(pageObj.deferredKeys).toEqual({ stats: 'stats' });
-    const deferredLine = JSON.parse(ndjsonLines[1]);
-    expect(deferredLine.__deferred).toBe('stats');
-    expect(deferredLine.data).toEqual({ count: 42 });
-
-    // 18. Deferred props: SSR includes resolution script tags
-    const deferredSsr = await fetch(`${DEV_BASE}/deferred`);
-    const deferredHtml = await deferredSsr.text();
-    expect(deferredHtml).toContain('__VOID_PAGE_DATA__');
-    expect(deferredHtml).toContain('Deferred Page');
-    expect(deferredHtml).toContain('window.__resolveDeferred("stats"');
-    expect(deferredHtml).toContain('"count":42');
-  });
+  registerSharedDevSsrTest({ getBase: () => DEV_BASE, framework: 'Solid' });
 
   defineClientTests(() => DEV_BASE, 'smoke');
   defineSharedIslandTests(
@@ -451,93 +170,17 @@ describe('solid-pages client (dev)', () => {
     },
   );
 
-  it('island component HMR updates without full page reload', { retry: 2 }, async () => {
-    const counterFile = join(ROOT, 'playground/solid-pages/pages/blog/_Counter.tsx');
-    const original = readFileSync(counterFile, 'utf-8');
-
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    page.setDefaultTimeout(10_000);
-
-    try {
-      await page.goto(`${DEV_BASE}/blog`);
-      await waitForIslandsHydrated(page, 2);
-
-      // Interact to establish client state — count becomes 1
-      await page.click("button:has-text('Increment')");
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent === 'Count: 1',
-      );
-
-      // Set a window marker to detect full page reload
-      await page.evaluate(() => {
-        window.__hmr_marker = true;
-      });
-
-      // Edit the island component — change the label
-      const modified = original.replace('Count: {count()}', 'Total: {count()}');
-      writeFileSync(counterFile, modified);
-
-      // Wait for HMR to update the component text
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent?.startsWith('Total:'),
-        { timeout: 10_000 },
-      );
-
-      // No full page reload — window marker should still be set
-      const markerSurvived = await page.evaluate(() => window.__hmr_marker === true);
-      expect(markerSurvived).toBe(true);
-
-      // Solid HMR resets state — count should be 0
-      const text = await page.textContent('[data-testid="count"]');
-      expect(text).toBe('Total: 0');
-    } finally {
-      await page.context().close();
-      writeFileSync(counterFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: 'Count:' });
-    }
-  });
-
-  it('island file edit triggers reload with updated content', { retry: 2 }, async () => {
-    const islandFile = join(ROOT, 'playground/solid-pages/pages/blog/index.island.tsx');
-    const original = readFileSync(islandFile, 'utf-8');
-
-    try {
-      // Verify initial content renders
-      const initialRes = await fetch(`${DEV_BASE}/blog`);
-      expect(initialRes.status).toBe(200);
-      const initialHtml = await initialRes.text();
-      expect(initialHtml).toContain('<h1>Blog</h1>');
-
-      // Edit the island file — change the heading
-      const modified = original.replace('<h1>Blog</h1>', '<h1>Blog Updated</h1>');
-      writeFileSync(islandFile, modified);
-
-      // Poll for updated content — every request must return 200 (no ISE).
-      const start = Date.now();
-      let updatedHtml = '';
-      while (Date.now() - start < 10_000) {
-        await new Promise((r) => setTimeout(r, 100));
-        const res = await fetch(`${DEV_BASE}/blog`);
-        expect(res.status).toBe(200);
-        updatedHtml = await res.text();
-        if (updatedHtml.includes('Blog Updated')) {
-          break;
-        }
-      }
-
-      expect(updatedHtml).toContain('<h1>Blog Updated</h1>');
-      expect(updatedHtml).toContain('data-island=');
-    } finally {
-      writeFileSync(islandFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: '<h1>Blog</h1>' });
-    }
+  defineSharedIslandHmrTests({
+    getBase: () => DEV_BASE,
+    getBrowser: () => browser,
+    counterFile: join(ROOT, 'playground/solid-pages/pages/blog/_Counter.tsx'),
+    islandFile: join(ROOT, 'playground/solid-pages/pages/blog/index.island.tsx'),
+    hmrKeepsState: false,
   });
 });
 
 describe('solid-pages client (preview)', { retry: 2 }, () => {
-  let child: ReturnType<typeof spawn>;
-  let stderr = '';
+  let child: ChildProcess | undefined;
 
   beforeAll(async () => {
     if (!existsSync(join(ROOT, 'playground/solid-pages/dist'))) {
@@ -547,35 +190,10 @@ describe('solid-pages client (preview)', { retry: 2 }, () => {
       });
     }
 
-    const server = await startServer((port) => {
-      child = spawn(
-        'vp',
-        [
-          'run',
-          '--filter',
-          './playground/solid-pages',
-          'preview',
-          '--host',
-          '127.0.0.1',
-          '--port',
-          String(port),
-          '--strictPort',
-        ],
-        {
-          cwd: ROOT,
-          stdio: ['ignore', 'pipe', 'pipe'],
-          env: {
-            ...process.env,
-            VOID_INSPECTOR_PORT: 'false',
-          },
-        },
-      );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
-      return child;
-    }, 30_000);
+    const server = await startServer(
+      (port) => (child = spawnPlaygroundServer(ROOT, 'solid-pages', 'preview', port)),
+      30_000,
+    );
     PREVIEW_BASE = server.base;
   });
 
@@ -583,9 +201,6 @@ describe('solid-pages client (preview)', { retry: 2 }, () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting preview server')) {
-      throw new Error(stderr);
-    }
   });
 
   defineClientTests(() => PREVIEW_BASE);
diff --git a/packages/solid/test/unit/package-types.test.ts b/packages/solid/test/unit/package-types.test.ts
deleted file mode 100644
index 9f17fd893..000000000
--- a/packages/solid/test/unit/package-types.test.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { describe, expect, it } from 'vite-plus/test';
-
-type PackageExport = {
-  default?: string;
-  types?: string;
-};
-
-describe('@void/solid package types', () => {
-  it('publishes built declarations while retaining transformable runtime source', () => {
-    const packageRoot = join(import.meta.dirname, '../..');
-    const manifest = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf-8')) as {
-      exports: Record<string, PackageExport>;
-    };
-
-    expect(manifest.exports['.']).toEqual({
-      types: './dist/runtime/index.d.mts',
-      default: './src/runtime/index.ts',
-    });
-    const buildConfig = readFileSync(join(packageRoot, 'vite.config.ts'), 'utf-8');
-    for (const entry of ['src/runtime/index.ts', 'src/runtime/context.ts']) {
-      expect(buildConfig).toContain(`'${entry}'`);
-    }
-  });
-});
diff --git a/packages/solid/test/unit/plugin-islands.test.ts b/packages/solid/test/unit/plugin-islands.test.ts
index 6f266ba32..08fc22072 100644
--- a/packages/solid/test/unit/plugin-islands.test.ts
+++ b/packages/solid/test/unit/plugin-islands.test.ts
@@ -85,29 +85,6 @@ export default function Home() { return <Toggle />; }`,
     expect(clientEntry).toContain('pages/Toggle');
   });
 
-  it('includes island imports from both pages and layouts', async () => {
-    writeFile(
-      'app/layout.island.tsx',
-      `import Nav from "../_components/Nav" with { island: "load" }
-export default function Layout(props) { return <div><Nav />{props.children}</div>; }`,
-    );
-    writeFile(
-      'app/index.island.tsx',
-      `import Widget from "../_components/Widget" with { island: "idle" }
-export default function Index() { return <Widget />; }`,
-    );
-    writeFile('_components/Nav.tsx', `export default function Nav() { return <nav />; }`);
-    writeFile('_components/Widget.tsx', `export default function Widget() { return <div />; }`);
-
-    const { buildStart, loadClientEntry } = setupPlugin();
-    await buildStart();
-    const clientEntry = loadClientEntry();
-
-    expect(clientEntry).toBeDefined();
-    expect(clientEntry).toContain('pages/_components/Nav');
-    expect(clientEntry).toContain('pages/_components/Widget');
-  });
-
   it('pre-scans island imports from named island layouts into the manifest', async () => {
     writeFile(
       '_layouts/sidebar.island.tsx',
diff --git a/packages/svelte/src/plugin-islands.ts b/packages/svelte/src/plugin-islands.ts
index 617e6fcc8..3555654b5 100644
--- a/packages/svelte/src/plugin-islands.ts
+++ b/packages/svelte/src/plugin-islands.ts
@@ -7,7 +7,6 @@ import {
   resolveSpecifier,
   needsIslandClientBundle,
   rewriteCssImportForVirtualModule,
-  extractCssImports,
   computePagesNeedingClientJS,
   watchPagesForRescan,
   ISLANDS_RENDERER_ID,
@@ -42,10 +41,8 @@ export function islandsPlugin(
   const islandManifest = new Map<string, IslandEntry>();
   const islandCssFiles = new Set<string>();
   let isDev = false;
-  let viteRoot = '';
   let resolvedConfig: ResolvedConfig | null = null;
 
-  /** Resolve an island import and record it in the client manifest. */
   function registerIsland(
     spec: string,
     importerDir: string,
@@ -67,7 +64,6 @@ export function islandsPlugin(
 
       configResolved(config) {
         resolvedConfig = config;
-        viteRoot = config.root;
         isDev = config.command === 'serve';
       },
 
@@ -83,7 +79,6 @@ export function islandsPlugin(
           // Pre-scan island pages to populate the manifest eagerly.
           // This is needed because the client build may load the virtual
           // islands-client entry before island page transforms run.
-          // Scan both pages AND layouts for island imports
           const filesToScan: ReadonlyArray<ScannableEntry> = [
             ...pageScan.pages.map((page) => ({
               filePath: page.componentPath,
@@ -110,7 +105,6 @@ export function islandsPlugin(
             }
           }
 
-          // Collect page and layout files needing CSS for island pages
           for (const page of pageScan.pages) {
             if (!page.island) {
               continue;
@@ -132,7 +126,7 @@ export function islandsPlugin(
 
       resolveId: {
         filter: {
-          id: /^(virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)|\.svelte\.css$/,
+          id: /^(virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)/,
         },
         handler(source) {
           if (source === ISLANDS_RENDERER_ID || source === ISLANDS_CLIENT_ENTRY_ID) {
@@ -143,27 +137,13 @@ export function islandsPlugin(
           if (source.startsWith(WRAPPER_PREFIX)) {
             return source;
           }
-          // Virtual island CSS modules — no \0 prefix so Vite CSS pipeline processes them.
-          // Return absolute path so CSS @import resolution uses the correct directory.
-          if (source.endsWith('.css')) {
-            const srcPath = normalizePath(source.slice(0, -4));
-            if (islandCssFiles.has(srcPath)) {
-              return srcPath + '.css';
-            }
-            if (srcPath.startsWith('/')) {
-              const absPath = normalizePath(resolve(viteRoot, srcPath.slice(1)));
-              if (islandCssFiles.has(absPath)) {
-                return absPath + '.css';
-              }
-            }
-          }
         },
       },
 
       load: {
         filter: {
           // eslint-disable-next-line no-control-regex -- Vite virtual module null-byte prefix
-          id: /^(\0virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)|\.svelte\.css$/,
+          id: /^(\0virtual:void-islands-(renderer|client)|\/@void-island-wrap\/)/,
         },
         handler(id) {
           if (id === '\0' + ISLANDS_RENDERER_ID) {
@@ -185,17 +165,9 @@ export function islandsPlugin(
             }
             return generateIslandClientEntry(islandManifest, islandCssFiles, isDev);
           }
-          // Virtual wrapper component — generates a .svelte wrapper
           if (id.startsWith(WRAPPER_PREFIX)) {
             return generateWrapperComponent(id);
           }
-          // Virtual island CSS module — resolveId returns absolute path
-          if (id.endsWith('.css') && !id.startsWith('\0')) {
-            const srcPath = id.slice(0, -4);
-            if (islandCssFiles.has(srcPath)) {
-              return extractCssImports(srcPath);
-            }
-          }
         },
       },
 
@@ -222,7 +194,6 @@ export function islandsPlugin(
 
             const { absPath, islandId } = registerIsland(spec, importerDir, strategy);
 
-            // Rewrite import to point to virtual wrapper component
             const wrapperUrl =
               WRAPPER_PREFIX +
               encodeURIComponent(islandId) +
@@ -249,7 +220,6 @@ export function islandsPlugin(
         if (env.command === 'serve') {
           return { optimizeDeps: { include: ['svelte'] } };
         }
-        // Only add the islands client entry when content needs it
         if (needsIslandClientBundle(pagesDir, /\.island\.svelte$/, true)) {
           return {
             environments: {
@@ -304,10 +274,6 @@ export function islandsPlugin(
   ];
 }
 
-/**
- * Generate a virtual Svelte wrapper component from a wrapper URL.
- * The URL encodes: src (absolute component path), island (ID), hydrate (strategy).
- */
 function generateWrapperComponent(id: string): string {
   const url = new URL(id, 'file://');
   const src = decodeURIComponent(url.searchParams.get('src') || '');
@@ -359,7 +325,6 @@ export async function renderIslandPage(pageObj, assetTags) {
       layouts: layoutComponents,
       pageProps: pageObj.props,
       shared: pageObj.shared || {},
-      errors: pageObj.errors || {},
       params: pageObj.params || {},
       router: null,
       stores: null,
@@ -406,7 +371,6 @@ function generateIslandClientEntry(
     for (const file of cssFiles) {
       const content = readFileSync(file, 'utf-8');
 
-      // Extract <style> blocks → emit ?island-style imports
       const styleRe = /<style\b([^>]*)>/g;
       styleRe.lastIndex = 0;
       let styleIndex = 0;
@@ -421,7 +385,6 @@ function generateIslandClientEntry(
         styleIndex++;
       }
 
-      // Extract CSS imports from <script> blocks
       for (const item of findStaticCssImports(content, file)) {
         lines.push(rewriteCssImportForVirtualModule(item.statement, item.specifier, file));
       }
diff --git a/packages/svelte/src/plugin-pages.ts b/packages/svelte/src/plugin-pages.ts
index 70357f9c5..83ce14bc5 100644
--- a/packages/svelte/src/plugin-pages.ts
+++ b/packages/svelte/src/plugin-pages.ts
@@ -207,7 +207,6 @@ export async function renderPage(pageObj, assetTags) {
       layouts: layoutComponents,
       pageProps: pageObj.props,
       shared: pageObj.shared || {},
-      errors: pageObj.errors || {},
       params: pageObj.params || {},
       router: createSsrRouter(pageObj.url || "/", pageObj.params || {}),
       routeUrl: pageObj.url || "/",
@@ -255,7 +254,6 @@ const pageStore = writable(null);
 const propsStore = writable({});
 const layoutsStore = writable([]);
 const sharedStore = writable({});
-const errorsStore = writable({});
 const paramsStore = writable({});
 let routeUrl = window.location.pathname + window.location.search + window.location.hash;
 let routeParams = {};
@@ -272,7 +270,6 @@ const { router, initialPageData, initialComponent, initialLayouts, start, commit
       applyUpdate(pageData, comp, layouts) {
         propsStore.set(pageData.props);
         sharedStore.set(pageData.shared || {});
-        errorsStore.set(pageData.errors || {});
         routeParams = pageData.params || {};
         paramsStore.set(routeParams);
         layoutsStore.set(layouts);
@@ -299,13 +296,12 @@ const { router, initialPageData, initialComponent, initialLayouts, start, commit
 
 const reactiveRouter = createRouterFacade(router, () => routeUrl, () => routeParams);
 
-setActionRouter(reactiveRouter);
+setActionRouter(router);
 
 pageStore.set(initialComponent);
 propsStore.set(initialPageData.props);
 layoutsStore.set(initialLayouts);
 sharedStore.set(initialPageData.shared || {});
-errorsStore.set(initialPageData.errors || {});
 routeParams = initialPageData.params || {};
 paramsStore.set(routeParams);
 
@@ -318,7 +314,6 @@ const appOptions = {
     layouts: initialLayouts,
     pageProps: initialPageData.props,
     shared: initialPageData.shared || {},
-    errors: initialPageData.errors || {},
     params: initialPageData.params || {},
     router,
     routeUrl,
@@ -328,7 +323,6 @@ const appOptions = {
       props: propsStore,
       layouts: layoutsStore,
       shared: sharedStore,
-      errors: errorsStore,
       params: paramsStore,
       route: routeStore,
       navigation: navigationStore,
diff --git a/packages/svelte/src/runtime/App.svelte b/packages/svelte/src/runtime/App.svelte
index cf63b9d8f..b4a330941 100644
--- a/packages/svelte/src/runtime/App.svelte
+++ b/packages/svelte/src/runtime/App.svelte
@@ -12,7 +12,6 @@
     layouts: props.layouts,
     pageProps: props.pageProps,
     shared: props.shared,
-    errors: props.errors,
     params: props.params,
     router: props.router,
     routeUrl: props.routeUrl,
@@ -25,7 +24,6 @@
   let currentLayouts = $state(init.layouts);
   let currentPageProps = $state(init.pageProps);
   let shared = $state(init.shared);
-  let errors = $state(init.errors);
   let params = $state(init.params || {});
   let routeUrl = $state(init.routeUrl || "/");
   let navigation = $state(init.navigation || idleNavigationState());
@@ -46,9 +44,6 @@
   setContext("__void_shared", {
     get value() { return shared; },
   });
-  setContext("__void_errors", {
-    get value() { return errors; },
-  });
   setContext("__void_params", {
     get value() { return params; },
   });
@@ -66,7 +61,6 @@
       init.stores.props.subscribe((v) => { currentPageProps = v; }),
       init.stores.layouts.subscribe((v) => { currentLayouts = v; }),
       init.stores.shared.subscribe(replaceShared),
-      init.stores.errors.subscribe((v) => { errors = v; }),
       init.stores.params.subscribe((v) => { params = v; }),
       init.stores.route.subscribe((v) => { routeUrl = v; }),
       init.stores.navigation.subscribe((v) => { navigation = v; }),
diff --git a/packages/svelte/src/runtime/Link.svelte b/packages/svelte/src/runtime/Link.svelte
index 9e4873a45..11e881759 100644
--- a/packages/svelte/src/runtime/Link.svelte
+++ b/packages/svelte/src/runtime/Link.svelte
@@ -1,15 +1,16 @@
 <script lang="ts">
   import { getContext, onDestroy, onMount, type Snippet } from "svelte";
-  import { isModifiedEvent, mergeDataIntoHref, type VoidRouter } from "void/pages-client";
+  import {
+    isModifiedEvent,
+    mergeDataIntoHref,
+    type PrefetchOptions,
+    type VoidRouter,
+  } from "void/pages-client";
 
   type PrefetchStrategy = "hover" | "click" | "mount" | "visible";
   type LinkMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
   type NavigateEvent = { preventDefault(): void };
   type EventHandler<T extends Event> = (event: T) => void;
-  type PrefetchOptions = {
-    cacheFor?: number | string | [string, string];
-    method?: LinkMethod;
-  };
 
   let {
     href,
@@ -57,12 +58,8 @@
 
   const router = getContext<VoidRouter>("__void_router");
 
-  function hasPrefetch(prefetch: boolean | PrefetchStrategy | Array<PrefetchStrategy>): boolean {
-    return prefetch !== false;
-  }
-
   function getStrategies(): Array<PrefetchStrategy> {
-    if (hasPrefetch(prefetchProp) && !isGet) {
+    if (prefetchProp !== false && !isGet) {
       throw new Error(
         'Link: prefetch only supports GET links. Remove `prefetch` or use method="GET".',
       );
@@ -90,13 +87,10 @@
     if (hrefWithData === current) {
       return;
     }
-    const options: PrefetchOptions = {};
+    const options: PrefetchOptions = { method: normalizedMethod };
     if (cacheFor !== undefined) {
       options.cacheFor = cacheFor;
     }
-    if (normalizedMethod) {
-      options.method = normalizedMethod;
-    }
     router.prefetch(hrefWithData, options);
   }
 
diff --git a/packages/svelte/src/runtime/use-navigation.ts b/packages/svelte/src/runtime/use-navigation.ts
index a57248320..9758dadb4 100644
--- a/packages/svelte/src/runtime/use-navigation.ts
+++ b/packages/svelte/src/runtime/use-navigation.ts
@@ -1,8 +1,6 @@
 import { getContext } from 'svelte';
 import { idleNavigationState, type NavigationState } from 'void/pages-client';
 
-export type { NavigationState } from 'void/pages-client';
-
 export function useNavigation(): NavigationState {
   const ctx = getContext<{ value: NavigationState }>('__void_navigation');
   if (!ctx) {
diff --git a/packages/svelte/src/runtime/use-router.ts b/packages/svelte/src/runtime/use-router.ts
index 3f2fc68d7..212a70dd9 100644
--- a/packages/svelte/src/runtime/use-router.ts
+++ b/packages/svelte/src/runtime/use-router.ts
@@ -2,8 +2,6 @@ import { getContext } from 'svelte';
 import { ssrProxy } from 'void/pages-client';
 import type { VoidRouter } from 'void/pages-client';
 
-export type { VoidRouter } from 'void/pages-client';
-
 export function useRouter(): VoidRouter {
   return getContext<VoidRouter>('__void_router') ?? ssrProxy;
 }
diff --git a/packages/svelte/test/integration/svelte-pages-client.test.ts b/packages/svelte/test/integration/svelte-pages-client.test.ts
index 0a666c662..1b7662b24 100644
--- a/packages/svelte/test/integration/svelte-pages-client.test.ts
+++ b/packages/svelte/test/integration/svelte-pages-client.test.ts
@@ -1,24 +1,22 @@
-import { execSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { execSync, type ChildProcess } from 'node:child_process';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import spawn from 'cross-spawn';
 import { type Browser, type Page } from 'playwright';
 import { describe, expect, it, beforeAll, afterAll } from 'vite-plus/test';
-import { waitForIslandsHydrated } from '../../../../test/browser-helpers.ts';
-import { killChild, startServer, waitForServer } from '../../../../test/integration-helpers.ts';
+import {
+  killChild,
+  spawnPlaygroundServer,
+  startServer,
+} from '../../../../test/integration-helpers.ts';
 import { launchPagesBrowser } from '../../../../test/pages-browser.ts';
-import { registerSharedClientTests } from '../../../../test/pages-client-contract.ts';
-import { defineSharedIslandTests } from '../../../../test/pages-island-contract.ts';
-
-declare global {
-  interface Window {
-    __SPA_MARKER?: boolean;
-    __linkOnClick?: boolean;
-    __preventedClick?: boolean;
-    __preventedNavigate?: boolean;
-    __hmr_marker?: boolean;
-  }
-}
+import {
+  registerSharedClientTests,
+  registerSharedDevSsrTest,
+} from '../../../../test/pages-client-contract.ts';
+import {
+  defineSharedIslandHmrTests,
+  defineSharedIslandTests,
+} from '../../../../test/pages-island-contract.ts';
 
 type NavElement = HTMLElement & { __stamp?: number };
 
@@ -91,7 +89,6 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
       await page.goto(BASE + '/');
       await waitForHydration(page);
 
-      // Stamp the nav element
       await page.evaluate(() => {
         (document.querySelector('nav') as NavElement | null)!.__stamp = 1;
       });
@@ -112,60 +109,16 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
       await page.context().close();
     }
   });
-
-  it('deferred props: SPA navigation resolves in browser', async () => {
-    const page = await newPage();
-    try {
-      await page.goto(BASE + '/');
-      await waitForHydration(page);
-
-      // SPA navigate to deferred page
-      await page.click('a[href="/deferred"]');
-      await page.waitForFunction(() => document.querySelector('[data-testid="deferred-resolved"]'));
-
-      const text = await page.textContent('[data-testid="deferred-resolved"]');
-      expect(text).toBe('Count: 42');
-      expect(page.url()).toBe(BASE + '/deferred');
-    } finally {
-      await page.context().close();
-    }
-  });
 }
 
 describe('svelte-pages client (dev)', () => {
-  let child: ReturnType<typeof spawn>;
-  let stderr = '';
+  let child: ChildProcess | undefined;
 
   beforeAll(async () => {
-    const server = await startServer((port) => {
-      child = spawn(
-        'vp',
-        [
-          'run',
-          '--filter',
-          './playground/svelte-pages',
-          'dev',
-          '--host',
-          '127.0.0.1',
-          '--port',
-          String(port),
-          '--strictPort',
-        ],
-        {
-          cwd: ROOT,
-          stdio: ['ignore', 'pipe', 'pipe'],
-          env: {
-            ...process.env,
-            VOID_INSPECTOR_PORT: 'false',
-          },
-        },
-      );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
-      return child;
-    }, 20_000);
+    const server = await startServer(
+      (port) => (child = spawnPlaygroundServer(ROOT, 'svelte-pages', 'dev', port)),
+      20_000,
+    );
     DEV_BASE = server.base;
   });
 
@@ -173,225 +126,9 @@ describe('svelte-pages client (dev)', () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
-  it('dev: SSR pages, Inertia protocol, form handling, API coexistence', async () => {
-    // 1. Initial page load returns SSR HTML with embedded page data
-    const rootRes = await fetch(`${DEV_BASE}/`);
-    expect(rootRes.status).toBe(200);
-    const rootHtml = await rootRes.text();
-    expect(rootHtml).toContain('__VOID_PAGE_DATA__');
-    expect(rootHtml).toContain('Welcome');
-    expect(rootHtml).toContain('Svelte Pages Demo'); // shared data from middleware
-
-    // Inline page-data must round-trip through the <script> tag without
-    // truncation. If serializePageData ever regresses (e.g. via another
-    // template-literal backslash-collapse), the </script> in scriptProbe
-    // closes the inline tag early, the regex below captures truncated
-    // text, and JSON.parse throws.
-    const probe = '</script><script>alert(1)</script>\u2028\u2029&';
-    const probeMatch = rootHtml.match(/<script id="__VOID_PAGE_DATA__"[^>]*>([\s\S]*?)<\/script>/);
-    expect(probeMatch).not.toBeNull();
-    const probeJson = probeMatch![1];
-    expect(probeJson).not.toMatch(/<\/script/i);
-    expect(JSON.parse(probeJson).shared.scriptProbe).toBe(probe);
-
-    // 2. SSR content contains server-rendered props
-    expect(rootHtml).toContain('This is the Svelte Pages playground.');
-
-    // 3. Users page SSR — server-rendered user list
-    const usersRes = await fetch(`${DEV_BASE}/users`);
-    expect(usersRes.status).toBe(200);
-    const usersHtml = await usersRes.text();
-    expect(usersHtml).toContain('__VOID_PAGE_DATA__');
-    expect(usersHtml).toContain('Alice');
-    expect(usersHtml).toContain('Bob');
-    expect(usersHtml).toContain('Svelte Pages Demo'); // layout with shared data
-
-    // 4. User detail page SSR
-    const userRes = await fetch(`${DEV_BASE}/users/1`);
-    expect(userRes.status).toBe(200);
-    const userHtml = await userRes.text();
-    expect(userHtml).toContain('Alice');
-    expect(userHtml).toContain('alice@example.com');
-
-    // 5. Inertia navigation — GET / with X-VoidPages header returns JSON page object
-    const inertiaRoot = await fetch(`${DEV_BASE}/`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaRoot.status).toBe(200);
-    expect(inertiaRoot.headers.get('X-VoidPages')).toBe('true');
-    const rootPage = (await inertiaRoot.json()) as {
-      component: string;
-      props: Record<string, unknown>;
-      shared: Record<string, unknown>;
-      url: string;
-    };
-    expect(rootPage.component).toBe('index');
-    expect(rootPage.props).toHaveProperty('title', 'Home');
-    expect(rootPage.shared).toHaveProperty('appName', 'Svelte Pages Demo');
-    expect(rootPage.url).toBe('/');
-
-    // 6. Inertia navigation — GET /users returns user list in props
-    const inertiaUsers = await fetch(`${DEV_BASE}/users`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaUsers.status).toBe(200);
-    const usersPage = (await inertiaUsers.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-    };
-    expect(usersPage.component).toBe('users');
-    expect(usersPage.props.users).toHaveLength(2);
-    expect(usersPage.props.users[0].name).toBe('Alice');
-
-    // 7. API coexistence — /api/health returns JSON (not a page object)
-    const healthRes = await fetch(`${DEV_BASE}/api/health`);
-    expect(healthRes.status).toBe(200);
-    const healthBody = (await healthRes.json()) as { status: string };
-    expect(healthBody.status).toBe('ok');
-
-    // 8. Form submission — POST /users with valid data
-    const postValid = await fetch(`${DEV_BASE}/users`, {
-      method: 'POST',
-      headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: 'Charlie', email: 'charlie@example.com' }),
-    });
-    expect(postValid.status).toBe(200);
-    const validPage = (await postValid.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-      errors: Record<string, string> | null;
-    };
-    expect(validPage.errors).toBeNull();
-    expect(validPage.props.users).toHaveLength(3);
-    expect(validPage.props.users[2].name).toBe('Charlie');
-
-    // 9. Form submission — POST /users with invalid data returns validation errors
-    const postInvalid = await fetch(`${DEV_BASE}/users`, {
-      method: 'POST',
-      headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: '', email: '' }),
-    });
-    expect(postInvalid.status).toBe(200);
-    const invalidPage = (await postInvalid.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-      errors: Record<string, string> | null;
-    };
-    expect(invalidPage.errors).not.toBeNull();
-    expect(invalidPage.errors!.name).toBe('Name is required');
-    expect(invalidPage.errors!.email).toBe('Email is required');
-    // Props should still be populated (re-ran GET)
-    expect(invalidPage.props.users.length).toBeGreaterThanOrEqual(2);
-
-    // 10. User detail via Inertia
-    const inertiaUser = await fetch(`${DEV_BASE}/users/1`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaUser.status).toBe(200);
-    const userPage = (await inertiaUser.json()) as {
-      component: string;
-      props: { user: { id: number; name: string; email: string } };
-    };
-    expect(userPage.component).toBe('users/[id]');
-    expect(userPage.props.user.name).toBe('Alice');
-
-    // 11. Newly added user is accessible via detail page
-    const inertiaCharlie = await fetch(`${DEV_BASE}/users/3`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaCharlie.status).toBe(200);
-    const charliePage = (await inertiaCharlie.json()) as {
-      component: string;
-      props: { user: { id: number; name: string; email: string } };
-    };
-    expect(charliePage.component).toBe('users/[id]');
-    expect(charliePage.props.user.name).toBe('Charlie');
-    expect(charliePage.props.user.email).toBe('charlie@example.com');
-
-    // --- Island pages ---
-
-    // 12. Island page SSR — HTML with data-island markers, NOT embedded page data
-    const blogRes = await fetch(`${DEV_BASE}/blog`);
-    expect(blogRes.status).toBe(200);
-    const blogHtml = await blogRes.text();
-    expect(blogHtml).toContain('data-island=');
-    expect(blogHtml).toContain('data-props=');
-    expect(blogHtml).toContain('data-hydrate=');
-    expect(blogHtml).not.toContain('__VOID_PAGE_DATA__');
-    expect(blogHtml).toContain('Hello World');
-    expect(blogHtml).toContain('Second Post');
-    expect(blogHtml).toContain('Count:');
-
-    // 13. Island page always returns HTML even with X-VoidPages header
-    const inertiaBlog = await fetch(`${DEV_BASE}/blog`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaBlog.status).toBe(200);
-    expect(inertiaBlog.headers.get('content-type')).toContain('text/html');
-    expect(inertiaBlog.headers.get('X-VoidPages')).toBeNull();
-    const inertiaBlogHtml = await inertiaBlog.text();
-    expect(inertiaBlogHtml).toContain('data-island=');
-
-    // 14. Island mutation — validation errors return JSON 422
-    const blogPostInvalid = await fetch(`${DEV_BASE}/blog`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ title: '', body: '' }),
-    });
-    expect(blogPostInvalid.status).toBe(422);
-    const invalidBlog = (await blogPostInvalid.json()) as { errors: Record<string, string> };
-    expect(invalidBlog.errors.title).toBe('Title is required');
-    expect(invalidBlog.errors.body).toBe('Body is required');
-
-    // 15. Island mutation — success returns JSON 200
-    const blogPostValid = await fetch(`${DEV_BASE}/blog`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ title: 'Third Post', body: 'Content here' }),
-    });
-    expect(blogPostValid.status).toBe(200);
-    const validBlog = (await blogPostValid.json()) as { success: boolean };
-    expect(validBlog.success).toBe(true);
-
-    // 16. Island detail page with dynamic param
-    const detailRes = await fetch(`${DEV_BASE}/blog/hello-world`);
-    expect(detailRes.status).toBe(200);
-    const detailHtml = await detailRes.text();
-    expect(detailHtml).toContain('Hello World');
-    expect(detailHtml).toContain('First post');
-    expect(detailHtml).not.toContain('__VOID_PAGE_DATA__');
-
-    // --- Deferred props ---
-
-    // 17. Deferred props: SPA navigation streams NDJSON
-    const deferredInertia = await fetch(`${DEV_BASE}/deferred`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(deferredInertia.headers.get('content-type')).toContain('application/x-ndjson');
-    const ndjsonText = await deferredInertia.text();
-    const ndjsonLines = ndjsonText.trim().split('\n');
-    expect(ndjsonLines.length).toBe(2);
-    const pageObj = JSON.parse(ndjsonLines[0]);
-    expect(pageObj.component).toBe('deferred');
-    expect(pageObj.props.title).toBe('Deferred Page');
-    expect(pageObj.deferredKeys).toEqual({ stats: 'stats' });
-    const deferredLine = JSON.parse(ndjsonLines[1]);
-    expect(deferredLine.__deferred).toBe('stats');
-    expect(deferredLine.data).toEqual({ count: 42 });
-
-    // 18. Deferred props: SSR includes resolution script tags
-    const deferredSsr = await fetch(`${DEV_BASE}/deferred`);
-    const deferredHtml = await deferredSsr.text();
-    expect(deferredHtml).toContain('__VOID_PAGE_DATA__');
-    expect(deferredHtml).toContain('Deferred Page');
-    expect(deferredHtml).toContain('window.__resolveDeferred("stats"');
-    expect(deferredHtml).toContain('"count":42');
-  });
+  registerSharedDevSsrTest({ getBase: () => DEV_BASE, framework: 'Svelte' });
 
   defineClientTests(() => DEV_BASE, 'smoke');
   defineSharedIslandTests(
@@ -400,93 +137,17 @@ describe('svelte-pages client (dev)', () => {
     { coverage: 'smoke' },
   );
 
-  it('island component HMR updates without full page reload', { retry: 2 }, async () => {
-    const counterFile = join(ROOT, 'playground/svelte-pages/pages/blog/_Counter.svelte');
-    const original = readFileSync(counterFile, 'utf-8');
-
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    page.setDefaultTimeout(10_000);
-
-    try {
-      await page.goto(`${DEV_BASE}/blog`);
-      await waitForIslandsHydrated(page, 2);
-
-      // Interact to establish client state — count becomes 1
-      await page.click("button:has-text('Increment')");
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent === 'Count: 1',
-      );
-
-      // Set a window marker to detect full page reload
-      await page.evaluate(() => {
-        window.__hmr_marker = true;
-      });
-
-      // Edit the island component — change the label in the template
-      const modified = original.replace('Count: {count}', 'Total: {count}');
-      writeFileSync(counterFile, modified);
-
-      // Wait for HMR to update the component text
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent?.startsWith('Total:'),
-        { timeout: 10_000 },
-      );
-
-      // No full page reload — window marker should still be set
-      const markerSurvived = await page.evaluate(() => window.__hmr_marker === true);
-      expect(markerSurvived).toBe(true);
-
-      // Svelte HMR resets component state (unlike React Fast Refresh / Vue HMR)
-      const text = await page.textContent('[data-testid="count"]');
-      expect(text).toBe('Total: 0');
-    } finally {
-      await page.context().close();
-      writeFileSync(counterFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: 'Count:' });
-    }
-  });
-
-  it('island file edit triggers reload with updated content', { retry: 2 }, async () => {
-    const islandFile = join(ROOT, 'playground/svelte-pages/pages/blog/index.island.svelte');
-    const original = readFileSync(islandFile, 'utf-8');
-
-    try {
-      // Verify initial content renders
-      const initialRes = await fetch(`${DEV_BASE}/blog`);
-      expect(initialRes.status).toBe(200);
-      const initialHtml = await initialRes.text();
-      expect(initialHtml).toContain('<h1>Blog</h1>');
-
-      // Edit the island file — change the heading
-      const modified = original.replace('<h1>Blog</h1>', '<h1>Blog Updated</h1>');
-      writeFileSync(islandFile, modified);
-
-      // Poll for updated content — every request must return 200 (no ISE).
-      const start = Date.now();
-      let updatedHtml = '';
-      while (Date.now() - start < 10_000) {
-        await new Promise((r) => setTimeout(r, 100));
-        const res = await fetch(`${DEV_BASE}/blog`);
-        expect(res.status).toBe(200);
-        updatedHtml = await res.text();
-        if (updatedHtml.includes('Blog Updated')) {
-          break;
-        }
-      }
-
-      expect(updatedHtml).toContain('<h1>Blog Updated</h1>');
-      expect(updatedHtml).toContain('data-island=');
-    } finally {
-      writeFileSync(islandFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: '<h1>Blog</h1>' });
-    }
+  defineSharedIslandHmrTests({
+    getBase: () => DEV_BASE,
+    getBrowser: () => browser,
+    counterFile: join(ROOT, 'playground/svelte-pages/pages/blog/_Counter.svelte'),
+    islandFile: join(ROOT, 'playground/svelte-pages/pages/blog/index.island.svelte'),
+    hmrKeepsState: false,
   });
 });
 
 describe('svelte-pages client (preview)', { retry: 2 }, () => {
-  let child: ReturnType<typeof spawn>;
-  let stderr = '';
+  let child: ChildProcess | undefined;
 
   beforeAll(async () => {
     if (!existsSync(join(ROOT, 'playground/svelte-pages/dist'))) {
@@ -496,35 +157,10 @@ describe('svelte-pages client (preview)', { retry: 2 }, () => {
       });
     }
 
-    const server = await startServer((port) => {
-      child = spawn(
-        'vp',
-        [
-          'run',
-          '--filter',
-          './playground/svelte-pages',
-          'preview',
-          '--host',
-          '127.0.0.1',
-          '--port',
-          String(port),
-          '--strictPort',
-        ],
-        {
-          cwd: ROOT,
-          stdio: ['ignore', 'pipe', 'pipe'],
-          env: {
-            ...process.env,
-            VOID_INSPECTOR_PORT: 'false',
-          },
-        },
-      );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
-      return child;
-    }, 30_000);
+    const server = await startServer(
+      (port) => (child = spawnPlaygroundServer(ROOT, 'svelte-pages', 'preview', port)),
+      30_000,
+    );
     PREVIEW_BASE = server.base;
   });
 
@@ -532,9 +168,6 @@ describe('svelte-pages client (preview)', { retry: 2 }, () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting preview server')) {
-      throw new Error(stderr);
-    }
   });
 
   defineClientTests(() => PREVIEW_BASE);
diff --git a/packages/void/package.json b/packages/void/package.json
index 287b822fb..9e858a1d6 100644
--- a/packages/void/package.json
+++ b/packages/void/package.json
@@ -26,23 +26,15 @@
   ],
   "type": "module",
   "imports": {
-    "#self": "./dist/index.mjs",
     "#self/_env": "./dist/runtime/env.mjs",
     "#self/email": "./dist/runtime/email.mjs",
     "#self/env": "./dist/runtime/env-public.mjs",
     "#self/client": "./dist/runtime/client.mjs",
     "#self/handler": "./dist/runtime/handler.mjs",
-    "#self/pages-head": "./dist/pages/head.mjs",
-    "#self/pages-protocol": "./dist/pages/protocol.mjs",
     "#self/queues": "./dist/runtime/queues.mjs",
     "#self/remote": "./dist/runtime/remote/index.mjs",
     "#self/remote/binding-handler": "./dist/runtime/remote/binding-handler.mjs",
-    "#self/response": "./dist/runtime/response.mjs",
     "#self/sandbox": "./dist/runtime/sandbox.mjs",
-    "#self/sse": "./dist/runtime/sse.mjs",
-    "#self/sse/client": "./dist/runtime/sse-client.mjs",
-    "#self/live": "./dist/runtime/live.mjs",
-    "#self/live/client": "./dist/runtime/live-client.mjs",
     "#self/runtime/live-server": "./dist/runtime/live-server.mjs",
     "#self/runtime/fetch": "./dist/runtime/fetch.mjs",
     "#self/runtime/fetch-stream": "./dist/runtime/fetch-stream.mjs",
diff --git a/packages/void/src/application-analysis.ts b/packages/void/src/application-analysis.ts
index 4eb7614ff..6d3a4008d 100644
--- a/packages/void/src/application-analysis.ts
+++ b/packages/void/src/application-analysis.ts
@@ -8,7 +8,7 @@ import { collectMigrations } from './migrations/collect.ts';
 import { detectFramework, FRAMEWORK_SCAN_DIRS, inferProjectBindings } from './plugin-inference.ts';
 import { resolveProjectPaths } from './project-paths.ts';
 import { scanQueuesSync } from './queues/scan.ts';
-import { hasEmailHandlers, scanEmailHandlersSync } from './router/email.ts';
+import { scanEmailHandlersSync } from './router/email.ts';
 import { isRouteEnabledForEnvironment, type RouteEnvironment } from './router/parse-filename.ts';
 import { scanMiddlewareSync, scanRoutePatternsSync } from './router/scan.ts';
 import { scanWebSocketRoutesSync } from './router/websocket.ts';
@@ -18,11 +18,6 @@ export type ApplicationReasons = {
   database: Array<string>;
   kv: Array<string>;
   r2: Array<string>;
-  ai: Array<string>;
-  sandbox: Array<string>;
-  live: Array<string>;
-  email: Array<string>;
-  queues: Array<string>;
 };
 
 export type ApplicationAnalysis = {
@@ -76,8 +71,8 @@ export function analyzeApplicationSync(
   };
   const dialect = getDatabaseDialect(config);
   const migrations = collectMigrations(paths.migrationsDir);
-  const jobs = scanJobsSync(root, paths.cronsDir);
-  const queues = scanQueuesSync(root, paths.queuesDir);
+  const jobs = scanJobsSync(paths.cronsDir);
+  const queues = scanQueuesSync(paths.queuesDir);
   const allWebsockets = scanWebSocketRoutesSync(root, paths);
   const websockets = allWebsockets.filter((route) =>
     isRouteEnabledForEnvironment(route, environment),
@@ -87,7 +82,7 @@ export function analyzeApplicationSync(
   const email = scanEmailHandlersSync(paths.sourceRoot);
   const overrides = config.inference?.bindings;
   const bindingReason = (
-    key: 'db' | 'kv' | 'storage' | 'ai' | 'email',
+    key: 'db' | 'kv' | 'storage',
     label: string,
     inferredReason: string,
   ): string => (overrides?.[key] ? `inference.bindings.${key} enables ${label}` : inferredReason);
@@ -95,13 +90,6 @@ export function analyzeApplicationSync(
     database: [],
     kv: bindings.needsKV ? [bindingReason('kv', 'KV', 'app uses env.KV')] : [],
     r2: bindings.needsR2 ? [bindingReason('storage', 'R2', 'app uses env.STORAGE (R2)')] : [],
-    ai: bindings.needsAI ? [bindingReason('ai', 'Workers AI', 'app uses Workers AI')] : [],
-    sandbox: bindings.needsSandbox
-      ? [isSandboxEnabled(config) ? 'void.config.ts enables Sandbox' : 'app uses void/sandbox']
-      : [],
-    live: bindings.needsLive ? ['app uses void/live'] : [],
-    email: bindings.needsEmail ? [bindingReason('email', 'email', 'app uses void/email')] : [],
-    queues: bindings.needsQueues ? ['app uses void/queues'] : [],
   };
   const databaseName = dialect === 'sqlite' ? 'a D1 database' : 'a Hyperdrive database';
   if (bindings.needsD1) {
@@ -119,12 +107,6 @@ export function analyzeApplicationSync(
   if (migrations.length > 0) {
     reasons.database.push(`checked-in migrations need ${databaseName}`);
   }
-  for (const queue of queues) {
-    reasons.queues.push(`queues/${queue.filePath} requires ${queue.bindingName}`);
-  }
-  if (hasEmailHandlers(email)) {
-    reasons.email.push('email/ contains inbound email handlers');
-  }
   return {
     root,
     config,
diff --git a/packages/void/src/application-routing.ts b/packages/void/src/application-routing.ts
index eba8b0af3..48d7c6fb7 100644
--- a/packages/void/src/application-routing.ts
+++ b/packages/void/src/application-routing.ts
@@ -10,7 +10,6 @@ export async function completeApplicationAnalysis(
   const scan = await scanRoutes(analysis.root, {
     output: analysis.config.output,
     paths: analysis.paths,
-    environment: analysis.environment,
     inventory: {
       routes: analysis.routes,
       middleware: analysis.middleware,
diff --git a/packages/void/src/auth/node.ts b/packages/void/src/auth/node.ts
index 4a8e05117..85d43009d 100644
--- a/packages/void/src/auth/node.ts
+++ b/packages/void/src/auth/node.ts
@@ -1,10 +1,11 @@
-import { join } from 'pathslash';
 import { readConfig } from '../config.ts';
 import { getMiniflareDatabasePath } from '../migrations/runner.ts';
 import {
   applyMySqlAuthMigrations,
   applyPgAuthMigrations,
   applySqliteAuthMigrations,
+  mysqlMigrationRunner,
+  pgMigrationRunner,
 } from '../runtime/auth-migrations.ts';
 import type { VoidAuthDialect, VoidAuthEnv } from '../runtime/better-auth-shared.ts';
 import { loadLocalEnv } from '../shared/env.ts';
@@ -14,8 +15,8 @@ import { resolveVoidAuthMigrationSchema } from './drizzle.ts';
 export async function runLocalVoidAuthMigrations(
   root: string,
   dialect: VoidAuthDialect,
-  persistRoot: string = join(root, '.void'),
-  databaseId: string = 'local',
+  persistRoot: string,
+  databaseId: string,
   configPath: string | null = findVoidAuthConfig(root),
 ): Promise<void> {
   const authConfig = await loadVoidAuthConfig(configPath);
@@ -61,18 +62,7 @@ export async function runLocalVoidAuthMigrations(
     const { createConnection } = await import('mysql2/promise');
     const connection = await createConnection(connectionString);
     try {
-      await applyMySqlAuthMigrations(
-        {
-          async all<T extends Record<string, unknown>>(sql: string, params?: Array<unknown>) {
-            const [rows] = await connection.query(sql, params);
-            return rows as Array<T>;
-          },
-          async run(sql: string, params?: Array<unknown>) {
-            await connection.query(sql, params);
-          },
-        },
-        migrationSchema,
-      );
+      await applyMySqlAuthMigrations(mysqlMigrationRunner(connection), migrationSchema);
     } finally {
       await connection.end();
     }
@@ -83,18 +73,7 @@ export async function runLocalVoidAuthMigrations(
   const client = new Client({ connectionString });
   await client.connect();
   try {
-    await applyPgAuthMigrations(
-      {
-        async all<T extends Record<string, unknown>>(sql: string, params?: Array<unknown>) {
-          const result = await client.query(sql, params);
-          return result.rows as Array<T>;
-        },
-        async run(sql: string, params?: Array<unknown>) {
-          await client.query(sql, params);
-        },
-      },
-      migrationSchema,
-    );
+    await applyPgAuthMigrations(pgMigrationRunner(client), migrationSchema);
   } finally {
     await client.end();
   }
diff --git a/packages/void/src/cli/agents.ts b/packages/void/src/cli/agents.ts
index c6a6c4e58..3d7d49eb7 100644
--- a/packages/void/src/cli/agents.ts
+++ b/packages/void/src/cli/agents.ts
@@ -16,6 +16,10 @@ export function getPackageDir(): string {
   throw new Error('Could not find void package root');
 }
 
+export function getOwnVersion(): string {
+  return JSON.parse(readFileSync(join(getPackageDir(), 'package.json'), 'utf-8')).version;
+}
+
 // Agent configs: project-local skillsDir and how to detect presence in the project root.
 // Skill directory locations are aligned with:
 // https://github.com/vercel-labs/skills/blob/main/README.md
diff --git a/packages/void/src/cli/args.ts b/packages/void/src/cli/args.ts
index 149a13f63..022809315 100644
--- a/packages/void/src/cli/args.ts
+++ b/packages/void/src/cli/args.ts
@@ -1,18 +1,9 @@
 import { parseArgs } from 'node:util';
+import type { RunDeployOptions } from './deploy-types.ts';
 
-export type DeployArgs = {
-  projectSlug?: string;
-  dir?: string;
-  spa?: boolean;
-  skipBuild?: boolean;
-  debug?: boolean;
-  platform?: 'cloudflare' | 'void';
-  provision?: boolean;
-  requireEmail?: boolean;
-  atomic?: boolean;
-};
-
-export function parseDeployArgs(args: Array<string>): DeployArgs {
+export function parseDeployArgs(
+  args: Array<string>,
+): Omit<RunDeployOptions, 'reuseExistingWorker'> {
   let parsed: ReturnType<typeof parseArgs>;
   try {
     parsed = parseArgs({
@@ -93,7 +84,7 @@ export function parseDeployArgs(args: Array<string>): DeployArgs {
     throw new Error('deploy: --provision requires --platform cloudflare.');
   }
 
-  // Mode B email (design doc 0078): fail the deploy — before any upload — instead of
+  // Native Cloudflare email: fail the deploy — before any upload — instead of
   // continuing without email when the domain is not set up and nobody can press Enter
   // (CI / non-TTY). Only the Cloudflare backend runs the email step.
   const requireEmail = parsed.values['require-email'] === true ? true : undefined;
diff --git a/packages/void/src/cli/auth-link.ts b/packages/void/src/cli/auth-link.ts
index b2c1baf0f..1d111b46c 100644
--- a/packages/void/src/cli/auth-link.ts
+++ b/packages/void/src/cli/auth-link.ts
@@ -1,4 +1,3 @@
-import { execFile } from 'node:child_process';
 import { log } from '@voidzero-dev/vite-plus-prompts';
 import { getApiUrl, getToken, openBrowser, runPlatformLogin, savePlatformToken } from './auth.ts';
 import { PlatformClient } from './client.ts';
@@ -16,13 +15,13 @@ export async function runAuthLink(root: string, connectionId?: string): Promise<
     throw new Error('auth: This platform must be upgraded before linking login methods.');
   }
   const target = await selectPlatformLoginMethod(platform, connectionId);
-  const existing = await new PlatformClient(token, apiUrl).whoami();
+  const existing = await new PlatformClient(token, { apiUrl }).whoami();
   log.info(`Sign in again to ${existing.login} using an already linked login method.`);
   const source = await selectPlatformLoginMethod(platform);
   const freshToken = await runPlatformLogin(apiUrl, source.id, (url) =>
     log.info(`Sign in: ${url}`),
   );
-  const client = new PlatformClient(freshToken, apiUrl);
+  const client = new PlatformClient(freshToken, { apiUrl });
   const fresh = await client.whoami();
   if (fresh.id !== existing.id) {
     throw new Error(
@@ -34,5 +33,5 @@ export async function runAuthLink(root: string, connectionId?: string): Promise<
   log.info(
     `Authenticate with ${target.label}, then review and confirm the identity in your browser.\n${launch.url}`,
   );
-  openBrowser(launch.url, execFile);
+  openBrowser(launch.url);
 }
diff --git a/packages/void/src/cli/auth.ts b/packages/void/src/cli/auth.ts
index d9f46e4d5..da16d22d5 100644
--- a/packages/void/src/cli/auth.ts
+++ b/packages/void/src/cli/auth.ts
@@ -1,10 +1,11 @@
+import { execFile } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { browserPageLead, browserPageStatus, renderBrowserPage } from '@void/platform/browser-page';
 import { join } from 'pathslash';
 import { cfAccessHeaders } from '../shared/cf-access.ts';
-import { ensureCloudflaredToken } from './cf-access.ts';
+import { ensurePlatformAccessToken } from './cf-access.ts';
 import { deleteKeyringPassword, readKeyringPassword, writeKeyringPassword } from './keyring.ts';
 import {
   getActivePlatformConnection,
@@ -18,11 +19,6 @@ const CONFIG_DIR = join(homedir(), '.void');
 const CONFIG_PATH = join(CONFIG_DIR, 'config.json');
 const KEYRING_SERVICE = 'dev.void.cli';
 
-// ---------------------------------------------------------------------------
-// Keyring helpers — try/catch around `new Entry` for environments where the
-// native addon fails at runtime (CI, Docker, SSH, etc.)
-// ---------------------------------------------------------------------------
-
 function keyringGet(account: string): string | null {
   return readKeyringPassword(KEYRING_SERVICE, account);
 }
@@ -35,14 +31,9 @@ function keyringDelete(account: string): boolean {
   return deleteKeyringPassword(KEYRING_SERVICE, account);
 }
 
-// ---------------------------------------------------------------------------
-// Config file — non-sensitive fields only (api).
-// Origin-scoped file credentials remain readable when a keychain is unavailable.
-// ---------------------------------------------------------------------------
-
+// Legacy origin-scoped tokens, moved to the keychain when read.
 type Config = {
   tokens?: Record<string, string>;
-  api?: string;
 };
 
 function readConfig(): Config {
@@ -161,26 +152,14 @@ export function getTokenSource(): 'ci' | 'manual' {
   return process.env.VOID_TOKEN ? 'ci' : 'manual';
 }
 
-export function saveToken(
-  token: string,
-  root: string = process.cwd(),
-  dependencies: { keyringSet?: (account: string, password: string) => boolean } = {},
-): void {
-  savePlatformToken(token, getApiUrl(root), dependencies);
-}
-
 export function readPlatformToken(apiUrl: string): string | null {
   return readOriginScopedToken(apiUrl, readConfig());
 }
 
-export function savePlatformToken(
-  token: string,
-  origin: string,
-  dependencies: { keyringSet?: (account: string, password: string) => boolean } = {},
-): void {
+export function savePlatformToken(token: string, origin: string): void {
   const apiUrl = normalizePlatformApiUrl(origin);
   const account = platformCredentialAccount(apiUrl);
-  if ((dependencies.keyringSet ?? keyringSet)(account, token)) {
+  if (keyringSet(account, token)) {
     return;
   }
   throw new Error(
@@ -189,7 +168,7 @@ export function savePlatformToken(
 }
 
 export function removeToken(root: string = process.cwd()): boolean {
-  const apiUrl = normalizePlatformApiUrl(getApiUrl(root));
+  const apiUrl = getApiUrl(root);
   const account = platformCredentialAccount(apiUrl);
   let removed = false;
 
@@ -235,9 +214,8 @@ async function exchangeLoginCode(
   state: string,
   codeVerifier: string,
 ): Promise<string> {
-  const base = apiUrl.endsWith('/') ? apiUrl : `${apiUrl}/`;
-  ensureCloudflaredToken(apiUrl);
-  const res = await fetch(new URL('auth/cli/token', base), {
+  ensurePlatformAccessToken(apiUrl);
+  const res = await fetch(`${apiUrl}/auth/cli/token`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', ...cfAccessHeaders(process.env, apiUrl) },
     body: JSON.stringify({
@@ -315,53 +293,35 @@ function page(title: string, message: string): string {
   });
 }
 
-export function openBrowser(
-  url: string,
-  execFile: typeof import('node:child_process').execFile,
-): void {
+export function openBrowser(url: string, run: typeof execFile = execFile): void {
   // Launch via argv (execFile), never a shell: the URL is passed as a single
   // argument so shell metacharacters in it can't be interpreted as commands.
   const ignore = (): void => {};
   if (process.platform === 'win32') {
     // Avoid cmd.exe interpreting URL query separators such as & as shell commands.
-    execFile('rundll32.exe', ['url.dll,FileProtocolHandler', url], ignore);
+    run('rundll32.exe', ['url.dll,FileProtocolHandler', url], ignore);
     return;
   }
   if (process.platform === 'darwin') {
-    execFile('open', [url], ignore);
+    run('open', [url], ignore);
     return;
   }
   // Linux — including WSL2 where `xdg-open` typically has no usable handler.
   // Try `wslview` (wslu), then fall back to the Windows URL handler.
   if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP) {
-    execFile('wslview', [url], (error) => {
+    run('wslview', [url], (error) => {
       if (error) {
-        execFile('rundll32.exe', ['url.dll,FileProtocolHandler', url], ignore);
+        run('rundll32.exe', ['url.dll,FileProtocolHandler', url], ignore);
       }
     });
     return;
   }
-  execFile('xdg-open', [url], ignore);
+  run('xdg-open', [url], ignore);
 }
 
 /**
- * Start a local HTTP callback server, open the browser to a caller-built
- * authorize URL, and wait for the redirect back to `http://localhost:PORT/callback`.
- *
- * The server validates the `state` it appended to the callback URL against the
- * incoming request, then runs the caller's `finalize` hook INSIDE the request
- * handler (so the browser only ever sees the success page after the underlying
- * exchange/link actually succeeded). On finalize success it renders the success
- * HTML and resolves with finalize's return value; on finalize failure it
- * renders the same "could not complete" failure page the login flow uses and
- * rejects with the thrown error. The server is always closed before settling.
- *
- * `onUrl` is invoked with the authorize URL once the local server is listening,
- * so callers can show the URL to the user as a manual fallback when the browser
- * fails to open (common on WSL2, headless SSH, Docker, etc.). To match the
- * login flow it fires immediately before the browser is opened.
- *
- * `execFile` is injectable so tests can avoid launching a real browser.
+ * Serve `http://localhost:PORT/callback`, open the browser at the caller's
+ * authorize URL, and settle with `finalize`'s result. The server closes before settling.
  */
 export async function awaitBrowserCallback<T>(options: {
   /** Caller-generated; appended to the callback URL and validated on the incoming request. */
@@ -369,34 +329,26 @@ export async function awaitBrowserCallback<T>(options: {
   /** Given `http://localhost:PORT/callback?state=…`, return the URL to open. */
   buildAuthUrl: (callback: URL) => Promise<string> | string;
   /**
-   * Runs INSIDE the request handler, after state/error/validate checks pass and
-   * BEFORE the success page is rendered. Resolve to settle the outer promise
-   * with this value (success page shown); throw to render the failure page and
-   * reject the outer promise with the thrown error.
+   * Runs inside the request handler, so the browser sees the success page only
+   * after it resolves; a throw renders the failure page and rejects.
    */
   finalize: (params: URLSearchParams) => Promise<T>;
   /** Name the completed action in the browser. Defaults to sign-in. */
   successTitle?: string;
   /** Map an `?error=…` query to a user message (return null to ignore). */
   describeError?: (params: URLSearchParams) => string | null;
-  /**
-   * Reject an otherwise-valid callback request (renders a 400 page) WITHOUT
-   * settling, so the server keeps listening for a subsequent valid callback.
-   * Used by login to reject `?token=` and missing-`code` requests. Return a
-   * message to reject, or null to accept.
-   */
+  /** Return a message to answer 400 and keep listening for a valid callback, or null to accept. */
   validate?: (params: URLSearchParams) => string | null;
-  /** Optional, invoked with the authorize URL before the browser is opened. */
+  /** Invoked with the authorize URL before the browser opens, for a manual fallback. */
   onUrl?: (url: string) => void;
   /** Default 5 minutes. */
   timeoutMs?: number;
-  /** Injectable for tests; defaults to the real `node:child_process` `execFile`. */
-  execFile?: typeof import('node:child_process').execFile;
+  /** Injectable for tests; defaults to `node:child_process` `execFile`. */
+  execFile?: typeof execFile;
 }): Promise<T> {
   const http = await import('node:http');
   const { state, buildAuthUrl, finalize, describeError, validate, onUrl } = options;
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
-  const execFile = options.execFile ?? (await import('node:child_process')).execFile;
 
   return new Promise<T>((resolve, reject) => {
     let settled = false;
@@ -441,9 +393,6 @@ export async function awaitBrowserCallback<T>(options: {
         return;
       }
 
-      // Reject-but-keep-listening: invalid request shapes (e.g. a stray
-      // `?token=`, or a redirect that arrived without a code). The server
-      // stays open so the genuine callback can still complete.
       const invalidMessage = validate?.(url.searchParams);
       if (invalidMessage) {
         res.writeHead(400, { 'Content-Type': 'text/html' });
@@ -451,10 +400,7 @@ export async function awaitBrowserCallback<T>(options: {
         return;
       }
 
-      // Finalize INSIDE the request path so the browser only sees the success
-      // page once the underlying exchange/link succeeds. A finalize failure
-      // (expired code, API error, 409 conflict, etc.) renders the failure page
-      // and rejects. Guard against the timeout racing the in-flight finalize.
+      // The timeout may settle while finalize is in flight.
       let result: T;
       try {
         result = await finalize(url.searchParams);
@@ -504,7 +450,7 @@ export async function awaitBrowserCallback<T>(options: {
       }
 
       onUrl?.(authUrl);
-      openBrowser(authUrl, execFile);
+      openBrowser(authUrl, options.execFile);
     });
 
     const timeout = setTimeout(() => {
@@ -514,43 +460,22 @@ export async function awaitBrowserCallback<T>(options: {
   });
 }
 
-/**
- * Start a local HTTP server, open the browser to the platform login page,
- * and wait for the OAuth callback with a short-lived code. The CLI exchanges
- * the code itself so the localhost callback never accepts bearer tokens.
- *
- * `onUrl` is invoked with the login URL once the local server is listening,
- * so callers can show the URL to the user as a manual fallback when the
- * browser fails to open (common on WSL2, headless SSH, Docker, etc.).
- */
-export async function runLogin(
-  root: string = process.cwd(),
-  provider = 'github',
-  onUrl?: (url: string) => void,
-): Promise<string> {
-  return runPlatformLogin(getApiUrl(root), provider, onUrl);
-}
-
+/** The CLI exchanges the code itself, so the localhost callback never accepts bearer tokens. */
 export async function runPlatformLogin(
   origin: string,
   provider = 'github',
   onUrl?: (url: string) => void,
 ): Promise<string> {
-  const { execFile } = await import('node:child_process');
-
   const apiUrl = normalizePlatformApiUrl(origin);
   const state = randomBytes(32).toString('hex');
   const codeVerifier = createCodeVerifier();
   const codeChallenge = createCodeChallenge(codeVerifier);
 
-  // The exchange runs INSIDE the request handler (via finalize), so an exchange
-  // failure renders the failure page.
   return awaitBrowserCallback<string>({
     state,
-    execFile,
     onUrl,
     buildAuthUrl: (callback) => {
-      const loginUrl = new URL('auth/login', apiUrl.endsWith('/') ? apiUrl : `${apiUrl}/`);
+      const loginUrl = new URL(`${apiUrl}/auth/login`);
       loginUrl.searchParams.set('redirect', callback.href);
       loginUrl.searchParams.set('provider', provider);
       loginUrl.searchParams.set('code_challenge', codeChallenge);
@@ -561,8 +486,6 @@ export async function runPlatformLogin(
       p.get('error') === 'signup_restricted'
         ? 'Signup restricted: your email is not on the approved list for this environment.'
         : null,
-    // Keep listening but reject these request shapes: a stray `?token=` is never
-    // honored, and a callback without a `code` is ignored until the real one arrives.
     validate: (p) => {
       if (p.has('token')) {
         return 'Invalid login callback. Please try again.';
diff --git a/packages/void/src/cli/build-output-dir.ts b/packages/void/src/cli/build-output-dir.ts
new file mode 100644
index 000000000..96dea254c
--- /dev/null
+++ b/packages/void/src/cli/build-output-dir.ts
@@ -0,0 +1,52 @@
+import { existsSync } from 'node:fs';
+import { join } from 'pathslash';
+import type { FrameworkPreset } from './preset.ts';
+
+/**
+ * Resolve the top-level build output directory: the first segment of a
+ * framework preset's `workerDir`, or `dist` for a Void app.
+ */
+export function resolveDistDir(
+  root: string,
+  fwPreset?: FrameworkPreset,
+  buildCommand?: string,
+): string {
+  if (fwPreset) {
+    const topDir = fwPreset.workerDir.split('/')[0];
+    const distDir = join(root, topDir);
+    if (!existsSync(distDir)) {
+      throw new Error(
+        `deploy: Build output directory '${topDir}' not found. Run '${buildCommand ?? fwPreset.buildCommand}' first.`,
+      );
+    }
+    return distDir;
+  }
+  return join(root, 'dist');
+}
+
+/**
+ * Resolve the worker output subdirectory within the build dir: the rest of a
+ * framework preset's `workerDir`, or the first known Void output that exists.
+ */
+export function resolveWorkerDirName(
+  distDir: string,
+  fwPreset?: FrameworkPreset,
+  buildCommand?: string,
+): string {
+  if (fwPreset) {
+    const subDir = fwPreset.workerDir.split('/').slice(1).join('/');
+    if (!existsSync(join(distDir, subDir))) {
+      throw new Error(
+        `deploy: Worker output '${fwPreset.workerDir}' not found. Run '${buildCommand ?? fwPreset.buildCommand}' first.`,
+      );
+    }
+    return subDir;
+  }
+
+  for (const name of ['ssr', 'rsc', 'server']) {
+    if (existsSync(join(distDir, name))) {
+      return name;
+    }
+  }
+  throw new Error('deploy: Worker output not found. Expected dist/ssr/ or dist/rsc/.');
+}
diff --git a/packages/void/src/cli/cf-access.ts b/packages/void/src/cli/cf-access.ts
index b9dfb0e29..fa0769eea 100644
--- a/packages/void/src/cli/cf-access.ts
+++ b/packages/void/src/cli/cf-access.ts
@@ -131,11 +131,6 @@ export function ensurePlatformAccessToken(
   writeKeyringPassword(ACCESS_KEYRING_SERVICE, account, token);
 }
 
-/** Restore only credentials scoped to this explicitly selected platform origin. */
-export function ensureCloudflaredToken(apiUrl: string): void {
-  ensurePlatformAccessToken(apiUrl);
-}
-
 function runCloudflared(
   args: Array<string>,
   opts?: { inherit?: boolean; timeoutMs?: number },
diff --git a/packages/void/src/cli/cf-command-values.ts b/packages/void/src/cli/cf-command-values.ts
new file mode 100644
index 000000000..de2068b7d
--- /dev/null
+++ b/packages/void/src/cli/cf-command-values.ts
@@ -0,0 +1,23 @@
+/** Accept a cf positional only when it cannot be read as a flag or carry control characters. */
+export function safePositional(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    !value.startsWith('-') &&
+    ![...value].some((character) => {
+      const code = character.charCodeAt(0);
+      return code < 32 || code === 127;
+    })
+  );
+}
+
+/** Read the version ID and URLs that cf prints after a prebuilt upload. */
+export function readCfUploadOutput(
+  stdout: string,
+): Record<'versionId' | 'previewUrl' | 'workersDevUrl', string | undefined> {
+  return {
+    versionId: stdout.match(/(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i)?.[1],
+    previewUrl: stdout.match(/Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i)?.[1],
+    workersDevUrl: stdout.match(/(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i)?.[1],
+  };
+}
diff --git a/packages/void/src/cli/cf-user-agent.ts b/packages/void/src/cli/cf-user-agent.ts
index c9caae51a..bc91ed30d 100644
--- a/packages/void/src/cli/cf-user-agent.ts
+++ b/packages/void/src/cli/cf-user-agent.ts
@@ -1,14 +1,12 @@
 import { readFileSync } from 'node:fs';
-import { join } from 'pathslash';
-import { getPackageDir } from './agents.ts';
+import { getOwnVersion } from './agents.ts';
 
 let voidUserAgent: string | undefined;
 let cfCliVersion: string | undefined;
 
 export function getVoidUserAgent(): string {
   if (voidUserAgent === undefined) {
-    const pkg = JSON.parse(readFileSync(join(getPackageDir(), 'package.json'), 'utf8'));
-    voidUserAgent = `void/${pkg.version}`;
+    voidUserAgent = `void/${getOwnVersion()}`;
   }
   return voidUserAgent;
 }
diff --git a/packages/void/src/cli/cf-version-runner.ts b/packages/void/src/cli/cf-version-runner.ts
index fc9c33dda..f6a887990 100644
--- a/packages/void/src/cli/cf-version-runner.ts
+++ b/packages/void/src/cli/cf-version-runner.ts
@@ -12,6 +12,7 @@ import type {
 import { isRecord as record } from '@void/deploy-core';
 import { dirname, join } from 'pathslash';
 import type { CfBuildOutput } from './cf-build-output.ts';
+import { readCfUploadOutput, safePositional } from './cf-command-values.ts';
 import { migrateBuiltWranglerConfig } from './cf-config-migrate.ts';
 import { getCfCliVersion } from './cf-user-agent.ts';
 import {
@@ -19,15 +20,12 @@ import {
   uploadPinnedCloudflareVersion,
   type CfCommand,
 } from './cf-version-api.ts';
+import { isCleanCloudflareExit } from './cloudflare-process.ts';
 
 function failed(message: string): CloudflareCommandResult {
   return { status: 1, stdout: '', stderr: message };
 }
 
-function commandFailed(result: CloudflareCommandResult): boolean {
-  return result.status !== 0 || Boolean(result.signal) || Boolean(result.error);
-}
-
 function parseJson(value: string): unknown {
   try {
     return JSON.parse(value) as unknown;
@@ -36,18 +34,6 @@ function parseJson(value: string): unknown {
   }
 }
 
-function safePositional(value: unknown): value is string {
-  return (
-    typeof value === 'string' &&
-    value.length > 0 &&
-    !value.startsWith('-') &&
-    ![...value].some((character) => {
-      const code = character.charCodeAt(0);
-      return code < 32 || code === 127;
-    })
-  );
-}
-
 /** Existing-Worker handoffs retain their separate link and binding checks. */
 export function createActiveSecretPinner(options: {
   output: CfBuildOutput | null;
@@ -165,7 +151,7 @@ export function createCfResourceVerifier(options: {
             },
           ),
         );
-        if (commandFailed(found) || !record(found.data) || found.data.name !== name) {
+        if (!isCleanCloudflareExit(found) || !record(found.data) || found.data.name !== name) {
           return failed(
             `Cloudflare Queue ${name} is unavailable; refusing automatic provisioning.`,
           );
@@ -222,7 +208,7 @@ export function createCfResourceVerifier(options: {
         { cwd: directory, capture: true },
       );
       const body = result.data ?? parseJson(result.stdout);
-      if (commandFailed(result) || !record(body) || body[resource.response] !== name) {
+      if (!isCleanCloudflareExit(result) || !record(body) || body[resource.response] !== name) {
         return failed(
           `Cloudflare ${resource.kind} ${name} is unavailable; refusing automatic provisioning.`,
         );
@@ -236,7 +222,6 @@ export function createCfResourceVerifier(options: {
 export function createCfCommand(options: {
   accountId: string;
   apiBaseUrl: string;
-  token?: string;
   env: (accountId: string, apiBaseUrl: string) => NodeJS.ProcessEnv;
   verifyUploader: () => boolean;
 }): CfCommand {
@@ -259,9 +244,6 @@ export function createCfCommand(options: {
     if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) {
       env.NODE_USE_ENV_PROXY = '1';
     }
-    if (options.token) {
-      env.CLOUDFLARE_API_TOKEN = options.token;
-    }
     return await new Promise<CloudflareCommandResult>((resolve) => {
       const bounded = run.timeoutMs !== undefined;
       const processGroup = bounded && process.platform !== 'win32';
@@ -396,21 +378,13 @@ export function createCfVersionRunner(options: {
     return { ...result, data: result.data ?? parseJson(result.stdout) };
   };
   const uploadedResult = (result: CloudflareCommandResult): CloudflareCommandResult => {
-    if (commandFailed(result)) {
+    if (!isCleanCloudflareExit(result)) {
       return result;
     }
     if (record(result.data) && typeof result.data.versionId === 'string') {
       return result;
     }
-    const versionId = result.stdout.match(
-      /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i,
-    )?.[1];
-    const previewUrl = result.stdout.match(
-      /Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i,
-    )?.[1];
-    const workersDevUrl = result.stdout.match(
-      /(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i,
-    )?.[1];
+    const { versionId, previewUrl, workersDevUrl } = readCfUploadOutput(result.stdout);
     return {
       ...result,
       data: versionId
@@ -442,7 +416,7 @@ export function createCfVersionRunner(options: {
       return failed(targetChanged);
     }
     const verified = await verifyResources(output.directory);
-    return commandFailed(verified) ? verified : null;
+    return isCleanCloudflareExit(verified) ? null : verified;
   };
 
   const uploadPinnedVersion = async (
@@ -484,7 +458,7 @@ export function createCfVersionRunner(options: {
   return async (operation, command) => {
     if (operation.type === 'deployments.status') {
       const result = await run(['workers', 'deployments', 'list', '--worker', workerName], true);
-      if (commandFailed(result)) {
+      if (!isCleanCloudflareExit(result)) {
         return result;
       }
       const body = result.data;
@@ -531,7 +505,7 @@ export function createCfVersionRunner(options: {
         };
       };
       const first = await readPage(1);
-      if (commandFailed(first.result)) {
+      if (!isCleanCloudflareExit(first.result)) {
         return first.result;
       }
       if (!first.versions) {
@@ -540,7 +514,7 @@ export function createCfVersionRunner(options: {
       const versions = [...first.versions];
       if (versions.length === pageSize) {
         const second = await readPage(2);
-        if (commandFailed(second.result)) {
+        if (!isCleanCloudflareExit(second.result)) {
           return second.result;
         }
         if (!second.versions) {
@@ -554,7 +528,7 @@ export function createCfVersionRunner(options: {
             let last = Math.max(...secondNumbers);
             for (let page = 3; page <= 1000 && second.versions.length === pageSize; page++) {
               const next = await readPage(page);
-              if (commandFailed(next.result)) {
+              if (!isCleanCloudflareExit(next.result)) {
                 return next.result;
               }
               if (!next.versions) {
@@ -606,7 +580,7 @@ export function createCfVersionRunner(options: {
           })
         : await run(args, true);
       const result = { ...called, data: called.data ?? parseJson(called.stdout) };
-      if (commandFailed(result)) {
+      if (!isCleanCloudflareExit(result)) {
         return result;
       }
       const version = result.data;
@@ -789,7 +763,7 @@ export function createCfVersionRunner(options: {
         writeFileSync(workerPath, JSON.stringify(worker), { mode: 0o600 });
         await readBuildOutput(directory);
         const verified = await verifyResources(directory);
-        if (commandFailed(verified)) {
+        if (!isCleanCloudflareExit(verified)) {
           return verified;
         }
         return await run(
@@ -808,7 +782,7 @@ export function createCfVersionRunner(options: {
         return failed('The Cloudflare Queue consumer target changed.');
       }
       const queues = await run(['queues', 'list'], true);
-      if (commandFailed(queues)) {
+      if (!isCleanCloudflareExit(queues)) {
         return queues;
       }
       const allQueues = queues.data;
@@ -823,7 +797,7 @@ export function createCfVersionRunner(options: {
         ['queues', 'consumers', 'list', '--queue-id', queue.queue_id],
         true,
       );
-      if (commandFailed(consumers)) {
+      if (!isCleanCloudflareExit(consumers)) {
         return consumers;
       }
       const allConsumers = consumers.data;
diff --git a/packages/void/src/cli/cli.ts b/packages/void/src/cli/cli.ts
index 876efe823..c42b0d7f0 100644
--- a/packages/void/src/cli/cli.ts
+++ b/packages/void/src/cli/cli.ts
@@ -1,10 +1,8 @@
 #!/usr/bin/env node
 
-import { readFileSync } from 'node:fs';
 import { log } from '@voidzero-dev/vite-plus-prompts';
-import { join } from 'pathslash';
 import { accountSubcommands, parseAccountArgs } from './account-args.ts';
-import { getPackageDir } from './agents.ts';
+import { getOwnVersion } from './agents.ts';
 import { parseDeployArgs } from './args.ts';
 import { authSubcommands, parseAuthArgs } from './auth-args.ts';
 import { buildSubcommands, parseBuildArgs } from './build-args.ts';
@@ -196,17 +194,7 @@ if (helpPath) {
   }
 
   import('./deploy.ts').then(({ runDeploy }) => {
-    runDeploy(root, {
-      projectSlug: deployArgs.projectSlug,
-      dir: deployArgs.dir,
-      spa: deployArgs.spa,
-      skipBuild: deployArgs.skipBuild,
-      debug: deployArgs.debug,
-      platform: deployArgs.platform,
-      provision: deployArgs.provision,
-      requireEmail: deployArgs.requireEmail,
-      atomic: deployArgs.atomic,
-    }).catch((err) => {
+    runDeploy(root, deployArgs).catch((err) => {
       log.error(formatCloudflareUserMessage(err.message ?? String(err)));
       process.exit(1);
     });
@@ -238,16 +226,15 @@ if (helpPath) {
   });
 } else if (command === 'prepare') {
   const root = process.cwd();
-  let prepareArgs;
   try {
-    prepareArgs = parsePrepareArgs(args.slice(1));
+    parsePrepareArgs(args.slice(1));
   } catch (err) {
     log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
     process.exit(1);
   }
 
   import('./prepare.ts').then(({ runPrepareCommand }) => {
-    runPrepareCommand(root, prepareArgs).catch((err) => {
+    runPrepareCommand(root).catch((err) => {
       log.error(formatCloudflareUserMessage(err.message ?? String(err)));
       process.exit(1);
     });
@@ -279,9 +266,8 @@ if (helpPath) {
     });
   });
 } else if (command === '-v' || command === '--version') {
-  const version = JSON.parse(readFileSync(join(getPackageDir(), 'package.json'), 'utf-8')).version;
-  console.log(version);
-} else if (command && command !== 'help' && command !== '--help' && command !== '-h') {
+  console.log(getOwnVersion());
+} else if (command) {
   log.error(`cli: Unknown command '${command}'. Run \`void --help\` for usage.`);
   process.exit(1);
 } else if (!command && process.stdin.isTTY) {
@@ -413,7 +399,7 @@ if (helpPath) {
       }
       case 'prepare': {
         const { runPrepareCommand } = await import('./prepare.ts');
-        await runPrepareCommand(root, parsePrepareArgs([]));
+        await runPrepareCommand(root);
         return;
       }
       case 'help':
diff --git a/packages/void/src/cli/client.ts b/packages/void/src/cli/client.ts
index affbae116..7625e9a82 100644
--- a/packages/void/src/cli/client.ts
+++ b/packages/void/src/cli/client.ts
@@ -3,11 +3,7 @@ import { join } from 'pathslash';
 import { cfAccessHeaders } from '../shared/cf-access.ts';
 import { getPackageDir } from './agents.ts';
 import { getApiUrl } from './auth.ts';
-import {
-  ensureCloudflaredToken,
-  ensurePlatformAccessToken,
-  isCloudflareAccessChallenge,
-} from './cf-access.ts';
+import { ensurePlatformAccessToken, isCloudflareAccessChallenge } from './cf-access.ts';
 import type { CliLogger } from './log-file.ts';
 import { readPlatformDiscoveryResponse } from './platform-discovery.ts';
 import {
@@ -19,20 +15,8 @@ import {
 import { normalizePlatformApiUrl } from './platform-registry.ts';
 import type { DeployAssetUploadRequest, DeployEvent, DeployUploadPayload } from './types.ts';
 
-/**
- * Current CLI version. Sent as `X-Void-CLI-Version` on every platform
- * request so the platform's CLI-version gate can refuse stale CLIs
- * cleanly (HTTP 426 + `cli_outdated`) instead of letting a wire
- * mismatch surface as an opaque parse error.
- *
- * Resolved once per process. Returns `null` when package.json can't be
- * read or has no `version` string — the ctor then OMITS the header
- * entirely. We deliberately do NOT send a placeholder string like
- * "unknown": the platform treats present-but-unparseable headers as a
- * stale-CLI signal and would 426 the request, bricking the CLI on any
- * packaging error. Missing-header is the documented pass-through path.
- */
-export function readCliVersion(): string | null {
+// Null omits `X-Void-CLI-Version`: the platform answers an unparseable version with 426.
+function readCliVersion(): string | null {
   try {
     const pkgPath = join(getPackageDir(), 'package.json');
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')) as { version?: unknown };
@@ -307,12 +291,8 @@ export type CreateProjectResponse = {
   warnings?: Array<string>;
   zero_trust?: ProjectZeroTrustState;
   /**
-   * Present exactly when the platform scheduled the project owner's own
-   * address to be registered as an outbound email destination. The
-   * registration runs after the response is sent, so this says nothing about
-   * its outcome — Cloudflare may mail a verification link, or adopt an
-   * address the owner already verified. `void email destinations` shows the
-   * resulting state.
+   * Set when the platform scheduled the owner's address as an email destination.
+   * Registration runs after the response, so this says nothing about its outcome.
    */
   owner_email_destination?: {
     address: string;
@@ -436,19 +416,9 @@ export type EmailDestinationResponse = {
   status: 'pending' | 'verified' | 'failed';
   verified_at: string | null;
   created_at: string;
-  /**
-   * Set when the platform (not Cloudflare) mailed the confirmation link —
-   * on the first add AND on every repeat add while the row is pending, since
-   * a repeat POST is how that link gets re-sent.
-   */
+  /** Set when the platform, not Cloudflare, mailed the confirmation link; a repeat add re-sends it. */
   platformVerificationPending?: boolean;
-  /**
-   * `false` when the call mailed nothing and the row waits on a Cloudflare
-   * link sent EARLIER: a repeat add of a CF-pending address, or a first add
-   * (201) of an address Cloudflare already held pending — the owner's own,
-   * from another project or a hand add. CF refused the create and mails its
-   * link on create only, so a bare 201 must not read as "a link went out".
-   */
+  /** `false` when this call mailed nothing because an earlier Cloudflare link is still pending. */
   verificationSent?: boolean;
 };
 
@@ -514,9 +484,6 @@ export type EmailOperationResponse = {
   error?: string;
 };
 
-export type EmailDomainStatusResponse = EmailDomainResponse;
-export type EmailDomainSyncResponse = EmailDomainResponse;
-
 export type RemoveEmailDomainResponse = {
   operationId: string;
   operationStatus?: EmailOperationResponse['status'];
@@ -578,48 +545,11 @@ export type GithubConnection = {
   updated_at: string;
 };
 
-/**
- * Asset declaration shape for `POST /:id/deploy/upload-urls`. Each entry
- * carries both hashes the platform needs:
- *   - `blake3` is the storage key (`assets/${projectId}/${blake3}`)
- *   - `md5` is the wire-level upload-integrity primitive — the platform
- *     bakes it into the presigned PUT URL as a SIGNED `Content-Md5`
- *     header so R2 enforces integrity at write time.
- */
-export type UploadUrlAssetRequest = DeployAssetUploadRequest;
-
-/**
- * Manifest-only (direct-to-R2) deploy payload. Sent as JSON to
- * `POST /:id/deploy` with `Content-Type: application/json`. Mirrors the
- * `handleManifestOnlyDeploy` server contract documented in design doc 0068.
- *
- * Asset bytes are NOT carried in this payload — they were uploaded directly
- * to R2 via presigned PUT URLs before this call. The server verifies each
- * declared asset key exists in R2 (parallel HEAD) before flipping routing.
- */
 export type ManifestOnlyDeployPayload = DeployUploadPayload;
 
-/**
- * Retry contract for the deploy POST's transport phase.
- *
- * - Only `fetch` rejections (`TypeError` — no HTTP response) are retried.
- *   A Response of any status means the server answered; surface it
- *   verbatim rather than replay a request it may have accepted.
- * - A headers timeout is retried too. Every attempt sends the same
- *   idempotency key, so once an earlier request has created its deployment,
- *   a receipt-aware platform answers the retry with that deployment's
- *   receipt and the CLI follows it to the real result.
- * - A rejected fetch does NOT prove the request never arrived — the
- *   connection may have dropped after delivery. Arbitration is left to
- *   the server's precheck, the only atomic (project-locked) verdict: if
- *   an earlier attempt or a concurrent deploy is still in flight, the
- *   replay is rejected with 409 and surfaced as a deploy conflict
- *   naming the deployment id. Receipt-aware platforms additionally bind
- *   the stable invocation key to the accepted artifact, so an accepted
- *   request can be recovered without creating another execution. Older
- *   platforms retain their concurrency guard. No client-side deployment
- *   lookup may authorize replay or identify an unrelated conflicting row.
- */
+// Only fetch rejections (TypeError, including a headers timeout) are retried; any
+// HTTP response is final. Every attempt sends the same idempotency key, so the
+// platform answers a replay with the earlier deployment's receipt or a 409.
 const DEPLOY_POST_MAX_RETRIES = 3;
 const DEPLOY_POST_BACKOFF_MS = [1000, 5000, 10000];
 /**
@@ -700,27 +630,21 @@ export class PlatformClient {
    */
   constructor(
     token: string,
-    options?:
-      | string
-      | { apiUrl?: string; root?: string; cliLog?: CliLogger; checkPlatformVersion?: boolean },
+    options?: {
+      apiUrl?: string;
+      root?: string;
+      cliLog?: CliLogger;
+      checkPlatformVersion?: boolean;
+    },
   ) {
-    if (typeof options === 'string') {
-      this.baseUrl = normalizePlatformApiUrl(options);
-      this.checkPlatformVersion = true;
-    } else {
-      this.baseUrl = normalizePlatformApiUrl(options?.apiUrl ?? getApiUrl(options?.root));
-      this.cliLog = options?.cliLog;
-      this.checkPlatformVersion = options?.checkPlatformVersion !== false;
-    }
+    this.baseUrl = normalizePlatformApiUrl(options?.apiUrl ?? getApiUrl(options?.root));
+    this.cliLog = options?.cliLog;
+    this.checkPlatformVersion = options?.checkPlatformVersion !== false;
     this.apiUrl = this.baseUrl;
-    ensureCloudflaredToken(this.baseUrl);
+    ensurePlatformAccessToken(this.baseUrl);
     this.accessHeaders = cfAccessHeaders(process.env, this.baseUrl);
     this.authHeaders = {
       Authorization: `Bearer ${token}`,
-      // Conditional spread: omit the header entirely if package.json was
-      // unreadable. The platform's gate treats missing as pass-through;
-      // sending a placeholder like "unknown" would trip the fail-closed
-      // 426 path and brick the CLI permanently.
       ...(VOID_CLI_VERSION !== null && { 'X-Void-CLI-Version': VOID_CLI_VERSION }),
     };
   }
@@ -783,7 +707,7 @@ export class PlatformClient {
     // so keep checking for a newer environment value when no service pair was
     // captured and let current credentials override the fallback below.
     if (!this.accessHeaders['CF-Access-Client-Id']) {
-      ensureCloudflaredToken(this.baseUrl);
+      ensurePlatformAccessToken(this.baseUrl);
     }
     const send = () => {
       const currentAccessHeaders = cfAccessHeaders(process.env, this.baseUrl);
@@ -824,18 +748,43 @@ export class PlatformClient {
     return send().response;
   }
 
+  /** Sends an authenticated request and throws `PlatformApiError` unless it succeeds. */
+  private async call(
+    url: string | URL,
+    action: string,
+    options: { method?: string; body?: unknown; permission?: ProjectPermission } = {},
+  ): Promise<Response> {
+    const { method, body, permission } = options;
+    const res = await this.request(url, {
+      ...(method !== undefined && { method }),
+      headers:
+        body === undefined
+          ? { ...this.authHeaders }
+          : { 'Content-Type': 'application/json', ...this.authHeaders },
+      ...(body !== undefined && { body: JSON.stringify(body) }),
+    });
+    if (!res.ok) {
+      await throwPlatformApiError(action, res, permission);
+    }
+    return res;
+  }
+
+  private async json<T>(
+    url: string | URL,
+    action: string,
+    options?: { method?: string; body?: unknown; permission?: ProjectPermission },
+  ): Promise<T> {
+    return (await this.call(url, action, options)).json() as Promise<T>;
+  }
+
   async startIdentityLink(
     connectionId: string,
   ): Promise<{ id: string; url: string; expiresAt: string }> {
-    const response = await this.request(this.baseUrl + '/auth/link', {
-      method: 'POST',
-      headers: { ...this.authHeaders, 'Content-Type': 'application/json' },
-      body: JSON.stringify({ connectionId }),
-    });
-    if (!response.ok) {
-      await throwPlatformApiError('Failed to link login method', response);
-    }
-    const result = (await response.json()) as { id: string; url: string; expiresAt: string };
+    const result = await this.json<{ id: string; url: string; expiresAt: string }>(
+      `${this.baseUrl}/auth/link`,
+      'Failed to link login method',
+      { method: 'POST', body: { connectionId } },
+    );
     const url = new URL(result.url);
     if (
       url.origin !== this.baseUrl ||
@@ -849,42 +798,16 @@ export class PlatformClient {
   }
 
   async whoami(): Promise<{ id: string; login: string; plan: string }> {
-    const res = await this.request(`${this.baseUrl}/me`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch user info', res);
-    }
-
-    return res.json();
+    return this.json(`${this.baseUrl}/me`, 'Failed to fetch user info');
   }
 
   async listProjects(): Promise<Array<ProjectResponse>> {
-    const res = await this.request(`${this.baseUrl}/projects`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list projects', res);
-    }
-
-    return res.json();
+    return this.json(`${this.baseUrl}/projects`, 'Failed to list projects');
   }
 
   /** A lightweight project list for interactive linking. */
   async listProjectChoices(): Promise<Array<ProjectResponse>> {
-    const res = await this.request(`${this.baseUrl}/projects/choices`, {
-      headers: { ...this.authHeaders },
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list project choices', res);
-    }
-    return res.json();
+    return this.json(`${this.baseUrl}/projects/choices`, 'Failed to list project choices');
   }
 
   /** Resolve one known project without loading account-wide deployment and traffic summaries. */
@@ -903,96 +826,80 @@ export class PlatformClient {
 
   /** Resolve a slug through the current platform contract. */
   async findProjectBySlug(slug: string): Promise<ProjectResponse | null> {
-    const url = new URL(`${this.baseUrl}/projects/resolve`);
-    url.searchParams.set('slug', slug);
-    const res = await this.request(url.toString(), { headers: { ...this.authHeaders } });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to resolve project', res);
-    }
-    const body = (await res.json()) as { project: ProjectResponse | null };
+    const body = await this.json<{ project: ProjectResponse | null }>(
+      `${this.baseUrl}/projects/resolve?${new URLSearchParams({ slug })}`,
+      'Failed to resolve project',
+    );
     return body.project;
   }
 
   async listProjectTokens(projectId: string): Promise<Array<ProjectDeployCredentialResponse>> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, {
-      headers: { ...this.authHeaders },
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list project tokens', res, 'owner');
-    }
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/tokens`,
+      'Failed to list project tokens',
+      {
+        permission: 'owner',
+      },
+    );
   }
 
   async getProjectZeroTrust(projectId: string): Promise<ProjectZeroTrustResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, {
-      headers: { ...this.authHeaders },
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to inspect project Zero Trust', res, 'read');
-    }
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/zero-trust`,
+      'Failed to inspect project Zero Trust',
+      { permission: 'read' },
+    );
   }
 
   async setProjectZeroTrust(
     projectId: string,
     protectedProject: boolean,
   ): Promise<ProjectZeroTrustUpdateResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json', ...this.authHeaders },
-      body: JSON.stringify({ protected: protectedProject }),
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to update project Zero Trust', res, 'settings');
-    }
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/zero-trust`,
+      'Failed to update project Zero Trust',
+      { method: 'PUT', body: { protected: protectedProject }, permission: 'settings' },
+    );
   }
 
   async reconcileProjectZeroTrust(projectId: string): Promise<ProjectZeroTrustUpdateResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust/reconcile`, {
-      method: 'POST',
-      headers: { ...this.authHeaders },
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to reconcile project Zero Trust', res, 'settings');
-    }
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/zero-trust/reconcile`,
+      'Failed to reconcile project Zero Trust',
+      { method: 'POST', permission: 'settings' },
+    );
   }
 
   async createProjectToken(
     projectId: string,
     input: { name?: string; expiresInDays?: number },
   ): Promise<IssuedProjectDeployCredentialResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, {
-      method: 'POST',
-      headers: { ...this.authHeaders, 'Content-Type': 'application/json' },
-      body: JSON.stringify(input),
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to create project token', res, 'owner');
-    }
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/tokens`,
+      'Failed to create project token',
+      {
+        method: 'POST',
+        body: input,
+        permission: 'owner',
+      },
+    );
   }
 
   async listProjectMembers(projectId: string): Promise<ProjectMemberListResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/members`, {
-      headers: { ...this.authHeaders },
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list project members', res, 'read');
-    }
-    const body = (await res.json()) as ProjectMemberListResponse;
+    const body = await this.json<ProjectMemberListResponse>(
+      `${this.baseUrl}/projects/${projectId}/members`,
+      'Failed to list project members',
+      { permission: 'read' },
+    );
     return { members: body.members, ...(body.warnings ? { warnings: body.warnings } : {}) };
   }
 
   async listProjectInvitations(projectId: string): Promise<Array<ProjectInvitationResponse>> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, {
-      headers: { ...this.authHeaders },
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list project invitations', res, 'members');
-    }
-    const body = (await res.json()) as { invitations: Array<ProjectInvitationResponse> };
+    const body = await this.json<{ invitations: Array<ProjectInvitationResponse> }>(
+      `${this.baseUrl}/projects/${projectId}/invitations`,
+      'Failed to list project invitations',
+      { permission: 'members' },
+    );
     return body.invitations;
   }
 
@@ -1005,15 +912,11 @@ export class PlatformClient {
     refreshed: boolean;
     delivery: ProjectInvitationDelivery;
   }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...this.authHeaders },
-      body: JSON.stringify({ email, role }),
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to invite project member', res, 'members');
-    }
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/invitations`,
+      'Failed to invite project member',
+      { method: 'POST', body: { email, role }, permission: 'members' },
+    );
   }
 
   async renewProjectToken(
@@ -1021,18 +924,11 @@ export class PlatformClient {
     credentialId: string,
     expiresInDays?: number,
   ): Promise<IssuedProjectDeployCredentialResponse> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}/renew`,
-      {
-        method: 'POST',
-        headers: { ...this.authHeaders, 'Content-Type': 'application/json' },
-        body: JSON.stringify(expiresInDays ? { expiresInDays } : {}),
-      },
+      'Failed to renew project token',
+      { method: 'POST', body: expiresInDays ? { expiresInDays } : {}, permission: 'owner' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to renew project token', res, 'owner');
-    }
-    return res.json();
   }
 
   async updateProjectMemberRole(
@@ -1040,69 +936,48 @@ export class PlatformClient {
     userId: string,
     role: Exclude<ProjectRole, 'owner'>,
   ): Promise<{ member: ProjectMemberResponse }> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`,
-      {
-        method: 'PATCH',
-        headers: { 'Content-Type': 'application/json', ...this.authHeaders },
-        body: JSON.stringify({ role }),
-      },
+      'Failed to change project member role',
+      { method: 'PATCH', body: { role }, permission: 'members' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to change project member role', res, 'members');
-    }
-    return res.json();
   }
 
   async revokeProjectToken(projectId: string, credentialId: string): Promise<{ ok: boolean }> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}`,
-      { method: 'DELETE', headers: { ...this.authHeaders } },
+      'Failed to revoke project token',
+      { method: 'DELETE', permission: 'owner' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to revoke project token', res, 'owner');
-    }
-    return res.json();
   }
 
   async removeProjectMember(projectId: string, userId: string): Promise<void> {
-    const res = await this.request(
+    await this.call(
       `${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`,
-      { method: 'DELETE', headers: { ...this.authHeaders } },
+      'Failed to remove project member',
+      { method: 'DELETE', permission: 'members' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to remove project member', res, 'members');
-    }
   }
 
   async revokeProjectInvitation(projectId: string, invitationId: string): Promise<void> {
-    const res = await this.request(
+    await this.call(
       `${this.baseUrl}/projects/${projectId}/invitations/${encodeURIComponent(invitationId)}`,
-      { method: 'DELETE', headers: { ...this.authHeaders } },
+      'Failed to revoke project invitation',
+      { method: 'DELETE', permission: 'members' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to revoke project invitation', res, 'members');
-    }
   }
 
   async leaveProject(projectId: string): Promise<void> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/leave`, {
+    await this.call(`${this.baseUrl}/projects/${projectId}/leave`, 'Failed to leave project', {
       method: 'POST',
-      headers: { ...this.authHeaders },
     });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to leave project', res);
-    }
   }
 
   async listPendingProjectInvitations(): Promise<Array<ProjectInvitationResponse>> {
-    const res = await this.request(`${this.baseUrl}/me/project-invitations`, {
-      headers: { ...this.authHeaders },
-    });
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list pending project invitations', res);
-    }
-    const body = (await res.json()) as { invitations: Array<ProjectInvitationResponse> };
+    const body = await this.json<{ invitations: Array<ProjectInvitationResponse> }>(
+      `${this.baseUrl}/me/project-invitations`,
+      'Failed to list pending project invitations',
+    );
     return body.invitations;
   }
 
@@ -1110,27 +985,21 @@ export class PlatformClient {
     invitationId: string,
     action: 'accept' | 'decline',
   ): Promise<void> {
-    const res = await this.request(
+    await this.call(
       `${this.baseUrl}/project-invitations/${encodeURIComponent(invitationId)}/${action}`,
-      { method: 'POST', headers: { ...this.authHeaders } },
+      `Failed to ${action} project invitation`,
+      { method: 'POST' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError(`Failed to ${action} project invitation`, res);
-    }
   }
 
   async listDeployments(projectId: string): Promise<DeploymentListResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/deployments`, {
-      headers: {
-        ...this.authHeaders,
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/deployments`,
+      'Failed to list deployments',
+      {
+        permission: 'read',
       },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list deployments', res, 'read');
-    }
-
-    return res.json();
+    );
   }
 
   async rollback(
@@ -1149,58 +1018,29 @@ export class PlatformClient {
     if (options?.allowDestructive && options.allowDestructive.length > 0) {
       body.allowDestructive = options.allowDestructive;
     }
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/rollback`, {
+    return this.json(`${this.baseUrl}/projects/${projectId}/rollback`, 'Rollback failed', {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify(body),
+      body,
+      permission: 'deploy',
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Rollback failed', res, 'deploy');
-    }
-
-    return res.json();
   }
 
   async cancelDeployment(
     projectId: string,
     deploymentId: string,
   ): Promise<{ ok: boolean; deploymentId: string; status: string }> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/deployments/${deploymentId}/cancel`,
-      {
-        method: 'POST',
-        headers: {
-          ...this.authHeaders,
-        },
-      },
+      'Cancel deployment failed',
+      { method: 'POST', permission: 'deploy' },
     );
-
-    if (!res.ok) {
-      await throwPlatformApiError('Cancel deployment failed', res, 'deploy');
-    }
-
-    return res.json();
   }
 
   async createProject(slug: string): Promise<CreateProjectResponse> {
-    const res = await this.request(`${this.baseUrl}/projects`, {
+    return this.json(`${this.baseUrl}/projects`, 'Failed to create project', {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ slug }),
+      body: { slug },
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to create project', res);
-    }
-
-    return res.json();
   }
 
   async preflight(
@@ -1243,15 +1083,9 @@ export class PlatformClient {
     }
   }
 
-  /**
-   * Request presigned R2 PUT URLs for a batch of assets. Each entry carries
-   * both `blake3` (storage key) and `md5` (wire-level integrity primitive)
-   * so the platform can sign a PUT URL that R2 enforces against the bytes
-   * the CLI is about to upload. See design doc 0068 for the full protocol.
-   */
   async requestUploadUrls(
     projectId: string,
-    assets: Array<UploadUrlAssetRequest>,
+    assets: Array<DeployAssetUploadRequest>,
   ): Promise<Record<string, { url: string; headers: Record<string, string> }>> {
     const url = `${this.baseUrl}/projects/${projectId}/deploy/upload-urls`;
     this.cliLog?.info('upload_urls_post', { url, assetCount: assets.length });
@@ -1283,12 +1117,6 @@ export class PlatformClient {
     return json.urls;
   }
 
-  /**
-   * Manifest-only (direct-to-R2) deploy. POSTs a JSON body containing the
-   * deploy manifest, asset manifest (no asset bytes), and any worker module
-   * bytes (base64-encoded). Streams an NDJSON response that the caller can
-   * apply with the existing `applyDeployEvent` machinery.
-   */
   async *finalizeDeploy(
     projectId: string,
     payload: ManifestOnlyDeployPayload,
@@ -1305,10 +1133,6 @@ export class PlatformClient {
     });
   }
 
-  /**
-   * POST + NDJSON-stream-reader used by `finalizeDeploy()`. Captures
-   * `cf-ray` + `cf-cache-status` for postmortem correlation.
-   */
   private async *streamDeployRequest(
     url: string,
     projectId: string,
@@ -1317,9 +1141,6 @@ export class PlatformClient {
     const cliLog = this.cliLog;
     cliLog?.info('deploy_post', { url });
 
-    // `fetch` reports transport failures as TypeError ('fetch failed') —
-    // the only retryable case per the DEPLOY_POST_* contract above.
-    // Anything else (e.g. AbortError) is not transient and fails fast.
     let res: Response;
     let attempt = 0;
     while (true) {
@@ -1342,9 +1163,6 @@ export class PlatformClient {
       }
     }
 
-    // `cf-ray` and `cf-cache-status` are the correlation keys that platform
-    // engineers need to look up server-side tail logs. Capture them whenever
-    // the response makes it back.
     const cfRay = res.headers.get('cf-ray');
     const cfCacheStatus = res.headers.get('cf-cache-status');
     cliLog?.info('deploy_response', {
@@ -1357,10 +1175,7 @@ export class PlatformClient {
     if (!res.ok) {
       const body = await res.text();
       if (res.status === 409) {
-        // The precheck's authoritative verdict — a deployment is already
-        // in flight (possibly the earlier attempt of this same deploy,
-        // or a concurrent one). Surface it as a structured error event
-        // naming the deployment rather than a bare HTTP failure.
+        // A deployment is in flight: possibly an earlier attempt of this deploy.
         const parsed = parsePlatformErrorBody(body);
         if (parsed?.deployment) {
           cliLog?.warn('deploy_conflict', {
@@ -1641,52 +1456,24 @@ export class PlatformClient {
   }
 
   async listSecrets(projectId: string): Promise<Array<{ name: string }>> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets`, {
-      headers: {
-        ...this.authHeaders,
-      },
+    return this.json(`${this.baseUrl}/projects/${projectId}/secrets`, 'Failed to list secrets', {
+      permission: 'configure',
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list secrets', res, 'configure');
-    }
-
-    return res.json();
   }
 
   async setSecret(projectId: string, name: string, value: string): Promise<SecretResponse> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`,
-      {
-        method: 'PUT',
-        headers: {
-          'Content-Type': 'application/json',
-          ...this.authHeaders,
-        },
-        body: JSON.stringify({ value }),
-      },
+      'Failed to set secret',
+      { method: 'PUT', body: { value }, permission: 'configure' },
     );
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to set secret', res, 'configure');
-    }
-
-    return res.json();
   }
 
   async deleteProject(projectId: string): Promise<DeleteProjectResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}`, {
+    return this.json(`${this.baseUrl}/projects/${projectId}`, 'Failed to delete project', {
       method: 'DELETE',
-      headers: {
-        ...this.authHeaders,
-      },
+      permission: 'owner',
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to delete project', res, 'owner');
-    }
-
-    return res.json();
   }
 
   async getMigrationStatus(
@@ -1697,17 +1484,7 @@ export class PlatformClient {
     if (dialect) {
       url.searchParams.set('dialect', dialect);
     }
-    const res = await this.request(url, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to get migration status', res, 'read');
-    }
-
-    return res.json();
+    return this.json(url, 'Failed to get migration status', { permission: 'read' });
   }
 
   async applyRemoteMigrations(
@@ -1718,217 +1495,108 @@ export class PlatformClient {
     applied: Array<string>;
     skipped: Array<string>;
     error?: string;
-    migration_protocol?: 'stable' | 'legacy';
-    migration_stability?: 'stable' | 'legacy';
-    warnings?: Array<string>;
   }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/apply`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ migrations }),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to apply remote migrations', res, 'configure');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/migrations/apply`,
+      'Failed to apply remote migrations',
+      { method: 'POST', body: { migrations }, permission: 'configure' },
+    );
   }
 
   async renameMigrations(
     projectId: string,
     renames: Array<{ from: string; to: string }>,
   ): Promise<{ ok: boolean }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/rename`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ renames }),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to rename remote migrations', res, 'configure');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/migrations/rename`,
+      'Failed to rename remote migrations',
+      { method: 'POST', body: { renames }, permission: 'configure' },
+    );
   }
 
   async addDomain(projectId: string, hostname: string): Promise<DomainResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, {
+    return this.json(`${this.baseUrl}/projects/${projectId}/domains`, 'Failed to add domain', {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ hostname }),
+      body: { hostname },
+      permission: 'settings',
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to add domain', res, 'settings');
-    }
-
-    return res.json();
   }
 
   async listDomains(projectId: string): Promise<Array<DomainResponse>> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, {
-      headers: {
-        ...this.authHeaders,
-      },
+    return this.json(`${this.baseUrl}/projects/${projectId}/domains`, 'Failed to list domains', {
+      permission: 'read',
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list domains', res, 'read');
-    }
-
-    return res.json();
-  }
+  }
 
   async getDomainStatus(projectId: string, domainId: string): Promise<DomainStatusResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to get domain status', res, 'read');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/domains/${domainId}`,
+      'Failed to get domain status',
+      { permission: 'read' },
+    );
   }
 
   async removeDomain(projectId: string, domainId: string): Promise<{ ok: boolean }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, {
-      method: 'DELETE',
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to remove domain', res, 'settings');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/domains/${domainId}`,
+      'Failed to remove domain',
+      { method: 'DELETE', permission: 'settings' },
+    );
   }
 
   async deleteSecret(projectId: string, name: string): Promise<SecretResponse> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`,
-      {
-        method: 'DELETE',
-        headers: {
-          ...this.authHeaders,
-        },
-      },
+      'Failed to delete secret',
+      { method: 'DELETE', permission: 'configure' },
     );
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to delete secret', res, 'configure');
-    }
-
-    return res.json();
   }
 
   async getResources(projectId: string): Promise<Array<{ type: string; binding_name: string }>> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/resources`, {
-      headers: {
-        ...this.authHeaders,
-      },
+    return this.json(`${this.baseUrl}/projects/${projectId}/resources`, 'Failed to get resources', {
+      permission: 'read',
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to get resources', res, 'read');
-    }
-
-    return res.json();
   }
 
   async createPrerenderToken(projectId: string): Promise<string> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/prerender-token`, {
-      method: 'POST',
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to create prerender token', res, 'deploy');
-    }
-
-    const body = (await res.json()) as { token: string };
+    const body = await this.json<{ token: string }>(
+      `${this.baseUrl}/projects/${projectId}/prerender-token`,
+      'Failed to create prerender token',
+      { method: 'POST', permission: 'deploy' },
+    );
     return body.token;
   }
 
   async provisionDatabase(projectId: string, connectionString: string): Promise<{ ok: boolean }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/database`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ connectionString }),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to provision database', res, 'configure');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/database`,
+      'Failed to provision database',
+      { method: 'POST', body: { connectionString }, permission: 'configure' },
+    );
   }
 
   async setDatabaseUrl(projectId: string, connectionString: string): Promise<{ ok: boolean }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, {
-      method: 'PUT',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ connectionString }),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to update database URL', res, 'configure');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/database-url`,
+      'Failed to update database URL',
+      { method: 'PUT', body: { connectionString }, permission: 'configure' },
+    );
   }
 
   async getDatabaseUrl(projectId: string): Promise<{ url: string }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch database URL', res, 'owner');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/database-url`,
+      'Failed to fetch database URL',
+      { permission: 'owner' },
+    );
   }
 
   async purgeCache(projectId: string): Promise<{ purged: number }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/revalidate`, {
+    return this.json(`${this.baseUrl}/projects/${projectId}/revalidate`, 'Cache purge failed', {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ all: true }),
+      body: { all: true },
+      permission: 'deploy',
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Cache purge failed', res, 'deploy');
-    }
-
-    return res.json();
   }
 
   async getLogs(
@@ -1948,18 +1616,11 @@ export class PlatformClient {
     if (level && level !== 'all') {
       params.set('level', level);
     }
-
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/logs?${params}`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch logs', res, 'read');
-    }
-
-    const json = (await res.json()) as { data: Array<LogEntry> };
+    const json = await this.json<{ data: Array<LogEntry> }>(
+      `${this.baseUrl}/projects/${projectId}/logs?${params}`,
+      'Failed to fetch logs',
+      { permission: 'read' },
+    );
     return json.data;
   }
 
@@ -1976,81 +1637,39 @@ export class PlatformClient {
     if (status && status !== 'all') {
       params.set('status', status);
     }
-
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/requests?${params}`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch requests', res, 'read');
-    }
-
-    const json = (await res.json()) as { data: Array<RequestEntry> };
+    const json = await this.json<{ data: Array<RequestEntry> }>(
+      `${this.baseUrl}/projects/${projectId}/requests?${params}`,
+      'Failed to fetch requests',
+      { permission: 'read' },
+    );
     return json.data;
   }
 
   async listBuilds(projectId: string, limit = 20): Promise<Array<BuildSummary>> {
     const params = new URLSearchParams({ limit: String(limit) });
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/builds?${params}`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list builds', res, 'read');
-    }
-
-    const json = (await res.json()) as { builds: Array<BuildSummary> };
+    const json = await this.json<{ builds: Array<BuildSummary> }>(
+      `${this.baseUrl}/projects/${projectId}/builds?${params}`,
+      'Failed to list builds',
+      { permission: 'read' },
+    );
     return json.builds;
   }
 
   async getBuildLogs(projectId: string, buildId: string, since = 0): Promise<BuildLogsResponse> {
     const params = new URLSearchParams({ since: String(since) });
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/builds/${buildId}/logs?${params}`,
-      {
-        headers: {
-          ...this.authHeaders,
-        },
-      },
+      'Failed to fetch build logs',
+      { permission: 'read' },
     );
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch build logs', res, 'read');
-    }
-
-    return res.json();
   }
 
   async getGithubInstallUrl(): Promise<{ url: string }> {
-    const res = await this.request(`${this.baseUrl}/github/install-url`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to get GitHub install URL', res);
-    }
-
-    return res.json();
+    return this.json(`${this.baseUrl}/github/install-url`, 'Failed to get GitHub install URL');
   }
 
   async listGithubInstallations(): Promise<Array<GithubInstallation>> {
-    const res = await this.request(`${this.baseUrl}/github/installations`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list GitHub installations', res);
-    }
-
-    return res.json();
+    return this.json(`${this.baseUrl}/github/installations`, 'Failed to list GitHub installations');
   }
 
   async connectGithub(
@@ -2065,28 +1684,16 @@ export class PlatformClient {
       codeVerifier?: string;
     },
   ): Promise<GithubConnection> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify(body),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to connect GitHub repository', res, 'settings');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/github`,
+      'Failed to connect GitHub repository',
+      { method: 'POST', body, permission: 'settings' },
+    );
   }
 
   /**
-   * Start the per-repo connect-authorization round-trip used by a non-owner org
-   * member. The callback redirects back to `redirect`
-   * with either `?connect_grant=<signed>` (proof of per-repo access) or
-   * `?error=repo_not_accessible`. Mirrors {@link getGithubLinkUrl} but carries
-   * the installation + repo the grant is scoped to.
+   * Start the per-repo connect authorization for a non-owner org member. The
+   * callback carries `?connect_grant=<signed>` or `?error=repo_not_accessible`.
    */
   async getGithubConnectAuthorizeUrl(
     redirect: string,
@@ -2101,31 +1708,18 @@ export class PlatformClient {
       installationId,
       repoFullName,
     });
-    const res = await this.request(`${this.baseUrl}/github/connect-authorize-url?${params}`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to start GitHub connect authorization', res);
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/github/connect-authorize-url?${params}`,
+      'Failed to start GitHub connect authorization',
+    );
   }
 
   async getGithubConnection(projectId: string): Promise<GithubConnection> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to get GitHub connection', res, 'read');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/github`,
+      'Failed to get GitHub connection',
+      { permission: 'read' },
+    );
   }
 
   async updateGithubConnection(
@@ -2136,35 +1730,19 @@ export class PlatformClient {
       workflowPath?: string;
     },
   ): Promise<GithubConnection> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
-      method: 'PATCH',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify(body),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to update GitHub connection', res, 'settings');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/github`,
+      'Failed to update GitHub connection',
+      { method: 'PATCH', body, permission: 'settings' },
+    );
   }
 
   async deleteGithubConnection(projectId: string): Promise<{ ok: boolean }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
-      method: 'DELETE',
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to disconnect GitHub repository', res, 'settings');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/github`,
+      'Failed to disconnect GitHub repository',
+      { method: 'DELETE', permission: 'settings' },
+    );
   }
 
   async getGithubLinkUrl(redirect: string, codeChallenge: string): Promise<{ url: string }> {
@@ -2173,37 +1751,17 @@ export class PlatformClient {
       code_challenge: codeChallenge,
       code_challenge_method: 'S256',
     });
-    const res = await this.request(`${this.baseUrl}/github/link-url?${params}`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to start GitHub link', res);
-    }
-
-    return res.json();
+    return this.json(`${this.baseUrl}/github/link-url?${params}`, 'Failed to start GitHub link');
   }
 
   async completeGithubLink(
     linkCode: string,
     codeVerifier: string,
   ): Promise<{ status: 'linked' | 'already_linked' }> {
-    const res = await this.request(`${this.baseUrl}/github/link/complete`, {
+    return this.json(`${this.baseUrl}/github/link/complete`, 'Failed to complete GitHub link', {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ link_code: linkCode, code_verifier: codeVerifier }),
+      body: { link_code: linkCode, code_verifier: codeVerifier },
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to complete GitHub link', res);
-    }
-
-    return res.json();
   }
 
   async getGithubJoinUrl(redirect: string, codeChallenge: string): Promise<{ url: string }> {
@@ -2212,51 +1770,25 @@ export class PlatformClient {
       code_challenge: codeChallenge,
       code_challenge_method: 'S256',
     });
-    const res = await this.request(`${this.baseUrl}/github/join-url?${params}`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to start GitHub join', res);
-    }
-
-    return res.json();
+    return this.json(`${this.baseUrl}/github/join-url?${params}`, 'Failed to start GitHub join');
   }
 
   async completeGithubJoin(
     joinCode: string,
     codeVerifier: string,
   ): Promise<{ status: 'joined'; count: number }> {
-    const res = await this.request(`${this.baseUrl}/github/join/complete`, {
+    return this.json(`${this.baseUrl}/github/join/complete`, 'Failed to complete GitHub join', {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ join_code: joinCode, code_verifier: codeVerifier }),
+      body: { join_code: joinCode, code_verifier: codeVerifier },
     });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to complete GitHub join', res);
-    }
-
-    return res.json();
   }
 
   async getEmailUsage(projectId: string): Promise<EmailUsageResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/usage`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch email usage', res, 'read');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/email/usage`,
+      'Failed to fetch email usage',
+      { permission: 'read' },
+    );
   }
 
   async getEmailLogs(projectId: string, limit?: number): Promise<EmailLogsResponse> {
@@ -2264,115 +1796,63 @@ export class PlatformClient {
     if (limit !== undefined) {
       url.searchParams.set('limit', String(limit));
     }
-
-    const res = await this.request(url, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch email logs', res, 'read');
-    }
-
-    return res.json();
+    return this.json(url, 'Failed to fetch email logs', { permission: 'read' });
   }
 
   async getEmailOperation(projectId: string, operationId: string): Promise<EmailOperationResponse> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${encodeURIComponent(projectId)}/email/operations/${encodeURIComponent(operationId)}`,
-      { headers: { ...this.authHeaders } },
+      'Failed to fetch email operation',
+      { permission: 'read' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch email operation', res, 'read');
-    }
-    return res.json();
   }
 
   async listEmailDestinations(projectId: string): Promise<Array<EmailDestinationResponse>> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list email destinations', res, 'read');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/email/destinations`,
+      'Failed to list email destinations',
+      { permission: 'read' },
+    );
   }
 
   async addEmailDestination(
     projectId: string,
     address: string,
   ): Promise<EmailDestinationResponse & { created: boolean }> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({ address }),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to add email destination', res, 'settings');
-    }
-
-    // 201 registered the address just now; 200 found it already on the
-    // project's list. The body is the same shape either way, so the status
-    // is the "created" signal — whether a link went out is the body's
-    // `verificationSent` / `platformVerificationPending`, not the status.
+    const res = await this.call(
+      `${this.baseUrl}/projects/${projectId}/email/destinations`,
+      'Failed to add email destination',
+      { method: 'POST', body: { address }, permission: 'settings' },
+    );
+    // 201 registered the address now; 200 found it already listed. Whether a
+    // link went out is the body's `verificationSent`, not the status.
     const body = (await res.json()) as EmailDestinationResponse;
     return { ...body, created: res.status === 201 };
   }
 
   async removeEmailDestination(projectId: string, destinationId: string): Promise<{ ok: boolean }> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/email/destinations/${destinationId}`,
-      {
-        method: 'DELETE',
-        headers: {
-          ...this.authHeaders,
-        },
-      },
+      'Failed to remove email destination',
+      { method: 'DELETE', permission: 'settings' },
     );
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to remove email destination', res, 'settings');
-    }
-
-    return res.json();
   }
 
   /** Installation email settings the CLI reads before starting a credential flow. */
   async getEmailSettings(projectId: string): Promise<EmailSettingsResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/settings`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to read email settings', res, 'read');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/email/settings`,
+      'Failed to read email settings',
+      { permission: 'read' },
+    );
   }
 
   async listEmailDomains(projectId: string): Promise<Array<EmailDomainResponse>> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, {
-      headers: {
-        ...this.authHeaders,
-      },
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to list email domains', res, 'read');
-    }
-
-    return res.json();
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/email/domains`,
+      'Failed to list email domains',
+      { permission: 'read' },
+    );
   }
 
   /** Submit a scoped token once; later operations address the domain without it. */
@@ -2380,41 +1860,27 @@ export class PlatformClient {
     projectId: string,
     input: { domain: string; apiToken?: string; attemptId?: string },
   ): Promise<EmailDomainResponse> {
-    const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...this.authHeaders,
-      },
-      body: JSON.stringify({
-        domain: input.domain,
-        ...(input.apiToken !== undefined ? { apiToken: input.apiToken } : {}),
-        ...(input.attemptId !== undefined ? { attemptId: input.attemptId } : {}),
-      }),
-    });
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to add email domain', res, 'settings');
-    }
-
-    return res.json();
-  }
-
-  async getEmailDomain(projectId: string, domain: string): Promise<EmailDomainStatusResponse> {
-    const res = await this.request(
-      `${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`,
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/email/domains`,
+      'Failed to add email domain',
       {
-        headers: {
-          ...this.authHeaders,
+        method: 'POST',
+        body: {
+          domain: input.domain,
+          ...(input.apiToken !== undefined ? { apiToken: input.apiToken } : {}),
+          ...(input.attemptId !== undefined ? { attemptId: input.attemptId } : {}),
         },
+        permission: 'settings',
       },
     );
+  }
 
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to fetch email domain status', res, 'read');
-    }
-
-    return res.json();
+  async getEmailDomain(projectId: string, domain: string): Promise<EmailDomainResponse> {
+    return this.json(
+      `${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`,
+      'Failed to fetch email domain status',
+      { permission: 'read' },
+    );
   }
 
   /** Rotates the shared zone connection secret. */
@@ -2423,54 +1889,27 @@ export class PlatformClient {
     domain: string,
     attemptId: string,
   ): Promise<EmailDomainResponse> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/rotate-secret`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...this.authHeaders },
-        body: JSON.stringify({ attemptId }),
-      },
+      'Failed to rotate email connection secret',
+      { method: 'POST', body: { attemptId }, permission: 'settings' },
     );
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to rotate email connection secret', res, 'settings');
-    }
-    return res.json();
   }
 
-  async syncEmailDomain(projectId: string, domain: string): Promise<EmailDomainSyncResponse> {
-    const res = await this.request(
+  async syncEmailDomain(projectId: string, domain: string): Promise<EmailDomainResponse> {
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/sync`,
-      {
-        method: 'POST',
-        headers: {
-          ...this.authHeaders,
-        },
-      },
+      'Failed to sync email domain',
+      { method: 'POST', permission: 'settings' },
     );
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to sync email domain', res, 'settings');
-    }
-
-    return res.json();
   }
 
   async removeEmailDomain(projectId: string, domain: string): Promise<RemoveEmailDomainResponse> {
-    const res = await this.request(
+    return this.json(
       `${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`,
-      {
-        method: 'DELETE',
-        headers: {
-          ...this.authHeaders,
-        },
-      },
+      'Failed to remove email domain',
+      { method: 'DELETE', permission: 'settings' },
     );
-
-    if (!res.ok) {
-      await throwPlatformApiError('Failed to remove email domain', res, 'settings');
-    }
-
-    return res.json();
   }
 }
 
diff --git a/packages/void/src/cli/cloudflare-auth.ts b/packages/void/src/cli/cloudflare-auth.ts
index 6ebdbd267..d65994f90 100644
--- a/packages/void/src/cli/cloudflare-auth.ts
+++ b/packages/void/src/cli/cloudflare-auth.ts
@@ -1,9 +1,10 @@
-import { execFile, spawn, spawnSync } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
 import type { CloudflareOperation } from '@void/deploy-cloudflare';
 import {
+  createCloudflareProcessRunner,
   encodeCloudflareOperation,
   decodeCloudflareOperationResult,
-  writeUncapturedOperationOutput,
+  isCleanCloudflareExit,
 } from './cloudflare-process.ts';
 import { resolveCloudflareOperationArgv } from './preset.ts';
 
@@ -99,7 +100,7 @@ export async function ensureCloudflareAuthentication(
   };
   const readSession = async (): Promise<CloudflareAuthSession | null> => {
     const result = await run(whoami, true);
-    if (!isCleanExit(result)) {
+    if (!isCleanCloudflareExit(result)) {
       return null;
     }
     const session = parseCloudflareAuthSession(result.data);
@@ -123,7 +124,7 @@ export async function ensureCloudflareAuthentication(
   }
 
   const login = await run({ type: 'auth.login' }, false);
-  if (!isCleanExit(login)) {
+  if (!isCleanCloudflareExit(login)) {
     throw new CloudflareAuthenticationError(
       'Cloudflare browser sign-in did not complete. Run `void cloudflare login` to try again.',
       'login',
@@ -184,37 +185,12 @@ export function parseCloudflareAuthSession(value: unknown): CloudflareAuthSessio
 }
 
 export function createBundledCloudflareAuthRunner(root: string): CloudflareAuthRunner {
-  const [command, ...prefix] = resolveCloudflareOperationArgv(root);
-  return (operation, capture) => {
-    const args = encodeCloudflareOperation(operation);
-    const env = cloudflareAuthEnvironment();
-    const streaming = cloudflareAuthNeedsTerminal(operation);
-    const result = spawnSync(command!, [...prefix, ...args], {
-      cwd: root,
-      encoding: 'utf8',
-      env,
-      maxBuffer: 10 * 1024 * 1024,
-      shell: false,
-      stdio: streaming ? 'inherit' : ['ignore', 'pipe', 'pipe'],
-      timeout: 10 * 60 * 1000,
-      windowsHide: true,
-    });
-    const raw = {
-      status: result.status,
-      stderr: streaming ? '' : result.stderr || '',
-      stdout: streaming ? '' : result.stdout || '',
-      signal: result.signal,
-      error: result.error?.message,
-    };
-    if (streaming) {
-      return raw;
-    }
-    const decoded = decodeCloudflareOperationResult(raw);
-    if (!capture) {
-      writeUncapturedOperationOutput(decoded);
-    }
-    return decoded;
-  };
+  const run = createCloudflareProcessRunner({
+    root,
+    env: cloudflareAuthEnvironment,
+    timeoutMs: 10 * 60 * 1000,
+  });
+  return (operation, capture) => run(operation, { capture });
 }
 
 /** Run a captured auth command without blocking terminal input or exposing credentials. */
@@ -223,7 +199,7 @@ export function runCloudflareAuthCommand(
   operation: CloudflareOperation,
   signal?: AbortSignal,
 ): Promise<CloudflareAuthRunResult> {
-  const [command, ...prefix] = resolveCloudflareOperationArgv(root);
+  const [command, ...prefix] = resolveCloudflareOperationArgv();
   const args = encodeCloudflareOperation(operation);
   if (cloudflareAuthNeedsTerminal(operation)) {
     // cf can prompt or print a device code while the browser login is active.
@@ -276,7 +252,7 @@ export function runCloudflareAuthCommand(
 }
 
 /** Browser login must display cf's prompts before it completes. */
-export function cloudflareAuthNeedsTerminal(operation: CloudflareOperation): boolean {
+function cloudflareAuthNeedsTerminal(operation: CloudflareOperation): boolean {
   return operation.type === 'auth.login';
 }
 
@@ -306,9 +282,3 @@ export function cloudflareAuthEnvironment(
   env.CLOUDFLARE_AUTH_USE_KEYRING = 'true';
   return env;
 }
-
-function isCleanExit(result: CloudflareAuthRunResult): boolean {
-  return (
-    result.status === 0 && result.signal == null && (result.error == null || result.error === '')
-  );
-}
diff --git a/packages/void/src/cli/cloudflare-candidate.ts b/packages/void/src/cli/cloudflare-candidate.ts
index 842650035..2576189d5 100644
--- a/packages/void/src/cli/cloudflare-candidate.ts
+++ b/packages/void/src/cli/cloudflare-candidate.ts
@@ -1,12 +1,6 @@
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs';
 import { join } from 'pathslash';
+import { writeFileAtomic } from '../shared/atomic-write.ts';
 
 const CANDIDATE_FILE = '.void/cloudflare-candidate.json';
 const INVALID_CANDIDATE_MESSAGE =
@@ -101,20 +95,11 @@ export function recordCloudflareCandidateUpload(
     versionId,
   ];
   mkdirSync(join(root, '.void'), { recursive: true });
-  const path = join(root, CANDIDATE_FILE);
-  const temp = `${path}.${process.pid}.tmp`;
-  try {
-    writeFileSync(
-      temp,
-      `${JSON.stringify({ accountId, workerName, parentVersionId, versionIds })}\n`,
-      { mode: 0o600 },
-    );
-    renameSync(temp, path);
-  } finally {
-    if (existsSync(temp)) {
-      unlinkSync(temp);
-    }
-  }
+  writeFileAtomic(
+    join(root, CANDIDATE_FILE),
+    `${JSON.stringify({ accountId, workerName, parentVersionId, versionIds })}\n`,
+    0o600,
+  );
 }
 
 export function clearCloudflareCandidate(root: string): void {
diff --git a/packages/void/src/cli/cloudflare-cmd.ts b/packages/void/src/cli/cloudflare-cmd.ts
index 749876c96..273b20c46 100644
--- a/packages/void/src/cli/cloudflare-cmd.ts
+++ b/packages/void/src/cli/cloudflare-cmd.ts
@@ -8,6 +8,7 @@ import {
   parseCloudflareAuthSession,
   type CloudflareAuthSession,
 } from './cloudflare-auth.ts';
+import { isCleanCloudflareExit } from './cloudflare-process.ts';
 import { printSuccess } from './output.ts';
 import { readRootWranglerConfig } from './wrangler.ts';
 
@@ -21,10 +22,9 @@ export async function runCloudflareCommand(root: string, args: CloudflareArgs):
     }
     case 'status': {
       const result = await runWrangler({ type: 'auth.whoami' }, true);
-      const session =
-        result.status === 0 && !result.signal && !result.error
-          ? parseCloudflareAuthSession(result.data)
-          : null;
+      const session = isCleanCloudflareExit(result)
+        ? parseCloudflareAuthSession(result.data)
+        : null;
       if (!session) {
         throw new Error('Not signed in to Cloudflare. Run `void cloudflare login`.');
       }
diff --git a/packages/void/src/cli/cloudflare-deploy/classify.ts b/packages/void/src/cli/cloudflare-deploy/classify.ts
index a1eb1f868..f35d8ddcc 100644
--- a/packages/void/src/cli/cloudflare-deploy/classify.ts
+++ b/packages/void/src/cli/cloudflare-deploy/classify.ts
@@ -1,9 +1,9 @@
-import { analyzeApplicationSync, type ApplicationAnalysis } from '../../application-analysis.ts';
+import { type ApplicationAnalysis } from '../../application-analysis.ts';
 import { type VoidConfig } from '../../config.ts';
-import { detectFramework } from '../../plugin-inference.ts';
 import { assertNoRootSourceConventionConflicts } from '../../project-paths.ts';
 import { validateSsrEntry } from '../../ssr/entry.ts';
-import { detectPreset, FRAMEWORK_PRESETS, hasBackendFiles } from '../preset.ts';
+import { getErrorMessage } from '../output.ts';
+import { detectPreset, hasBackendFiles } from '../preset.ts';
 import { syncWranglerDurableObjects, syncWranglerWebSockets } from '../wrangler.ts';
 
 export type CloudflareDeployAppOptions = {
@@ -24,17 +24,9 @@ export function classifyCloudflareDeployApp(
   root: string,
   voidConfig: VoidConfig,
   options: CloudflareDeployAppOptions,
-  application?: ApplicationAnalysis,
+  application: ApplicationAnalysis,
 ): CloudflareDeployAppClassification {
-  const framework = application?.framework ?? detectFramework(root);
-  if (framework) {
-    const preset = FRAMEWORK_PRESETS[framework.name];
-    if (!preset) {
-      return unsupported(
-        `deploy: --platform cloudflare has no deployment preset for framework ${framework.name}.`,
-      );
-    }
-  }
+  const framework = application.framework;
 
   // Frameworks have their own Worker output. Their Vite dependency does not
   // imply that the project is a standalone SPA.
@@ -65,17 +57,11 @@ export function classifyCloudflareDeployApp(
   }
 
   try {
-    const analysis =
-      application ??
-      analyzeApplicationSync(root, {
-        config: voidConfig,
-        environment: 'prod',
-      });
-    const paths = analysis.paths;
+    const paths = application.paths;
     assertNoRootSourceConventionConflicts(paths);
     validateSsrEntry(root, paths);
-    syncWranglerDurableObjects(root, analysis.durableObjects);
-    syncWranglerWebSockets(root, analysis.websockets);
+    syncWranglerDurableObjects(root, application.durableObjects);
+    syncWranglerWebSockets(root, application.websockets);
   } catch (error) {
     return unsupported(`deploy: ${getErrorMessage(error)}`);
   }
@@ -86,7 +72,3 @@ export function classifyCloudflareDeployApp(
 function unsupported(reason: string): CloudflareDeployAppClassification {
   return { supported: false, reason };
 }
-
-function getErrorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
diff --git a/packages/void/src/cli/cloudflare-isr.ts b/packages/void/src/cli/cloudflare-isr.ts
index 6add1da9f..fd4afb1a9 100644
--- a/packages/void/src/cli/cloudflare-isr.ts
+++ b/packages/void/src/cli/cloudflare-isr.ts
@@ -1,10 +1,6 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import type { ApprovedCloudflareKvBinding } from '@void/deploy-cloudflare';
 import { readStoredResourceName } from '@void/deploy-cloudflare';
 import { confirm, isCancel, log } from '@voidzero-dev/vite-plus-prompts';
-import { modify, applyEdits } from 'jsonc-parser';
-import { join } from 'pathslash';
-import { TYPED_CONFIG_FILE } from '../config-loader.ts';
 import { writeVoidProjectConfig } from '../config-write.ts';
 import { resolveBindingNames, type VoidConfig } from '../config.ts';
 
@@ -49,21 +45,7 @@ export async function chooseCloudflareIsr(
       return answer === true;
     })
   )(message);
-  if (existsSync(join(root, TYPED_CONFIG_FILE))) {
-    writeVoidProjectConfig(root, { ...config, routing: { ...config.routing, isr: enabled } });
-  } else {
-    const path = join(root, 'void.json');
-    const source = existsSync(path) ? readFileSync(path, 'utf8') : '{}\n';
-    writeFileSync(
-      path,
-      applyEdits(
-        source,
-        modify(source, ['routing', 'isr'], enabled, {
-          formattingOptions: { insertSpaces: true, tabSize: 2 },
-        }),
-      ),
-    );
-  }
+  writeVoidProjectConfig(root, { ...config, routing: { ...config.routing, isr: enabled } });
   config.routing = { ...config.routing, isr: enabled };
   log.info(
     `Saved routing.isr: ${String(enabled)} in void.config.ts. ISR caching ${enabled ? 'will be enabled in this deployment' : 'stays disabled until you change this setting'}.`,
diff --git a/packages/void/src/cli/cloudflare-operation-process.ts b/packages/void/src/cli/cloudflare-operation-process.ts
index b98625306..10749fcb3 100644
--- a/packages/void/src/cli/cloudflare-operation-process.ts
+++ b/packages/void/src/cli/cloudflare-operation-process.ts
@@ -8,9 +8,13 @@ import { fileURLToPath } from 'node:url';
  * Execute typed Cloudflare operations using the pinned provider CLI and API.
  * Secret values arrive on stdin; captured results use one structured envelope.
  */
-import type { CloudflareOperation } from '@void/deploy-cloudflare';
+import type {
+  CloudflareCommandResult as Result,
+  CloudflareOperation,
+} from '@void/deploy-cloudflare';
 import { parse } from 'jsonc-parser';
 import { dirname, join, resolve } from 'pathslash';
+import { readCfUploadOutput, safePositional } from './cf-command-values.ts';
 import { persistCfKeyringPreference, readCfSessionCredential } from './cf-session.ts';
 import { getCfCliVersion, getVoidUserAgent } from './cf-user-agent.ts';
 import {
@@ -21,16 +25,6 @@ import {
 } from './cloudflare-login-output.ts';
 import { sanitizeTerminalLogText } from './terminal-log-text.ts';
 
-type Result = {
-  status: number;
-  stdout: string;
-  stderr: string;
-  data?: unknown;
-  errorCode?: number;
-  signal?: NodeJS.Signals | null;
-  error?: string;
-  failure?: 'not-found' | 'durable-migration' | 'containers-unavailable';
-};
 type Json = Record<string, unknown>;
 
 const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
@@ -478,7 +472,15 @@ async function readVersionResources(worker: string, versionId: string): Promise<
   return resources;
 }
 
-async function apiHeaders(): Promise<Record<string, string>> {
+let cachedApiHeaders: Promise<Record<string, string>> | undefined;
+
+/** This process runs one operation, so the credential is read once. */
+function apiHeaders(): Promise<Record<string, string>> {
+  cachedApiHeaders ??= readApiHeaders();
+  return cachedApiHeaders;
+}
+
+async function readApiHeaders(): Promise<Record<string, string>> {
   const key = process.env.CLOUDFLARE_API_KEY ?? process.env.CF_API_KEY;
   const email = process.env.CLOUDFLARE_EMAIL ?? process.env.CF_EMAIL;
   if (key && email) {
@@ -998,14 +1000,8 @@ async function workerChanges(): Promise<Result> {
     }
     for (const item of matching) {
       if (
-        typeof item.consumer_id !== 'string' ||
-        !item.consumer_id ||
-        item.consumer_id.startsWith('-') ||
+        !safePositional(item.consumer_id) ||
         /\s/.test(item.consumer_id) ||
-        [...item.consumer_id].some((character) => {
-          const code = character.charCodeAt(0);
-          return code < 32 || code === 127;
-        }) ||
         (item.type !== undefined && item.type !== 'worker')
       ) {
         throw new Error('Queue consumer ID or type is invalid.');
@@ -1072,23 +1068,17 @@ async function workerChanges(): Promise<Result> {
     } catch {
       /* Human upload presentation. */
     }
-    const output = called.stdout;
-    const versionId =
-      uploaded.version_id ??
-      uploaded.id ??
-      uploaded.versionId ??
-      output.match(/(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i)?.[1];
+    const printed = readCfUploadOutput(called.stdout);
+    const versionId = uploaded.version_id ?? uploaded.id ?? uploaded.versionId ?? printed.versionId;
     if (typeof versionId !== 'string' || !/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(versionId)) {
       throw new Error('Cloudflare did not return the uploaded Worker version ID.');
     }
     const previewUrl =
-      typeof uploaded.preview_url === 'string'
-        ? uploaded.preview_url
-        : output.match(/Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i)?.[1];
+      typeof uploaded.preview_url === 'string' ? uploaded.preview_url : printed.previewUrl;
     const workersDevUrl =
       typeof uploaded.workers_dev_url === 'string'
         ? uploaded.workers_dev_url
-        : output.match(/(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i)?.[1];
+        : printed.workersDevUrl;
     return result(0, '', called.stderr, {
       versionId,
       ...(previewUrl ? { previewUrl } : {}),
diff --git a/packages/void/src/cli/cloudflare-operations.ts b/packages/void/src/cli/cloudflare-operations.ts
index 61faffc38..a54698ee6 100644
--- a/packages/void/src/cli/cloudflare-operations.ts
+++ b/packages/void/src/cli/cloudflare-operations.ts
@@ -1,6 +1,6 @@
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import type { CloudflareOperation } from '@void/deploy-cloudflare';
+import type { CloudflareCommandResult, CloudflareOperation } from '@void/deploy-cloudflare';
 import {
   encodeCloudflareVersionMessage,
   deployCloudflareVersionTraffic,
@@ -15,8 +15,9 @@ import {
 } from '@void/deploy-cloudflare';
 import { join } from 'pathslash';
 import { materializeCloudflareConfig, persistCloudflareConfig } from '../cloudflare-config.ts';
-import { scanWranglerDotenvKeys } from '../shared/dotenv.ts';
 import { createCloudflareProcessRunner } from './cloudflare-process.ts';
+import { findAmbientConfigOverride, findWranglerCiOverrideDotenvFile } from './deploy-transport.ts';
+import { getErrorMessage } from './output.ts';
 import {
   assertNoTransportRedirectInProjectDotenv,
   deleteEnvVarCaseAware,
@@ -31,21 +32,10 @@ import {
   type WranglerCustomDomain,
 } from './wrangler.ts';
 
-export type CloudflareOperationResult = {
-  status: number;
-  stdout: string;
-  stderr: string;
-  signal?: NodeJS.Signals | null;
-  error?: string | null;
-  data?: unknown;
-  errorCode?: number;
-  failure?: 'not-found' | 'durable-migration' | 'containers-unavailable';
-};
-
 export type CloudflareOperationRunner = (
   args: CloudflareOperation,
   options: { capture: boolean; input?: string },
-) => CloudflareOperationResult | Promise<CloudflareOperationResult>;
+) => CloudflareCommandResult | Promise<CloudflareCommandResult>;
 
 export type CloudflareOperationContext = {
   accountId: string;
@@ -55,10 +45,6 @@ export type CloudflareOperationContext = {
   runWrangler: CloudflareOperationRunner;
 };
 
-export type CloudflareCustomDomainPublisher = (
-  context: CloudflareOperationContext,
-) => Promise<void>;
-
 export type CloudflareWorkerVersion = {
   id: string;
   createdAt: string | null;
@@ -127,7 +113,7 @@ export async function listCloudflareSecrets(
     configPath: context.configPath,
     workerName: context.workerName,
   });
-  const parsed = parseJson(result.data, 'Cloudflare secret list');
+  const parsed = requireData(result.data, 'Cloudflare secret list');
   if (!Array.isArray(parsed)) {
     throw new Error('Cloudflare secret list returned an unexpected response.');
   }
@@ -235,7 +221,7 @@ export async function executeCloudflareD1Sql(
     sql: sql,
     configPath: context.operation.configPath,
   });
-  const parsed = parseJson(result.data, 'Cloudflare D1 execute');
+  const parsed = requireData(result.data, 'Cloudflare D1 execute');
   if (!Array.isArray(parsed)) {
     throw new Error('Cloudflare D1 execute returned an unexpected response.');
   }
@@ -267,7 +253,7 @@ export async function readCloudflareD1Migrations(
       .map((row) => (typeof row.name === 'string' ? row.name : null))
       .filter((name): name is string => name !== null);
   } catch (error) {
-    if (/no such table/i.test(errorMessage(error))) {
+    if (/no such table/i.test(getErrorMessage(error))) {
       return [];
     }
     throw error;
@@ -321,7 +307,7 @@ export async function readCloudflareWorkerStatus(
 
 /** Return only versions that Cloudflare records as members of a production deployment. */
 export function parseCloudflareDeployedVersionIds(value: unknown): Array<string> {
-  const parsed = parseJson(value, 'Cloudflare deployment list');
+  const parsed = requireData(value, 'Cloudflare deployment list');
   if (!Array.isArray(parsed)) {
     throw new Error('Cloudflare deployment list returned an unexpected response.');
   }
@@ -358,7 +344,7 @@ export function parseCloudflareDeployedVersionIds(value: unknown): Array<string>
 }
 
 export function parseCloudflareVersions(value: unknown): Array<CloudflareWorkerVersion> {
-  const parsed = parseJson(value, 'Cloudflare version list');
+  const parsed = requireData(value, 'Cloudflare version list');
   if (!Array.isArray(parsed)) {
     throw new Error('Cloudflare version list returned an unexpected response.');
   }
@@ -386,7 +372,7 @@ export function parseCloudflareVersions(value: unknown): Array<CloudflareWorkerV
 }
 
 export function parseActiveVersionId(value: unknown): string | null {
-  const parsed = parseJson(value, 'Cloudflare deployment status');
+  const parsed = requireData(value, 'Cloudflare deployment status');
   if (typeof parsed !== 'object' || parsed === null) {
     throw new Error('Cloudflare deployment status returned an unexpected response.');
   }
@@ -551,7 +537,7 @@ export async function activateCloudflareExistingVersion(
       recordPublishedTraffic(context.configPath, currentTriggerConfig);
     }
   } catch (error) {
-    recoveryFailure = errorMessage(error);
+    recoveryFailure = getErrorMessage(error);
   }
   throw new Error(
     recoveryFailure
@@ -598,7 +584,6 @@ export async function changeCloudflareDomain(
   hostname: string,
   action: 'add' | 'delete',
   runner?: CloudflareOperationRunner,
-  emptyDomainPublisher?: CloudflareCustomDomainPublisher,
 ): Promise<{ modified: boolean; domains: Array<WranglerCustomDomain> }> {
   const context = resolveCloudflareOperationContext(root, runner);
   const before = readWranglerCustomDomains(root);
@@ -611,7 +596,7 @@ export async function changeCloudflareDomain(
   const triggerConfigPath = join(triggerConfigDir, 'wrangler.json');
   const deployRoutes = async (): Promise<void> => {
     if (readWranglerCustomDomains(root).domains.length === 0) {
-      await (emptyDomainPublisher ?? publishEmptyCloudflareCustomDomainSet)(context);
+      await publishEmptyCloudflareCustomDomainSet(context);
       return;
     }
     writeDomainTriggerConfig(context, before.configPath, triggerConfigPath);
@@ -632,11 +617,11 @@ export async function changeCloudflareDomain(
       throw new Error(
         `Cloudflare rejected the domain trigger update and also rejected the automatic remote restore. ` +
           `The local Wrangler config was restored, but remote route state may be partially applied. ` +
-          `${errorMessage(error)} Restore failed: ${errorMessage(restoreError)}`,
+          `${getErrorMessage(error)} Restore failed: ${getErrorMessage(restoreError)}`,
       );
     }
     throw new Error(
-      `Cloudflare rejected the domain trigger update; both the local config and remote triggers were restored. ${errorMessage(error)}`,
+      `Cloudflare rejected the domain trigger update; both the local config and remote triggers were restored. ${getErrorMessage(error)}`,
     );
   } finally {
     rmSync(triggerConfigDir, { recursive: true, force: true });
@@ -675,7 +660,7 @@ export async function publishEmptyCloudflareCustomDomainSet(
 /** Adapt the direct empty-domain API call to the deployment package's result contract. */
 export function createCloudflareEmptyDomainPublisher(
   context: CloudflareOperationContext,
-): () => Promise<CloudflareOperationResult> {
+): () => Promise<CloudflareCommandResult> {
   return async () => {
     try {
       await publishEmptyCloudflareCustomDomainSet(context);
@@ -689,7 +674,7 @@ export function createCloudflareEmptyDomainPublisher(
 /** Publish an explicit empty Cron Trigger set through Void's pinned cf transport. */
 export function createCloudflareEmptyCronPublisher(
   context: CloudflareOperationContext,
-): () => Promise<CloudflareOperationResult> {
+): () => Promise<CloudflareCommandResult> {
   return async () => {
     try {
       return await run(context, {
@@ -738,7 +723,7 @@ async function run(
   context: CloudflareOperationContext,
   args: CloudflareOperation,
   options?: { capture?: boolean; input?: string },
-): Promise<CloudflareOperationResult> {
+): Promise<CloudflareCommandResult> {
   const result = await Promise.resolve(
     context.runWrangler(args, {
       capture: options?.capture ?? true,
@@ -774,41 +759,32 @@ function createCloudflareOperationRunner(
 }
 
 function assertNoOperationConfigOverride(root: string): void {
-  if (process.env.CLOUDFLARE_ENV?.trim()) {
+  const override = findAmbientConfigOverride();
+  if (override === 'CLOUDFLARE_ENV') {
     throw new Error(
       'CLOUDFLARE_ENV is set. Void Cloudflare operations target the top-level config only.',
     );
   }
-  if (process.env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH?.trim()) {
+  if (override) {
     throw new Error(
       'CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH is set. Void Cloudflare operations use the root Wrangler config only.',
     );
   }
-  for (const file of ['.env', '.env.local', '.env.', '.env..local']) {
-    const keys = scanWranglerDotenvKeys(join(root, file));
-    const containsOverride =
-      process.platform === 'win32'
-        ? [...keys].some((key) => key.toLowerCase() === 'wrangler_ci_override_name')
-        : keys.has('WRANGLER_CI_OVERRIDE_NAME');
-    if (containsOverride) {
-      throw new Error(
-        `Project file "${file}" sets WRANGLER_CI_OVERRIDE_NAME, which can replace the pinned Worker name. Remove it before running this command.`,
-      );
-    }
+  const file = findWranglerCiOverrideDotenvFile(root);
+  if (file) {
+    throw new Error(
+      `Project file "${file}" sets WRANGLER_CI_OVERRIDE_NAME, which can replace the pinned Worker name. Remove it before running this command.`,
+    );
   }
 }
 
-function parseJson(value: unknown, label: string): unknown {
+function requireData(value: unknown, label: string): unknown {
   if (value === undefined) {
     throw new Error(label + ' did not return structured data.');
   }
   return value;
 }
 
-function failedOperationResult(error: unknown): CloudflareOperationResult {
-  return { status: 1, stdout: '', stderr: errorMessage(error), error: errorMessage(error) };
-}
-
-function errorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
+function failedOperationResult(error: unknown): CloudflareCommandResult {
+  return { status: 1, stdout: '', stderr: getErrorMessage(error), error: getErrorMessage(error) };
 }
diff --git a/packages/void/src/cli/cloudflare-process.ts b/packages/void/src/cli/cloudflare-process.ts
index 485280d5d..b00cfe175 100644
--- a/packages/void/src/cli/cloudflare-process.ts
+++ b/packages/void/src/cli/cloudflare-process.ts
@@ -24,6 +24,15 @@ type OperationEnvelopeFields = {
   error?: string | null;
 };
 
+/** True only for a child that ran to completion with a clean exit 0. */
+export function isCleanCloudflareExit(
+  result: Pick<ProcessResult, 'status' | 'signal' | 'error'>,
+): boolean {
+  return (
+    result.status === 0 && result.signal == null && (result.error == null || result.error === '')
+  );
+}
+
 /** Decode the private process envelope once, retaining cancellation provenance. */
 export function decodeCloudflareOperationResult<T extends ProcessResult>(
   result: T,
@@ -89,7 +98,7 @@ export function decodeCloudflareOperationResult<T extends ProcessResult>(
 }
 
 /** Echo a decoded result to the terminal when the caller did not capture it. */
-export function writeUncapturedOperationOutput(result: { stdout: string; stderr: string }): void {
+function writeUncapturedOperationOutput(result: { stdout: string; stderr: string }): void {
   if (result.stdout) {
     process.stdout.write(result.stdout);
   }
@@ -103,8 +112,9 @@ export function createCloudflareProcessRunner(options: {
   accountId?: string;
   apiBaseUrl?: string;
   env?: NodeJS.ProcessEnv | (() => NodeJS.ProcessEnv);
+  timeoutMs?: number;
 }) {
-  const [command, ...prefix] = resolveCloudflareOperationArgv(options.root);
+  const [command, ...prefix] = resolveCloudflareOperationArgv();
   return (
     operation: CloudflareOperation,
     run: { capture: boolean; input?: string; cwd?: string },
@@ -124,6 +134,7 @@ export function createCloudflareProcessRunner(options: {
       shell: false,
       windowsHide: true,
       maxBuffer: 32 * 1024 * 1024,
+      timeout: options.timeoutMs,
       stdio: streaming ? ['inherit', 'inherit', 'inherit'] : ['pipe', 'pipe', 'pipe'],
     });
     const raw = {
diff --git a/packages/void/src/cli/create-project.ts b/packages/void/src/cli/create-project.ts
index af67eaa3f..12a3c7b3b 100644
--- a/packages/void/src/cli/create-project.ts
+++ b/packages/void/src/cli/create-project.ts
@@ -12,7 +12,7 @@ import { inferDefaultSlug } from './resolve-project.ts';
  * caller's prompt callback returns `undefined` (cancel).
  *
  * The shared retry loop keeps `promptAndCreateProject` (deploy/link paths)
- * and the AI-setup path in `index.ts` in sync.
+ * and the AI-setup path in `plugin-ai-setup.ts` in sync.
  */
 export async function createProjectWithSlugRetry(
   client: PlatformClient,
@@ -65,7 +65,7 @@ export async function promptAndCreateProject(
   }
   const config: ProjectConfig = { projectId: project.id, slug: project.slug };
   if (options.link !== false) {
-    writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
+    writeProjectConfig(root, attachSelectedPlatform(config, client.apiUrl));
   }
   if (project.owner_email_destination) {
     // The platform registers the owner's address after it has answered, so
@@ -94,10 +94,7 @@ export function isRetryableCreateError(error: PlatformApiError): boolean {
 }
 
 function isSlugRelatedError(error: PlatformApiError): boolean {
-  // Inspect BOTH `code` (parsed error/message field) and `body` (full response
-  // text). The server's current short-slug response embeds "slug" in `error`,
-  // but a future generic code like "forbidden" with the slug detail only in a
-  // separate message field would slip past a `code ?? body` short-circuit.
+  // The slug detail may be in either field.
   const haystack = `${error.code ?? ''} ${error.body ?? ''}`.toLowerCase();
   return haystack.includes('slug');
 }
diff --git a/packages/void/src/cli/db-args.ts b/packages/void/src/cli/db-args.ts
index 8c25ee8c8..54914903d 100644
--- a/packages/void/src/cli/db-args.ts
+++ b/packages/void/src/cli/db-args.ts
@@ -80,8 +80,28 @@ export type DbArgs =
     }
   | { action: 'rename-migrations' };
 
+// Positional arguments each action accepts after its name.
+const MAX_POSITIONALS: Record<DbArgs['action'], number> = {
+  push: 0,
+  generate: 0,
+  status: 0,
+  reset: 0,
+  seed: 0,
+  execute: 1,
+  migrate: 0,
+  studio: 0,
+  'set-url': 0,
+  connect: 1,
+  'rename-migrations': 0,
+  export: 0,
+};
+
+function isDbAction(value: string | undefined): value is DbArgs['action'] {
+  return value !== undefined && Object.hasOwn(MAX_POSITIONALS, value);
+}
+
 export function parseDbArgs(args: Array<string>): DbArgs {
-  const parsed = parseArgs({
+  const { values, positionals } = parseArgs({
     args,
     options: {
       file: { type: 'string' },
@@ -99,125 +119,59 @@ export function parseDbArgs(args: Array<string>): DbArgs {
     strict: true,
   });
 
-  const [action, ...rest] = parsed.positionals;
-
-  if (action === 'push') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    return { action };
-  }
-
-  if (action === 'generate') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    return { action };
-  }
-
-  if (action === 'status') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    return { action };
-  }
-
-  if (action === 'reset') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    return { action };
-  }
-
-  if (action === 'seed') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    const file = typeof parsed.values.file === 'string' ? parsed.values.file : undefined;
-    return { action, file };
-  }
-
-  if (action === 'execute') {
-    const command = rest[0];
-    if (rest.length > 1) {
-      throw new Error(`db: Unexpected argument '${rest[1]}'.`);
-    }
-    const file = typeof parsed.values.file === 'string' ? parsed.values.file : undefined;
-    if (!command && !file) {
-      throw new Error('db: Usage: void db execute <sql> or void db execute --file <path>.');
-    }
-    if (command && file) {
-      throw new Error('db: Provide either SQL inline or --file, not both.');
-    }
-    const remote = parsed.values.remote === true ? true : undefined;
-    return { action, command, file, remote };
-  }
-
-  if (action === 'migrate') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    const remote = parsed.values.remote === true ? true : undefined;
-    return { action, remote };
+  const [action, ...rest] = positionals;
+  if (!isDbAction(action)) {
+    throw new Error(
+      'db: Usage: void db <push|generate|status|reset|seed|execute|migrate|studio|export|connect|set-url|rename-migrations>.',
+    );
   }
-
-  if (action === 'studio') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    const remote = parsed.values.remote === true ? true : undefined;
-    return { action, remote };
+  if (action === 'export' && values.remote) {
+    throw new Error('`void db export --remote` is not yet supported. Local export only for now.');
   }
-
-  if (action === 'set-url') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    return { action };
+  const maxPositionals = MAX_POSITIONALS[action];
+  if (rest.length > maxPositionals) {
+    throw new Error(`db: Unexpected argument '${rest[maxPositionals]}'.`);
   }
 
-  if (action === 'connect') {
-    if (rest.length > 1) {
-      throw new Error(`db: Unexpected argument '${rest[1]}'.`);
-    }
-    const url = rest[0];
-    const provider =
-      typeof parsed.values.provider === 'string' ? parsed.values.provider : undefined;
-    if (url && provider) {
-      throw new Error('db: Provide either a connection string or --provider, not both.');
-    }
-    return {
-      action,
-      url,
-      provider,
-      name: typeof parsed.values.name === 'string' ? parsed.values.name : undefined,
-      region: typeof parsed.values.region === 'string' ? parsed.values.region : undefined,
-      localOnly: parsed.values['local-only'] === true ? true : undefined,
-    };
+  switch (action) {
+    case 'seed':
+      return { action, file: values.file };
+    case 'execute': {
+      const [command] = rest;
+      if (!command && !values.file) {
+        throw new Error('db: Usage: void db execute <sql> or void db execute --file <path>.');
+      }
+      if (command && values.file) {
+        throw new Error('db: Provide either SQL inline or --file, not both.');
+      }
+      return { action, command, file: values.file, remote: values.remote };
+    }
+    case 'migrate':
+    case 'studio':
+      return { action, remote: values.remote };
+    case 'connect': {
+      const [url] = rest;
+      if (url && values.provider) {
+        throw new Error('db: Provide either a connection string or --provider, not both.');
+      }
+      return {
+        action,
+        url,
+        provider: values.provider,
+        name: values.name,
+        region: values.region,
+        localOnly: values['local-only'],
+      };
+    }
+    case 'export':
+      return {
+        action,
+        output: values.output,
+        noData: values['no-data'],
+        noSchema: values['no-schema'],
+        table: values.table,
+      };
+    default:
+      return { action };
   }
-
-  if (action === 'rename-migrations') {
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    return { action };
-  }
-
-  if (action === 'export') {
-    if (parsed.values.remote === true) {
-      throw new Error('`void db export --remote` is not yet supported. Local export only for now.');
-    }
-    if (rest.length > 0) {
-      throw new Error(`db: Unexpected argument '${rest[0]}'.`);
-    }
-    const output = typeof parsed.values.output === 'string' ? parsed.values.output : undefined;
-    const noData = parsed.values['no-data'] === true ? true : undefined;
-    const noSchema = parsed.values['no-schema'] === true ? true : undefined;
-    const table = typeof parsed.values.table === 'string' ? parsed.values.table : undefined;
-    return { action, output, noData, noSchema, table };
-  }
-
-  throw new Error(
-    'db: Usage: void db <push|generate|status|reset|seed|execute|migrate|studio|export|connect|set-url|rename-migrations>.',
-  );
 }
diff --git a/packages/void/src/cli/db.ts b/packages/void/src/cli/db.ts
index 3cee30a1a..1167fe17c 100644
--- a/packages/void/src/cli/db.ts
+++ b/packages/void/src/cli/db.ts
@@ -1,9 +1,17 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { createRequire } from 'node:module';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { confirm, isCancel, outro, log } from '@voidzero-dev/vite-plus-prompts';
-import { basename, extname, join, relative, resolve } from 'pathslash';
+import { pathToFileURL } from 'node:url';
+import { confirm, isCancel, outro, log, text } from '@voidzero-dev/vite-plus-prompts';
+import { basename, dirname, extname, join, relative, resolve } from 'pathslash';
 import {
   readConfig,
   getDatabaseDialect,
@@ -18,11 +26,8 @@ import {
   stripSqlExt,
   writeJournal,
 } from '../migrations/collect.ts';
-import {
-  assertJournalCoherence,
-  listDrizzleArtifacts,
-  validateMigrations,
-} from '../migrations/validate.ts';
+import type { MySqlClient } from '../migrations/runner-mysql.ts';
+import { assertJournalCoherence, validateMigrations } from '../migrations/validate.ts';
 import { detectFramework } from '../plugin-inference.ts';
 import { readProjectPaths } from '../project-paths.ts';
 import type { SeedFn } from '../runtime/seed.ts';
@@ -44,10 +49,10 @@ import {
   quoteSqlString,
 } from './db-export-sequences.ts';
 import { formatTimestamp } from './gen.ts';
-import { printSuccess, dim, formatCount, pc } from './output.ts';
+import { printSuccess, dim, formatCount, getErrorMessage, pc } from './output.ts';
 import { readDeploymentPlatform, readProjectConfig } from './project.ts';
+import { drizzleKitBin } from './yarn-pnp.ts';
 
-const drizzleKitBin = join(fileURLToPath(import.meta.resolve('drizzle-kit')), '..', 'bin.cjs');
 const DEFAULT_SEED_FILES = [
   'db/seed.ts',
   'db/seed.mts',
@@ -63,14 +68,17 @@ export function getLocalD1Target(root: string): LocalD1Target {
     detected && (detected.class === 'b' || detected.class === 'c')
       ? join(root, '.wrangler', 'state')
       : join(root, '.void');
-  const bindingName = resolveBindingNames(readConfig(root).inference?.bindings)?.d1 ?? 'DB';
   return resolveLocalD1Target(root, {
-    bindingName,
+    bindingName: configuredD1Binding(root),
     defaultPersistRoot,
     readPersistState: true,
   });
 }
 
+function configuredD1Binding(root: string): string {
+  return resolveBindingNames(readConfig(root).inference?.bindings)?.d1 ?? 'DB';
+}
+
 function runDrizzleKit(root: string, args: Array<string>): void {
   execFileSync(process.execPath, [drizzleKitBin, ...args], {
     cwd: root,
@@ -119,41 +127,18 @@ type PgClient = {
   ): Promise<{ rows: Array<T> }>;
 };
 
-type MySqlClient = {
-  end(): Promise<void>;
-  query<T extends Array<Record<string, unknown>> = Array<Record<string, unknown>>>(
-    sql: string,
-    params?: Array<unknown>,
-  ): Promise<T>;
-};
-
-function getErrorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-function getPgUrl(root: string): string {
-  const vars = loadLocalEnv(root);
-  const url = vars.DATABASE_URL;
-  if (!url) {
-    throw new Error(
-      'DATABASE_URL not found in .env. Add it to connect to your local PostgreSQL database.',
-    );
-  }
-  return url;
-}
-
-function getMySqlUrl(root: string): string {
+function getLocalDatabaseUrl(root: string, dialect: 'postgresql' | 'mysql'): string {
   const url = loadLocalEnv(root).DATABASE_URL;
   if (!url) {
     throw new Error(
-      'DATABASE_URL not found in .env. Add it to connect to your local MySQL database.',
+      `DATABASE_URL not found in .env. Add it to connect to your local ${dialect === 'mysql' ? 'MySQL' : 'PostgreSQL'} database.`,
     );
   }
   return url;
 }
 
 async function withPgClient<T>(root: string, fn: (client: PgClient) => Promise<T>): Promise<T> {
-  const url = getPgUrl(root);
+  const url = getLocalDatabaseUrl(root, 'postgresql');
   const { Client } = await import('pg');
   const client: PgClient = new Client({ connectionString: url });
   await client.connect();
@@ -168,24 +153,16 @@ async function withMySqlClient<T>(
   root: string,
   fn: (client: MySqlClient) => Promise<T>,
 ): Promise<T> {
+  const { toMySqlClient } = await import('../migrations/runner-mysql.ts');
   const { createConnection } = await import('mysql2/promise');
-  const connection = await createConnection({ uri: getMySqlUrl(root), multipleStatements: true });
-  const client: MySqlClient = {
-    async query<T extends Array<Record<string, unknown>> = Array<Record<string, unknown>>>(
-      sql: string,
-      params?: Array<unknown>,
-    ): Promise<T> {
-      const [rows] = await connection.query(sql, params);
-      return (Array.isArray(rows) ? rows : []) as T;
-    },
-    async end() {
-      await connection.end();
-    },
-  };
+  const connection = await createConnection({
+    uri: getLocalDatabaseUrl(root, 'mysql'),
+    multipleStatements: true,
+  });
   try {
-    return await fn(client);
+    return await fn(toMySqlClient(connection));
   } finally {
-    await client.end();
+    await connection.end();
   }
 }
 
@@ -225,7 +202,7 @@ export async function runDbCommand(root: string, args: DbArgs): Promise<void> {
   } else if (args.action === 'studio') {
     await runStudio(root, dialect, args.remote);
   } else if (args.action === 'set-url') {
-    await runSetUrl(root);
+    await runSetUrl(root, dialect);
   } else if (args.action === 'connect') {
     await runConnect(root, dialect, args);
   } else if (args.action === 'rename-migrations') {
@@ -342,16 +319,14 @@ async function runConnect(
   }
 
   if (!connectionString) {
-    const { text: promptText, isCancel: isCancelCheck } =
-      await import('@voidzero-dev/vite-plus-prompts');
-    const answer = await promptText({
+    const answer = await text({
       message: `Enter your ${dialect === 'mysql' ? 'MySQL' : 'PostgreSQL'} connection string:`,
       placeholder:
         dialect === 'mysql'
           ? 'mysql://user:pass@host:3306/database'
           : 'postgresql://user:pass@host:5432/database',
     });
-    if (isCancelCheck(answer)) {
+    if (isCancel(answer)) {
       process.exit(0);
     }
     connectionString = answer as string;
@@ -385,15 +360,13 @@ async function runConnect(
 
 async function runPush(root: string, dialect: DatabaseDialect): Promise<void> {
   if (dialect !== 'sqlite') {
-    const url = dialect === 'mysql' ? getMySqlUrl(root) : getPgUrl(root);
+    const url = getLocalDatabaseUrl(root, dialect);
     await runDrizzleKitWithDatabaseUrl(root, url, dialect, 'push');
     printSuccess('Database schema pushed.');
     return;
   }
 
   const { writeDrizzleConfig } = await import('../drizzle/config.ts');
-  const { mkdirSync } = await import('node:fs');
-  const { dirname } = await import('pathslash');
   const { databasePath: dbPath } = getLocalD1Target(root);
   mkdirSync(dirname(dbPath), { recursive: true });
   const configPath = writeDrizzleConfig(root, dbPath);
@@ -408,7 +381,7 @@ async function runPush(root: string, dialect: DatabaseDialect): Promise<void> {
 
 async function runGenerate(root: string, dialect: DatabaseDialect): Promise<void> {
   const { prepareProject } = await import('../codegen/prepare.ts');
-  const { writeDrizzleConfig } = await import('../drizzle/config.ts');
+  const { PLACEHOLDER_DB_URL, writeDrizzleConfig } = await import('../drizzle/config.ts');
 
   // Generate the auth schema, then include those tables in Drizzle Kit's schema input. This makes
   // Better Auth tables ordinary, reviewable migration SQL instead of a deploy-time
@@ -417,16 +390,9 @@ async function runGenerate(root: string, dialect: DatabaseDialect): Promise<void
   const authSchemaPath = join(root, '.void', 'better-auth-schema.ts');
   const additionalSchemas = existsSync(authSchemaPath) ? [authSchemaPath] : undefined;
 
-  const configPath = writeDrizzleConfig(
-    root,
-    dialect === 'postgresql'
-      ? 'postgresql://dummy'
-      : dialect === 'mysql'
-        ? 'mysql://dummy'
-        : ':memory:',
-    dialect,
-    { additionalSchemas },
-  );
+  const configPath = writeDrizzleConfig(root, PLACEHOLDER_DB_URL[dialect], dialect, {
+    additionalSchemas,
+  });
 
   try {
     if (dialect === 'sqlite') {
@@ -462,42 +428,27 @@ async function runStatus(root: string, dialect: DatabaseDialect): Promise<void>
     return;
   }
 
-  let localApplied: Array<{ name: string }>;
+  let localApplied: Array<string>;
   if (dialect === 'postgresql') {
     try {
-      localApplied = await withPgClient(root, async (client) => {
-        try {
-          const result = await client.query<{ name: string }>(
-            'SELECT name FROM _void_migrations ORDER BY name',
-          );
-          return result.rows;
-        } catch {
-          return [];
-        }
-      });
+      const { readPgAppliedMigrations } = await import('../migrations/runner-pg.ts');
+      localApplied = await withPgClient(root, readPgAppliedMigrations);
     } catch {
       localApplied = [];
     }
   } else if (dialect === 'mysql') {
     try {
-      localApplied = await withMySqlClient(root, async (client) => {
-        try {
-          return (await client.query(
-            'SELECT `name` FROM `_void_migrations` ORDER BY `name`',
-          )) as Array<{ name: string }>;
-        } catch {
-          return [];
-        }
-      });
+      const { readMySqlAppliedMigrations } = await import('../migrations/runner-mysql.ts');
+      localApplied = await withMySqlClient(root, readMySqlAppliedMigrations);
     } catch {
       localApplied = [];
     }
   } else {
     const { getAppliedMigrations } = await import('../migrations/runner.ts');
     const { databasePath: dbPath } = getLocalD1Target(root);
-    localApplied = await getAppliedMigrations(dbPath);
+    localApplied = (await getAppliedMigrations(dbPath)).map((m) => m.name);
   }
-  const localSet = new Set(localApplied.map((m) => m.name));
+  const localSet = new Set(localApplied);
 
   let remoteApplied: Array<{ name: string; applied_at: string }> | null = null;
   const deploymentPlatform = readDeploymentPlatform(root);
@@ -518,8 +469,7 @@ async function runStatus(root: string, dialect: DatabaseDialect): Promise<void>
       } else {
         const { readCloudflareD1Migrations, resolveCloudflareD1Context } =
           await import('./cloudflare-operations.ts');
-        const configured = resolveBindingNames(readConfig(root).inference?.bindings);
-        const context = resolveCloudflareD1Context(root, configured?.d1 ?? 'DB');
+        const context = resolveCloudflareD1Context(root, configuredD1Binding(root));
         remoteApplied = (await readCloudflareD1Migrations(context)).map((name) => ({
           name,
           applied_at: '',
@@ -590,6 +540,7 @@ async function resetDatabase(root: string, dialect: DatabaseDialect): Promise<nu
   }
 
   if (dialect === 'postgresql') {
+    const { applyPgMigrations } = await import('../migrations/runner-pg.ts');
     await withPgClient(root, async (client) => {
       const tables = await client.query(
         "SELECT tablename FROM pg_tables WHERE schemaname = 'public'",
@@ -597,28 +548,8 @@ async function resetDatabase(root: string, dialect: DatabaseDialect): Promise<nu
       for (const row of tables.rows) {
         await client.query(`DROP TABLE IF EXISTS "${row.tablename}" CASCADE`);
       }
+      await applyPgMigrations(client, migrations);
     });
-    if (migrations.length > 0) {
-      await withPgClient(root, async (client) => {
-        await client.query(
-          `CREATE TABLE IF NOT EXISTS _void_migrations (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL)`,
-        );
-        for (const m of migrations) {
-          await client.query('BEGIN');
-          try {
-            await client.query(m.sql);
-            await client.query('INSERT INTO _void_migrations (name, applied_at) VALUES ($1, $2)', [
-              m.name,
-              new Date().toISOString(),
-            ]);
-            await client.query('COMMIT');
-          } catch (err) {
-            await client.query('ROLLBACK');
-            throw err;
-          }
-        }
-      });
-    }
     return migrations.length;
   }
 
@@ -712,37 +643,10 @@ async function runSeed(
 }
 
 /**
- * Returns true when the SQL is read-only (SELECT / EXPLAIN only).
- * Used to skip the destructive-statement safety prompt for safe queries.
- *
- * This is a fail-closed heuristic, not a real SQL parser:
- * - SQL comments (slash-star block and double-dash line) are stripped first,
- *   so commented variants like `EXPLAIN <block-comment> ANALYZE DELETE FROM
- *   users` or `EXPLAIN -- c\n ANALYZE ...` can't bypass the EXPLAIN ANALYZE
- *   check by hiding the `ANALYZE` keyword behind a comment that PostgreSQL
- *   treats as whitespace. This also handles leading comments, so
- *   `-- header\nSELECT 1` is classified as safe.
- * - The comment-stripping regex is naive and doesn't understand string
- *   literals: a string literal containing a block-comment marker will have its
- *   contents stripped. That's harmless here (still classified as SELECT, still
- *   safe), but worth knowing if this helper is ever reused.
- * - `WITH` (CTEs) is intentionally excluded: writable CTEs such as
- *   `WITH deleted AS (DELETE FROM users RETURNING *) SELECT * FROM deleted`
- *   are destructive but match a naive `WITH` prefix check. Users with
- *   read-only CTEs will see the safety prompt — minor friction, safe by default.
- * - Multi-statement SQL (`SELECT 1; DELETE FROM users`) is rejected: any `;`
- *   followed by non-whitespace content after stripping a trailing semicolon is
- *   treated as unsafe.
- * - `EXPLAIN ANALYZE` is explicitly excluded: in PostgreSQL, `EXPLAIN ANALYZE`
- *   actually executes the underlying statement (including DML) to collect runtime
- *   statistics. A naive `EXPLAIN` prefix check would treat it as safe when it is
- *   in fact destructive. Only plain `EXPLAIN` (without `ANALYZE`) is allowed.
- * - `EXPLAIN (...)` parenthesized option lists (PostgreSQL) are scanned for
- *   `ANALYZE`. The bare-keyword form `EXPLAIN ANALYZE ...` and the option-list
- *   form `EXPLAIN (ANALYZE) ...` / `EXPLAIN (ANALYZE TRUE) ...` both execute
- *   the underlying statement, so either shape is rejected. Even
- *   `EXPLAIN (ANALYZE FALSE)` is rejected (over-strict, but safer than
- *   guessing the boolean value of an arbitrary option expression).
+ * Fail-closed check for read-only SQL (SELECT or plain EXPLAIN), which skips the remote
+ * confirmation prompt. Comments are stripped first so they cannot hide `ANALYZE`.
+ * Multiple statements and `WITH` (a CTE can write) are rejected, and so is `EXPLAIN ANALYZE`
+ * in either form, because PostgreSQL executes the analyzed statement.
  */
 function isSafeStatement(sql: string): boolean {
   const decommented = sql.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/--[^\n]*/g, ' ');
@@ -826,7 +730,6 @@ async function confirmDestructiveRemote(sql: string): Promise<boolean> {
     return true;
   }
   if (!process.stdin.isTTY) {
-    // --yes flag (skip prompt under a TTY) is intentionally not wired here — non-TTY already bypasses; --yes can be added in a follow-up if scripted-TTY callers need it.
     return true;
   }
   const ok = await confirm({
@@ -866,9 +769,8 @@ async function runExecute(
       if (dialect === 'sqlite') {
         const { executeCloudflareD1Sql, resolveCloudflareD1Context } =
           await import('./cloudflare-operations.ts');
-        const configured = resolveBindingNames(readConfig(root).inference?.bindings);
         const rows = await executeCloudflareD1Sql(
-          resolveCloudflareD1Context(root, configured?.d1 ?? 'DB'),
+          resolveCloudflareD1Context(root, configuredD1Binding(root)),
           sql,
         );
         if (rows.length > 0) {
@@ -918,12 +820,7 @@ async function runExecute(
 
     // D1 remote: route through the platform proxy.
     const platformClient = new PlatformClient(token, { root });
-    // Resolve the locally-configured binding name (inference.bindings.db in void.config.ts) so that
-    // the fallback honours custom names instead of always hardcoding 'DB'.
-    const voidConfig = readConfig(root);
-    const configuredBindingNames = resolveBindingNames(voidConfig.inference?.bindings);
-    const configuredD1Binding = configuredBindingNames?.d1 ?? 'DB';
-    let binding = configuredD1Binding;
+    let binding = configuredD1Binding(root);
     try {
       const resources = await platformClient.getResources(projectConfig.projectId);
       // TODO: support --binding for projects with multiple D1 bindings (currently auto-selects the first).
@@ -1150,8 +1047,7 @@ async function runMigrate(root: string, dialect: DatabaseDialect, remote?: boole
         readCloudflareD1Migrations,
         resolveCloudflareD1Context,
       } = await import('./cloudflare-operations.ts');
-      const configured = resolveBindingNames(readConfig(root).inference?.bindings);
-      const binding = configured?.d1 ?? 'DB';
+      const binding = configuredD1Binding(root);
       const context = resolveCloudflareD1Context(root, binding);
       const remoteBefore = new Set(await readCloudflareD1Migrations(context));
       const pending = rawMigrations.filter((migration) => !remoteBefore.has(migration.name));
@@ -1262,9 +1158,6 @@ async function runMigrate(root: string, dialect: DatabaseDialect, remote?: boole
         log.step(name);
       }
     }
-    for (const warning of result.warnings ?? []) {
-      log.warn(warning);
-    }
     if (result.applied.length > 0) {
       printSuccess(
         `Applied ${formatCount(result.applied.length, 'migration')} to remote database.`,
@@ -1275,18 +1168,12 @@ async function runMigrate(root: string, dialect: DatabaseDialect, remote?: boole
   }
 
   if (dialect === 'postgresql') {
-    const { applyPgMigrations } = await import('../migrations/runner-pg.ts');
+    const { applyPgMigrations, readPgAppliedMigrations } =
+      await import('../migrations/runner-pg.ts');
     const applied = await withPgClient(root, async (client) => {
-      let existingRows: Array<{ name: string }> = [];
-      try {
-        const result = await client.query<{ name: string }>('SELECT name FROM _void_migrations');
-        existingRows = result.rows;
-      } catch {
-        existingRows = [];
-      }
-
+      const appliedNames = await readPgAppliedMigrations(client).catch(() => []);
       try {
-        validatePendingMigrations(rawMigrations, new Set(existingRows.map((row) => row.name)));
+        validatePendingMigrations(rawMigrations, new Set(appliedNames));
       } catch (err: unknown) {
         log.error(getErrorMessage(err));
         process.exit(1);
@@ -1308,19 +1195,12 @@ async function runMigrate(root: string, dialect: DatabaseDialect, remote?: boole
   }
 
   if (dialect === 'mysql') {
-    const { applyMySqlMigrations } = await import('../migrations/runner-mysql.ts');
+    const { applyMySqlMigrations, readMySqlAppliedMigrations } =
+      await import('../migrations/runner-mysql.ts');
     const applied = await withMySqlClient(root, async (client) => {
-      let existingRows: Array<{ name: string }> = [];
+      const appliedNames = await readMySqlAppliedMigrations(client).catch(() => []);
       try {
-        existingRows = await client.query<Array<{ name: string }>>(
-          'SELECT `name` FROM `_void_migrations`',
-        );
-      } catch {
-        existingRows = [];
-      }
-
-      try {
-        validatePendingMigrations(rawMigrations, new Set(existingRows.map((row) => row.name)));
+        validatePendingMigrations(rawMigrations, new Set(appliedNames));
       } catch (err: unknown) {
         log.error(getErrorMessage(err));
         process.exit(1);
@@ -1402,7 +1282,7 @@ async function runStudio(root: string, dialect: DatabaseDialect, remote?: boolea
   }
 
   if (dialect !== 'sqlite') {
-    const url = dialect === 'mysql' ? getMySqlUrl(root) : getPgUrl(root);
+    const url = getLocalDatabaseUrl(root, dialect);
 
     log.info('Opening Drizzle Studio...');
     await runDrizzleKitWithDatabaseUrl(root, url, dialect, 'studio');
@@ -1435,16 +1315,7 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
     return;
   }
 
-  // Drift / partial-state gate. Mirrors the preflight used by `runStatus`,
-  // `runMigrate`, and `runReset` — one shared helper, one source of truth.
-  // Run BEFORE the bundled-mode guard and BEFORE computing files or
-  // touching anything remote, so a project in a partial drizzle-kit state
-  // (missing journal + leftover snapshots/`migrations.js`) or a project
-  // whose journal tags don't line up with its `.sql` files gets refused
-  // with the same message the rest of the CLI emits. Bare-legacy (no
-  // journal, no artifacts) silently passes through — those projects are
-  // the entire reason `rename-migrations` exists, and the journal/snapshot
-  // mutation steps below are already no-ops on that shape.
+  // Refuse drift or a partial drizzle-kit state before changing anything, local or remote.
   const currentMigrations = collectMigrations(migrationsDir);
   try {
     assertJournalCoherence(migrationsDir, currentMigrations);
@@ -1453,15 +1324,7 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
     process.exit(1);
   }
 
-  // Refuse bundled-mode projects up front. A bundled project has a valid
-  // `_journal.json` AND a sibling `db/migrations/migrations.js` that
-  // statically imports every `.sql` file by filename. Renaming the files
-  // here would leave `migrations.js` pointing at nonexistent imports, so
-  // the next bundled migration run blows up at module resolution.
-  // Drizzle-kit owns the bundle format (import paths, padding, trailing
-  // comma) — replicating its emit here would silently break whenever
-  // drizzle-kit bumps that format. Fail fast with a concrete recovery path
-  // instead.
+  // The bundled `migrations.js` imports each `.sql` file by name, so renaming would break it.
   if (existsSync(join(migrationsDir, 'migrations.js'))) {
     log.error(
       "This project uses Drizzle's bundled migration format (db/migrations/migrations.js).\n" +
@@ -1484,13 +1347,11 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
     return;
   }
 
-  // Find the earliest existing timestamp-prefixed migration so renamed files sort before them
+  // Renamed files sort just before the earliest existing timestamped migration.
   const timestampFiles = files.filter((f) => /^\d{14}_/.test(f));
-  const formatTs = formatTimestamp;
 
   let baseTime: Date;
   if (timestampFiles.length > 0) {
-    // Parse the earliest timestamp (always UTC) and place renamed files before it
     const earliest = timestampFiles[0].slice(0, 14);
     const year = +earliest.slice(0, 4);
     const monthIndex = +earliest.slice(4, 6) - 1;
@@ -1510,82 +1371,24 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
     const oldName = oldStyleFiles[fileIndex];
     const description = oldName.replace(/^\d+_/, '');
     const ts = new Date(baseTime.getTime() + fileIndex * 1000);
-    const newName = `${formatTs(ts)}_${description}`;
+    const newName = `${formatTimestamp(ts)}_${description}`;
     renames.push({ from: oldName, to: newName });
   }
 
-  // Snapshot the raw journal bytes BEFORE the remote rename and BEFORE
-  // the snapshot preflight gate. Two reasons:
-  //   1. The preflight below uses `originalJournalBytes !== null` as
-  //      the "journal-backed project" signal, so it must be captured
-  //      first.
-  //   2. `restoreJournal` (defined further down) needs the pre-run
-  //      bytes to byte-restore after a rollback — capturing them here
-  //      guarantees we have the state from before ANY mutation.
-  // Legacy projects have no journal at all — `originalJournalBytes` stays
-  // `null` and `restoreJournal` becomes a no-op in that mode.
-  const journalPath = join(migrationsDir, 'meta', '_journal.json');
+  const metaDir = join(migrationsDir, 'meta');
+  const journalPath = join(metaDir, '_journal.json');
   const originalJournalBytes: Buffer | null = existsSync(journalPath)
     ? readFileSync(journalPath)
     : null;
-
-  // Drizzle-kit locates snapshot files by splitting the journal tag on the
-  // first underscore and appending `_snapshot.json`. When we rewrite tags,
-  // we must rename the matching snapshot alongside the .sql file so
-  // rollback/drop tooling keeps working. The old tag prefix is the numeric
-  // `NNNN` chunk before the first underscore; the new prefix is the
-  // 14-digit timestamp. Legacy projects without snapshots are skipped.
-  // These helpers are hoisted above the remote rename because the
-  // snapshot preflight below needs `snapshotPathFor` / `snapshotPrefix`.
-  const metaDir = join(migrationsDir, 'meta');
+  const journal = readJournal(migrationsDir);
+  // Drizzle-kit finds a snapshot by the part of the journal tag before the first underscore.
   const snapshotPrefix = (tag: string): string => tag.split('_')[0];
   const snapshotPathFor = (tag: string): string =>
     join(metaDir, `${snapshotPrefix(tag)}_snapshot.json`);
 
-  // If this is a journal-backed project, every tag we're
-  // about to rename MUST have its matching snapshot on disk. The rename
-  // loop below silently skips missing snapshots so bare-legacy projects
-  // (no journal, no snapshots at all) keep working — but a journal-backed
-  // project with a missing snapshot is a partial state. Proceeding would
-  // rename the .sql + journal entry to the new tag, then the next
-  // `void gen migration` (custom-migration path) or `void db generate`
-  // would be unable to locate the expected snapshot under the new
-  // filename. Refuse up front with a concrete recovery path.
-  //
-  // The "journal file exists on disk" signal
-  // (`originalJournalBytes !== null`) is not enough on its own. The
-  // kitchen-sink playground ships a placeholder journal of the form
-  // `{ "version": "7", "dialect": "sqlite", "entries": [] }` with no
-  // `meta/*_snapshot.json` files and no bundled `migrations.js`.
-  // `assertJournalCoherence` treats that exact shape as identical to
-  // "bare-legacy, no journal at all" and lets `void db status`, `migrate`,
-  // `reset`, and `deploy` fall through to the filename-based runner. The
-  // gate below must honor the same equivalence — otherwise
-  // `rename-migrations` rejects the playground outright, even though
-  // there is no snapshot chain to worry about. The
-  // `entries: [] + drizzle artifacts on disk` partial state is a real
-  // shape but `assertJournalCoherence` already rejected it long before
-  // this gate runs, so we don't need to re-handle it here.
-  //
-  // Order of operations note: this gate MUST run BEFORE
-  // `client.renameMigrations` below. Running it after the remote call
-  // means a failed gate leaves the remote mutated while the local
-  // filesystem is untouched; the best-effort `reverseRemote()` rollback
-  // can then fail on a transient network error and leave the project in
-  // divergent state that's hard to recover from. Running it up front
-  // guarantees "remote is mutated only after the local preflight
-  // passes," so there is nothing to reverse when the gate bails.
-  const preRenameJournal = readJournal(migrationsDir);
-  const drizzleArtifacts = listDrizzleArtifacts(migrationsDir);
-  const isBareLegacyPlaceholder =
-    preRenameJournal !== undefined &&
-    preRenameJournal !== null &&
-    typeof preRenameJournal === 'object' &&
-    Array.isArray((preRenameJournal as { entries?: unknown }).entries) &&
-    (preRenameJournal as { entries: Array<unknown> }).entries.length === 0 &&
-    drizzleArtifacts.length === 0;
-
-  if (originalJournalBytes !== null && !isBareLegacyPlaceholder) {
+  // Without its snapshot, drizzle-kit cannot find a renamed entry. Check before the remote
+  // rename, so a failure leaves nothing to undo.
+  if (journal && journal.entries.length > 0) {
     const missingSnapshots: Array<string> = [];
     for (const { from } of renames) {
       const fromTag = stripSqlExt(from);
@@ -1604,14 +1407,11 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
       log.error(
         '\nRestore the missing snapshot(s) from version control, or reset the migration directory with `void db generate`, then retry.',
       );
-      // No reverseRemote() here — the remote has not been touched yet.
       process.exit(1);
     }
   }
 
-  // Update remote tracking — the snapshot preflight above has already
-  // verified that the local filesystem is in a state we can safely
-  // mutate. If this fails, nothing local has changed yet.
+  // Update remote tracking first. If this fails, nothing local has changed yet.
   const token = getToken(root);
   const config = readProjectConfig(root);
   let remoteRenamed = false;
@@ -1638,62 +1438,54 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
     }
   }
 
-  // Best-effort reversal of remote renames when a later step fails
-  const reverseRemote = async () => {
-    if (!remoteRenamed || !token || !config) {
-      return;
-    }
-    try {
-      const client = new PlatformClient(token, { root });
-      const reversed = renames.map(({ from, to }) => ({ from: to, to: from }));
-      await client.renameMigrations(config.projectId, reversed);
-    } catch {
-      log.warn('db: Could not reverse remote rename. Run `void deploy` to sync remote records.');
-    }
-  };
-
-  // Tracks whether `_journal.json` was actually rewritten below, so
-  // `restoreJournal` knows when a byte-restore is needed on rollback.
-  // `originalJournalBytes` was captured above (before the remote call).
   let journalRewritten = false;
-
-  const restoreJournal = () => {
-    // Byte-restore the pre-run snapshot. No-op when nothing was rewritten
-    // or when no journal existed before the run (legacy path).
-    if (!journalRewritten || originalJournalBytes === null) {
-      return;
-    }
-    try {
-      writeFileSync(journalPath, originalJournalBytes);
-    } catch (err) {
-      log.warn(
-        'Could not restore db/migrations/meta/_journal.json after rollback. ' +
-          'The journal may be in a partial state.\n' +
-          'Regenerate it with `void db generate`, or restore it from version control.',
-      );
-      log.warn(String(err));
-    }
-  };
-
-  // Rename files — roll back completed renames (and remote) on any failure
   const renamed: Array<{ from: string; to: string }> = [];
-  // Parallel list tracking snapshot renames so rollback can reverse them
-  // with the same best-effort semantics as the .sql file renames.
   const renamedSnapshots: Array<{ from: string; to: string }> = [];
 
-  const reverseSnapshotRenames = () => {
+  // Best-effort undo of every completed step, then exit.
+  const rollback = async (message: string, err: unknown): Promise<never> => {
     for (const { from, to } of renamedSnapshots) {
       try {
         renameSync(to, from);
-      } catch (err) {
-        // best-effort rollback — warn but don't fail
+      } catch (error) {
         log.warn(
           `db: Could not reverse snapshot rename for '${from}'. ` +
             'The meta/ directory may be in a partial state.',
         );
-        log.warn(String(err));
+        log.warn(String(error));
       }
     }
+    for (const { from, to } of renamed) {
+      try {
+        renameSync(join(migrationsDir, to), join(migrationsDir, from));
+      } catch {
+        // Keep reverting the remaining files.
+      }
+    }
+    if (journalRewritten && originalJournalBytes !== null) {
+      try {
+        writeFileSync(journalPath, originalJournalBytes);
+      } catch (error) {
+        log.warn(
+          'Could not restore db/migrations/meta/_journal.json after rollback. ' +
+            'The journal may be in a partial state.\n' +
+            'Regenerate it with `void db generate`, or restore it from version control.',
+        );
+        log.warn(String(error));
+      }
+    }
+    if (remoteRenamed && token && config) {
+      try {
+        const client = new PlatformClient(token, { root });
+        const reversed = renames.map(({ from, to }) => ({ from: to, to: from }));
+        await client.renameMigrations(config.projectId, reversed);
+      } catch {
+        log.warn('db: Could not reverse remote rename. Run `void deploy` to sync remote records.');
+      }
+    }
+    log.error(message);
+    log.error(String(err));
+    process.exit(1);
   };
 
   try {
@@ -1702,45 +1494,22 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
       renamed.push({ from, to });
       log.step(`${from} → ${to}`);
 
-      // Mirror the SQL rename onto the Drizzle snapshot when one exists.
-      const fromTag = stripSqlExt(from);
-      const toTag = stripSqlExt(to);
-      const snapshotFrom = snapshotPathFor(fromTag);
-      const snapshotTo = snapshotPathFor(toTag);
+      const snapshotFrom = snapshotPathFor(stripSqlExt(from));
+      const snapshotTo = snapshotPathFor(stripSqlExt(to));
       if (existsSync(snapshotFrom)) {
         renameSync(snapshotFrom, snapshotTo);
         renamedSnapshots.push({ from: snapshotFrom, to: snapshotTo });
       }
     }
   } catch (err) {
-    reverseSnapshotRenames();
-    for (const { from, to } of renamed) {
-      try {
-        renameSync(join(migrationsDir, to), join(migrationsDir, from));
-      } catch {
-        // best-effort rollback
-      }
-    }
-    restoreJournal();
-    await reverseRemote();
-    log.error('db: Failed to rename migration files. All changes have been reverted.');
-    log.error(String(err));
-    process.exit(1);
+    await rollback('db: Failed to rename migration files. All changes have been reverted.', err);
   }
 
-  // Rewrite `_journal.json` tags to match the new filenames BEFORE touching
-  // the tracking tables, so any tracking-table failure can roll the journal
-  // back alongside the file renames. Legacy projects with no journal skip
-  // this step entirely — there's nothing to rewrite, and the snapshot/
-  // tracking rollback sites already no-op via `journalRewritten === false`.
-  if (originalJournalBytes !== null) {
+  // Rewrite journal tags before the tracking tables, so a tracking failure also restores it.
+  if (journal) {
     try {
-      const journal = readJournal(migrationsDir);
-      if (!journal) {
-        // The journal existed when we snapshotted its bytes above but has
-        // since disappeared or become unreadable. Treat this as a hard
-        // failure so the rename flow rolls back rather than silently
-        // losing journal coherence.
+      const current = readJournal(migrationsDir);
+      if (!current) {
         throw new Error(
           'db: db/migrations/meta/_journal.json disappeared mid-run. File renames will be reverted.',
         );
@@ -1749,37 +1518,22 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
       for (const { from, to } of renames) {
         renameMap.set(stripSqlExt(from), stripSqlExt(to));
       }
-      const updatedEntries = journal.entries.map((entry) => {
+      const updatedEntries = current.entries.map((entry) => {
         const next = renameMap.get(entry.tag);
         return next ? { ...entry, tag: next } : entry;
       });
-      // Mark the journal as mutated BEFORE the write, so rollback will
-      // byte-restore the snapshot even if `writeJournal` fails mid-write
-      // (disk full, EIO, process killed). The flag's semantic is "a
-      // mutation was attempted," which is what rollback correctness needs.
+      // Set before writing, so a partial write is still restored.
       journalRewritten = true;
       writeJournal(migrationsDir, {
-        version: journal.version,
-        dialect: journal.dialect,
+        version: current.version,
+        dialect: current.dialect,
         entries: updatedEntries,
       });
     } catch (err) {
-      // Revert file renames so journal and filenames stay in sync
-      reverseSnapshotRenames();
-      for (const { from, to } of renames) {
-        try {
-          renameSync(join(migrationsDir, to), join(migrationsDir, from));
-        } catch {
-          // best-effort rollback
-        }
-      }
-      restoreJournal();
-      await reverseRemote();
-      log.error(
+      await rollback(
         'db: Failed to update db/migrations/meta/_journal.json. File renames have been reverted.',
+        err,
       );
-      log.error(String(err));
-      process.exit(1);
     }
   }
 
@@ -1804,23 +1558,11 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
         }
       });
     } catch (err) {
-      // Roll back file renames so tracking and filenames stay in sync
-      reverseSnapshotRenames();
-      for (const { from, to } of renames) {
-        try {
-          renameSync(join(migrationsDir, to), join(migrationsDir, from));
-        } catch {
-          // best-effort rollback — ignore individual rename failures
-        }
-      }
-      restoreJournal();
-      await reverseRemote();
-      log.error(
+      await rollback(
         'db: Failed to update PostgreSQL tracking table. File renames have been reverted.\n' +
           'Fix the database connection and run `void db rename-migrations` again.',
+        err,
       );
-      log.error(String(err));
-      process.exit(1);
     }
   } else if (dialect === 'mysql') {
     try {
@@ -1839,22 +1581,11 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
         }
       });
     } catch (err) {
-      reverseSnapshotRenames();
-      for (const { from, to } of renames) {
-        try {
-          renameSync(join(migrationsDir, to), join(migrationsDir, from));
-        } catch {
-          // best-effort rollback
-        }
-      }
-      restoreJournal();
-      await reverseRemote();
-      log.error(
+      await rollback(
         'db: Failed to update MySQL tracking table. File renames have been reverted.\n' +
           'Fix the database connection and run `void db rename-migrations` again.',
+        err,
       );
-      log.error(String(err));
-      process.exit(1);
     }
   } else {
     const { openSqliteDatabase } = await import('../migrations/runner.ts');
@@ -1885,23 +1616,11 @@ async function runRenameMigrations(root: string, dialect: DatabaseDialect): Prom
           db.close();
         }
       } catch (err) {
-        // Roll back file renames so tracking and filenames stay in sync
-        reverseSnapshotRenames();
-        for (const { from, to } of renames) {
-          try {
-            renameSync(join(migrationsDir, to), join(migrationsDir, from));
-          } catch {
-            // best-effort rollback — ignore individual rename failures
-          }
-        }
-        restoreJournal();
-        await reverseRemote();
-        log.error(
+        await rollback(
           'db: Failed to update SQLite tracking table. File renames have been reverted.\n' +
             'Fix the database issue and run `void db rename-migrations` again.',
+          err,
         );
-        log.error(String(err));
-        process.exit(1);
       }
     }
   }
@@ -2233,12 +1952,7 @@ async function runExport(
   }
 }
 
-async function runSetUrl(root: string): Promise<void> {
-  const { readConfig: readVoidConfig, getDatabaseDialect: getDialect } =
-    await import('../config.ts');
-  const config = readVoidConfig(root);
-  const dialect = getDialect(config);
-
+async function runSetUrl(root: string, dialect: DatabaseDialect): Promise<void> {
   if (dialect === 'sqlite') {
     log.error(
       'db: This command is only for PostgreSQL and MySQL projects. Set "database" to "pg" or "mysql" in void.config.ts.',
@@ -2258,10 +1972,7 @@ async function runSetUrl(root: string): Promise<void> {
     process.exit(1);
   }
 
-  const { text: promptText, isCancel: isCancelCheck } =
-    await import('@voidzero-dev/vite-plus-prompts');
-
-  const connectionString = await promptText({
+  const connectionString = await text({
     message: `Enter your ${dialect === 'mysql' ? 'MySQL' : 'PostgreSQL'} connection string:`,
     placeholder:
       dialect === 'mysql'
@@ -2278,7 +1989,7 @@ async function runSetUrl(root: string): Promise<void> {
     },
   });
 
-  if (isCancelCheck(connectionString)) {
+  if (isCancel(connectionString)) {
     process.exit(0);
   }
 
@@ -2356,7 +2067,7 @@ async function runSeedModule(
   if (dialect === 'mysql') {
     const { drizzle } = await import('drizzle-orm/mysql2');
     const { createConnection } = await import('mysql2/promise');
-    const connection = await createConnection(getMySqlUrl(root));
+    const connection = await createConnection(getLocalDatabaseUrl(root, 'mysql'));
     try {
       const options = getDrizzleSchemaOptions(schema);
       const db = options
diff --git a/packages/void/src/cli/deploy-artifact-validation.ts b/packages/void/src/cli/deploy-artifact-validation.ts
index 65d363c77..3e57961dc 100644
--- a/packages/void/src/cli/deploy-artifact-validation.ts
+++ b/packages/void/src/cli/deploy-artifact-validation.ts
@@ -1,4 +1,5 @@
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { isDeepStrictEqual as deepEqual } from 'node:util';
 import {
   parseRootWranglerConfig,
   readConfigEntryString as readD1EntryString,
@@ -17,16 +18,14 @@ import {
   collectConfigBindingIdentities,
   DEPLOY_PASSTHROUGH_ASSERT_FIELDS,
   DEPLOY_WHOLE_OBJECT_PINNED_FIELDS,
-  deepEqual,
   isEmptyPassthroughValue,
   verifyNoInjectedExternalDurableObject,
   DEFAULT_VOID_AI_BINDING,
   verifyNoInjectedDestructiveMigration,
   normalizeContainerImagePaths,
-  collectEmittedQueueNames,
   collectEmittedQueueGroupNames,
 } from './deploy-binding-snapshot.ts';
-import { log, getErrorMessage } from './deploy-helpers.ts';
+import { log } from './deploy-helpers.ts';
 import { BETTER_AUTH_SECRET_NAME } from './deploy-resources.ts';
 import { buildSchemaProbeEnv } from './deploy-transport.ts';
 import { type BindingIdentitySnapshot, type CloudflareDeployDeps } from './deploy-types.ts';
@@ -44,21 +43,16 @@ import {
   SelfHostFirstDeployError,
   SelfHostSchemaError,
   SelfHostSecretListError,
-  type EmittedWorkerVarsResult,
   type SelfHostSchemaFacts,
 } from './env-validation.ts';
 import { readGeneratedWranglerConfigFile } from './generated-wrangler-config.ts';
-// Type-only: the provision module must load lazily (see `deploy-types.ts`).
+import { getErrorMessage } from './output.ts';
 import type { DesiredResourceSet } from './provision.ts';
 import { bindingEntriesForField } from './wrangler.ts';
 
 /**
- * Default {@link CloudflareDeployDeps.resolveSchemaFacts} seam: derive the
- * env-INSENSITIVE schema facts (server and required key names) in an ISOLATED SUBPROCESS ({@link
- * resolveEnvSchemaFactsViaSubprocess}) under the scrubbed `env`. The parent runs NO
- * project code: importing the user's env.ts (and resolving the Vite config) happens in
- * the child, so a deferred handler can never read the parent's credentials. Loaded
- * lazily so a managed deploy never pulls the probe in.
+ * Derive the env schema's server and required key names in an isolated subprocess, so project
+ * code never runs in the credentialed parent. Loaded lazily to keep it out of managed deploys.
  */
 export async function resolveEnvSchemaFactsDefault(
   input: EnvSchemaProbeInput,
@@ -68,13 +62,7 @@ export async function resolveEnvSchemaFactsDefault(
   return resolveEnvSchemaFactsViaSubprocess(input, env);
 }
 
-/**
- * Default {@link CloudflareDeployDeps.validateEmittedVars} seam: validate the REAL
- * emitted worker `vars` (post-build ground truth) against the schema validators in the
- * SAME isolated subprocess ({@link validateEmittedVarsViaSubprocess}) under the scrubbed
- * `env`, returning the FAILING key NAMES only. Runs the user's validators (project
- * code) off the credentialed parent; loaded lazily so a managed deploy never pulls it in.
- */
+/** Validate the emitted Worker vars in the same isolated subprocess; returns failing names only. */
 async function validateEmittedVarsDefault(
   input: EnvSchemaProbeInput,
   env: NodeJS.ProcessEnv,
@@ -83,17 +71,6 @@ async function validateEmittedVarsDefault(
   return validateEmittedVarsViaSubprocess(input, env);
 }
 
-/**
- * Default {@link CloudflareDeployDeps.readEmittedWorkerVars} seam: read the REAL
- * `vars` map the build baked into `dist/ssr/wrangler.json` (ground truth — the exact
- * plaintext the worker ships). Delegates to the shared {@link readEmittedWorkerVars}
- * reader (also used by the isolated `validate-emitted` probe child), so the parent
- * and the child resolve the SAME artifact.
- */
-function readEmittedWorkerVarsDefault(root: string): EmittedWorkerVarsResult {
-  return readEmittedWorkerVars(root);
-}
-
 export function resolveGeneratedDeployConfigPathDefault(root: string): string {
   const pointerPath = deployPointerPath(root);
   const pointer = JSON.parse(readFileSync(pointerPath, 'utf-8')) as { configPath?: unknown };
@@ -150,41 +127,18 @@ export function hasConfiguredVoidWorkerRoutingRules(routing: RoutingConfig | und
 }
 
 /**
- * Remove the CF plugin's deploy pointer before building so the post-build
- * verification can only pass on a pointer THIS build re-created. The CF plugin
- * overwrites (never deletes) it, and only when the CF Vite plugin runs — a build
- * that emits no worker artifact would otherwise leave a stale pointer from a prior
- * run, which a bare `wrangler deploy` would follow to old code.
+ * Remove the CF plugin's deploy pointer before building. The plugin rewrites it only when it
+ * emits a Worker, so the post-build checks then accept only a pointer this build wrote.
  */
 export function removeDeployPointer(root: string): void {
   rmSync(deployPointerPath(root), { force: true });
 }
 
 /**
- * Confirm the deploy config the CF Vite plugin emitted targets the pinned account, the
- * expected worker name, AND the exact resources this deploy provisioned — at the
- * TOP-LEVEL environment, BEFORE a bare `wrangler deploy` uploads anything.
- * `wrangler deploy` (no `-c`) follows `.wrangler/deploy/config.json` → the generated
- * `dist/.../wrangler.json`. A `CLOUDFLARE_ENV` / `CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH`
- * in the ambient env or a production `.env` can make the build FLATTEN a named env or an
- * alternate config into that artifact — keeping the same `account_id`/`name` while
- * swapping the binding set, so `wrangler deploy --env=` ships it as top-level with no
- * mismatch. When a `bindingIdentitySnapshot` is given we therefore assert, in TWO directions,
- * that the generated artifact's id-bearing bindings (D1 database_id / KV id / R2 bucket_name /
- * Hyperdrive id) equal the identities PINNED before the build (the in-memory snapshot the
- * drift-check / provision resolved) — NOT a post-build re-read of the root config, so a build
- * that consistently rewrote BOTH the root config and this artifact is still caught:
- *   (a) with `desired`, every DESIRED binding must still be present with its pinned id — catches a
- *       binding the build DROPPED or whose id it rewrote; and
- *   (b) COMPLETENESS — every id-bearing binding the artifact declares must be one the snapshot
- *       pinned, with the pinned id — catches a binding the build ADDED (absent from the snapshot)
- *       or a pre-existing NON-desired binding whose id it rewrote, either of which the CF plugin
- *       would otherwise merge verbatim into the artifact and `wrangler deploy` would bind.
- * Only these four id-bearing kinds are inspected; every other binding the build legitimately
- * emits (ai / queues / durable_objects / vars / …) passes through untouched. This makes the id
- * defense symmetric with the `account_id` check above, which already compares against the
- * in-memory pinned account. Returns `{ ok:false, reason }` on any mismatch — or when the config
- * is missing/unreadable — so the caller fails closed.
+ * Check the generated deploy config before upload: the pinned account and Worker name, required
+ * secrets, and every binding, container, migration, queue and cron against the pre-build pins,
+ * so a build that adds, drops or retargets one fails closed. Returns `{ ok: false, reason }` on
+ * any mismatch, or when the config is missing or unreadable.
  */
 export function verifyGeneratedDeployConfig(
   root: string,
@@ -193,63 +147,25 @@ export function verifyGeneratedDeployConfig(
     workerName: string;
     desired?: DesiredResourceSet;
     bindingIdentitySnapshot?: BindingIdentitySnapshot;
-    /**
-     * Per-assert-field binding ENTRY pin taken pre-build ({@link snapshotPassthroughIdentities}) —
-     * field → (bindingName → root entry). Drives the pass-through assertion: an emitted entry in a
-     * field Void never emits whose binding was not pinned pre-build is a build-injected binding,
-     * and one whose pinned target keys were rewritten is a build-retargeted binding.
-     */
+    /** Pre-build entries for binding fields Void never emits. */
     passthroughIdentitySnapshot?: Map<string, Map<string, Record<string, unknown>>>;
-    /**
-     * Raw pre-build root values ({@link snapshotPassthroughRawFields}) for the fields the ENTRY
-     * pin cannot cover: the whole-object-pinned fields, `durable_objects` (external-DO check),
-     * `ai` (binding pin), and `migrations` (destructive-migration check). An emitted value that
-     * diverges from its root pin — a whole-object field added/removed/rewritten, an external DO
-     * absent from root, an `ai` binding that is neither the root's nor Void's own (and only when
-     * the source uses AI), or an injected destructive migration — fails closed.
-     */
+    /** Pre-build raw values for whole-object fields, `durable_objects`, `ai` and `migrations`. */
     passthroughRawFields?: Map<string, unknown>;
-    /**
-     * Whether the pre-build inference found Workers AI use in the source (the SAME `needsAI`
-     * signal `shouldBindWorkersAi` gates on in index.ts). Authorizes Void's emitted AI binding
-     * (default `AI`, or `aiBindingName`) when the root config declares none: only an AI-using app
-     * legitimately receives one, so a build that injects it into a non-AI app (billable inference
-     * the source never asked for) fails closed.
-     */
+    /** Whether the source uses Workers AI; only then may the build add Void's AI binding. */
     needsAI?: boolean;
     /** Custom `inference.bindings.ai` name authorized for Void's emitted AI binding. */
     aiBindingName?: string;
-    /**
-     * Auth-enabled Cloudflare builds must emit `secrets.required` with
-     * BETTER_AUTH_SECRET so Wrangler inherits the persistent remote value into
-     * the uploaded Worker version instead of dropping it during replacement.
-     */
+    /** Require BETTER_AUTH_SECRET in `secrets.required` so the upload keeps the remote value. */
     authEnabled?: boolean;
     /** Additional Worker secret names the generated version must inherit. */
     requiredSecretNames?: Array<string>;
-    /**
-     * The exact `containers` set Void's build emits, reconstructed PRE-BUILD
-     * ({@link reconstructExpectedContainers}) from the root-declared containers plus — when the
-     * source needs the sandbox — Void's own sandbox container. A bare `wrangler deploy` PROVISIONS a
-     * container application from the emitted array (billable, runs the image), so an emitted
-     * container absent from this set is one the build INJECTED, an expected container missing from
-     * the emitted array is one it DROPPED, and one present but not byte-identical is one it
-     * RETARGETED (e.g. a rewritten `image` pointing at an attacker's).
-     */
+    /** Containers the build should emit: the root's, plus Void's sandbox container when used. */
     expectedContainers?: Array<Record<string, unknown>>;
     /** Exact pre-build Durable Object bindings, including Void's sandbox and live additions. */
     expectedDurableObjectBindings?: Array<Record<string, unknown>>;
     /** Exact pre-build migration sequence, including Void's sandbox and live additions. */
     expectedMigrations?: Array<Record<string, unknown>>;
-    /**
-     * The exact cron trigger schedules Void's build emits into `triggers.crons`, reconstructed
-     * PRE-BUILD from the SAME `scanJobsSync` scan index.ts derives them from
-     * ({@link computeDesiredCloudflareResources}). A bare `wrangler deploy` reading
-     * `dist/ssr/wrangler.json` INSTALLS the worker's Cron Triggers from `triggers.crons`, so an
-     * emitted schedule absent from this multiset is one the build INJECTED (attacker code runs on a
-     * billable schedule) and an expected schedule missing from the emitted array is one it DROPPED
-     * (or, paired with an injected replacement, RETARGETED).
-     */
+    /** Cron schedules the build should emit, derived from the source before the build. */
     expectedCrons?: Array<string>;
   },
 ): { ok: boolean; reason?: string } {
@@ -317,21 +233,16 @@ export function verifyGeneratedDeployConfig(
       };
     }
   }
-  // Binding-identity check: the generated artifact's id-bearing bindings must be the SAME ones
-  // (by id) as were PINNED before the build (the in-memory snapshot). A flattened named-env /
-  // alternate config — or a build that rewrote/added an id in BOTH the root config and this
-  // artifact — keeps account+name but swaps the binding set, caught here against the snapshot.
+  // Id-bearing bindings (D1, KV, R2, Hyperdrive) must match the in-memory pre-build pins, so a
+  // build that rewrote both the root config and the artifact is still caught.
   if (expected.bindingIdentitySnapshot) {
     const snapshot = expected.bindingIdentitySnapshot;
-    // (a) Every DESIRED binding must still be present with its pinned id — catches a binding the
-    // build DROPPED (the completeness loop below, which only walks what the artifact DECLARES,
-    // cannot see an omission) or whose id it rewrote.
+    // Every desired binding is still emitted with its pinned id.
     if (expected.desired) {
       for (const { kind, binding } of desiredIdentityBindings(expected.desired)) {
         const { field, idField } = DEPLOY_BINDING_IDENTITY_FIELDS[kind];
         const pinnedId = snapshot.get(bindingIdentityKey(field, binding));
-        // A binding with no pinned id was never provisioned with a real one (the drift check's
-        // job); here we only assert the generated artifact did not DIVERGE from the pre-build pin.
+        // Unprovisioned bindings are the drift check's job.
         if (pinnedId === undefined) {
           continue;
         }
@@ -350,15 +261,7 @@ export function verifyGeneratedDeployConfig(
         }
       }
     }
-    // (b) COMPLETENESS — every id-bearing binding the artifact DECLARES must be one the snapshot
-    // pinned (by binding name) AND carry the pinned id. The desired loop above only inspects the
-    // desired set, so a binding the build ADDED to the root config (absent from the snapshot) or a
-    // pre-existing NON-desired binding whose id it rewrote would otherwise flow into the artifact
-    // and get bound by `wrangler deploy`. Scoped to the four id-bearing kinds only — every other
-    // binding the build emits (ai / queues / durable_objects / vars / …) is neither inspected nor
-    // rejected. The pin is the pre-build snapshot of the SAME root config the CF plugin merges, so
-    // a legitimately emitted binding's id equals what was captured; only an added / rewritten one
-    // diverges.
+    // Every emitted id-bearing binding was pinned, with the same id.
     const generatedIdentities = collectConfigBindingIdentities(generated);
     for (const { field, binding, id } of generatedIdentities) {
       const pinnedId = snapshot.get(bindingIdentityKey(field, binding));
@@ -375,16 +278,7 @@ export function verifyGeneratedDeployConfig(
         };
       }
     }
-    // (c) Reverse-presence — the desired loop (a) inspects only the DESIRED bindings and the
-    // completeness loop (b) walks only what the artifact DECLARES, so neither sees a NON-desired,
-    // manually-declared root id-bearing binding (e.g. a hand-added `EXTRA_DB`) the build DROPPED: it
-    // is absent from `desired`, and (b) cannot iterate an omission. Walk the PINNED snapshot instead —
-    // every pinned `<field>:<binding>` must still appear among the emitted id-bearing bindings (read
-    // the SAME way (b) reads them). A field the build removed entirely leaves every pinned binding in
-    // it missing. This is the exact mirror of the pass-through reverse-presence loop (A1) below and is
-    // FP-safe on the same reasoning: a legitimate CF-plugin build spreads the root config, so no
-    // pinned id-binding is ever dropped; `bindingIdentitySnapshot` holds only bindings that had a real
-    // id pre-build, so a placeholder/absent id is never asserted here.
+    // Every pinned binding, desired or hand-declared, is still emitted.
     const emittedIdentityKeys = new Set<string>();
     for (const { field, binding } of generatedIdentities) {
       emittedIdentityKeys.add(bindingIdentityKey(field, binding));
@@ -401,20 +295,8 @@ export function verifyGeneratedDeployConfig(
       }
     }
   }
-  // (A) Pass-through assert-set — every entry the artifact declares in a resource field Void's own
-  // build never emits ({@link DEPLOY_PASSTHROUGH_ASSERT_FIELDS}, derived from the wrangler binding
-  // registry) must have been present in the pre-build root snapshot, matched by its wrangler-shape
-  // identity key, AND be byte-identical to the pinned root entry. Two failures fail closed:
-  //   • the binding name was NOT pinned pre-build → a binding the build INJECTED; and
-  //   • the emitted entry differs from the pinned root entry → a binding the build REWROTE
-  //     (kept the name but changed the service/namespace/type it points at, or added a sub-field).
-  // Compare the WHOLE entry (exact equality): a real `vite build` adds NOTHING to a PRESENT
-  // pass-through entry — services/vectorize/workflows/mtls_certificates/send_email/ratelimits/
-  // dispatch_namespaces all emit byte-identical to root — so any added/removed/rewritten sub-field
-  // is the build tampering with the binding's target. Fields NOT in the assert-set are deliberately
-  // NOT asserted here (fail OPEN): a resource field wrangler does not yet know about must never
-  // false-positive a legitimate build. `unsafe` stays in the assert-set (for the drift invariant)
-  // but is routed to the whole-object pin below — its `.metadata`/`.capnp` are never entry-iterated.
+  // Binding fields Void never emits: each emitted entry must equal its pre-build entry. Fields
+  // outside the assert set stay unchecked, so a binding type added later cannot fail a valid build.
   if (expected.passthroughIdentitySnapshot) {
     const passthrough = expected.passthroughIdentitySnapshot;
     for (const field of DEPLOY_PASSTHROUGH_ASSERT_FIELDS) {
@@ -447,14 +329,7 @@ export function verifyGeneratedDeployConfig(
         }
       }
     }
-    // (A1) Reverse-presence — the forward loop above only walks EMITTED entries, so it cannot see a
-    // root-declared pass-through binding the build DROPPED (removing a `services` / `mtls_certificates`
-    // / … binding the source declared silently strips a capability). Walk the PINNED entries instead:
-    // every pinned binding NAME must still appear in the emitted entries for its field. A field
-    // ABSENT from the emitted config means every pinned name in it is missing. Whole-object-pinned
-    // fields are skipped — their SYMMETRIC raw pin already rejects a removed value. FP-safe: a
-    // legitimate CF-plugin build spreads the root config, so no pinned pass-through binding is ever
-    // dropped; only a build that omits one to strip what the source declared is caught here.
+    // Every pinned binding is still emitted. Whole-object fields are checked below.
     for (const [field, pinnedEntries] of passthrough) {
       if (DEPLOY_WHOLE_OBJECT_PINNED_FIELDS.includes(field) || pinnedEntries.size === 0) {
         continue;
@@ -466,8 +341,7 @@ export function verifyGeneratedDeployConfig(
             emittedNames.add(name);
           }
         } catch {
-          // A malformed emitted field is already rejected by the forward loop; treat it as carrying
-          // no names so any pinned name is reported missing here too (fail closed).
+          // A malformed field emits no names, so every pinned name is reported missing.
         }
       }
       for (const name of pinnedEntries.keys()) {
@@ -480,44 +354,14 @@ export function verifyGeneratedDeployConfig(
       }
     }
   }
-  // (A2) Whole-object + targeted pins for the fields the per-binding ENTRY pin cannot cover, each
-  // compared against the raw pre-build root value ({@link snapshotPassthroughRawFields}):
-  //   • `unsafe` / `tail_consumers` / `streaming_tail_consumers` — the emitted value must be
-  //     byte-identical to the root's. The empty check is SYMMETRIC: an emitted empty value passes
-  //     ONLY when the root value is ALSO empty (the clean-build shape / a normalizer default-fill).
-  //     A root that DECLARED a non-empty value emitted back EMPTY is a REMOVAL — clearing
-  //     `tail_consumers` silently disables the source's audit/log forwarding — so it is rejected
-  //     like any other rewrite. `unsafe.metadata` overwrites the WHOLE uploaded bindings array at
-  //     upload, and `tail_consumers`/`streaming_tail_consumers` forward every log/request — so a
-  //     build injecting, rewriting, OR removing one changes exfil/audit the source declared.
-  //   • `routes` / `route` / `workers_dev` / `preview_urls` — the worker's traffic attachment.
-  //     Void emits none, so undeclared → absent → both-empty → pass; a build-injected `routes`
-  //     entry (attaching the worker to a hostname the account controls) or a flipped
-  //     `workers_dev`/`preview_urls` fails the deepEqual against the absent/declared root value.
-  //   • `addresses` — the worker's inbound-mail attachment. Same pin, minus the both-empty pass:
-  //     `[]` is loaded (it deletes every owned routing rule), so an emitted `[]` passes only
-  //     when the root declared exactly `[]`.
-  //   • `durable_objects` — an emitted binding carrying a cross-script field targets ANOTHER
-  //     worker's DOs; Void's own DOs are always LOCAL, so it must match a root binding.
-  //   • `ai` — when the root declared its own ai binding it must SURVIVE byte-identical (a build
-  //     that REMOVED or rewrote it is rejected); otherwise the emitted binding must be ABSENT or —
-  //     ONLY when the source's pre-build inference says the app uses Workers AI — Void's
-  //     configured Workers AI binding. An injected AI binding on an app that does not use AI would
-  //     incur account-billed inference from build-injected worker code.
-  //   • `migrations` — an emitted Durable Object migration carrying a DESTRUCTIVE key (deleting,
-  //     renaming, or transferring classes) must match a root-declared migration byte-for-byte;
-  //     Void emits only creation-key migrations, so a destructive one is a build injection that
-  //     `wrangler deploy` would run against production Durable Object data.
+  // Fields compared as whole values against the pre-build root (`unsafe`, tail consumers, routes,
+  // `addresses`, …). An empty value passes only when the root's is empty too, except `addresses`:
+  // `[]` deletes every email routing rule the Worker owns, so it must match exactly.
   if (expected.passthroughRawFields) {
     const raw = expected.passthroughRawFields;
     for (const field of DEPLOY_WHOLE_OBJECT_PINNED_FIELDS) {
       const emitted = generated[field];
       const rootValue = raw.get(field);
-      // Both-empty is the only case an empty emitted value passes: a root that declared a
-      // non-empty value emitted back empty REMOVES a control the source configured.
-      // `addresses: []` is NOT empty to wrangler — it plans the deletion of every rule this
-      // worker owns (wrangler returns early only on `undefined`, and never default-fills the
-      // key) — so it gets no both-empty pass: an emitted `[]` must equal a root-declared `[]`.
       if (
         field !== 'addresses' &&
         isEmptyPassthroughValue(emitted) &&
@@ -539,14 +383,10 @@ export function verifyGeneratedDeployConfig(
     if (!externalDo.ok) {
       return externalDo;
     }
-    // Read `rootAi` FIRST (not gated on `emittedAi !== undefined`) so a root ai binding the build
-    // REMOVED — emitted ai absent — is rejected too, not only a rewrite.
     const emittedAi = generated.ai;
     const rootAi = raw.get('ai');
     if (rootAi !== undefined) {
-      // The root declared its own `ai` binding — the emitted one must equal it EXACTLY, so a build
-      // can neither rewrite a custom root ai binding down to the default `{binding:'AI'}` nor drop
-      // it (`deepEqual(undefined, rootAi)` is false → a removed root ai fails closed here).
+      // A root ai binding must survive unchanged; removing it fails too.
       if (!deepEqual(emittedAi, rootAi)) {
         return {
           ok: false,
@@ -554,8 +394,7 @@ export function verifyGeneratedDeployConfig(
         };
       }
     } else if (emittedAi !== undefined) {
-      // No root ai binding: Void emits the configured binding name (default `AI`) ONLY when
-      // pre-build inference says the source uses Workers AI. Anything else is build-injected.
+      // Otherwise only Void's own AI binding, and only when the source uses Workers AI.
       const expectedAi = { binding: expected.aiBindingName ?? DEFAULT_VOID_AI_BINDING };
       if (!(expected.needsAI === true && deepEqual(emittedAi, expectedAi))) {
         return {
@@ -564,10 +403,7 @@ export function verifyGeneratedDeployConfig(
         };
       }
     }
-    // Reject a build-injected DESTRUCTIVE Durable Object migration. Only emitted migration entries
-    // carrying a destructive key are checked, and each must match a root-declared migration
-    // byte-for-byte, so Void's creation-only migrations and a user's own root-declared destructive
-    // migration both pass — only an injected one absent from root is rejected.
+    // Void emits only creation migrations; a destructive one must come from the root config.
     const destructiveMigration = verifyNoInjectedDestructiveMigration(
       generated.migrations,
       raw.get('migrations'),
@@ -616,20 +452,8 @@ export function verifyGeneratedDeployConfig(
       };
     }
   }
-  // (C) Containers — pin the emitted `containers` array against the set Void's build emits,
-  // reconstructed PRE-BUILD ({@link reconstructExpectedContainers}): root-declared containers pass
-  // through verbatim, plus Void's own sandbox container when the source needs it. A bare `wrangler
-  // deploy` PROVISIONS a container application from this array — billable, and it runs the image's
-  // code — so a build that INJECTS a container (an attacker image on an app that declared none),
-  // DROPS the sandbox container, or RETARGETS one (rewrites its `image`/`instance_type`/… to an
-  // attacker's) must fail closed. Compared as a set keyed by `class_name` — the identity
-  // `mergeBindings` itself dedups on: every emitted container's class must be expected AND
-  // byte-identical, and every expected class must still be emitted. `generated.containers` is read
-  // defensively (absent/non-array → none), and absent-vs-`[]` is treated as both-empty so a clean
-  // no-sandbox build (no root containers, Void adds none, emitted none) passes. Containers with no
-  // `class_name` are not a shape Void or a buildable root config produce; they are compared as a
-  // deepEqual multiset so a verbatim root passthrough still passes while an injected/dropped one
-  // fails closed.
+  // Containers must equal the expected set, keyed by `class_name`: an emitted container
+  // provisions a billable application that runs its image.
   if (expected.expectedContainers) {
     const emittedContainers: Array<unknown> = Array.isArray(generated.containers)
       ? generated.containers
@@ -705,13 +529,12 @@ export function verifyGeneratedDeployConfig(
       }
     }
   }
-  // (B) Queues ⊆ desired — every queue the artifact binds (producers/consumers) must be one Void
-  // desired from source (`scanQueuesSync`, the SAME scan the build binds from), so a legitimate
-  // build always satisfies emitted ⊆ desired. A queue NAME the artifact binds that is not in the
-  // desired set is a queue binding the build injected — fail closed.
+  // Every emitted queue must be one Void derived from source.
   if (expected.desired) {
     const desiredQueues = new Set(expected.desired.queues);
-    for (const name of collectEmittedQueueNames(generated.queues)) {
+    const emittedProducers = collectEmittedQueueGroupNames(generated.queues, 'producers');
+    const emittedConsumers = collectEmittedQueueGroupNames(generated.queues, 'consumers');
+    for (const name of [...emittedProducers, ...emittedConsumers]) {
       if (!desiredQueues.has(name)) {
         return {
           ok: false,
@@ -719,16 +542,7 @@ export function verifyGeneratedDeployConfig(
         };
       }
     }
-    // (B1) desired ⊆ emitted, PER GROUP — the emitted ⊆ desired check above rejects an INJECTED
-    // queue but waves through a DROPPED one: an absent/empty `queues` field, or one retaining only
-    // the producer OR only the consumer, would deploy a worker that loses message processing or
-    // leaves a `QUEUE_*` binding undefined. `mergeBindings` (index.ts) emits EVERY desired queue as
-    // BOTH a producer and a consumer (both groups mapped from the SAME scanned array), so requiring
-    // each desired queue name in both emitted groups is FP-safe. Read each group defensively (a
-    // missing/empty/wrong-shaped `queues` field yields empty sets → any desired queue is reported
-    // missing → reject); per-group presence is why this cannot reuse the merged reader above.
-    const emittedProducers = collectEmittedQueueGroupNames(generated.queues, 'producers');
-    const emittedConsumers = collectEmittedQueueGroupNames(generated.queues, 'consumers');
+    // Void emits every desired queue as both a producer and a consumer; both must remain.
     for (const name of expected.desired.queues) {
       if (!emittedProducers.has(name) || !emittedConsumers.has(name)) {
         return {
@@ -738,18 +552,8 @@ export function verifyGeneratedDeployConfig(
       }
     }
   }
-  // (D) Cron Triggers — pin the emitted `triggers.crons` schedules against the set Void's build
-  // emits, reconstructed PRE-BUILD from the SAME `scanJobsSync` scan index.ts derives them from
-  // (`scanJobsSync(root, paths.cronsDir).flatMap((job) => job.crons)`). A bare `wrangler deploy`
-  // reading `dist/ssr/wrangler.json` INSTALLS the worker's Cron Triggers from this array — a
-  // schedule the build INJECTED runs attacker code on a billable schedule, and one it DROPPED (or
-  // RETARGETED, caught as a drop of the old string plus an injection of the new one) silently
-  // changes the worker's scheduled behavior. Compared as an order-independent, count-aware multiset
-  // of schedule strings. `generated.triggers` is read DEFENSIVELY: only an object with an array
-  // `crons` yields emitted schedules — anything else (absent, a bare `{}` the CF plugin
-  // materializes for a no-cron app, a non-array `crons`) yields none, so a no-cron app (expected
-  // empty, emitted none) passes symmetric-empty. A non-string emitted element is never a shape Void
-  // derives, so it fails the expected lookup and is rejected as injected.
+  // Emitted cron schedules must equal the expected multiset. A missing or non-array
+  // `triggers.crons` counts as none.
   if (expected.expectedCrons) {
     const triggers = generated.triggers;
     const emittedCrons: Array<unknown> =
@@ -762,8 +566,7 @@ export function verifyGeneratedDeployConfig(
     for (const schedule of expected.expectedCrons) {
       expectedCronCounts.set(schedule, (expectedCronCounts.get(schedule) ?? 0) + 1);
     }
-    // Injected / retargeted — every emitted schedule must be one the source derived, with a
-    // remaining count; anything else is a schedule the build injected.
+    // Injected / retargeted — every emitted schedule must have a remaining expected count.
     for (const schedule of emittedCrons) {
       const remaining = typeof schedule === 'string' ? (expectedCronCounts.get(schedule) ?? 0) : 0;
       if (typeof schedule !== 'string' || remaining <= 0) {
@@ -774,8 +577,7 @@ export function verifyGeneratedDeployConfig(
       }
       expectedCronCounts.set(schedule, remaining - 1);
     }
-    // Dropped — every expected schedule must still be emitted; any leftover count is a schedule the
-    // build dropped (e.g. the old side of a retarget).
+    // Dropped — any leftover count is a schedule the build removed.
     for (const [schedule, remaining] of expectedCronCounts) {
       if (remaining > 0) {
         return {
@@ -794,17 +596,6 @@ export function verifyCloudflareDeployArtifact(
   deps: CloudflareDeployDeps,
   options: Parameters<typeof verifyGeneratedDeployConfig>[1],
 ): boolean {
-  // 10. Verify the generated deploy config targets the pinned account + expected worker
-  // AND the exact provisioned binding IDENTITIES BEFORE uploading. A `CLOUDFLARE_ENV` /
-  // `CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH` the CF plugin loaded could have baked a
-  // different account/name — or the SAME account/name with a flattened, DIFFERENT binding
-  // set — into dist/ssr/wrangler.json; passing `desired` + the step-6 snapshots lets the check
-  // reject a divergent binding set, not only an account/name mismatch. The comparison is against
-  // the in-memory `bindingIdentitySnapshot` (NOT a post-build root re-read), so a build that
-  // consistently rewrote both the root config and this artifact is still caught. The
-  // `passthroughIdentitySnapshot` extends the same defense to the resource fields Void never emits
-  // (`services` / `secrets_store_secrets` / …): an entry the build injected into one of them — or a
-  // queue not in `desired.queues` — fails closed here too, before the credentialed upload binds it.
   const verification = (deps.verifyDeployConfig ?? verifyGeneratedDeployConfig)(root, options);
   if (!verification.ok) {
     log.error(
@@ -826,25 +617,33 @@ export function verifyCloudflareDeployArtifact(
 }
 
 /** Validate emitted Worker vars and required secrets against post-build ground truth. */
-export async function validateCloudflarePostBuildEnv(
-  root: string,
-  configPath: string,
-  accountId: string,
-  apiBaseUrl: string,
-  workerName: string,
-  schemaFacts: SelfHostSchemaFacts,
-  authEnabled: boolean,
-  existingWorker: ExistingCloudflareWorker | null,
-  approvedHandoffKv: Array<ApprovedCloudflareKvBinding>,
-  deps: CloudflareDeployDeps,
-  assertUploaderStillPinned: () => boolean,
-): Promise<boolean> {
-  // 8. Post-build GROUND-TRUTH gates — validate the REAL artifact the build emitted, not a
-  // facsimile. Read the actual `vars` the build baked into `dist/ssr/wrangler.json`, then
-  // WARN (plaintext secret-looking vars) + GATE (required secrets, incl. INVALID values) +
-  // auth-schema check + local migration gates, all against that ground truth. The only
-  // project code that runs does so in the isolated `validate-emitted` probe (8b).
-  const emitted = (deps.readEmittedWorkerVars ?? readEmittedWorkerVarsDefault)(root);
+export async function validateCloudflarePostBuildEnv(options: {
+  root: string;
+  configPath: string;
+  accountId: string;
+  apiBaseUrl: string;
+  workerName: string;
+  schemaFacts: SelfHostSchemaFacts;
+  authEnabled: boolean;
+  existingWorker: ExistingCloudflareWorker | null;
+  approvedHandoffKv: Array<ApprovedCloudflareKvBinding>;
+  deps: CloudflareDeployDeps;
+  assertUploaderStillPinned: () => boolean;
+}): Promise<boolean> {
+  const {
+    root,
+    configPath,
+    accountId,
+    apiBaseUrl,
+    workerName,
+    schemaFacts,
+    authEnabled,
+    existingWorker,
+    approvedHandoffKv,
+    deps,
+    assertUploaderStillPinned,
+  } = options;
+  const emitted = (deps.readEmittedWorkerVars ?? readEmittedWorkerVars)(root);
   if (existingWorker) {
     const generated = readGeneratedDeployConfig(root);
     assertExistingCloudflareConfig(existingWorker, generated.config, true, approvedHandoffKv);
@@ -861,9 +660,7 @@ export async function validateCloudflarePostBuildEnv(
     return false;
   }
   const emittedVars = emitted.vars;
-  // Better Auth's signing secret must never be baked into the generated config.
-  // Match the managed Void deploy contract: the deploy target owns this secret
-  // and stores it through its encrypted secret API, not through plaintext vars.
+  // Better Auth's signing secret belongs in the secret store, never in plaintext vars.
   if (authEnabled && Object.prototype.hasOwnProperty.call(emittedVars, BETTER_AUTH_SECRET_NAME)) {
     log.error(
       [
@@ -887,16 +684,9 @@ export async function validateCloudflarePostBuildEnv(
     return false;
   }
 
-  // 8b. Required-secret gate — build the values-free context from the REAL emitted vars + the
-  // env-insensitive required-key names (pure parent work, no project code): a required key
-  // shipped EMPTY (`K=""`) SHADOWS a same-named remote secret → fail closed always; a required
-  // key ABSENT from the emitted vars is discharged only by `wrangler secret list`.
+  // A required key the build did not emit must exist as a remote secret. Value validation runs
+  // project code, so it stays in the isolated probe.
   const envContext = deriveSelfHostEnvContextFromVars(emittedVars, schemaFacts);
-  // Then VALUE-validate the REAL emitted vars against the schema's validators in the isolated
-  // `validate-emitted` probe (project code, off this credentialed parent) and fold the FAILING
-  // key NAMES into the context, so a required var shipped with a MALFORMED value (e.g. a
-  // non-number `PORT`, a bad JSON object) fails closed HERE — before any remote mutation —
-  // rather than only at worker boot. Values-free: only key names cross the process boundary.
   if (schemaFacts.hasSchema) {
     let validateResult: EnvSchemaValidateResult;
     try {
@@ -916,9 +706,7 @@ export async function validateCloudflarePostBuildEnv(
     }
     envContext.invalidKeys = validateResult.invalidKeys;
   }
-  // The auth secret has its own deploy-owned lifecycle below. If an env schema
-  // also declares it required, do not make the generic secret gate reject it
-  // before the deploy has a chance to provision and verify it.
+  // The deploy provisions the auth secret itself later, so the generic gate must not reject it.
   if (authEnabled) {
     envContext.absentRequired = envContext.absentRequired.filter(
       (key) => key !== BETTER_AUTH_SECRET_NAME,
@@ -927,12 +715,7 @@ export async function validateCloudflarePostBuildEnv(
       (key) => key !== BETTER_AUTH_SECRET_NAME,
     );
   }
-  // DISCHARGE the context. Reuses the same `dischargeSelfHostEnvContext` the unit tests
-  // exercise, fed the ground-truth vars + the real invalid-value set. It may spawn a
-  // credentialed `wrangler secret list` (its own runner, via `createDefaultSecretListRunner`),
-  // which runs the hashed uploader bundle — and the emitted-var validation above just ran project
-  // code (env.ts) that could have overwritten it. Re-verify the uploader against the pre-build
-  // baseline immediately before the spawn.
+  // The probe above ran project code, so re-check the uploader before the credentialed secret list.
   if (!assertUploaderStillPinned()) {
     return false;
   }
@@ -941,10 +724,7 @@ export async function validateCloudflarePostBuildEnv(
       root,
       configPath,
       accountId,
-      // Pin the worker NAME too: the secret list resolves the worker from the config's
-      // `name`, which the emitted-var probe above (project code) could have rewritten
-      // since step 5 pinned it. The gate reconciles the config against this and fails
-      // closed on a mismatch, mirroring the account pin.
+      // The probe could have rewritten the config's `name`; pin the expected Worker.
       workerName,
     });
   } catch (err) {
diff --git a/packages/void/src/cli/deploy-binding-snapshot.ts b/packages/void/src/cli/deploy-binding-snapshot.ts
index cd184acf7..00a6a41ff 100644
--- a/packages/void/src/cli/deploy-binding-snapshot.ts
+++ b/packages/void/src/cli/deploy-binding-snapshot.ts
@@ -8,6 +8,7 @@ import {
   statSync,
 } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { isDeepStrictEqual } from 'node:util';
 import { readConfigEntryString as readD1EntryString } from '@void/deploy-cloudflare';
 import { dirname, join, resolve } from 'pathslash';
 import { analyzeApplicationSync, type ApplicationAnalysis } from '../application-analysis.ts';
@@ -20,7 +21,6 @@ import {
 } from '../sandbox/config.ts';
 import { type BindingIdentitySnapshot } from './deploy-types.ts';
 import { resolveCloudflareOperationArgv } from './preset.ts';
-// Type-only: the provision module must load lazily (see `deploy-types.ts`).
 import type { DesiredResourceSet, ProvisionDriftEntry } from './provision.ts';
 import {
   readExistingLiveBindingConfig,
@@ -63,25 +63,15 @@ export function desiredIdentityBindings(
   return out;
 }
 
-/**
- * The snapshot/lookup key for one binding identity. `field` is one of a fixed set of wrangler
- * config sections (`d1_databases` / `kv_namespaces` / `r2_buckets` / `hyperdrive`) and `binding`
- * is a wrangler binding name (an identifier — no `:`), so the joined key is collision-free.
- */
+/** Snapshot key for one binding. Binding names contain no `:`, so keys never collide. */
 export function bindingIdentityKey(field: string, binding: string): string {
   return `${field}:${binding}`;
 }
 
 /**
- * Enumerate EVERY id-bearing binding DECLARED in `config` across the four id-bearing sections
- * (`d1_databases` / `kv_namespaces` / `r2_buckets` / `hyperdrive`), as `{ field, binding, id }`.
- * `id` is `undefined` when the entry omits it or leaves it empty (never pinned, never asserted —
- * the same "absent or empty → undefined" collapse as {@link readStoredResourceName}). Reads each
- * entry on its OWN terms (never a first-match re-scan) so a duplicated / appended entry is seen as
- * itself. Section + id-field names come from {@link DEPLOY_BINDING_IDENTITY_FIELDS} — no per-kind
- * branching. Unlike {@link desiredIdentityBindings} this is NOT restricted to the desired set: it
- * captures a user's hand-declared extra binding too, which is exactly what lets the completeness
- * check tell a pre-existing binding apart from one the build injected.
+ * Every id-bearing binding declared in `config`, not only the desired ones, so the completeness
+ * check can tell a user's own binding from one the build added. A missing or empty id is
+ * `undefined`.
  */
 export function collectConfigBindingIdentities(
   config: Record<string, unknown>,
@@ -104,21 +94,9 @@ export function collectConfigBindingIdentities(
 }
 
 /**
- * Snapshot the real, id-bearing identity of EVERY binding declared in the root `config` into an
- * in-memory map — the id defense's ground truth, mirroring the pinned in-memory `accountId`.
- *
- * Taken AFTER provision (which writes each real id into the root config via
- * `wrangler <res> create --update-config`) and the `name`/`account_id` reconcile, and BEFORE
- * the build. `vite build` runs untrusted project code with its Cloudflare credentials scrubbed,
- * so a compromised build dependency can only edit FILES — it could rewrite
- * `wrangler.jsonc`'s `d1_databases[<binding>].database_id` (keeping the binding + database_name)
- * to redirect the privileged remote D1 migrate or the deploy to a DIFFERENT same-account
- * resource, OR ADD a wholly new id-bearing binding (`EXTRA_DB`/`EXTRA_KV`/…) that the CF plugin
- * would then merge verbatim into `dist/ssr/wrangler.json`. Snapshotting EVERY declared id here —
- * not only the desired ones — and asserting the post-build config + emitted artifact carry
- * exactly this set closes both gaps for D1/KV/R2/Hyperdrive alike. A binding whose id is absent
- * post-drift (which the drift check already rejects for desired bindings) is simply not pinned —
- * never asserted.
+ * Pin every declared D1/KV/R2/Hyperdrive id after provisioning and before the build. The build
+ * runs project code that can edit config files, so the post-build checks compare against this
+ * in-memory copy to catch a rewritten or added id. Bindings without an id are not pinned.
  */
 export function snapshotBindingIdentities(
   config: Record<string, unknown>,
@@ -133,27 +111,22 @@ export function snapshotBindingIdentities(
 }
 
 /**
- * Resource fields Void's OWN build legitimately emits into `dist/ssr/wrangler.json` — either
- * merged by `mergeBindings` (index.ts) or default-filled by the wrangler normalizer — so an entry
- * the artifact declares in one of THESE is NOT an injection and must not be asserted against the
- * pre-build root. Audited against `mergeBindings` (index.ts) + 13 real playground
- * `dist/ssr/wrangler.json` artifacts: the only {@link FRIENDLY_BINDING_NAMES} fields ever emitted
- * non-empty are these. The four id-bearing fields are excluded here because the id-pin
- * ({@link DEPLOY_BINDING_IDENTITY_FIELDS}) already pins them precisely.
+ * Binding fields that Void's own build emits (through `mergeWorkerBindings` in
+ * plugin-worker-bindings.ts or the config normalizer), so they are not checked against the
+ * pre-build root.
  */
 export const DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS: ReadonlySet<string> = new Set<string>([
-  // id-pinned elsewhere (DEPLOY_BINDING_IDENTITY_FIELDS)
+  // id-pinned by DEPLOY_BINDING_IDENTITY_FIELDS
   'd1_databases',
   'kv_namespaces',
   'r2_buckets',
   'hyperdrive',
-  // Void-emitted / merged by mergeBindings
+  // emitted by Void
   'ai',
   'durable_objects',
   'assets',
   'vars',
-  // bundled content / worker self-metadata — no external-resource grant, and worker code is
-  // already fully controlled by a malicious build, so pinning these adds nothing
+  // bundled content and self-metadata grant no external resource
   'data_blobs',
   'text_blobs',
   'wasm_modules',
@@ -161,49 +134,22 @@ export const DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS: ReadonlySet<string> = new Set<st
 ]);
 
 /**
- * The pass-through assert-set: every binding field wrangler knows about
- * ({@link FRIENDLY_BINDING_NAMES}, Void's authoritative transcription of wrangler's binding
- * registry) that Void does NOT itself emit. An entry the EMITTED artifact declares in one of
- * these is either a verbatim pass-through of the user's OWN root config (captured in the pre-build
- * snapshot) or a build-time INJECTION — the latter would grant the deployed worker a same-account
- * capability the source never asked for (a `services` binding to another worker, a
- * `secrets_store_secrets` handle, a `dispatch_namespaces` entry, an `unsafe` binding of an
- * arbitrary type, …), which the CF plugin passes through into the emitted config and the
- * credentialed `wrangler deploy` then binds.
- *
- * Complete-by-construction against the known registry: it auto-covers every capability field
- * (browser/images/stream/media/websearch/unsafe included) and any FUTURE field added to the
- * registry fails CLOSED — a new registry field is asserted until explicitly excluded here. Fields
- * wrangler does not yet know about are absent from the registry and still fail OPEN — the same
- * residual the id-pin has, so a future resource field can never false-positive a legitimate build.
+ * Every known binding field ({@link FRIENDLY_BINDING_NAMES}) that Void does not emit. An emitted
+ * entry in one of these must come verbatim from the root config; any other entry (a `services`
+ * binding, an `unsafe` binding, ...) was added by the build. New registry fields are checked
+ * until they are excluded above.
  */
 export const DEPLOY_PASSTHROUGH_ASSERT_FIELDS: ReadonlyArray<string> = Object.keys(
   FRIENDLY_BINDING_NAMES,
 ).filter((field) => !DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS.has(field));
 
 /**
- * Fields the CF plugin passes through VERBATIM that the per-binding ENTRY pin cannot cover, so
- * each is compared WHOLE against the raw pre-build root value instead:
- *   - `unsafe` — is in {@link DEPLOY_PASSTHROUGH_ASSERT_FIELDS} (so it stays in the drift
- *     invariant) but its `.metadata`/`.capnp` are never entry-iterated, and wrangler applies
- *     `unsafe.metadata` LAST at upload, OVERWRITING the whole uploaded bindings array — so an
- *     entry-level pin is blind to it. Routed OUT of the entry loop into the whole-object pin.
- *   - `tail_consumers` / `streaming_tail_consumers` — are NOT "bindings" (absent from
- *     {@link FRIENDLY_BINDING_NAMES}), so the assert-set structurally can't see them, yet wrangler
- *     uploads them and they forward every log/request to the named worker (exfil).
- *   - `routes` / `route` / `workers_dev` / `preview_urls` — the worker's TRAFFIC attachment. A
- *     build that injects a `routes`/`route` entry attaches the deployed worker to a production
- *     hostname/path the account controls (traffic interception), and flipping `workers_dev` /
- *     `preview_urls` changes its public exposure. None is a "binding" either, so the assert-set
- *     can't see them, yet wrangler uploads them.
- *   - `addresses` — the worker's INBOUND MAIL attachment (0078 Mode B). wrangler ≥ 4.113
- *     reconciles the account's Email Routing rules from this array on `wrangler deploy`: a build
- *     that injects an address redirects the account's inbound mail to the deployed worker, and one
- *     that drops the root's removes the rules Void's email step set up. Not a binding either, and
- *     the CF plugin passes the key through verbatim.
- * Void's own build emits NONE of them: a clean `vite build` (root declaring none) leaves every one
- * ABSENT from the emitted artifact (verified against a real build), so an emptiness check
- * ({@link isEmptyPassthroughValue}) keeps the normalizer's default-fill from false-positiving.
+ * Fields the CF plugin passes through verbatim that the per-entry pin cannot cover, so each is
+ * compared whole against the root value. Void's own build emits none of them.
+ *   - `unsafe`: its `metadata` replaces the whole uploaded bindings list.
+ *   - `tail_consumers` / `streaming_tail_consumers`: forward every log to another Worker.
+ *   - `routes` / `route` / `workers_dev` / `preview_urls`: attach the Worker to traffic.
+ *   - `addresses`: routes the account's inbound mail to the Worker.
  */
 export const DEPLOY_WHOLE_OBJECT_PINNED_FIELDS: ReadonlyArray<string> = [
   'unsafe',
@@ -217,12 +163,8 @@ export const DEPLOY_WHOLE_OBJECT_PINNED_FIELDS: ReadonlyArray<string> = [
 ];
 
 /**
- * Fields whose RAW pre-build root value {@link snapshotPassthroughRawFields} captures for
- * {@link verifyGeneratedDeployConfig}'s whole-object + targeted checks: the
- * {@link DEPLOY_WHOLE_OBJECT_PINNED_FIELDS} plus `durable_objects` (external-DO check), `ai`
- * (binding pin), and `migrations` (destructive-DO-migration check). The last three are Void-emitted
- * (excluded from the assert-set) yet still need a pin because a build can add an EXTERNAL DO handle
- * (`script_name`), a rewritten/removed `ai` binding, or a DESTRUCTIVE Durable Object migration.
+ * Root values captured for {@link verifyGeneratedDeployConfig}: the whole-object fields plus
+ * `durable_objects`, `ai` and `migrations`, which Void emits but a build could still tamper with.
  */
 const DEPLOY_RAW_SNAPSHOT_FIELDS: ReadonlyArray<string> = [
   ...DEPLOY_WHOLE_OBJECT_PINNED_FIELDS,
@@ -231,25 +173,13 @@ const DEPLOY_RAW_SNAPSHOT_FIELDS: ReadonlyArray<string> = [
   'migrations',
 ];
 
-/** Void's default injected Workers AI binding name (`mergeBindings` in index.ts). */
+/** Default Workers AI binding name that Void emits. */
 export const DEFAULT_VOID_AI_BINDING = 'AI';
 
-/**
- * Sub-fields on a `durable_objects` binding that make it target ANOTHER worker's Durable Objects.
- * `script_name` is the one wrangler binds a cross-script DO through; `environment` narrows a
- * cross-script binding to a named environment — either marks a binding Void's own build never
- * emits (its DOs are always LOCAL `{name, class_name}`).
- */
+/** `durable_objects` sub-fields that bind another Worker's Durable Objects. Void never emits them. */
 const DURABLE_OBJECT_EXTERNAL_FIELDS = ['script_name', 'environment'];
 
-/**
- * Keys on a wrangler `migrations` entry that DELETE or MOVE existing Durable Object classes (and
- * their stored data): `deleted_classes` drops them, `renamed_classes` renames them, and the two
- * `transferred_classes*` keys move them from another script. Void's own emitted migrations only
- * ever carry the CREATION keys (`new_classes` / `new_sqlite_classes`), never one of these — so an
- * emitted entry carrying one is a build injection that `wrangler deploy` would run against
- * production Durable Object data.
- */
+/** Migration keys that delete or move Durable Object classes. Void only emits creation keys. */
 const DESTRUCTIVE_MIGRATION_KEYS = [
   'deleted_classes',
   'renamed_classes',
@@ -258,17 +188,8 @@ const DESTRUCTIVE_MIGRATION_KEYS = [
 ];
 
 /**
- * A pin of every pass-through binding's ENTRY per {@link DEPLOY_PASSTHROUGH_ASSERT_FIELDS} field —
- * field → (bindingName → the root entry object) — captured from the root config at the SAME
- * pre-build point as {@link snapshotBindingIdentities} (after provision/drift resolves ids, before
- * the untrusted build). Lets a user's LEGITIMATELY hand-declared pass-through binding (e.g. a
- * `services` entry present before the build) survive, while an entry the build ADDED — absent from
- * this pin — OR one whose TARGET the build rewrote (same name, different service/namespace/type)
- * fails closed at {@link verifyGeneratedDeployConfig}. Entries come from each field's wrangler
- * shape via {@link bindingEntriesForField} (the SAME shapes the build's uniqueness check uses), so
- * `send_email` / `ratelimits` key on `.name` and `logfwdr` on its nested `.bindings[].name`. A
- * present field whose shape the strict reader cannot parse is recorded as an EMPTY inner map, so
- * any emitted entry in it fails closed on the symmetric read.
+ * Pin each pass-through binding entry (field → name → entry) before the build, so a user's own
+ * entry survives while an added or retargeted one fails {@link verifyGeneratedDeployConfig}.
  */
 export function snapshotPassthroughIdentities(
   config: Record<string, unknown>,
@@ -292,14 +213,7 @@ export function snapshotPassthroughIdentities(
   return snapshot;
 }
 
-/**
- * Companion of {@link snapshotPassthroughIdentities} for the fields the per-binding ENTRY pin
- * cannot cover: capture the RAW pre-build root value for each {@link DEPLOY_RAW_SNAPSHOT_FIELDS}
- * entry. Taken at the SAME pre-build point
- * as the other snapshots, so a build that INJECTS or REWRITES one of these into the emitted
- * artifact is caught at {@link verifyGeneratedDeployConfig}, while a user's own hand-declared value
- * (present here, unchanged) passes.
- */
+/** Raw pre-build root value of each {@link DEPLOY_RAW_SNAPSHOT_FIELDS} field. */
 export function snapshotPassthroughRawFields(
   config: Record<string, unknown>,
 ): Map<string, unknown> {
@@ -311,20 +225,9 @@ export function snapshotPassthroughRawFields(
 }
 
 /**
- * Reconstruct the exact `containers` set Void's build emits into `dist/ssr/wrangler.json`, computed
- * PRE-BUILD from the SAME inputs `mergeBindings` (index.ts) uses so a legitimate build's emitted
- * entry deepEquals one reconstructed here:
- *   1. every root-declared container passes through VERBATIM (mergeBindings spreads
- *      `resolved.containers` unchanged), and
- *   2. PLUS — only when the source needs the sandbox (`needsSandbox`, the SAME
- *      `isSandboxEnabled(config) || inferProjectBindings(...).needsSandbox` signal index.ts gates
- *      emission on) AND no root-declared container already declares the sandbox class — the single
- *      Void sandbox container, built field-for-field from {@link resolveSandboxConfig} (the SAME
- *      pure function the build calls, so the reconstructed entry is byte-identical to the emitted
- *      one, absent optionals omitted).
- * A bare `wrangler deploy` PROVISIONS a container application from this array (billable, and it runs
- * the image's code), so pinning it lets {@link verifyGeneratedDeployConfig} reject a container the
- * build injected, dropped, or retargeted.
+ * The `containers` array Void's build emits: root containers verbatim and, when the app needs
+ * Sandbox, Void's sandbox container in place of any root container with the same class (as
+ * `mergeWorkerBindings` does). Deploy rejects an emitted array that differs.
  */
 export function reconstructExpectedContainers(
   config: VoidConfig,
@@ -440,14 +343,9 @@ export function reconstructExpectedDurableObjectState(
 }
 
 /**
- * Deterministic sha256 over the wrangler uploader BUNDLE the credentialed deploy executes — the
- * resolved `wrangler-dist/cli.js` PLUS every sibling file in its directory. `cli.js` loads sibling
- * chunks from its own `__dirname` (the proxy workers, the experimental-config module), so the
- * whole directory is the trust surface, not just the entry file. Content hash of the bytes, NOT
- * mtime. Resolves the SAME entry {@link createDeployWranglerRunner} spawns (via
- * {@link resolveCloudflareOperationArgv}, whose launcher's LAST argv element is the JS entry). Returns
- * `undefined` when the entry cannot be resolved or a file cannot be read, so the caller FAILS
- * CLOSED — it never deploys a binary it could not verify. The resolver is injectable for tests.
+ * Content hash of the directory holding the Cloudflare operation-process entry that the
+ * credentialed deploy runs (the last element of {@link resolveCloudflareOperationArgv}). Returns
+ * `undefined` when it cannot be resolved or read, so the caller fails closed.
  */
 export function hashWranglerUploader(
   root: string,
@@ -495,9 +393,8 @@ export function hashCfUploader(): string | undefined {
 }
 
 /**
- * sha256 over every file under `dir`, walked in a STABLE (name-sorted, depth-first) order with
- * each file's relative path folded into the digest, so the hash depends only on the directory's
- * contents — never on filesystem enumeration order. Returns `undefined` on any read error.
+ * sha256 over every file under `dir` in name-sorted order, with relative paths folded in.
+ * Returns `undefined` on any read error.
  */
 function hashDirectoryContents(dir: string): string | undefined {
   try {
@@ -557,11 +454,8 @@ function hashDirectoryContents(dir: string): string | undefined {
 }
 
 /**
- * Assert the wrangler uploader bundle was NOT modified between the pre-build snapshot and now.
- * A legitimate `vite build` never touches `node_modules/wrangler`, so the hash is stable across
- * the build. A build that overwrote the uploader — to run attacker code WITH the Cloudflare token
- * at the post-build remote migrate / deploy — changes it, and an unresolvable/unreadable binary
- * (either snapshot `undefined`) is a binary that cannot be verified: both FAIL CLOSED.
+ * Fail when the uploader hash changed across the build or could not be computed: a build that
+ * rewrote the uploader would otherwise run with the Cloudflare credentials.
  */
 export function assertWranglerUploaderUnchanged(
   before: string | undefined,
@@ -583,12 +477,8 @@ export function assertWranglerUploaderUnchanged(
 }
 
 /**
- * True when a resource field's emitted value carries NO capability: `undefined`/`null`, an empty
- * array, an empty object, or a `{ bindings: [] }`. A clean `vite build` (root declaring none of
- * the whole-object-pinned fields) emits `unsafe` / `tail_consumers` / `streaming_tail_consumers`
- * ABSENT (verified against a real build); this also absorbs any normalizer default-fill
- * (`[]` / `{}` / `{ bindings: [] }`) so the whole-object pin never false-positives on an empty
- * shape while still catching a value that actually grants a capability.
+ * True when a field value grants nothing: absent, `null`, `[]`, `{}` or `{ bindings: [] }`. This
+ * covers the config normalizer's default fills.
  */
 export function isEmptyPassthroughValue(value: unknown): boolean {
   if (value === undefined || value === null) {
@@ -611,12 +501,8 @@ export function isEmptyPassthroughValue(value: unknown): boolean {
 }
 
 /**
- * Reject an emitted `durable_objects` binding that targets ANOTHER worker (carrying a
- * {@link DURABLE_OBJECT_EXTERNAL_FIELDS} sub-field) unless the pre-build root declared the SAME
- * binding byte-for-byte. Void's own build only ever emits LOCAL DO bindings (`{name, class_name}`;
- * index.ts), so an external DO in the artifact is a build injection — a handle to a same-account
- * worker's Durable Objects the source never asked for. Emitted LOCAL DOs (no cross-script field)
- * always pass. A malformed emitted `durable_objects` fails closed (Void never emits one).
+ * Reject an emitted `durable_objects` binding that targets another Worker unless the root declared
+ * the same entry. Local bindings always pass; a malformed value fails.
  */
 export function verifyNoInjectedExternalDurableObject(
   emitted: unknown,
@@ -645,7 +531,7 @@ export function verifyNoInjectedExternalDurableObject(
       continue;
     }
     const rootEntry = rootByName.get(name);
-    if (rootEntry === undefined || !deepEqual(entry, rootEntry)) {
+    if (rootEntry === undefined || !isDeepStrictEqual(entry, rootEntry)) {
       return {
         ok: false,
         reason: `generated config declares a durable_objects binding ${JSON.stringify(name)} bound to another worker's script that was not present before the build — refusing to deploy an external Durable Object the build injected.`,
@@ -656,22 +542,14 @@ export function verifyNoInjectedExternalDurableObject(
 }
 
 /**
- * Reject an emitted `migrations` entry that carries a {@link DESTRUCTIVE_MIGRATION_KEYS} key unless
- * the pre-build root declared the SAME entry byte-for-byte. Void's build only ever emits migrations
- * with CREATION keys (its own DOs), so a destructive entry in the artifact is a build injection —
- * `wrangler deploy` runs the emitted migrations and would DELETE or MOVE production Durable Object
- * data. Emitted entries with only creation keys are NEVER inspected (Void's own migrations pass
- * untouched), and a user's own root-declared destructive migration (e.g. a legit rename) is pinned
- * and passes. This is the destructive-injection guard only — deriving Void's complete desired
- * migration set (full array pinning) is out of scope.
+ * Reject an emitted migration with a {@link DESTRUCTIVE_MIGRATION_KEYS} key unless the root
+ * declared the same entry. Creation-only migrations always pass.
  */
 export function verifyNoInjectedDestructiveMigration(
   emitted: unknown,
   root: unknown,
 ): { ok: boolean; reason?: string } {
   if (!Array.isArray(emitted)) {
-    // Void emits `migrations` as an array; a non-array (or absent) value carries no destructive
-    // entry to check here, and full migration-array pinning is out of scope.
     return { ok: true };
   }
   const rootEntries = Array.isArray(root) ? root : [];
@@ -683,7 +561,7 @@ export function verifyNoInjectedDestructiveMigration(
     if (!DESTRUCTIVE_MIGRATION_KEYS.some((key) => record[key] !== undefined)) {
       continue;
     }
-    if (!rootEntries.some((rootEntry) => deepEqual(record, rootEntry))) {
+    if (!rootEntries.some((rootEntry) => isDeepStrictEqual(record, rootEntry))) {
       const tag = typeof record.tag === 'string' ? ` ${JSON.stringify(record.tag)}` : '';
       return {
         ok: false,
@@ -694,72 +572,7 @@ export function verifyNoInjectedDestructiveMigration(
   return { ok: true };
 }
 
-/**
- * Minimal JSON-safe structural equality: primitives by `===`, arrays element-wise, plain objects
- * key-for-key (order-insensitive). Used to compare a pinned pre-build pass-through binding entry's
- * values against the emitted artifact's, so a build that RETARGETS a binding (rewrites a
- * service/namespace/type the user wrote in root) is caught while a normalizer-added default
- * sub-field is ignored. No cyclic/`undefined`/class support needed — wrangler config is JSON.
- */
-export function deepEqual(a: unknown, b: unknown): boolean {
-  if (a === b) {
-    return true;
-  }
-  if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null) {
-    return false;
-  }
-  if (Array.isArray(a) || Array.isArray(b)) {
-    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
-      return false;
-    }
-    return a.every((item, i) => deepEqual(item, b[i]));
-  }
-  const aObj = a as Record<string, unknown>;
-  const bObj = b as Record<string, unknown>;
-  const aKeys = Object.keys(aObj);
-  const bKeys = Object.keys(bObj);
-  if (aKeys.length !== bKeys.length) {
-    return false;
-  }
-  return aKeys.every(
-    (key) => Object.prototype.hasOwnProperty.call(bObj, key) && deepEqual(aObj[key], bObj[key]),
-  );
-}
-
-/**
- * Every queue NAME the emitted artifact binds — `queues.producers[].queue` +
- * `queues.consumers[].queue`. Non-throwing: a wrong-shaped `queues` field or an entry with no
- * readable `queue` string contributes no name (an unnamed queue binds nothing), so only real,
- * NAMED queue bindings are asserted against the desired set.
- */
-export function collectEmittedQueueNames(value: unknown): Array<string> {
-  const names: Array<string> = [];
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    return names;
-  }
-  for (const group of ['producers', 'consumers'] as const) {
-    const list = (value as Record<string, unknown>)[group];
-    if (!Array.isArray(list)) {
-      continue;
-    }
-    for (const entry of list) {
-      const name = readD1EntryString(entry, 'queue');
-      if (name !== undefined) {
-        names.push(name);
-      }
-    }
-  }
-  return names;
-}
-
-/**
- * The queue NAMES the emitted artifact binds in ONE group (`producers` or `consumers`), as a Set.
- * Read defensively — a wrong-shaped `queues` field, a missing group, or an entry with no readable
- * `queue` string contributes no name — so a missing/empty group yields an EMPTY set. Used to assert
- * every DESIRED queue survives in BOTH groups: `mergeBindings` (index.ts) emits each desired queue as
- * both a producer AND a consumer, so per-group presence is required — {@link collectEmittedQueueNames}
- * merges the two groups and cannot tell that a queue lost one of its two sides.
- */
+/** Queue names bound in one group. A malformed `queues` value yields none. */
 export function collectEmittedQueueGroupNames(
   value: unknown,
   group: 'producers' | 'consumers',
@@ -781,7 +594,7 @@ export function collectEmittedQueueGroupNames(
   return names;
 }
 
-/** The CF Vite plugin's deploy-config redirect that a bare `wrangler deploy` follows. */
+/** The CF Vite plugin's deploy-config redirect file. */
 export function deployPointerPath(root: string): string {
   return join(root, '.wrangler', 'deploy', 'config.json');
 }
diff --git a/packages/void/src/cli/deploy-cloudflare-auth.ts b/packages/void/src/cli/deploy-cloudflare-auth.ts
index bd9cee863..55d304612 100644
--- a/packages/void/src/cli/deploy-cloudflare-auth.ts
+++ b/packages/void/src/cli/deploy-cloudflare-auth.ts
@@ -13,13 +13,9 @@ import {
   parseCloudflareAuthSession,
 } from './cloudflare-auth.ts';
 import { prepareExistingCloudflareDeploy } from './cloudflare-link.ts';
-import { createCloudflareProcessRunner } from './cloudflare-process.ts';
+import { createCloudflareProcessRunner, isCleanCloudflareExit } from './cloudflare-process.ts';
 import { log } from './deploy-helpers.ts';
-import {
-  isCleanWranglerExit,
-  CloudflareAuthSecretError,
-  BETTER_AUTH_SECRET_NAME,
-} from './deploy-resources.ts';
+import { CloudflareAuthSecretError, BETTER_AUTH_SECRET_NAME } from './deploy-resources.ts';
 import { deployChildEnv } from './deploy-transport.ts';
 import { type DeployWranglerRun, type DeployWranglerRunResult } from './deploy-types.ts';
 import {
@@ -66,7 +62,7 @@ export async function prepareExistingCloudflareDeployWithAuth(
       { type: 'auth.whoami', configPath },
       { capture: true },
     );
-    const session = isCleanWranglerExit(identity)
+    const session = isCleanCloudflareExit(identity)
       ? parseCloudflareAuthSession(identity.data)
       : null;
     const wrongAccount =
@@ -175,28 +171,14 @@ export async function chooseCloudflareDeployAccount(options: {
   return account.id;
 }
 
-/**
- * wrangler's own interactivity gate (`isNonInteractiveOrCI`, workers-utils): `ci-info`'s `isCI`
- * OR either stdio not a TTY. The email step (3b-ii) uses THIS rather than the deploy's `isCI`
- * (stdin-only, or a CI token source): wrangler asks its own y/n on a destructive `addresses`
- * plan change after the upload under the same gate, and the two halves of one deploy must call
- * the same run interactive — otherwise Void would prompt where wrangler then throws in "CI", or
- * skip a prompt wrangler goes on to ask.
- */
+/** Non-interactive when CI is detected or stdin/stdout is not a TTY. */
 export function isWranglerNonInteractiveOrCI(): boolean {
   return ciInfoIsCI || !(process.stdin.isTTY && process.stdout.isTTY);
 }
 
 /**
- * Borrow the wrangler session's bearer for the two email calls wrangler has no command for
- * (0078 "The flow, by lane": subdomain routing enable, the subaddressing PATCH, plus the
- * read-only zone classification). Spawns `wrangler auth token --json` through the deploy runner
- * — the pinned uploader, the pinned account + API base — with `WRANGLER_WRITE_LOGS=false`
- * layered on the child env: without it wrangler appends the token to
- * `~/.wrangler/logs/wrangler-*.log`, mode `-rw-r--r--` (`shouldLogToDisk`). The captured stdout
- * is parsed and the token string is handed to the caller's closure ONLY: it is never logged,
- * never placed in `process.env` or any later child env, and never part of an error — every
- * failure resolves `null`, which the email module reports as "session bearer unavailable".
+ * Read the current Cloudflare session bearer through the pinned deploy runner, for API calls
+ * Void makes itself. The token goes only to the caller; every failure resolves `null`.
  */
 export async function runWranglerAuthToken(
   runWrangler: DeployWranglerRun,
@@ -205,18 +187,12 @@ export async function runWranglerAuthToken(
   let result: DeployWranglerRunResult;
   try {
     result = await Promise.resolve(
-      runWrangler(
-        { type: 'auth.token', configPath },
-        {
-          capture: true,
-          env: { WRANGLER_WRITE_LOGS: 'false' },
-        },
-      ),
+      runWrangler({ type: 'auth.token', configPath }, { capture: true }),
     );
   } catch {
     return null;
   }
-  if (!isCleanWranglerExit(result)) {
+  if (!isCleanCloudflareExit(result)) {
     return null;
   }
   const parsed = result.data as { type?: unknown; token?: unknown } | null | undefined;
@@ -311,7 +287,7 @@ export async function ensureCloudflareAuthSecret(options: {
       'put-failed',
     );
   }
-  if (!isCleanWranglerExit(put)) {
+  if (!isCleanCloudflareExit(put)) {
     throw new CloudflareAuthSecretError(
       `deploy: could not create the remote ${BETTER_AUTH_SECRET_NAME} ` +
         `(Cloudflare command exit ${String(put.status)}). No worker was uploaded. ` +
diff --git a/packages/void/src/cli/deploy-cloudflare-build.ts b/packages/void/src/cli/deploy-cloudflare-build.ts
index fdb483ac3..127058b33 100644
--- a/packages/void/src/cli/deploy-cloudflare-build.ts
+++ b/packages/void/src/cli/deploy-cloudflare-build.ts
@@ -4,12 +4,9 @@ import {
   readStoredResourceName,
   resolveD1MigrateTarget,
   assertCloudflareDurableObjectLifecycleSupported,
-  type ExistingCloudflareWorker,
-  type ApprovedCloudflareKvBinding,
 } from '@void/deploy-cloudflare';
 import { dirname } from 'pathslash';
 import { type VoidConfig } from '../config.ts';
-import type { DatabaseDialect } from '../config.ts';
 import { collectMigrations } from '../migrations/collect.ts';
 import { SqliteMigrationError } from '../migrations/sqlite-validation.ts';
 import { detectFramework } from '../plugin-inference.ts';
@@ -22,83 +19,59 @@ import {
   validateCloudflarePostBuildEnv,
   resolveGeneratedDeployConfigPathDefault,
 } from './deploy-artifact-validation.ts';
-import {
-  snapshotBindingIdentities,
-  DEPLOY_BINDING_IDENTITY_FIELDS,
-  bindingIdentityKey,
-} from './deploy-binding-snapshot.ts';
+import { DEPLOY_BINDING_IDENTITY_FIELDS, bindingIdentityKey } from './deploy-binding-snapshot.ts';
+import type { CloudflareDeploySource, CloudflarePreflight } from './deploy-cloudflare-preflight.ts';
 import { prepareCloudflareFrameworkArtifact } from './deploy-cloudflare-static.ts';
-import { log, getErrorMessage, getExitCode } from './deploy-helpers.ts';
+import { log, getExitCode } from './deploy-helpers.ts';
 import {
   validateAuthMigrationSchema,
   assertRemoteMigrationsDeployable,
   checkWranglerMigrationApplySet,
 } from './deploy-migrations.ts';
-import { requireProvisionModule } from './deploy-provision.ts';
 import {
   scrubManagedDeployBuildMarkers,
   scrubWranglerAuthCredentials,
   deployChildEnv,
 } from './deploy-transport.ts';
 import { type CloudflareDeployDeps } from './deploy-types.ts';
-import { type SelfHostSchemaFacts } from './env-validation.ts';
-import { resolveProjectCommand } from './preset.ts';
+import { getErrorMessage } from './output.ts';
+import { resolveProjectCommand, type FrameworkPreset } from './preset.ts';
+import { deleteEnvVarCaseAware } from './provision.ts';
+
+export type CloudflareBuild = Awaited<ReturnType<typeof buildCloudflareWorker>>;
 
+/** Build the Worker without Cloudflare credentials, then run the post-build gates. */
 export async function buildCloudflareWorker(input: {
-  readonly accountId: string;
-  readonly apiBaseUrl: string;
-  readonly existingWorker: ExistingCloudflareWorker | null;
-  readonly deps: CloudflareDeployDeps;
-  readonly frameworkPreset: import('./preset.ts').FrameworkPreset | undefined;
-  readonly voidConfig: VoidConfig;
   readonly root: string;
+  readonly voidConfig: VoidConfig;
+  readonly deps: CloudflareDeployDeps;
   readonly exit: (code: number) => never;
-  readonly detectedFramework: ReturnType<typeof detectFramework>;
-  readonly configPath: string;
-  readonly workerName: string;
-  readonly schemaFacts: SelfHostSchemaFacts;
-  readonly needsAI: boolean;
-  readonly aiBindingName: string;
-  readonly assertUploaderStillPinned: () => boolean;
-  readonly migrationsDir: string;
-  readonly dialect: DatabaseDialect;
   readonly atomic: boolean;
-  readonly runWrangler: NonNullable<CloudflareDeployDeps['runWrangler']>;
-  readonly authEnabled: boolean;
-  readonly approvedHandoffKv: Array<ApprovedCloudflareKvBinding>;
-  readonly desired: import('./provision.ts').DesiredResourceSet;
-  readonly bindingIdentitySnapshot: ReturnType<typeof snapshotBindingIdentities>;
+  readonly frameworkPreset: FrameworkPreset | undefined;
+  readonly detectedFramework: ReturnType<typeof detectFramework>;
+  readonly source: CloudflareDeploySource;
+  readonly preflight: CloudflarePreflight;
 }): Promise<{
   migrations: ReturnType<typeof collectMigrations>;
   d1MigrateToken: string | undefined;
   generatedConfigPath: string;
   prepareBuildOutput: () => ReturnType<typeof prepareCfBuildOutput>;
 }> {
+  const { root, voidConfig, deps, exit, atomic, frameworkPreset, detectedFramework } = input;
+  const { configPath, needsAI, aiBindingName, migrationsDir, dialect, authEnabled, desired } =
+    input.source;
   const {
     accountId,
     apiBaseUrl,
+    usesCf,
     existingWorker,
-    deps,
-    frameworkPreset,
-    voidConfig,
-    root,
-    exit,
-    detectedFramework,
-    configPath,
     workerName,
     schemaFacts,
-    needsAI,
-    aiBindingName,
     assertUploaderStillPinned,
-    migrationsDir,
-    dialect,
-    atomic,
     runWrangler,
-    authEnabled,
     approvedHandoffKv,
-    desired,
     bindingIdentitySnapshot,
-  } = input;
+  } = input.preflight;
 
   const buildChildEnv = scrubManagedDeployBuildMarkers(
     scrubWranglerAuthCredentials(deployChildEnv(accountId, apiBaseUrl)),
@@ -106,22 +79,15 @@ export async function buildCloudflareWorker(input: {
   // Tell void:env to build Worker vars from portable production dotenv files
   // only. Outside this deploy path Vite keeps its standard dotenv behavior,
   // but local files cannot be serialized into the artifact this command uploads.
-  requireProvisionModule().deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_DEPLOY_BUILD_ENV);
+  deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_DEPLOY_BUILD_ENV);
   buildChildEnv[CLOUDFLARE_DEPLOY_BUILD_ENV] = '1';
-  requireProvisionModule().deleteEnvVarCaseAware(
-    buildChildEnv,
-    CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV,
-  );
+  deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV);
   if (existingWorker) {
     buildChildEnv[CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV] = '1';
   }
-  // Pin NODE_ENV=production for the build too, so the build and the env-schema probes evaluate
-  // env.ts under the SAME environment. `vite build` only DEFAULTS NODE_ENV to production when it
-  // is unset (`if (!isNodeEnvSet) process.env.NODE_ENV = defaultNodeEnv`), so an ambient
-  // NODE_ENV=development would otherwise build a development schema while the probes (pinned
-  // production) derive a production one — the exact divergence the probe pin exists to close.
-  // Scrub any ambient spelling first (case-aware on win32) so it cannot shadow the pin.
-  requireProvisionModule().deleteEnvVarCaseAware(buildChildEnv, 'NODE_ENV');
+  // The env-schema probes run with NODE_ENV=production; `vite build` keeps an ambient value, so
+  // pin it here too.
+  deleteEnvVarCaseAware(buildChildEnv, 'NODE_ENV');
   buildChildEnv.NODE_ENV = 'production';
   const runBuild =
     deps.runBuild ??
@@ -131,13 +97,8 @@ export async function buildCloudflareWorker(input: {
         : resolveProjectCommand(root, 'vite build');
       execSync(command, { cwd: root, stdio: 'inherit', env });
     });
-  // The wrangler UPLOADER was pinned into `wranglerUploaderHashBefore` at the START of the deploy
-  // (before the env-schema probe and the pre-build credentialed runs), and `assertUploaderStillPinned`
-  // re-checks it against that ONE baseline before every credentialed spawn — never re-baselined. The
-  // build below runs untrusted project code with the parent's Cloudflare creds scrubbed, so it can
-  // only edit FILES — but that INCLUDES the `wrangler-dist` bundle every post-build credentialed
-  // wrangler run (the secret list, the remote D1 migrate, and the deploy) executes — so re-verify
-  // against the same baseline right after it, and again immediately before each spawn.
+  // The build runs project code without credentials, but it can edit files, including the
+  // pinned uploader. The uploader is re-checked after it and before every credentialed run.
   try {
     runBuild(buildChildEnv);
   } catch (err) {
@@ -147,18 +108,18 @@ export async function buildCloudflareWorker(input: {
   log.step('Preparing deployment...');
   if (detectedFramework && frameworkPreset) {
     try {
-      await (deps.prepareFrameworkArtifact ?? prepareCloudflareFrameworkArtifact)(
+      await (deps.prepareFrameworkArtifact ?? prepareCloudflareFrameworkArtifact)({
         root,
         configPath,
         accountId,
         workerName,
         voidConfig,
-        detectedFramework,
-        frameworkPreset,
-        schemaFacts.requiredKeys,
-        needsAI ? { binding: aiBindingName } : undefined,
-        existingWorker !== null,
-      );
+        framework: detectedFramework,
+        preset: frameworkPreset,
+        requiredSecretNames: schemaFacts.requiredKeys,
+        ai: needsAI ? { binding: aiBindingName } : undefined,
+        preserveBindings: existingWorker !== null,
+      });
     } catch (error) {
       log.error(
         `deploy: could not prepare ${detectedFramework.name} for Cloudflare — ${getErrorMessage(error)}`,
@@ -166,19 +127,12 @@ export async function buildCloudflareWorker(input: {
       return exit(1);
     }
   }
-  // Early fail — re-check right after the build, before the ground-truth gates do any work. No
-  // remote mutation has happened since the baseline was pinned, so a changed/unverifiable uploader
-  // here leaves nothing half-done. Each credentialed spawn below re-checks again immediately.
   if (!assertUploaderStillPinned()) {
     return exit(1);
   }
 
-  // Re-collect the checked-in migrations from disk AFTER the build. `vite build` runs
-  // arbitrary project plugins that could add or rewrite `db/migrations` SQL (or the
-  // `migrations_dir` presence), and step 9's `wrangler d1 migrations apply` reads the
-  // LIVE post-build files — so every migration that can reach remote D1 must be validated
-  // against exactly what is on disk now, not a pre-build snapshot. This one set feeds both
-  // the auth-schema check (8c) and the local migration gates (8d).
+  // Build plugins can add or rewrite migrations, and the remote apply reads the files on disk,
+  // so every gate below uses this post-build set.
   const migrations = collectMigrations(migrationsDir);
   if (existingWorker && migrations.length) {
     throw new Error(
@@ -196,9 +150,8 @@ export async function buildCloudflareWorker(input: {
     return exit(1);
   }
 
-  // Wrangler Versions cannot apply a new Durable Object class migration to an existing Worker.
-  // Inspect the active migration tag after the build has produced the exact config, but before
-  // remote database migration or secret mutation. First deployments remain supported.
+  // Worker Versions cannot apply a new Durable Object class migration to an existing Worker.
+  // Check the active migration tag before any remote database or secret change.
   const lifecycleConfigPath = (
     deps.resolveGeneratedConfigPath ??
     ((projectRoot) => readGeneratedDeployConfig(projectRoot).path)
@@ -225,7 +178,7 @@ export async function buildCloudflareWorker(input: {
   }
 
   if (
-    !(await validateCloudflarePostBuildEnv(
+    !(await validateCloudflarePostBuildEnv({
       root,
       configPath,
       accountId,
@@ -237,19 +190,13 @@ export async function buildCloudflareWorker(input: {
       approvedHandoffKv,
       deps,
       assertUploaderStillPinned,
-    ))
+    }))
   ) {
     return exit(1);
   }
 
-  // 8c. Auth-schema check — the managed platform creates Void-managed Better Auth tables at
-  // RUNTIME (POST /__void/migrate/auth) after dispatch; this self-host backend never calls it,
-  // it only applies checked-in `db/migrations/*.sql`. So verify the checked-in migrations
-  // PRODUCE the required Better Auth schema (tables + columns, incl. configured renames + plugin
-  // tables) by reading the schema the BUILD generated (`.void/better-auth-schema.ts` — ground
-  // truth) and applying the migrations to in-memory SQLite. PostgreSQL uses the same generated
-  // schema as the drift gate below; applying its SQL to SQLite would be invalid, so only the D1
-  // dialect needs this additional structural simulation.
+  // This backend never creates the Better Auth tables at runtime, so the checked-in D1
+  // migrations must produce the schema the build generated.
   if (authEnabled && dialect === 'sqlite') {
     try {
       await (deps.validateAuthMigrations ?? validateAuthMigrationSchema)(root, migrations);
@@ -277,20 +224,11 @@ export async function buildCloudflareWorker(input: {
     }
   }
 
-  // 8d. Local migration gates — run POST-build,
-  // immediately before the remote apply, against the RE-COLLECTED post-build migrations. Moving
-  // them here (from pre-build) closes the window where a build plugin could add/rewrite migration
-  // SQL that step 9 would then apply to remote D1 ungated: `wrangler d1 migrations apply` reads
-  // the live post-build files, and these gates now validate exactly that set. Nothing between the
-  // build and here mutates remote state, so a failed gate never leaves a half-migrated account.
+  // Nothing remote has changed yet, so a failed migration gate leaves no half-migrated account.
   let d1MigrateToken: string | undefined;
   if (desired.d1 || desired.hyperdrive) {
-    // 8d-i. Run the SAME gates the managed deploy runs — schema drift, journal coherence,
-    // destructive-op-without-pragma — for EVERY D1 app REGARDLESS of migration count. A
-    // `db/schema.ts` with no generated migration is drift the old count-gated check silently
-    // skipped (shipping a schemaless remote DB); wrangler also auto-applies destructive SQL in CI
-    // (its confirmation defaults to "yes" non-interactively). `validateMigrations` self-guards on
-    // an empty set.
+    // The managed deploy's gates (schema drift, journal coherence, destructive SQL) run even with
+    // no migrations, since a schema without migrations is drift too.
     try {
       (deps.assertMigrationsDeployable ?? assertRemoteMigrationsDeployable)(
         root,
@@ -303,12 +241,9 @@ export async function buildCloudflareWorker(input: {
       return exit(1);
     }
 
-    // Resolve + validate the D1 migrate target ONLY when there ARE checked-in migrations: a D1
-    // desired purely from DB-use or auth can have no `db/migrations`, and wrangler 4.131
-    // HARD-FAILS `d1 migrations apply` on a missing/empty folder (it never no-ops).
+    // A D1 database used only for queries or auth may have no migrations folder at all.
     if (desired.d1 && migrations.length > 0) {
-      // `migrations_dir` must be present in the config: wrangler defaults a missing value to
-      // `./migrations` (relative to the config) and would apply an unrelated folder.
+      // A missing `migrations_dir` defaults to `./migrations`, which may be an unrelated folder.
       const migrateConfig = parseRootWranglerConfig(configPath);
       const d1MigrationsDir = readStoredResourceName(
         migrateConfig,
@@ -328,12 +263,8 @@ export async function buildCloudflareWorker(input: {
         );
         return exit(1);
       }
-      // wrangler 4.131 resolves the migrate target by FIRST-matching the passed token
-      // against `database_name` OR `binding` (getDatabaseInfoFromConfig, src/d1/utils.ts)
-      // and reads THAT entry's `migrations_dir`. The gate validated the entry matched by
-      // BINDING, so migrate by a token that resolves to exactly that entry — fail closed
-      // when an earlier alias entry would shadow it (else wrangler could migrate the wrong
-      // DB / an unrelated folder though the gate passed).
+      // The apply resolves its target by the first entry whose id, database_name or binding
+      // matches the token, so use a token that resolves only to the validated binding.
       const migrateTarget = resolveD1MigrateTarget(migrateConfig, desired.d1.binding);
       if (!migrateTarget.ok) {
         log.error(
@@ -348,14 +279,8 @@ export async function buildCloudflareWorker(input: {
         return exit(1);
       }
 
-      // 8d-iii. Pin check — the remote apply below resolves its target from THIS post-build
-      // `migrateConfig` (the root config wrangler re-reads to map the token → database_id), so
-      // assert that database_id still equals what was snapshotted at step 6 BEFORE the build.
-      // A tampered build that rewrote `d1_databases[<binding>].database_id` — keeping the binding
-      // + database_name so the token still resolves — would otherwise redirect this privileged
-      // `--remote` migration to a DIFFERENT same-account database. Fail closed, mirroring the
-      // account_id pin. A binding never pinned (no real id pre-build, which the drift check
-      // already rejects) is not asserted.
+      // The apply reads its database id from this post-build config; a build that rewrote it
+      // would redirect the remote migration to another database.
       const { field: d1Field, idField: d1IdField } = DEPLOY_BINDING_IDENTITY_FIELDS.d1;
       const pinnedD1Id = bindingIdentitySnapshot.get(
         bindingIdentityKey(d1Field, desired.d1.binding),
@@ -378,12 +303,8 @@ export async function buildCloudflareWorker(input: {
         return exit(1);
       }
 
-      // 8d-ii. The EXACT files wrangler will apply (its own `migrations_dir` + `migrations_pattern`
-      // resolution) must EQUAL the gated source set by normalized name AND content. Otherwise
-      // a stray/extra `.sql` (e.g. `seed.sql`, which the gate's `collectMigrations` skips but
-      // wrangler's `*.sql` glob matches), a differing dir, or a divergent file would be applied
-      // to REMOTE D1 unvalidated. The gate above only checked `migrations`; this makes the
-      // applied set == the validated set.
+      // The files the apply will read must equal the validated set; a stray `seed.sql` matches
+      // its `*.sql` glob but not the gates.
       const applyCheck = await (deps.checkMigrationApplySet ?? checkWranglerMigrationApplySet)(
         configPath,
         migrateConfig,
@@ -410,7 +331,7 @@ export async function buildCloudflareWorker(input: {
           accountId,
         })
       : prepareCfBuildOutput(dirname(generatedConfigPath), accountId);
-  if (!deps.activateVersion && !deps.runWrangler) {
+  if (usesCf) {
     // Validate the exact upload format before changing a remote database or secret.
     const preflight = await prepareBuildOutput();
     if (!preflight) {
diff --git a/packages/void/src/cli/deploy-cloudflare-email.ts b/packages/void/src/cli/deploy-cloudflare-email.ts
index 00c7f42c3..cc67a81ec 100644
--- a/packages/void/src/cli/deploy-cloudflare-email.ts
+++ b/packages/void/src/cli/deploy-cloudflare-email.ts
@@ -1,6 +1,6 @@
 import { basename } from 'pathslash';
 import { runWranglerAuthToken } from './deploy-cloudflare-auth.ts';
-import { log, getErrorMessage } from './deploy-helpers.ts';
+import { log } from './deploy-helpers.ts';
 import {
   type CloudflareEmailStepInput,
   type CloudflareEmailStepResult,
@@ -9,13 +9,14 @@ import {
 import {
   applyEmailSetup,
   EMAIL_FROM_VAR,
-  findEmailConfigConflicts,
+  emailConfigInputs,
   preflightEmail,
   SEND_EMAIL_BINDING,
   renderEmailChecklist,
   type EmailCloudflareInputs,
   type EmailPreflight,
 } from './email-cloudflare.ts';
+import { getErrorMessage } from './output.ts';
 import { writeProvisionedWranglerConfig, type ProvisionedWranglerPatch } from './wrangler.ts';
 
 /** Whether the root config carries the `send_email` binding Void writes. */
@@ -65,15 +66,11 @@ function isCommittedSubdomainPlanWaitingForDns(
 }
 
 /**
- * Step 3b-ii — Mode B email on the developer's own account (design doc 0078, "One keystroke").
- * Preflight is read-only; the checklist is shown; ONE `confirm` (default Yes) authorizes the
- * apply, which runs only the rows not ready and returns the root-config patch this writes.
- * Most branches that cannot finish return `satisfied: false`, leaving `--require-email` to
- * decide whether deployment continues. One ambiguous handoff fails closed for every deploy:
- * an exact committed subdomain plan whose new MX is still empty or unreadable. It is preserved,
- * and the caller stops before build/upload until DNS can be verified. No output of this step
- * ever contains the session bearer: the module borrows it through `getSessionBearer` inside its
- * own closures and drops it.
+ * The deploy's email step on the developer's own account: read-only preflight, checklist,
+ * one confirmation (default Yes), then apply and write the config patch. Branches that cannot
+ * finish return `satisfied: false` and leave `--require-email` to decide. A committed subdomain
+ * plan whose new MX is still empty or unreadable is preserved and aborts the deploy before
+ * build. The session bearer never appears in any output of this step.
  */
 export async function runCloudflareEmailStep(
   input: CloudflareEmailStepInput,
@@ -105,16 +102,7 @@ export async function runCloudflareEmailStep(
     from,
     workerName: input.workerName,
     accountId: input.accountId,
-    existingSendEmail: Array.isArray(rootConfig.send_email)
-      ? (rootConfig.send_email as Array<{ name?: unknown }>)
-      : undefined,
-    existingAddresses: rootConfig.addresses,
-    existingVars:
-      rootConfig.vars && typeof rootConfig.vars === 'object' && !Array.isArray(rootConfig.vars)
-        ? (rootConfig.vars as Record<string, unknown>)
-        : undefined,
-    configConflicts: findEmailConfigConflicts(rootConfig),
-    // The SAME `-c`/`--env=` context every other credentialed wrangler run gets.
+    ...emailConfigInputs(rootConfig),
     configPath: input.configPath,
     apiBaseUrl: input.apiBaseUrl,
     runWrangler: input.runWrangler,
@@ -141,9 +129,8 @@ export async function runCloudflareEmailStep(
     sendingReady,
     creating,
   });
-  // Pin `configPath` so read/parse/write hit the SAME file every other step uses. A refused
-  // write (e.g. an `addresses` array with a comment nested inside it) is the developer's
-  // territory (decision 13): surface it as-is; the caller decides what the deploy ships.
+  // Pin `configPath` so every step writes the same file. A refused write (e.g. a comment
+  // nested in `addresses`) is reported as-is; the caller decides what the deploy ships.
   const writeConfig = (patch: ProvisionedWranglerPatch): boolean => {
     try {
       writeProvisionedWranglerConfig(input.root, patch, { configPath: input.configPath });
@@ -154,28 +141,10 @@ export async function runCloudflareEmailStep(
     }
   };
 
-  // Every account row ready: no prompt, no account call, zero keystrokes (the second deploy).
-  // A sending row the committed binding remembers as refused (Workers Free) lands here too
-  // — the deploy never retries the onboarding; the map ends `(verified destinations only)`
-  // and `void email setup` is where the retry is offered (`preflightEmail`'s memory rule).
-  // The two CONFIG rows are reconciled here by a plain file write, because a stale one is
-  // not idle: an `addresses` entry no longer in the pruned set reaches wrangler's plan as a
-  // `conflict` (a takeover prompt in a TTY, a UserError after the upload in CI — decision
-  // 12), and a stale `__VOID_EMAIL_FROM` ships the OLD sender while the map prints the new.
-  //
-  // The `null` (key removed) branch below is reachable in exactly one shape: every derived
-  // address is routed elsewhere (a forward, another worker — a worker rename makes all of
-  // them so), so this worker OWNS none of those rules and `[]` would plan nothing either;
-  // the key goes because a plan on a stale entry is a `conflict`. A handler deleted while
-  // its entry stays never gets here: the preflight (step 8) has no provenance for entries
-  // Void wrote on an earlier deploy, so it reads that leftover as an entry Void did not
-  // derive — the decision-13 blocker, array untouched, rule still routed to this worker
-  // (guide: "Deleting a handler leaves its address in `addresses`"). Making the leftover
-  // Void-managed instead (a marker like `void:managed-queues`, then `[]` or a prune) is
-  // decision 13's other branch, and under `triggers deploy` a `[]` plan that deletes owned
-  // rules is destructive: wrangler asks (default No) in a TTY and throws in CI, which the
-  // activation reports as `triggers-failed` and compensates by restoring the previous
-  // version. A product call, not a deploy default.
+  // Ready: no prompt and no account call; a sending onboarding recorded as refused is never
+  // retried here. The config rows are still rewritten, because a stale `addresses` entry
+  // becomes a plan conflict and a stale `__VOID_EMAIL_FROM` ships the old sender. `null`
+  // removes the key when every derived address is routed elsewhere.
   if (pre.ready) {
     const patch: ProvisionedWranglerPatch = {};
     const rows: Array<string> = [];
@@ -236,13 +205,9 @@ export async function runCloudflareEmailStep(
       map: mapFor(existingAddresses(rootConfig, pre), pre.sending.state === 'ready'),
     };
   }
-  // The three exits below leave the account alone. What the worker then ships is whatever
-  // the config already carries — so when the binding is committed the deploy is WITH the
-  // existing setup (map printed, wording says so). A committed `addresses` array whose routing
-  // is verifiably off is withdrawn first: wrangler's plan on it 400s (`2062`) AFTER the upload,
-  // on every deploy, until the key goes (0078: "deleted, never `[]`, when a later preflight finds
-  // routing off"). The ambiguous post-setup DNS case returned above instead. Only Void's own
-  // array is touched (decision 13); deleting the KEY changes no rule — wrangler skips the plan.
+  // The exits below leave the account alone and ship whatever the config carries. Void's own
+  // `addresses` array is removed (never `[]`) when routing is off, since its plan would fail
+  // (`2062`) after the upload on every deploy.
   const shipsBinding = pre.binding.state === 'present';
   const leaveAccount = (reason: string): CloudflareEmailStepResult => {
     let configWritten = false;
@@ -294,47 +259,17 @@ export async function runCloudflareEmailStep(
   if (out.lines.length > 0) {
     log.message(out.lines.join('\n'));
   }
-  let configWritten = false;
-  if (
-    out.patch.sendEmail !== undefined ||
-    out.patch.addresses !== undefined ||
-    out.patch.vars !== undefined
-  ) {
-    if (
-      !writeConfig({
-        sendEmail: out.patch.sendEmail,
-        addresses: out.patch.addresses,
-        vars: out.patch.vars,
-      })
-    ) {
-      log.warn('deploy: deploying without email.');
-      return without;
-    }
-    configWritten = true;
+  if (!writeConfig(out.patch)) {
+    log.warn('deploy: deploying without email.');
+    return without;
   }
   const bindingPresent = shipsBinding || out.patch.sendEmail !== undefined;
   const written = out.patch.addresses ?? [];
-  // `satisfied` is post-apply READINESS, not binding presence. `applyEmailSetup` writes
-  // `patch.sendEmail` as soon as EITHER routing or sending came up, and withholds
-  // `addresses` when the bearer failed or routing is off — so a run whose subdomain
-  // routing POST failed ships the binding with no inbound rule behind it, which is
-  // exactly the end state the `leaveAccount` branch above already returns as
-  // `satisfied: false`. Gating `--require-email` on the binding alone would contradict
-  // both that branch and the error text ("not fully set up … refusing to deploy"), so
-  // this mirrors `preflightEmail`'s own `ready` predicate instead: the inbound rows
-  // (routing + subaddressing, with `addresses` actually written — `out.inboundReady`, the
-  // same field `void email setup` exits on) + the binding. The sending row needs no term
-  // of its own: apply has just made its one `sending enable` call (or found the row ready
-  // or blocked), and the binding it writes on that same run is what the NEXT preflight
-  // reads as the memory of a refusal — binding present + sending pending is settled there
-  // (Workers Free, `10105`; the memory rule in `preflightEmail`), so it is settled here,
-  // or the two would disagree on the very next deploy. `map` stays on `bindingPresent`:
-  // the worker DOES ship with email, and a deploy may ship with email while `satisfied`
-  // is false.
-  const satisfied = bindingPresent && out.inboundReady;
+  // `satisfied` mirrors preflight readiness (binding plus complete inbound), not binding
+  // presence; the map follows the binding, since the worker ships with email either way.
   return {
-    satisfied,
-    configWritten,
+    satisfied: bindingPresent && out.inboundReady,
+    configWritten: true,
     map: bindingPresent
       ? mapFor(
           written,
diff --git a/packages/void/src/cli/deploy-cloudflare-helpers.ts b/packages/void/src/cli/deploy-cloudflare-helpers.ts
index bade511a2..27a24be6b 100644
--- a/packages/void/src/cli/deploy-cloudflare-helpers.ts
+++ b/packages/void/src/cli/deploy-cloudflare-helpers.ts
@@ -1,6 +1,11 @@
 import { existsSync } from 'node:fs';
 import {
   activateCloudflareVersion,
+  assertCloudflareBindingsPreserved,
+  parseRootWranglerConfig,
+  readExistingCloudflareWorker,
+  readWranglerTopLevelString,
+  type ApprovedCloudflareKvBinding,
   type CloudflareCommandRunner,
   type ExistingCloudflareWorker,
 } from '@void/deploy-cloudflare';
@@ -13,39 +18,53 @@ import {
   createCfResourceVerifier,
   createCfVersionRunner,
 } from './cf-version-runner.ts';
-import { CloudflareAuthenticationError } from './cloudflare-auth.ts';
+import {
+  CloudflareAuthenticationError,
+  ensureCloudflareAuthentication,
+} from './cloudflare-auth.ts';
 import {
   assertCloudflareCandidateUnchanged,
   clearCloudflareCandidate,
+  recordCloudflareCandidateUpload,
   type CloudflareCandidateReceipt,
 } from './cloudflare-candidate.ts';
 import {
   assertCloudflareLinkUnchanged,
   completeCloudflareLink,
+  recordCloudflareCandidate,
   type CloudflareLink,
 } from './cloudflare-link.ts';
 import {
   createCloudflareEmptyCronPublisher,
   createCloudflareEmptyDomainPublisher,
 } from './cloudflare-operations.ts';
-import { rememberCloudflareWorkersDevSubdomain } from './cloudflare-readiness.ts';
+import {
+  rememberCloudflareWorkersDevSubdomain,
+  resolveCloudflareWorkersDevSubdomain,
+} from './cloudflare-readiness.ts';
 import {
   assertWranglerUploaderUnchanged,
   hashCfUploader,
   hashWranglerUploader,
 } from './deploy-binding-snapshot.ts';
-import { runWranglerAuthToken } from './deploy-cloudflare-auth.ts';
-import { getErrorMessage, log } from './deploy-helpers.ts';
-import { deployChildEnv } from './deploy-transport.ts';
+import {
+  chooseCloudflareDeployAccount,
+  createDeployWranglerRunner,
+  runWranglerAuthToken,
+} from './deploy-cloudflare-auth.ts';
+import { log } from './deploy-helpers.ts';
+import { deployChildEnv, resolveDeployTransport } from './deploy-transport.ts';
 import type { CloudflareDeployDeps, DeployWranglerRun } from './deploy-types.ts';
 import { type CliLogger } from './log-file.ts';
-import { createSpinner } from './output.ts';
+import { createSpinner, getErrorMessage } from './output.ts';
 import {
   acknowledgeWranglerManagedQueueRemovals,
+  readWranglerPublishedTrafficSnapshot,
   writeWranglerPublishedTrafficSnapshot,
   type readWranglerManagedQueueCleanupCandidates,
 } from './wrangler.ts';
 
+type CloudflareActivationOptions = Parameters<typeof activateCloudflareVersion>[0];
 type CloudflareActivationResult = Awaited<ReturnType<typeof activateCloudflareVersion>>;
 
 /**
@@ -67,7 +86,7 @@ export function discoverRootWranglerConfig(root: string): string {
  * checks the same baseline, so project code can never swap the executable under the session.
  * Injected test runners (`activateVersion` / `runWrangler`) bypass the pinned cf uploader.
  */
-export function createCloudflareUploaderPins(
+function createCloudflareUploaderPins(
   root: string,
   deps: CloudflareDeployDeps,
 ): {
@@ -107,12 +126,105 @@ export function createCloudflareUploaderPins(
 }
 
 /** Log a failed Cloudflare sign-in. An uploader change has already reported itself. */
-export function logCloudflareAuthFailure(error: unknown): void {
+function logCloudflareAuthFailure(error: unknown): void {
   if (!(error instanceof CloudflareAuthenticationError && error.reason === 'uploader-changed')) {
     log.error(`deploy: ${getErrorMessage(error)}`);
   }
 }
 
+type CloudflareDeployConnection = {
+  apiBaseUrl: string;
+  usesCf: boolean;
+  cfUploaderIsPinned: () => boolean;
+  assertUploaderStillPinned: () => boolean;
+  accountId: string;
+  workersDevSubdomain: string | undefined;
+  runWrangler: DeployWranglerRun;
+  /** The root config, read again after a first-run account choice. */
+  rootConfig: Record<string, unknown>;
+};
+
+/**
+ * Pin the transport, the uploaders and the account, then create the deploy runner. A first
+ * deploy without an account signs in and chooses one. Logs and returns null on failure.
+ */
+export async function connectCloudflareDeployAccount(options: {
+  root: string;
+  configPath: string;
+  rootConfig: Record<string, unknown>;
+  deps: CloudflareDeployDeps;
+  persistAccount: boolean;
+}): Promise<CloudflareDeployConnection | null> {
+  const { root, configPath, deps } = options;
+  let { rootConfig } = options;
+  let apiBaseUrl: string;
+  try {
+    apiBaseUrl = resolveDeployTransport(root, rootConfig);
+  } catch (error) {
+    log.error(`deploy: ${getErrorMessage(error)}`);
+    return null;
+  }
+  // Pin the uploaders before the first authenticated command, including account discovery.
+  const pins = createCloudflareUploaderPins(root, deps);
+  let accountId =
+    readWranglerTopLevelString(rootConfig, 'account_id') ??
+    (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || undefined);
+  if (!accountId) {
+    const accountRunner =
+      deps.runWrangler ?? createDeployWranglerRunner(root, undefined, apiBaseUrl);
+    try {
+      accountId = await chooseCloudflareDeployAccount({
+        persist: options.persistAccount,
+        beforeWranglerRun: pins.assertUploaderStillPinned,
+        configPath,
+        root,
+        runWrangler: accountRunner,
+      });
+      rootConfig = parseRootWranglerConfig(configPath);
+    } catch (error) {
+      logCloudflareAuthFailure(error);
+      return null;
+    }
+  }
+  let workersDevSubdomain: string | undefined;
+  try {
+    workersDevSubdomain = resolveCloudflareWorkersDevSubdomain(root, accountId);
+  } catch (error) {
+    log.error(getErrorMessage(error));
+    return null;
+  }
+  return {
+    ...pins,
+    apiBaseUrl,
+    accountId,
+    workersDevSubdomain,
+    runWrangler: deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl),
+    rootConfig,
+  };
+}
+
+/** Confirm the Cloudflare session through the pinned uploader. Logs and returns false on failure. */
+export async function confirmCloudflareDeployAuthentication(
+  connection: Pick<CloudflareDeployConnection, 'runWrangler' | 'assertUploaderStillPinned'>,
+  configPath: string,
+): Promise<boolean> {
+  if (!connection.assertUploaderStillPinned()) {
+    return false;
+  }
+  try {
+    await ensureCloudflareAuthentication({
+      acceptApiToken: true,
+      beforeRun: connection.assertUploaderStillPinned,
+      runWrangler: (operation, capture) => connection.runWrangler(operation, { capture }),
+      configPath: existsSync(configPath) ? configPath : undefined,
+    });
+    return true;
+  } catch (error) {
+    logCloudflareAuthFailure(error);
+    return false;
+  }
+}
+
 /** Fail before upload when the handoff link or saved candidate no longer matches this deploy. */
 export function assertCloudflareDeployTargetUnchanged(options: {
   root: string;
@@ -177,8 +289,102 @@ export function createCfActivationRunner(options: {
   });
 }
 
+/**
+ * Activation options shared by the Worker and static deploys: candidate tracking, the uploaded
+ * binding check, readiness probing and trigger cleanup.
+ */
+export function cloudflareCandidateActivationOptions(options: {
+  root: string;
+  /** Root config, read for the last published traffic state. */
+  rootConfigPath: string;
+  /** Config the version is uploaded from. */
+  uploadConfigPath: string;
+  accountId: string;
+  apiBaseUrl: string;
+  workerName: string;
+  workersDevSubdomain: string | undefined;
+  runWrangler: DeployWranglerRun;
+  readExistingWorker: CloudflareDeployDeps['readExistingWorker'];
+  existingWorker: ExistingCloudflareWorker | null;
+  pinnedHandoffLink: CloudflareLink | null;
+  initialCloudflareCandidate: CloudflareCandidateReceipt | null;
+  assertUploaderStillPinned: () => boolean;
+  approvedKv: ReadonlyArray<ApprovedCloudflareKvBinding>;
+  staticAssetsBinding?: string;
+  queueConsumerCleanup: ReturnType<typeof readWranglerManagedQueueCleanupCandidates>;
+}): Omit<
+  CloudflareActivationOptions,
+  | 'runWrangler'
+  | 'verifyUploader'
+  | 'message'
+  | 'requireVersionMetadata'
+  | 'requirePreviewForReadiness'
+> {
+  const { root, accountId, workerName, workersDevSubdomain, runWrangler, existingWorker } = options;
+  const { pinnedHandoffLink, initialCloudflareCandidate } = options;
+  const configPath = options.uploadConfigPath;
+  const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
+  return {
+    workerName,
+    configPath,
+    preserveTriggers: existingWorker !== null,
+    expectedPreviousVersionId: existingWorker?.versionId,
+    trustedInheritanceVersionIds: existingWorker
+      ? candidateReceipt?.parentVersionId === existingWorker.versionId
+        ? candidateReceipt.versionIds
+        : undefined
+      : initialCloudflareCandidate?.versionIds,
+    validateUploadedVersion: existingWorker
+      ? async (versionId) => {
+          if (!options.assertUploaderStillPinned()) {
+            throw new Error('The deployment uploader changed.');
+          }
+          const uploaded = await (options.readExistingWorker ?? readExistingCloudflareWorker)({
+            runWrangler,
+            configPath,
+            workerName,
+            versionId,
+          });
+          assertCloudflareBindingsPreserved(existingWorker, uploaded, options.approvedKv, {
+            staticAssetsBinding: options.staticAssetsBinding,
+          });
+        }
+      : undefined,
+    recordVerifiedCandidate: existingWorker
+      ? (versionId) =>
+          recordCloudflareCandidate(root, pinnedHandoffLink!, existingWorker.versionId, versionId)
+      : (versionId, parentVersionId) => {
+          if (parentVersionId) {
+            recordCloudflareCandidateUpload(
+              root,
+              initialCloudflareCandidate,
+              accountId,
+              workerName,
+              parentVersionId,
+              versionId,
+            );
+          }
+        },
+    readinessHeaders: cloudflareWorkerReadinessHeaders(),
+    workersDevSubdomain,
+    readinessHeadersWorkersDevSubdomain: process.env.CLOUDFLARE_WORKERS_SUBDOMAIN?.trim()
+      ? workersDevSubdomain
+      : undefined,
+    ...createCloudflareEmptyTriggerPublishers({
+      accountId,
+      apiBaseUrl: options.apiBaseUrl,
+      configPath,
+      workerName,
+      runWrangler,
+    }),
+    previousTrafficConfig: readWranglerPublishedTrafficSnapshot(options.rootConfigPath),
+    queueConsumerCleanup: options.queueConsumerCleanup,
+    verifyInheritedSecrets: true,
+  };
+}
+
 /** Activation callbacks that clear custom domains and crons when the config removes them. */
-export function createCloudflareEmptyTriggerPublishers(options: {
+function createCloudflareEmptyTriggerPublishers(options: {
   accountId: string;
   apiBaseUrl: string;
   configPath: string;
@@ -408,7 +614,7 @@ function formatCloudflareReadinessRestoration(
 }
 
 /** Capture the Access credential used only by the guarded Worker readiness probe. */
-export function cloudflareWorkerReadinessHeaders(): Record<string, string> {
+function cloudflareWorkerReadinessHeaders(): Record<string, string> {
   return trustedCloudflareWorkerAccessHeaders({
     CF_ACCESS_CLIENT_ID: process.env.CF_ACCESS_CLIENT_ID,
     CF_ACCESS_CLIENT_SECRET: process.env.CF_ACCESS_CLIENT_SECRET,
diff --git a/packages/void/src/cli/deploy-cloudflare-migrate.ts b/packages/void/src/cli/deploy-cloudflare-migrate.ts
index 1437f1eb3..e47de676e 100644
--- a/packages/void/src/cli/deploy-cloudflare-migrate.ts
+++ b/packages/void/src/cli/deploy-cloudflare-migrate.ts
@@ -1,82 +1,59 @@
-import type { DatabaseDialect } from '../config.ts';
-import { collectMigrations } from '../migrations/collect.ts';
 import { runMySqlMigrations } from '../migrations/runner-mysql.ts';
 import { runPgMigrations } from '../migrations/runner-pg.ts';
 import {
   verifyGeneratedDeployConfig,
   verifyCloudflareDeployArtifact,
 } from './deploy-artifact-validation.ts';
-import {
-  snapshotBindingIdentities,
-  snapshotPassthroughIdentities,
-  snapshotPassthroughRawFields,
-  reconstructExpectedContainers,
-  reconstructExpectedDurableObjectState,
-} from './deploy-binding-snapshot.ts';
 import { ensureCloudflareAuthSecret } from './deploy-cloudflare-auth.ts';
-import { log, getErrorMessage } from './deploy-helpers.ts';
+import type { CloudflareBuild } from './deploy-cloudflare-build.ts';
+import type { CloudflareDeploySource, CloudflarePreflight } from './deploy-cloudflare-preflight.ts';
+import { log } from './deploy-helpers.ts';
 import { applyAndVerifyRemoteD1Migrations } from './deploy-migrations.ts';
 import { CloudflareAuthSecretError } from './deploy-resources.ts';
 import { type CloudflareDeployDeps } from './deploy-types.ts';
-import { type SelfHostSchemaFacts } from './env-validation.ts';
 import { type CliLogger } from './log-file.ts';
+import { getErrorMessage } from './output.ts';
+
+export type CloudflareMigration = Awaited<ReturnType<typeof migrateCloudflareWorker>>;
 
+/** Provision the auth secret and apply database migrations, then verify the artifact. */
 export async function migrateCloudflareWorker(input: {
-  readonly authEnabled: boolean;
-  readonly deps: CloudflareDeployDeps;
   readonly root: string;
-  readonly accountId: string;
-  readonly workerName: string;
-  readonly desired: import('./provision.ts').DesiredResourceSet;
-  readonly bindingIdentitySnapshot: ReturnType<typeof snapshotBindingIdentities>;
-  readonly passthroughIdentitySnapshot: ReturnType<typeof snapshotPassthroughIdentities>;
-  readonly passthroughRawFields: ReturnType<typeof snapshotPassthroughRawFields>;
-  readonly needsAI: boolean;
-  readonly aiBindingName: string;
-  readonly expectedContainers: ReturnType<typeof reconstructExpectedContainers>;
-  readonly expectedDurableObjectState: ReturnType<typeof reconstructExpectedDurableObjectState>;
-  readonly expectedCrons: Array<string>;
+  readonly deps: CloudflareDeployDeps;
   readonly exit: (code: number) => never;
-  readonly configPath: string;
-  readonly runWrangler: NonNullable<CloudflareDeployDeps['runWrangler']>;
-  readonly assertUploaderStillPinned: () => boolean;
   readonly cliLog: CliLogger;
-  readonly dialect: DatabaseDialect;
-  readonly migrations: ReturnType<typeof collectMigrations>;
-  readonly migrationsDir: string;
-  readonly d1MigrateToken: string | undefined;
-  readonly schemaFacts: SelfHostSchemaFacts;
+  readonly source: CloudflareDeploySource;
+  readonly preflight: CloudflarePreflight;
+  readonly build: CloudflareBuild;
 }): Promise<{
   workerWasMissingBeforeSecretProvisioning: boolean;
   initialAuthSecret: string | undefined;
   appliedMigrations: number;
 }> {
+  const { root, deps, exit, cliLog } = input;
   const {
+    configPath,
     authEnabled,
-    deps,
-    root,
+    desired,
+    needsAI,
+    aiBindingName,
+    expectedCrons,
+    dialect,
+    migrationsDir,
+  } = input.source;
+  const {
     accountId,
     workerName,
-    desired,
     bindingIdentitySnapshot,
     passthroughIdentitySnapshot,
     passthroughRawFields,
-    needsAI,
-    aiBindingName,
     expectedContainers,
     expectedDurableObjectState,
-    expectedCrons,
-    exit,
-    configPath,
     runWrangler,
     assertUploaderStillPinned,
-    cliLog,
-    dialect,
-    migrations,
-    migrationsDir,
-    d1MigrateToken,
     schemaFacts,
-  } = input;
+  } = input.preflight;
+  const { migrations, d1MigrateToken } = input.build;
 
   let workerWasMissingBeforeSecretProvisioning = false;
   let initialAuthSecret: string | undefined;
@@ -96,15 +73,10 @@ export async function migrateCloudflareWorker(input: {
     expectedCrons,
   };
 
-  // 8e. Persistent Better Auth secret — after every local/build-derived gate,
-  // but before the first remote migration or worker upload. Existing secrets
-  // are adopted unchanged; a missing value is generated once, sent over stdin,
-  // and verified by name before deployment can continue.
+  // Persistent Better Auth secret: adopted when present, otherwise generated once and verified,
+  // before the first remote migration or upload.
   if (authEnabled) {
-    // Prove the artifact will inherit the secret BEFORE creating it. Wrangler
-    // replaces Worker versions on deploy; without `secrets.required`, a secret
-    // successfully written to the draft/current Worker can be dropped by the
-    // immediately following upload.
+    // Without `secrets.required`, the next upload could drop a newly written secret.
     const inheritance = (deps.verifyDeployConfig ?? verifyGeneratedDeployConfig)(
       root,
       verifyOptions,
@@ -146,10 +118,8 @@ export async function migrateCloudflareWorker(input: {
 
   let appliedMigrations = 0;
 
-  // 9. Apply pending PostgreSQL or MySQL migrations before the Worker upload. The
-  // production URL is intentionally provided by the deploy environment rather than recovered
-  // from Hyperdrive (Cloudflare never returns the database password). The runners record
-  // applied names in `_void_migrations`, so retries are idempotent.
+  // Cloudflare never returns the Hyperdrive password, so the deploy environment provides the
+  // production URL. The runners record applied names, so retries are idempotent.
   if (dialect !== 'sqlite' && migrations.length > 0) {
     const mysql = dialect === 'mysql';
     const label = mysql ? 'MySQL' : 'PostgreSQL';
diff --git a/packages/void/src/cli/deploy-cloudflare-preflight.ts b/packages/void/src/cli/deploy-cloudflare-preflight.ts
index 695bf0b2e..38d21f492 100644
--- a/packages/void/src/cli/deploy-cloudflare-preflight.ts
+++ b/packages/void/src/cli/deploy-cloudflare-preflight.ts
@@ -1,4 +1,5 @@
 import { existsSync } from 'node:fs';
+import { isDeepStrictEqual as deepEqual } from 'node:util';
 import {
   parseRootWranglerConfig,
   readStoredResourceName,
@@ -12,16 +13,13 @@ import { dirname, relative } from 'pathslash';
 import { analyzeApplicationSync, type ApplicationAnalysis } from '../application-analysis.ts';
 import { resolveBindingNames, type VoidConfig } from '../config.ts';
 import { detectFramework } from '../plugin-inference.ts';
-import type { EmailHandlersScan } from '../router/email.ts';
 import { assertSandboxNamespaceConfig, resolveSandboxConfig } from '../sandbox/config.ts';
-import { ensureCloudflareAuthentication } from './cloudflare-auth.ts';
 import { classifyCloudflareDeployApp } from './cloudflare-deploy/classify.ts';
 import { approvedCloudflareIsrBinding, chooseCloudflareIsr } from './cloudflare-isr.ts';
 import { readCloudflareLink, type CloudflareLink } from './cloudflare-link.ts';
-import { resolveCloudflareWorkersDevSubdomain } from './cloudflare-readiness.ts';
+import { isCleanCloudflareExit } from './cloudflare-process.ts';
 import { resolveEnvSchemaFactsDefault } from './deploy-artifact-validation.ts';
 import {
-  deepEqual,
   snapshotBindingIdentities,
   snapshotPassthroughIdentities,
   snapshotPassthroughRawFields,
@@ -29,32 +27,28 @@ import {
   reconstructExpectedDurableObjectState,
 } from './deploy-binding-snapshot.ts';
 import {
-  createDeployWranglerRunner,
-  chooseCloudflareDeployAccount,
   isWranglerNonInteractiveOrCI,
   prepareExistingCloudflareDeployWithAuth,
 } from './deploy-cloudflare-auth.ts';
 import { hasVoidSendEmailBinding, runCloudflareEmailStep } from './deploy-cloudflare-email.ts';
 import {
-  createCloudflareUploaderPins,
+  confirmCloudflareDeployAuthentication,
+  connectCloudflareDeployAccount,
   discoverRootWranglerConfig,
-  logCloudflareAuthFailure,
 } from './deploy-cloudflare-helpers.ts';
-import { log, getErrorMessage } from './deploy-helpers.ts';
+import { log } from './deploy-helpers.ts';
 import {
   resolveWranglerMigrationPattern,
   formatCloudflareDriftMessage,
 } from './deploy-migrations.ts';
-import { loadProvisionModule } from './deploy-provision.ts';
 import {
   computeDesiredCloudflareResources,
   deriveWorkerName,
-  isCleanWranglerExit,
   formatCloudflareSandboxUnavailable,
   CLOUDFLARE_RESOURCE_LABELS,
 } from './deploy-resources.ts';
 import { printDeployContext } from './deploy-summary.ts';
-import { resolveDeployTransport, buildSchemaProbeEnv } from './deploy-transport.ts';
+import { buildSchemaProbeEnv } from './deploy-transport.ts';
 import {
   type RunDeployOptions,
   type CloudflareDeployDeps,
@@ -64,15 +58,14 @@ import { createNodeEmailDns, SEND_EMAIL_BINDING } from './email-cloudflare.ts';
 import type { EnvSchemaProbeResult } from './env-schema-probe.ts';
 import { selfHostSchemaFailureMessage, type SelfHostSchemaFacts } from './env-validation.ts';
 import { type CliLogger } from './log-file.ts';
-// The provision module pulls in the whole-provision cross-process lock
-// (`proper-lockfile` → `signal-exit`), which patches `process.emit` /
-// `process.reallyExit` and installs exit handlers the moment it is imported. An
-// ordinary MANAGED `void deploy` never enters the Cloudflare-backend fork, so it
-// must not pay that side effect. Keep ONLY erasable `import type` at module scope
-// and load the runtime values with a DYNAMIC `import()` inside the fork
-// (`loadProvisionModule`), so importing this file (which `cli.ts` does for every
-// deploy) never evaluates the provision lifecycle.
-import type { ProvisionDriftEntry } from './provision.ts';
+import { getErrorMessage } from './output.ts';
+import {
+  assertValidResourceName,
+  checkCloudflareProvisionDrift,
+  isQueueConfirmedAbsent,
+  provisionCloudflareResources,
+  type ProvisionDriftEntry,
+} from './provision.ts';
 import { writeProvisionedWranglerConfig } from './wrangler.ts';
 
 /** Validate source-level native deploy inputs before account operations or project code. */
@@ -83,13 +76,8 @@ export async function prepareCloudflareDeploySource(
 ): Promise<
   ({ configPath: string } & Awaited<ReturnType<typeof computeDesiredCloudflareResources>>) | null
 > {
-  // 0. Flag guard — `--skip-build` cannot be honored by this backend, so REJECT the
-  // combination rather than silently ignore it. Every gate on this path reads the artifact
-  // `vite build` emits as ground truth: the plaintext-var warnings, the required-secret gate
-  // and the invalid-value gate all read the REAL `dist/ssr/wrangler.json`, and the auth check
-  // reads the generated `.void/better-auth-schema.ts`. Skipping the build would leave them
-  // validating a stale or absent artifact — i.e. reporting a worker that is not the one being
-  // uploaded. Rejected here, before any account op, so the flag can never cost a build hook.
+  // Every gate on this path validates the artifact the build emits, so a skipped build would
+  // check a stale or missing one.
   if (options.skipBuild) {
     log.error(
       [
@@ -104,8 +92,7 @@ export async function prepareCloudflareDeploySource(
     return null;
   }
 
-  // 1. App-class narrowing — reject every artifact shape the current native
-  // verifier cannot prove safe before any account, provision, or build op.
+  // Reject app shapes the native verifier cannot prove safe before any account operation.
   let application: ApplicationAnalysis;
   try {
     application = analyzeApplicationSync(root, { config: voidConfig, environment: 'prod' });
@@ -119,20 +106,12 @@ export async function prepareCloudflareDeploySource(
     return null;
   }
 
-  // 2. Desired resource set — computed ONCE from SOURCE, pre-build (fail-fast),
-  // shared by the provision and drift paths. `authEnabled` / `migrationsDir` /
-  // `dialect` drive the auth + migration gates below. The checked-in migrations are
-  // deliberately NOT read here: the auth + migration gates re-collect them AFTER the
-  // build (see step 8), because `vite build` runs arbitrary project plugins that could
-  // add/rewrite migration SQL, and the remote apply reads the live post-build files.
+  // The migration gates re-collect migrations after the build, because build plugins can
+  // rewrite them; these pre-build ones only fail fast.
   const configPath = discoverRootWranglerConfig(root);
   const facts = await computeDesiredCloudflareResources(root, voidConfig, configPath, application);
   const { desired, dialect, migrations: preBuildMigrations, migrationsDir } = facts;
 
-  // 2a. External-database migrations are applied directly after every local gate
-  // passes and immediately before the Worker upload. A checked-in migration therefore requires
-  // the production DATABASE_URL in the deploy environment; the URL is also the source used when
-  // provisioning a missing Hyperdrive config and is never serialized into the Worker artifact.
   if (dialect !== 'sqlite' && preBuildMigrations.length > 0 && !process.env.DATABASE_URL) {
     log.error(
       [
@@ -145,10 +124,7 @@ export async function prepareCloudflareDeploySource(
     return null;
   }
 
-  // 2b. Validate Wrangler's migration glob before any account operation. Custom patterns are
-  // supported, but they must follow Wrangler's migrations_dir prefix rule; the post-build gate
-  // later enumerates the exact Minimatch result and requires byte-for-byte set and order parity
-  // with Void's validated migrations before any remote D1 mutation.
+  // Custom migration patterns must stay under migrations_dir.
   if (desired.d1) {
     const migrationsPattern = resolveWranglerMigrationPattern(
       parseRootWranglerConfig(configPath),
@@ -164,30 +140,26 @@ export async function prepareCloudflareDeploySource(
   return { configPath, ...facts };
 }
 
+export type CloudflareDeploySource = NonNullable<
+  Awaited<ReturnType<typeof prepareCloudflareDeploySource>>
+>;
+
+export type CloudflarePreflight = Awaited<ReturnType<typeof preflightCloudflareWorker>>;
+
+/** Pin the account and uploader, set up email, provision resources and snapshot the pins. */
 export async function preflightCloudflareWorker(input: {
-  readonly configPath: string;
-  readonly needsSandbox: boolean;
-  readonly voidConfig: VoidConfig;
   readonly root: string;
-  readonly exit: (code: number) => never;
-  readonly deps: CloudflareDeployDeps;
+  readonly voidConfig: VoidConfig;
   readonly options: RunDeployOptions;
-  readonly initialCloudflareLink: CloudflareLink | null;
-  readonly needsEmail: boolean;
-  readonly emailHandlers: EmailHandlersScan;
-  readonly authEnabled: boolean;
-  readonly needsAI: boolean;
-  readonly expectedCrons: Array<string>;
-  readonly desired: import('./provision.ts').DesiredResourceSet;
-  readonly preBuildMigrations: Array<{ name: string; sql: string }>;
-  readonly provisionModule: Awaited<ReturnType<typeof loadProvisionModule>>;
-  readonly reasons: Map<string, string>;
+  readonly deps: CloudflareDeployDeps;
+  readonly exit: (code: number) => never;
   readonly cliLog: CliLogger;
+  readonly initialCloudflareLink: CloudflareLink | null;
   readonly detectedFramework: ReturnType<typeof detectFramework>;
-  readonly source: NonNullable<Awaited<ReturnType<typeof prepareCloudflareDeploySource>>>;
-  readonly needsLive: boolean;
+  readonly source: CloudflareDeploySource;
 }): Promise<{
   apiBaseUrl: string;
+  usesCf: boolean;
   cfUploaderIsPinned: () => boolean;
   assertUploaderStillPinned: () => boolean;
   accountId: string;
@@ -206,28 +178,29 @@ export async function preflightCloudflareWorker(input: {
   expectedDurableObjectState: ReturnType<typeof reconstructExpectedDurableObjectState>;
 }> {
   const {
-    configPath,
-    needsSandbox,
-    voidConfig,
     root,
-    exit,
-    deps,
+    voidConfig,
     options,
+    deps,
+    exit,
+    cliLog,
     initialCloudflareLink,
+    detectedFramework,
+    source,
+  } = input;
+  const {
+    configPath,
+    needsSandbox,
     needsEmail,
     emailHandlers,
     authEnabled,
     needsAI,
     expectedCrons,
     desired,
-    preBuildMigrations,
-    provisionModule,
+    migrations: preBuildMigrations,
     reasons,
-    cliLog,
-    detectedFramework,
-    source,
     needsLive,
-  } = input;
+  } = source;
 
   let rootConfig = parseRootWranglerConfig(configPath);
   if (needsSandbox) {
@@ -239,72 +212,32 @@ export async function preflightCloudflareWorker(input: {
     }
   }
 
-  // 3a. Resolve + pin the ONE transport for the WHOLE deploy (build + whoami + migrate +
-  // deploy), reusing the provisioner's resolver + dotenv fence. Fail closed on any
-  // ambient/dotenv redirect (endpoint, named env, worker-name override, alternate
-  // build config) BEFORE any wrangler call — so every child shares one account + API base.
-  let apiBaseUrl: string;
-  try {
-    apiBaseUrl = resolveDeployTransport(root, rootConfig);
-  } catch (err) {
-    log.error(`deploy: ${getErrorMessage(err)}`);
-    return exit(1);
-  }
-
-  // Pin the bundled uploader before the first authenticated command, including
-  // first-run account discovery.
-  const { cfUploaderIsPinned, assertUploaderStillPinned } = createCloudflareUploaderPins(
+  // One transport, account and uploader for every credentialed command of this deploy.
+  const connection = await connectCloudflareDeployAccount({
     root,
+    configPath,
+    rootConfig,
     deps,
-  );
-
-  // 3b. Pin the account. On an interactive first deploy Void authenticates,
-  // selects the account, and persists it without exposing Wrangler as a user step.
-  let accountId =
-    readWranglerTopLevelString(rootConfig, 'account_id') ??
-    (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || undefined);
-  if (!accountId) {
-    const accountRunner =
-      deps.runWrangler ?? createDeployWranglerRunner(root, undefined, apiBaseUrl);
-    try {
-      accountId = await chooseCloudflareDeployAccount({
-        persist: !(options.reuseExistingWorker || initialCloudflareLink),
-        beforeWranglerRun: assertUploaderStillPinned,
-        configPath,
-        root,
-        runWrangler: accountRunner,
-      });
-      rootConfig = parseRootWranglerConfig(configPath);
-    } catch (error) {
-      logCloudflareAuthFailure(error);
-      return exit(1);
-    }
-  }
-  let workersDevSubdomain: string | undefined;
-  try {
-    workersDevSubdomain = resolveCloudflareWorkersDevSubdomain(root, accountId);
-  } catch (error) {
-    log.error(getErrorMessage(error));
+    persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+  });
+  if (!connection) {
     return exit(1);
   }
-
-  // The orchestrator's own wrangler runner — created here, after the account is pinned and before
-  // the FIRST credentialed run of the email step below; shared by whoami / provision probes / migrate / deploy.
-  const runWrangler = deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl);
-  // The worker name `wrangler deploy` uploads as: the root's `name`, else derived. Needed by the
-  // email step (routing rules are matched to it) and reconciled into the root config at step 5.
+  const {
+    apiBaseUrl,
+    usesCf,
+    cfUploaderIsPinned,
+    assertUploaderStillPinned,
+    accountId,
+    workersDevSubdomain,
+    runWrangler,
+  } = connection;
+  rootConfig = connection.rootConfig;
   const workerName = readWranglerTopLevelString(rootConfig, 'name') ?? deriveWorkerName(root);
   printDeployContext(workerName, 'Cloudflare');
 
-  // 3b-ii. Mode B email (design doc 0078) — detect, preflight, and with one Enter set up the
-  // developer's own mail domain. Slotted AFTER the uploader hash (3b-i) and the account pin (3b), so its credentialed
-  // wrangler runs execute the pinned bundle, and BEFORE the env-schema probe (3c), so no project
-  // code has run when a credentialed call is made — and so `rootConfig` can simply be RE-PARSED
-  // after the write: the post-probe laundering guard (the full-config `deepEqual` after 3c) then
-  // sees `send_email` / `addresses` / `vars` as the pre-probe baseline and needs no exception.
-  // Only `needsEmail` apps pay for it. The step stops every deploy for an ambiguous committed
-  // subdomain plan waiting on DNS; otherwise `--require-email` turns every "deploying without
-  // email" branch into an exit BEFORE anything is built or uploaded.
+  // Email setup makes credentialed calls, so it runs before the env-schema probe runs any
+  // project code. Its config writes become part of the baseline the probe check compares.
   let emailMap: EmailAddressMapInput | null = null;
   if (needsEmail) {
     if (!assertUploaderStillPinned()) {
@@ -347,12 +280,8 @@ export async function preflightCloudflareWorker(input: {
     }
     emailMap = email.map;
   } else {
-    // The app stopped using email, but the root still carries what a Mode B deploy wrote.
-    // wrangler keeps those rules pointed at a worker that no longer exports `email()`, so
-    // inbound mail there fails with nothing in this output — say so. Warn only: deleting the
-    // key would ORPHAN the live rules (wrangler skips the plan on `undefined`), and `[]` is
-    // a destructive plan (a y/n in a TTY, a UserError after the upload in CI) — whether Void
-    // should write it is a product call, not a deploy default (decision 11: never a failure).
+    // The app stopped using email, but its routing rules still point at this Worker. Warn only:
+    // removing the config would orphan the live rules, and `[]` would delete them.
     const staleAddresses = Array.isArray(rootConfig.addresses)
       ? (rootConfig.addresses as Array<unknown>).filter((a): a is string => typeof a === 'string')
       : [];
@@ -372,10 +301,8 @@ export async function preflightCloudflareWorker(input: {
     }
   }
 
-  // 3c. Derive the env-INSENSITIVE server and required key names in an ISOLATED
-  // SUBPROCESS under a scrubbed env. Importing the user's env.ts is arbitrary project
-  // code, so it must not run in this credential-bearing parent. Run before provisioning/building so a
-  // broken env.ts fails fast.
+  // env.ts is project code, so read its key names in an uncredentialed subprocess. Running it
+  // before provisioning makes a broken env.ts fail fast.
   const schemaProbeEnv = buildSchemaProbeEnv(accountId, apiBaseUrl);
   let schemaResult: EnvSchemaProbeResult;
   try {
@@ -393,13 +320,8 @@ export async function preflightCloudflareWorker(input: {
   }
   const schemaFacts: SelfHostSchemaFacts = schemaResult.facts;
 
-  // The schema probe above imports project code. Its child has no Cloudflare credentials, but it
-  // can still rewrite files — including the root Wrangler config that every authenticated command
-  // below consumes. Compare the full parsed config with the pre-probe value before `whoami` or the
-  // provisioner gets a chance to run. This placement cleanly distinguishes an illicit probe write
-  // from the provisioner's legitimate id/migrations_dir updates, so automatic provisioning does
-  // not create a laundering exception. Formatting-only JSONC rewrites remain harmless because the
-  // comparison is semantic and key-order-independent.
+  // The probe can still rewrite files. Check the root config before any credentialed command,
+  // and before the provisioner makes its own legitimate writes.
   if (!deepEqual(rootConfig, parseRootWranglerConfig(configPath))) {
     log.error(
       [
@@ -411,22 +333,8 @@ export async function preflightCloudflareWorker(input: {
     return exit(1);
   }
 
-  // 3e. Confirm wrangler auth. `whoami` gets the SAME `-c`/`--env=`/pinned-transport
-  // context as migrate/deploy, so it authenticates against the exact endpoint they use.
-  // Re-verify the uploader immediately before this credentialed run — the env-schema probe above
-  // ran project code (env.ts) that could have overwritten the hashed bundle `whoami` executes.
-  if (!assertUploaderStillPinned()) {
-    return exit(1);
-  }
-  try {
-    await ensureCloudflareAuthentication({
-      acceptApiToken: true,
-      beforeRun: assertUploaderStillPinned,
-      runWrangler: (operation, capture) => runWrangler(operation, { capture }),
-      configPath: existsSync(configPath) ? configPath : undefined,
-    });
-  } catch (error) {
-    logCloudflareAuthFailure(error);
+  // The probe ran project code, so the uploader is re-checked before this credentialed run.
+  if (!(await confirmCloudflareDeployAuthentication(connection, configPath))) {
     return exit(1);
   }
 
@@ -466,8 +374,7 @@ export async function preflightCloudflareWorker(input: {
     }
     rootConfig = parseRootWranglerConfig(configPath);
 
-    // Resolve the cache choice now. The saved source setting applies to retries and
-    // ordinary deploys, so completing the handoff never changes the app's cache policy.
+    // Resolve the cache choice now. The saved setting applies to retries and later deploys.
     const isrNamespace = desired.kvNamespaces.find(
       (namespace) => namespace.binding === 'ISR_CACHE',
     );
@@ -477,9 +384,9 @@ export async function preflightCloudflareWorker(input: {
       resolveBindingNames(voidConfig.inference?.bindings)?.kv !== 'ISR_CACHE' &&
       isrNamespace
     ) {
-      const missing = provisionModule
-        .checkCloudflareProvisionDrift(configPath, desired)
-        .missing.filter((entry) => entry.binding !== 'ISR_CACHE');
+      const missing = checkCloudflareProvisionDrift(configPath, desired).missing.filter(
+        (entry) => entry.binding !== 'ISR_CACHE',
+      );
       if (missing.length) {
         throw new Error(
           formatCloudflareDriftMessage(
@@ -503,7 +410,7 @@ export async function preflightCloudflareWorker(input: {
           if (!assertUploaderStillPinned()) {
             return exit(1);
           }
-          await (deps.provision ?? provisionModule.provisionCloudflareResources)(
+          await (deps.provision ?? provisionCloudflareResources)(
             root,
             configPath,
             {
@@ -529,14 +436,9 @@ export async function preflightCloudflareWorker(input: {
     }
   }
 
-  // 3f. Sandbox is the one public Void feature whose native Cloudflare runtime has a hard
-  // Workers Paid dependency: `void/sandbox` emits a Cloudflare Container application. Verify the
-  // account entitlement + the active credential BEFORE provisioning any inferred resources or
-  // running the project build. `containers list --json` is a read-only account probe and succeeds
-  // even when the account has no existing containers. Its failure surface deliberately conflates
-  // a missing Workers Paid entitlement with insufficient API-token permissions, so the diagnostic
-  // explains both remedies instead of guessing from a 403. Apps that do not use Sandbox never run
-  // this probe and retain a Workers Free-compatible deploy path.
+  // Sandbox needs Workers Paid. A read-only Containers probe checks the plan and token before
+  // provisioning; its failure cannot tell the two apart, so the message covers both. Apps
+  // without Sandbox never run it.
   if (needsSandbox) {
     if (!assertUploaderStillPinned()) {
       return exit(1);
@@ -550,7 +452,7 @@ export async function preflightCloudflareWorker(input: {
         { capture: true },
       ),
     );
-    if (!isCleanWranglerExit(containers)) {
+    if (!isCleanCloudflareExit(containers)) {
       log.error(formatCloudflareSandboxUnavailable({ preflight: true }));
       return exit(1);
     }
@@ -567,14 +469,11 @@ export async function preflightCloudflareWorker(input: {
       'migrations_dir',
     ) !== desired.d1.migrationsDir;
 
-  // 4. Ensure every inferred resource exists. Missing id-bearing bindings trigger this
-  // immediately; queues are probed below and trigger it when absent. `--provision` remains a
-  // backwards-compatible force switch, but normal local and CI deploys need no extra command.
-  // The provisioner is read-first and idempotent, and its local lock/config postconditions remain
-  // the single authority for resource creation.
+  // Create missing inferred resources. Missing ids trigger this directly, absent queues after
+  // the probe below; `--provision` forces it. The provisioner is read-first and idempotent.
   const provisionAndVerify = async (): Promise<void> => {
     if (existingWorker) {
-      const { missing } = provisionModule.checkCloudflareProvisionDrift(configPath, desired);
+      const { missing } = checkCloudflareProvisionDrift(configPath, desired);
       throw new Error(
         missing.length > 0
           ? formatCloudflareDriftMessage(
@@ -586,14 +485,10 @@ export async function preflightCloudflareWorker(input: {
           : 'Linking cannot provision resources. Remove --provision and rerun `void deploy` to reuse the existing Worker.',
       );
     }
-    // Re-verify the uploader immediately before the credentialed provisioner, which runs
-    // `wrangler <res> create` with the CF token. Nothing between `whoami` and here runs project
-    // code, so this is defense-in-depth against the same probe-swap vector — against the one
-    // pre-probe baseline, never re-baselined.
     if (!assertUploaderStillPinned()) {
       return exit(1);
     }
-    const provision = deps.provision ?? provisionModule.provisionCloudflareResources;
+    const provision = deps.provision ?? provisionCloudflareResources;
     let result;
     try {
       result = await provision(root, configPath, desired, {
@@ -607,10 +502,8 @@ export async function preflightCloudflareWorker(input: {
       log.error(`deploy: provisioning failed — ${getErrorMessage(err)}`);
       return exit(1);
     }
-    // A DESIRED resource the provisioner could not satisfy is FATAL, not success.
-    // Hyperdrive returns action "skipped" when there is no connection source and
-    // nothing adoptable — deploying past that would ship a worker with no HYPERDRIVE
-    // binding that fails on its first DB request. Fail closed with guidance.
+    // A skipped resource (e.g. Hyperdrive with no connection source) would ship a Worker that
+    // fails on first use.
     const skipped = result.resources.filter((r) => r.action === 'skipped');
     if (skipped.length > 0) {
       log.error(
@@ -629,10 +522,7 @@ export async function preflightCloudflareWorker(input: {
       );
       return exit(1);
     }
-    // Re-run the id-drift predicate AFTER provisioning: any desired id-bearing
-    // resource the provisioner did not write a real id for still drifts and must
-    // block the build/deploy (the desired set is the single source of truth).
-    const { missing } = provisionModule.checkCloudflareProvisionDrift(configPath, desired);
+    const { missing } = checkCloudflareProvisionDrift(configPath, desired);
     if (missing.length > 0) {
       log.error(
         formatCloudflareDriftMessage(
@@ -652,28 +542,17 @@ export async function preflightCloudflareWorker(input: {
     }
   };
 
-  const { missing: initiallyMissing } = provisionModule.checkCloudflareProvisionDrift(
-    configPath,
-    desired,
-  );
+  const { missing: initiallyMissing } = checkCloudflareProvisionDrift(configPath, desired);
   // A handoff applies no migrations, so preserve the existing local migration settings.
   // Reconciling migrations_dir must not send an already-bound database to the provisioner.
   const d1NeedsConfigReconciliation = !existingWorker && d1MigrationsDirDiffers();
   if (options.provision || initiallyMissing.length > 0 || d1NeedsConfigReconciliation) {
     await provisionAndVerify();
   } else {
-    // Queue names come from file paths (`queues/order/jobs.ts` → `order-jobs`, see
-    // `queues/scan.ts`), and the probe below passes each one to wrangler as an ARGV positional.
-    // Apart from joining path segments, names are not sanitized. Gate them on the SAME
-    // `assertValidResourceName('queue', …)` the provisioner applies, BEFORE the probe runs:
-    // a name beginning with `-` is
-    // parsed by wrangler as a FLAG (`queues info --help` exits 0 printing usage), which the
-    // probe would classify as inconclusive and wave through — silently forfeiting the
-    // early-ordering guarantee this whole step exists to provide. Collect EVERY offending name
-    // (as the drift/absent-queue errors do) so one rename pass clears them all.
+    // Queue names come from unsanitized file paths. Report every invalid one before probing.
     const invalidQueues = desired.queues.filter((name) => {
       try {
-        provisionModule.assertValidResourceName('queue', name);
+        assertValidResourceName('queue', name);
         return false;
       } catch {
         return true;
@@ -694,24 +573,14 @@ export async function preflightCloudflareWorker(input: {
       );
       return exit(1);
     }
-    // The drift check above is config-only, and queues carry NO id in the config — so a
-    // desired queue that was never created is invisible to it. `wrangler deploy` (step 11)
-    // does reject a missing queue before uploading, but only AFTER the build (step 7) and
-    // the remote D1 apply (step 9) have run. Probe each desired queue by name HERE so that
-    // an absent queue can trigger the provisioner before either.
-    //
-    // `queues list` is unusable (a human table with no `--json`, whose single un-looped
-    // page-1 request silently truncates on large accounts), so this is N `queues info`
-    // calls — one clean binary probe per desired queue. Only the provisioner's exact,
-    // name-aware not-found signal counts as absence: an inconclusive probe (auth or
-    // network error, signal-killed child, unexpected output) must NOT block, since
-    // `wrangler deploy`'s own pre-upload check still backstops it.
+    // Queues have no id in the config, so the drift check cannot see a missing one. Probe each
+    // by name; only a confirmed not-found triggers provisioning, never an inconclusive probe.
     const absentQueues: Array<string> = [];
     for (const name of desired.queues) {
       const info = await Promise.resolve(
         runWrangler({ type: 'queues.info', name, configPath }, { capture: true }),
       );
-      if (provisionModule.isQueueConfirmedAbsent(info, name)) {
+      if (isQueueConfirmedAbsent(info)) {
         absentQueues.push(name);
       }
     }
@@ -720,17 +589,9 @@ export async function preflightCloudflareWorker(input: {
     }
   }
 
-  // 5. Reconcile the worker `name` AND the pinned `account_id` into the root config
-  // BEFORE the build. `name` is only-when-absent (never clobber the user's); the build
-  // defaults a name into dist/ssr/wrangler.json, but `wrangler secret list -c <root>`
-  // (the secrets gate) resolves the worker from the ROOT config's `name`, so pinning it
-  // makes the gate and deploy agree. `account_id` is always overwritten with the
-  // reconciled account: the CF Vite plugin copies `account_id` ONLY from the root config
-  // file (never from CLOUDFLARE_ACCOUNT_ID) into dist/ssr/wrangler.json, so an env-only
-  // pin would otherwise emit an artifact with NO `account_id` and the identity check
-  // below could never confirm the pin. Persisting it makes the documented env-only pin
-  // deploy the verified account. (`workerName` was resolved from the same root `name` before the
-  // email step, which never touches it.)
+  // Persist the Worker name and account before the build. The CF Vite plugin copies
+  // `account_id` only from the config file, so an env-only account would otherwise leave the
+  // artifact without one, and the secret gate resolves the Worker from the root `name`.
   const frameworkQueues = detectedFramework ? source.analysis.queues : [];
   writeProvisionedWranglerConfig(
     root,
@@ -761,47 +622,14 @@ export async function preflightCloudflareWorker(input: {
     { configPath },
   );
 
-  // 6. Pin the id-bearing binding IDENTITIES across the build, mirroring the account_id pin.
-  // Provision (step 4) wrote each real id into the root config via `wrangler <res> create
-  // --update-config`, and the reconcile above only touches `name`/`account_id` — so RE-READING
-  // the config here captures exactly what every legitimate PRE-BUILD write persisted. The build
-  // (step 7) runs untrusted project code with its Cloudflare credentials scrubbed, so a
-  // compromised build dependency can only edit FILES: it could rewrite `wrangler.jsonc`'s
-  // `d1_databases[<binding>].database_id` (keeping the binding + database_name) to redirect the
-  // privileged remote D1 migrate (step 9) or the deploy (step 11) to a DIFFERENT same-account
-  // resource — OR ADD a brand-new id-bearing binding (`EXTRA_DB`/`EXTRA_KV`/…) the CF plugin then
-  // merges verbatim into the emitted artifact. So the snapshot captures EVERY id-bearing binding
-  // declared here, not only the desired ones: the emitted-config check (step 10) rejects any
-  // id-bearing binding in `dist/ssr/wrangler.json` absent from this pin, so a binding the build
-  // added is caught while a user's own extra binding (present here) passes. This snapshot is the
-  // ground truth the migrate assert (step 9) and the emitted-config check (step 10) compare
-  // against. No legitimate path rewrites a binding id in the ROOT config after this point — the
-  // CF plugin's only post-build id writes go to the emitted dist/ssr/wrangler.json, never back to
-  // the root — so equality here is safe to assert.
+  // Snapshot the config before the build runs project code. A build can only edit files, so
+  // the remote migration and the emitted-config check compare against these pins to catch a
+  // binding, container or migration it added, dropped or retargeted. Nothing legitimate
+  // rewrites a binding id in the root config after this point.
   const preBuildRootConfig = parseRootWranglerConfig(configPath);
   const bindingIdentitySnapshot = snapshotBindingIdentities(preBuildRootConfig);
-  // Companion pin taken from the SAME pre-build root config: the per-binding ENTRY per resource
-  // field Void's own build never emits (`DEPLOY_PASSTHROUGH_ASSERT_FIELDS`). The emitted-config
-  // check (step 10) rejects any such binding in `dist/ssr/wrangler.json` absent from this pin — or
-  // one whose target it rewrote — so a build that INJECTS or RETARGETS a `services` /
-  // `secrets_store_secrets` / `dispatch_namespaces` / `unsafe` / … binding is caught, while a
-  // user's own hand-declared pass-through binding (present here, unchanged) passes. Void never
-  // writes these fields, so no legitimate build adds one that was not already in the root.
   const passthroughIdentitySnapshot = snapshotPassthroughIdentities(preBuildRootConfig);
-  // Companion RAW-value pin from the SAME pre-build root config for the fields the ENTRY pin cannot
-  // cover: `unsafe` / `tail_consumers` / `streaming_tail_consumers` (whole-object-pinned — wrangler
-  // applies `unsafe.metadata` LAST at upload and the tail consumers forward logs/requests; the pin
-  // is symmetric, so removing a root-declared value is caught too), plus `durable_objects` (reject a
-  // build-injected EXTERNAL DO `script_name`) and `ai` (pin the binding to the root's, or to Void's
-  // own `{binding:'AI'}` only when `needsAI`). Void's build emits none of the first three.
   const passthroughRawFields = snapshotPassthroughRawFields(preBuildRootConfig);
-  // Companion pin: the exact `containers` set Void's build emits — the root-declared containers
-  // (spread verbatim) plus Void's own sandbox container when the source needs it (`needsSandbox`,
-  // the SAME `isSandboxEnabled(config) || import-walk` signal index.ts gates emission on). A bare
-  // `wrangler deploy` provisions a container application from this array, so the emitted-config
-  // check (step 10) rejects a container the build injected, dropped, or retargeted.
-  // `resolveSandboxConfig` is the SAME pure function the build uses, so the reconstructed sandbox
-  // container is byte-identical to the emitted one.
   const expectedContainers = reconstructExpectedContainers(
     voidConfig,
     root,
@@ -816,6 +644,7 @@ export async function preflightCloudflareWorker(input: {
   );
   return {
     apiBaseUrl,
+    usesCf,
     cfUploaderIsPinned,
     assertUploaderStillPinned,
     accountId,
diff --git a/packages/void/src/cli/deploy-cloudflare-publish.ts b/packages/void/src/cli/deploy-cloudflare-publish.ts
index 617c64e9c..65affb103 100644
--- a/packages/void/src/cli/deploy-cloudflare-publish.ts
+++ b/packages/void/src/cli/deploy-cloudflare-publish.ts
@@ -3,107 +3,67 @@ import {
   encodeCloudflareVersionMessage,
   parseRootWranglerConfig,
   readCloudflareTriggerConfig,
-  readExistingCloudflareWorker,
-  assertCloudflareBindingsPreserved,
-  type ExistingCloudflareWorker,
-  type ApprovedCloudflareKvBinding,
 } from '@void/deploy-cloudflare';
-import { collectMigrations } from '../migrations/collect.ts';
 import { detectFramework } from '../plugin-inference.ts';
 import { readVersionMetadataBinding } from '../shared/version-metadata.ts';
-import { prepareCfBuildOutput } from './cf-build-output.ts';
 import { createActiveSecretPinner } from './cf-version-runner.ts';
 import {
   clearCloudflareCandidate,
-  readCloudflareCandidate,
-  recordCloudflareCandidateUpload,
+  type CloudflareCandidateReceipt,
 } from './cloudflare-candidate.ts';
-import { recordCloudflareCandidate, type CloudflareLink } from './cloudflare-link.ts';
+import type { CloudflareBuild } from './deploy-cloudflare-build.ts';
 import {
   activateCloudflareVersionWithProgress,
   assertCloudflareDeployTargetUnchanged,
-  cloudflareWorkerReadinessHeaders,
+  cloudflareCandidateActivationOptions,
   createCfActivationRunner,
-  createCloudflareEmptyTriggerPublishers,
   recordCloudflareActivation,
   reportCloudflareActivationFailure,
   formatCloudflareActivationError,
 } from './deploy-cloudflare-helpers.ts';
-import { prepareCloudflareDeploySource } from './deploy-cloudflare-preflight.ts';
+import type { CloudflareMigration } from './deploy-cloudflare-migrate.ts';
+import type { CloudflareDeploySource, CloudflarePreflight } from './deploy-cloudflare-preflight.ts';
 import { log } from './deploy-helpers.ts';
 import { formatCloudflareSandboxUnavailable, BETTER_AUTH_SECRET_NAME } from './deploy-resources.ts';
 import { formatDeploySummary } from './deploy-summary.ts';
 import { type CloudflareDeployDeps } from './deploy-types.ts';
-import { type SelfHostSchemaFacts } from './env-validation.ts';
 import { type CliLogger } from './log-file.ts';
 import { note } from './output.ts';
-import {
-  readWranglerManagedQueueCleanupCandidates,
-  readWranglerPublishedTrafficSnapshot,
-} from './wrangler.ts';
+import { readWranglerManagedQueueCleanupCandidates } from './wrangler.ts';
 
+/** Upload the verified Worker as a candidate version, probe it, and activate it. */
 export async function publishCloudflareWorker(input: {
-  readonly configPath: string;
-  readonly existingWorker: ExistingCloudflareWorker | null;
   readonly root: string;
-  readonly pinnedHandoffLink: CloudflareLink | null;
-  readonly initialCloudflareCandidate: ReturnType<typeof readCloudflareCandidate>;
-  readonly accountId: string;
-  readonly workerName: string;
   readonly deps: CloudflareDeployDeps;
-  readonly cfUploaderIsPinned: () => boolean;
   readonly exit: (code: number) => never;
-  readonly prepareBuildOutput: () => ReturnType<typeof prepareCfBuildOutput>;
-  readonly apiBaseUrl: string;
-  readonly runWrangler: NonNullable<CloudflareDeployDeps['runWrangler']>;
-  readonly generatedConfigPath: string;
-  readonly assertUploaderStillPinned: () => boolean;
-  readonly schemaFacts: SelfHostSchemaFacts;
-  readonly initialAuthSecret: string | undefined;
-  readonly approvedHandoffKv: Array<ApprovedCloudflareKvBinding>;
-  readonly migrations: ReturnType<typeof collectMigrations>;
-  readonly workerWasMissingBeforeSecretProvisioning: boolean;
-  readonly workersDevSubdomain: string | undefined;
-  readonly atomic: boolean;
   readonly cliLog: CliLogger;
-  readonly needsSandbox: boolean;
-  readonly appliedMigrations: number;
-  readonly d1MigrateToken: string | undefined;
-  readonly source: NonNullable<Awaited<ReturnType<typeof prepareCloudflareDeploySource>>>;
-  readonly desired: import('./provision.ts').DesiredResourceSet;
+  readonly atomic: boolean;
   readonly detectedFramework: ReturnType<typeof detectFramework>;
+  readonly initialCloudflareCandidate: CloudflareCandidateReceipt | null;
+  readonly source: CloudflareDeploySource;
+  readonly preflight: CloudflarePreflight;
+  readonly build: CloudflareBuild;
+  readonly migration: CloudflareMigration;
 }): Promise<void> {
+  const { root, deps, exit, cliLog, atomic, detectedFramework, initialCloudflareCandidate } = input;
+  const { configPath, needsSandbox, desired, analysis } = input.source;
   const {
-    configPath,
+    usesCf,
     existingWorker,
-    root,
     pinnedHandoffLink,
-    initialCloudflareCandidate,
     accountId,
     workerName,
-    deps,
     cfUploaderIsPinned,
-    exit,
-    prepareBuildOutput,
     apiBaseUrl,
     runWrangler,
-    generatedConfigPath,
     assertUploaderStillPinned,
     schemaFacts,
-    initialAuthSecret,
     approvedHandoffKv,
-    migrations,
-    workerWasMissingBeforeSecretProvisioning,
     workersDevSubdomain,
-    atomic,
-    cliLog,
-    needsSandbox,
-    appliedMigrations,
-    d1MigrateToken,
-    source,
-    desired,
-    detectedFramework,
-  } = input;
+  } = input.preflight;
+  const { migrations, d1MigrateToken, generatedConfigPath, prepareBuildOutput } = input.build;
+  const { workerWasMissingBeforeSecretProvisioning, initialAuthSecret, appliedMigrations } =
+    input.migration;
 
   const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
   assertCloudflareDeployTargetUnchanged({
@@ -114,8 +74,6 @@ export async function publishCloudflareWorker(input: {
     accountId,
     workerName,
   });
-  const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
-  const usesCf = !deps.activateVersion && !deps.runWrangler;
   if (usesCf && !cfUploaderIsPinned()) {
     return exit(1);
   }
@@ -145,48 +103,27 @@ export async function publishCloudflareWorker(input: {
   const execution = await activateCloudflareVersionWithProgress(
     deps.activateVersion ?? activateCloudflareVersion,
     {
+      ...cloudflareCandidateActivationOptions({
+        root,
+        rootConfigPath: configPath,
+        uploadConfigPath: generatedConfigPath,
+        accountId,
+        apiBaseUrl,
+        workerName,
+        workersDevSubdomain,
+        runWrangler,
+        readExistingWorker: deps.readExistingWorker,
+        existingWorker,
+        pinnedHandoffLink,
+        initialCloudflareCandidate,
+        assertUploaderStillPinned,
+        approvedKv: approvedHandoffKv,
+        queueConsumerCleanup,
+      }),
       runWrangler: activationRunner,
       verifyUploader: cfOutput ? cfUploaderIsPinned : assertUploaderStillPinned,
-      workerName,
-      configPath: generatedConfigPath,
-      preserveTriggers: existingWorker !== null,
       requireVersionMetadata: existingWorker === null || hasVersionMetadata,
       requirePreviewForReadiness: existingWorker !== null && !hasVersionMetadata,
-      expectedPreviousVersionId: existingWorker?.versionId,
-      trustedInheritanceVersionIds: existingWorker
-        ? candidateReceipt?.parentVersionId === existingWorker.versionId
-          ? candidateReceipt.versionIds
-          : undefined
-        : initialCloudflareCandidate?.versionIds,
-      validateUploadedVersion: existingWorker
-        ? async (versionId) => {
-            if (!assertUploaderStillPinned()) {
-              throw new Error('The deployment uploader changed.');
-            }
-            const uploaded = await (deps.readExistingWorker ?? readExistingCloudflareWorker)({
-              runWrangler,
-              configPath: generatedConfigPath,
-              workerName,
-              versionId,
-            });
-            assertCloudflareBindingsPreserved(existingWorker, uploaded, approvedHandoffKv);
-          }
-        : undefined,
-      recordVerifiedCandidate: existingWorker
-        ? (versionId) =>
-            recordCloudflareCandidate(root, pinnedHandoffLink!, existingWorker.versionId, versionId)
-        : (versionId, parentVersionId) => {
-            if (parentVersionId) {
-              recordCloudflareCandidateUpload(
-                root,
-                initialCloudflareCandidate,
-                accountId,
-                workerName,
-                parentVersionId,
-                versionId,
-              );
-            }
-          },
       message: encodeCloudflareVersionMessage(
         migrations.map((migration) => migration.name),
         {
@@ -195,21 +132,6 @@ export async function publishCloudflareWorker(input: {
         },
       ),
       allowFirstDeploymentBootstrap: workerWasMissingBeforeSecretProvisioning,
-      readinessHeaders: cloudflareWorkerReadinessHeaders(),
-      workersDevSubdomain,
-      readinessHeadersWorkersDevSubdomain: process.env.CLOUDFLARE_WORKERS_SUBDOMAIN?.trim()
-        ? workersDevSubdomain
-        : undefined,
-      ...createCloudflareEmptyTriggerPublishers({
-        accountId,
-        apiBaseUrl,
-        configPath: generatedConfigPath,
-        workerName,
-        runWrangler,
-      }),
-      previousTrafficConfig: readWranglerPublishedTrafficSnapshot(configPath),
-      queueConsumerCleanup,
-      verifyInheritedSecrets: true,
       ...(pinActiveSecrets ? { pinActiveSecrets } : {}),
       atomic,
       ...(initialAuthSecret
@@ -222,8 +144,7 @@ export async function publishCloudflareWorker(input: {
       execution.reason === 'atomic-readiness-failed' ||
       execution.reason === 'atomic-readiness-access-denied'
     ) {
-      // The atomic command published successfully; the old inactive-candidate chain
-      // no longer describes the live parent for the next deploy.
+      // The atomic publish went live, so the saved candidate chain is stale.
       clearCloudflareCandidate(root);
     }
     await reportCloudflareActivationFailure(
@@ -250,7 +171,7 @@ export async function publishCloudflareWorker(input: {
       migrations: appliedMigrations,
       d1MigrationsCurrent: d1MigrateToken !== undefined,
       // Existing Worker handoffs preserve remote triggers rather than publishing source jobs.
-      cronJobs: existingWorker ? undefined : source.analysis.jobs.length,
+      cronJobs: existingWorker ? undefined : analysis.jobs.length,
       queues: existingWorker ? undefined : desired.queues.length,
       framework: detectedFramework?.name,
     }),
diff --git a/packages/void/src/cli/deploy-cloudflare-static.ts b/packages/void/src/cli/deploy-cloudflare-static.ts
index e12a75699..0ebcf10ac 100644
--- a/packages/void/src/cli/deploy-cloudflare-static.ts
+++ b/packages/void/src/cli/deploy-cloudflare-static.ts
@@ -10,9 +10,7 @@ import {
   stageCloudflareStaticAssets,
   writeCloudflareFrameworkDeployConfig,
   writeCloudflareStaticDeployConfig,
-  readExistingCloudflareWorker,
   assertExistingCloudflareConfig,
-  assertCloudflareBindingsPreserved,
 } from '@void/deploy-cloudflare';
 import { dirname, join, relative } from 'pathslash';
 import { analyzeApplicationSync } from '../application-analysis.ts';
@@ -24,33 +22,19 @@ import { hasEmailHandlers } from '../router/email.ts';
 import { selectNativeVersionMetadataBinding } from '../shared/version-metadata.ts';
 import { validateSsrEntry } from '../ssr/entry.ts';
 import { prepareCfStaticBuildOutput } from './cf-build-output.ts';
-import { ensureCloudflareAuthentication } from './cloudflare-auth.ts';
-import {
-  recordCloudflareCandidateUpload,
-  type CloudflareCandidateReceipt,
-} from './cloudflare-candidate.ts';
-import {
-  readCloudflareLink,
-  recordCloudflareCandidate,
-  type CloudflareLink,
-} from './cloudflare-link.ts';
-import { resolveCloudflareWorkersDevSubdomain } from './cloudflare-readiness.ts';
+import { type CloudflareCandidateReceipt } from './cloudflare-candidate.ts';
+import { readCloudflareLink, type CloudflareLink } from './cloudflare-link.ts';
 import { deduplicateGeneratedCompatibilityFlags } from './deploy-artifact-validation.ts';
 import { deployPointerPath } from './deploy-binding-snapshot.ts';
-import {
-  createDeployWranglerRunner,
-  chooseCloudflareDeployAccount,
-  prepareExistingCloudflareDeployWithAuth,
-} from './deploy-cloudflare-auth.ts';
+import { prepareExistingCloudflareDeployWithAuth } from './deploy-cloudflare-auth.ts';
 import {
   discoverRootWranglerConfig,
   activateCloudflareVersionWithProgress,
   assertCloudflareDeployTargetUnchanged,
-  cloudflareWorkerReadinessHeaders,
+  cloudflareCandidateActivationOptions,
+  confirmCloudflareDeployAuthentication,
+  connectCloudflareDeployAccount,
   createCfActivationRunner,
-  createCloudflareEmptyTriggerPublishers,
-  createCloudflareUploaderPins,
-  logCloudflareAuthFailure,
   recordCloudflareActivation,
   reportCloudflareActivationFailure,
   formatCloudflareActivationError,
@@ -62,43 +46,42 @@ import {
   hasNonPageBackend,
   resolveFullDeployBuildCommand,
   log,
-  getErrorMessage,
   getExitCode,
 } from './deploy-helpers.ts';
-import { warnRedundantForceOn3xx } from './deploy-managed-events.ts';
-import { requireProvisionModule } from './deploy-provision.ts';
+import { mergeAndLintRoutingRules } from './deploy-managed-events.ts';
 import { deriveWorkerName } from './deploy-resources.ts';
 import { formatDeploySummary, printDeployContext, printDeploySuccess } from './deploy-summary.ts';
 import {
-  resolveDeployTransport,
   scrubManagedDeployBuildMarkers,
   scrubWranglerAuthCredentials,
   deployChildEnv,
 } from './deploy-transport.ts';
 import { type RunDeployOptions, type CloudflareDeployDeps } from './deploy-types.ts';
-import { lintDestinationSplats, lintDuplicateSources, mergeRoutingRules } from './headers.ts';
 import { type CliLogger } from './log-file.ts';
-import { note } from './output.ts';
+import { getErrorMessage, note } from './output.ts';
 import { buildStaticManifest } from './package.ts';
 import { detectPreset, type StaticPreset, type FrameworkPreset } from './preset.ts';
-import {
-  readWranglerManagedQueueCleanupCandidates,
-  readWranglerPublishedTrafficSnapshot,
-} from './wrangler.ts';
+import { deleteEnvVarCaseAware } from './provision.ts';
+import { readWranglerManagedQueueCleanupCandidates } from './wrangler.ts';
+
+/** Default runtime date for static and framework Workers that set none. */
+const DEFAULT_COMPATIBILITY_DATE = '2026-09-11';
 
 /** Build the trusted Wrangler pointer for a framework that emits Worker files directly. */
-export async function prepareCloudflareFrameworkArtifact(
-  root: string,
-  configPath: string,
-  accountId: string,
-  workerName: string,
-  voidConfig: VoidConfig,
-  framework: DetectedFramework,
-  preset: FrameworkPreset,
-  requiredSecretNames: ReadonlyArray<string> = [],
-  ai?: { binding: string },
-  preserveBindings = false,
-): Promise<void> {
+export async function prepareCloudflareFrameworkArtifact(options: {
+  root: string;
+  configPath: string;
+  accountId: string;
+  workerName: string;
+  voidConfig: VoidConfig;
+  framework: DetectedFramework;
+  preset: FrameworkPreset;
+  requiredSecretNames?: ReadonlyArray<string>;
+  ai?: { binding: string };
+  preserveBindings?: boolean;
+}): Promise<void> {
+  const { root, configPath, accountId, workerName, voidConfig, framework, preset, ai } = options;
+  const { requiredSecretNames = [], preserveBindings = false } = options;
   const workerMain = join(root, preset.workerDir, preset.workerMain);
   const assetsDirectory = join(root, preset.assetsDir);
   if (!existsSync(workerMain)) {
@@ -149,7 +132,7 @@ export async function prepareCloudflareFrameworkArtifact(
     compatibilityDate:
       voidConfig.worker?.compatibility_date ??
       readWranglerTopLevelString(rootConfig, 'compatibility_date') ??
-      '2026-09-11',
+      DEFAULT_COMPATIBILITY_DATE,
     compatibilityFlags: preset.cloudflareCompatibilityFlags,
     crons: [...new Set(crons.flatMap((job) => job.crons))],
     requiredSecrets: requiredSecretNames,
@@ -269,61 +252,25 @@ export async function runCloudflareStaticDeploy(
 ): Promise<void> {
   const exit = deps.exit ?? ((code: number): never => process.exit(code));
   const configPath = discoverRootWranglerConfig(root);
-  let rootConfig = parseRootWranglerConfig(configPath);
-  let apiBaseUrl: string;
-  try {
-    apiBaseUrl = resolveDeployTransport(root, rootConfig);
-  } catch (error) {
-    log.error(`deploy: ${getErrorMessage(error)}`);
+  const connection = await connectCloudflareDeployAccount({
+    root,
+    configPath,
+    rootConfig: parseRootWranglerConfig(configPath),
+    deps,
+    persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+  });
+  if (!connection || !(await confirmCloudflareDeployAuthentication(connection, configPath))) {
     return exit(1);
   }
   const {
+    apiBaseUrl,
     usesCf,
     cfUploaderIsPinned,
-    assertUploaderStillPinned: uploaderIsPinned,
-  } = createCloudflareUploaderPins(root, deps);
-  let accountId =
-    readWranglerTopLevelString(rootConfig, 'account_id') ??
-    (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || undefined);
-  if (!accountId) {
-    const accountRunner =
-      deps.runWrangler ?? createDeployWranglerRunner(root, undefined, apiBaseUrl);
-    try {
-      accountId = await chooseCloudflareDeployAccount({
-        persist: !(options.reuseExistingWorker || initialCloudflareLink),
-        beforeWranglerRun: uploaderIsPinned,
-        configPath,
-        root,
-        runWrangler: accountRunner,
-      });
-    } catch (error) {
-      logCloudflareAuthFailure(error);
-      return exit(1);
-    }
-  }
-  let workersDevSubdomain: string | undefined;
-  try {
-    workersDevSubdomain = resolveCloudflareWorkersDevSubdomain(root, accountId);
-  } catch (error) {
-    log.error(getErrorMessage(error));
-    return exit(1);
-  }
-
-  const runWrangler = deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl);
-  if (!uploaderIsPinned()) {
-    return exit(1);
-  }
-  try {
-    await ensureCloudflareAuthentication({
-      acceptApiToken: true,
-      beforeRun: uploaderIsPinned,
-      runWrangler: (operation, capture) => runWrangler(operation, { capture }),
-      configPath: existsSync(configPath) ? configPath : undefined,
-    });
-  } catch (error) {
-    logCloudflareAuthFailure(error);
-    return exit(1);
-  }
+    assertUploaderStillPinned,
+    accountId,
+    workersDevSubdomain,
+    runWrangler,
+  } = connection;
 
   const existingWorker = await prepareExistingCloudflareDeployWithAuth(
     {
@@ -335,13 +282,13 @@ export async function runCloudflareStaticDeploy(
       runWrangler,
       readExistingWorker: deps.readExistingWorker,
     },
-    uploaderIsPinned,
+    assertUploaderStillPinned,
   );
   const pinnedHandoffLink = existingWorker ? readCloudflareLink(root) : null;
   if (existingWorker && !pinnedHandoffLink) {
     throw new Error('The pending Cloudflare handoff was not saved before deployment.');
   }
-  rootConfig = parseRootWranglerConfig(configPath);
+  const rootConfig = parseRootWranglerConfig(configPath);
   const workerName = readWranglerTopLevelString(rootConfig, 'name') ?? deriveWorkerName(root);
   printDeployContext(workerName, 'Cloudflare');
   const rootConfigBeforeBuild = existsSync(configPath) ? readFileSync(configPath, 'utf-8') : null;
@@ -350,7 +297,7 @@ export async function runCloudflareStaticDeploy(
     const buildChildEnv = scrubManagedDeployBuildMarkers(
       scrubWranglerAuthCredentials(deployChildEnv(accountId, apiBaseUrl)),
     );
-    requireProvisionModule().deleteEnvVarCaseAware(buildChildEnv, 'NODE_ENV');
+    deleteEnvVarCaseAware(buildChildEnv, 'NODE_ENV');
     buildChildEnv.NODE_ENV = 'production';
     const runStaticBuild =
       deps.runStaticBuild ??
@@ -369,7 +316,7 @@ export async function runCloudflareStaticDeploy(
     log.error(`deploy: Output directory '${preset.outputDir}' not found. Run the build first.`);
     return exit(1);
   }
-  if (!uploaderIsPinned()) {
+  if (!assertUploaderStillPinned()) {
     return exit(1);
   }
   const rootConfigAfterBuild = existsSync(configPath) ? readFileSync(configPath, 'utf-8') : null;
@@ -383,12 +330,7 @@ export async function runCloudflareStaticDeploy(
     return exit(1);
   }
 
-  const merged = mergeRoutingRules({ dir: preset.outputDir, routing: voidConfig.routing });
-  warnRedundantForceOn3xx(merged.redundantForceOn3xx);
-  lintDuplicateSources(merged.redirectRules, 'redirects/rewrites (pre-asset)');
-  lintDuplicateSources(merged.fallbackRules, 'fallbacks (post-asset)');
-  lintDestinationSplats(merged.redirectRules, 'redirects/rewrites (pre-asset)');
-  lintDestinationSplats(merged.fallbackRules, 'fallbacks (post-asset)');
+  const merged = mergeAndLintRoutingRules(preset.outputDir, voidConfig.routing);
   const manifest = buildStaticManifest({
     appType: preset.appType,
     hashedAssetsPrefix: 'assets',
@@ -400,11 +342,8 @@ export async function runCloudflareStaticDeploy(
   const entryPath = join(root, '.void', 'deploy', 'cloudflare', 'static-edge.mjs');
   mkdirSync(dirname(entryPath), { recursive: true });
 
-  // Static deployment needs a fetch-only entry and must detach Worker-only
-  // bindings/triggers, but those are deployment-artifact concerns. Preserve the
-  // user's canonical Wrangler source byte-for-byte so switching back to the
-  // Worker app does not lose hand-authored DOs, workflows, containers, queues,
-  // or comments.
+  // Write the static config separately so the root config, with its Worker-only bindings and
+  // comments, stays untouched for a later switch back to a Worker app.
   const staticConfigPath = join(dirname(entryPath), 'wrangler-static.json');
   writeFileSync(staticConfigPath, `${JSON.stringify(rootConfig, null, 2)}\n`, { mode: 0o600 });
   writeCloudflareStaticDeployConfig({
@@ -416,7 +355,7 @@ export async function runCloudflareStaticDeploy(
     compatibilityDate:
       voidConfig.worker?.compatibility_date ??
       readWranglerTopLevelString(rootConfig, 'compatibility_date') ??
-      '2026-09-11',
+      DEFAULT_COMPATIBILITY_DATE,
     assetConfig: manifest.assetConfig ?? { not_found_handling: 'none' },
   });
   deduplicateGeneratedCompatibilityFlags(staticConfigPath, configPath);
@@ -462,7 +401,6 @@ export async function runCloudflareStaticDeploy(
     accountId,
     workerName,
   });
-  const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
   if (usesCf && !cfUploaderIsPinned()) {
     return exit(1);
   }
@@ -486,75 +424,38 @@ export async function runCloudflareStaticDeploy(
     configPath: staticConfigPath,
     runWrangler,
     cfUploaderIsPinned,
-    verifyCompatibilityRunner: uploaderIsPinned,
+    verifyCompatibilityRunner: assertUploaderStillPinned,
   });
   const execution = await activateCloudflareVersionWithProgress(
     deps.activateVersion ?? activateCloudflareVersion,
     {
+      ...cloudflareCandidateActivationOptions({
+        root,
+        rootConfigPath: configPath,
+        uploadConfigPath: staticConfigPath,
+        accountId,
+        apiBaseUrl,
+        workerName,
+        workersDevSubdomain,
+        runWrangler,
+        readExistingWorker: deps.readExistingWorker,
+        existingWorker,
+        pinnedHandoffLink,
+        initialCloudflareCandidate,
+        assertUploaderStillPinned,
+        approvedKv: [],
+        staticAssetsBinding: 'ASSETS',
+        queueConsumerCleanup,
+      }),
       runWrangler: activationRunner,
-      verifyUploader: cfOutput ? cfUploaderIsPinned : uploaderIsPinned,
-      configPath: staticConfigPath,
-      preserveTriggers: existingWorker !== null,
+      verifyUploader: cfOutput ? cfUploaderIsPinned : assertUploaderStillPinned,
       requireVersionMetadata: existingWorker === null || versionMetadataBinding !== undefined,
       requirePreviewForReadiness: existingWorker !== null && versionMetadataBinding === undefined,
-      expectedPreviousVersionId: existingWorker?.versionId,
-      trustedInheritanceVersionIds: existingWorker
-        ? candidateReceipt?.parentVersionId === existingWorker.versionId
-          ? candidateReceipt.versionIds
-          : undefined
-        : initialCloudflareCandidate?.versionIds,
-      validateUploadedVersion: existingWorker
-        ? async (versionId) => {
-            if (!uploaderIsPinned()) {
-              throw new Error('The deployment uploader changed.');
-            }
-            const uploaded = await (deps.readExistingWorker ?? readExistingCloudflareWorker)({
-              runWrangler,
-              configPath: staticConfigPath,
-              workerName,
-              versionId,
-            });
-            assertCloudflareBindingsPreserved(existingWorker, uploaded, [], {
-              staticAssetsBinding: 'ASSETS',
-            });
-          }
-        : undefined,
-      recordVerifiedCandidate: existingWorker
-        ? (versionId) =>
-            recordCloudflareCandidate(root, pinnedHandoffLink!, existingWorker.versionId, versionId)
-        : (versionId, parentVersionId) => {
-            if (parentVersionId) {
-              recordCloudflareCandidateUpload(
-                root,
-                initialCloudflareCandidate,
-                accountId,
-                workerName,
-                parentVersionId,
-                versionId,
-              );
-            }
-          },
-      workerName,
       message: encodeCloudflareVersionMessage([], {
         ...readCloudflareTriggerConfig(staticConfigPath, configPath),
         ...(existingWorker ? { preserve: true } : {}),
       }),
       assetsDirectoryOverride: stagedAssetsDirectory,
-      verifyInheritedSecrets: true,
-      readinessHeaders: cloudflareWorkerReadinessHeaders(),
-      workersDevSubdomain,
-      readinessHeadersWorkersDevSubdomain: process.env.CLOUDFLARE_WORKERS_SUBDOMAIN?.trim()
-        ? workersDevSubdomain
-        : undefined,
-      ...createCloudflareEmptyTriggerPublishers({
-        accountId,
-        apiBaseUrl,
-        configPath: staticConfigPath,
-        workerName,
-        runWrangler,
-      }),
-      previousTrafficConfig: readWranglerPublishedTrafficSnapshot(configPath),
-      queueConsumerCleanup,
     },
   ).finally(() => cfOutput?.dispose());
   if (!execution.ok) {
diff --git a/packages/void/src/cli/deploy-cloudflare.ts b/packages/void/src/cli/deploy-cloudflare.ts
index f063bcbfc..fcd7b7de1 100644
--- a/packages/void/src/cli/deploy-cloudflare.ts
+++ b/packages/void/src/cli/deploy-cloudflare.ts
@@ -19,7 +19,6 @@ import {
   runCloudflareStaticDeploy,
 } from './deploy-cloudflare-static.ts';
 import { log } from './deploy-helpers.ts';
-import { loadProvisionModule } from './deploy-provision.ts';
 import { printDeploySuccess } from './deploy-summary.ts';
 import { type RunDeployOptions, type CloudflareDeployDeps } from './deploy-types.ts';
 import { renderAddressMap } from './email-cloudflare.ts';
@@ -50,9 +49,8 @@ export async function runCloudflareDeploy(
     provision: options.provision === true ? true : undefined,
   });
 
-  // Static deploys branch before the full Worker classifier, so keep the
-  // runtime-target guard ahead of both paths. An explicit Cloudflare deploy
-  // must never reinterpret a node/bun/deno project as a Workers Assets app.
+  // Keep this guard ahead of the static branch, so a node/bun/deno project is never
+  // deployed as a Workers Assets app.
   if (isNodeTarget(voidConfig.target)) {
     log.error(
       [
@@ -75,7 +73,6 @@ export async function runCloudflareDeploy(
     return exit(1);
   }
 
-  const provisionModule = await loadProvisionModule();
   const staticPreset =
     resolveCloudflareStaticPreset(root, voidConfig, options) ??
     (await resolveCloudflareVoidStaticPreset(root, voidConfig));
@@ -100,206 +97,56 @@ export async function runCloudflareDeploy(
   if (!source) {
     return exit(1);
   }
-  const {
-    configPath,
-    desired,
-    reasons,
-    authEnabled,
-    dialect,
-    migrationsDir,
-    migrations: preBuildMigrations,
-    needsAI,
-    aiBindingName,
-    needsSandbox,
-    needsLive,
-    expectedCrons,
-    needsEmail,
-    emailHandlers,
-  } = source;
-
-  // 3. Preflight — pin ONE transport, pin the account, confirm wrangler auth. `rootConfig` is the
-  // pre-probe ground truth the post-probe laundering guard (after 3c) compares against; the ONLY
-  // re-parses are the account discovery's (3b) and the email step's (3b-ii), both of which write
-  // BEFORE any project code runs.
-  const {
-    apiBaseUrl,
-    cfUploaderIsPinned,
-    assertUploaderStillPinned,
-    accountId,
-    workersDevSubdomain,
-    runWrangler,
-    workerName,
-    emailMap,
-    schemaFacts,
-    existingWorker,
-    pinnedHandoffLink,
-    approvedHandoffKv,
-    bindingIdentitySnapshot,
-    passthroughIdentitySnapshot,
-    passthroughRawFields,
-    expectedContainers,
-    expectedDurableObjectState,
-  } = await preflightCloudflareWorker({
-    configPath,
-    needsSandbox,
-    voidConfig,
+  const preflight = await preflightCloudflareWorker({
     root,
-    exit,
-    deps,
+    voidConfig,
     options,
-    initialCloudflareLink,
-    needsEmail,
-    emailHandlers,
-    authEnabled,
-    needsAI,
-    expectedCrons,
-    desired,
-    preBuildMigrations,
-    provisionModule,
-    reasons,
+    deps,
+    exit,
     cliLog,
+    initialCloudflareLink,
     detectedFramework,
     source,
-    needsLive,
   });
 
-  // (The LOCAL migration gates run POST-build at step 8d, immediately before the remote
-  // apply — not here — so they validate the exact files on disk AFTER the build. See step 8d.)
-
-  // 7. Build with the pinned deploy transport — WITHOUT VOID_DEPLOY_PROJECT_ID — so
-  // self-host ISR emits and the CF plugin merges the wrangler.jsonc real ids into
-  // dist/ssr/wrangler.json. `deployChildEnv` scrubs CLOUDFLARE_ENV +
-  // CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH (and pins one account + API base), so the CF
-  // plugin generates the pinned TOP-LEVEL config from the CANONICAL root wrangler config,
-  // not a named-env / alternate-config one whose account/name/bindings could differ.
-  //
-  // The build runs BEFORE the secret / auth gates: the redesign validates the REAL artifact
-  // the build emits (`dist/ssr/wrangler.json` `vars` + the generated auth schema) rather than
-  // predicting it, so a missing secret / bad auth schema is caught AFTER the build — the
-  // accepted trade-off for reading ground truth. No REMOTE mutation has happened yet (provision
-  // ran earlier, but the remote D1 apply + deploy are still ahead), so a failed gate below
-  // never leaves a half-migrated / half-deployed account.
-  //
-  // DELETE the CF plugin's deploy pointer (`.wrangler/deploy/config.json`) FIRST. The
-  // plugin OVERWRITES it (never deletes) on each build, but ONLY when the CF Vite plugin
-  // participates — a build that emits no worker artifact leaves a STALE pointer from a
-  // previous run in place, and a bare `wrangler deploy` would follow it to an old
-  // `dist/ssr/wrangler.json`. Removing it now means the reads below (which require the
-  // pointer to exist) can only pass on a pointer THIS build re-created.
+  // Only a deploy pointer this build writes may pass the post-build checks.
   removeDeployPointer(root);
-  // `vite build` runs arbitrary project code — the user's config, every plugin, and env.ts
-  // — and needs NO Cloudflare credential of its own (the CF plugin makes no authenticated
-  // call from a build hook; Void's `remote: true` is a serve-only proxy to Void's own
-  // platform, and build-time prerender/ISR runs on local Miniflare). So the build child gets
-  // the same credential scrub as the probes, on the same rationale.
-  //
-  // Not a leak this can close: the CF plugin's `config` hook `loadEnv`s the project's own
-  // `CLOUDFLARE_*` dotenv keys back into the child's `process.env`. Those values are already
-  // on disk and readable by the build code either way — the scrub is about the credentials
-  // the PARENT holds, which the project never had.
-  const { migrations, d1MigrateToken, generatedConfigPath, prepareBuildOutput } =
-    await buildCloudflareWorker({
-      accountId,
-      apiBaseUrl,
-      existingWorker,
-      deps,
-      frameworkPreset,
-      voidConfig,
-      root,
-      exit,
-      detectedFramework,
-      configPath,
-      workerName,
-      schemaFacts,
-      needsAI,
-      aiBindingName,
-      assertUploaderStillPinned,
-      migrationsDir,
-      dialect,
-      atomic,
-      runWrangler,
-      authEnabled,
-      approvedHandoffKv,
-      desired,
-      bindingIdentitySnapshot,
-    });
-
-  // Remember whether a secret operation proved the Worker was absent before it wrote anything.
-  // Wrangler creates an active placeholder version while attaching the first secret. The version
-  // activator needs this proof to distinguish that placeholder from an existing application when
-  // Cloudflare requires a one-time ordinary deploy for initial Durable Object migrations.
-  const { workerWasMissingBeforeSecretProvisioning, initialAuthSecret, appliedMigrations } =
-    await migrateCloudflareWorker({
-      authEnabled,
-      deps,
-      root,
-      accountId,
-      workerName,
-      desired,
-      bindingIdentitySnapshot,
-      passthroughIdentitySnapshot,
-      passthroughRawFields,
-      needsAI,
-      aiBindingName,
-      expectedContainers,
-      expectedDurableObjectState,
-      expectedCrons,
-      exit,
-      configPath,
-      runWrangler,
-      assertUploaderStillPinned,
-      cliLog,
-      dialect,
-      migrations,
-      migrationsDir,
-      d1MigrateToken,
-      schemaFacts,
-    });
-
-  // 11. Deploy the exact generated config verified above. Passing its absolute path
-  // explicitly keeps the version upload AND the later trigger synchronization on the
-  // same artifact. `versions upload` follows the deploy pointer on its own, but
-  // `triggers deploy` does not; omitting `configPath` here would therefore upload the
-  // generated cron/queue configuration and then synchronize triggers from the root
-  // config, silently dropping generated Cron Triggers and queue consumers.
-  //
-  // Final uploader re-verification immediately before the deploy — the last and most privileged
-  // credentialed run of the hashed bundle. Against the same pre-build baseline; fail closed.
-  await publishCloudflareWorker({
-    configPath,
-    existingWorker,
+  const build = await buildCloudflareWorker({
     root,
-    pinnedHandoffLink,
-    initialCloudflareCandidate,
-    accountId,
-    workerName,
+    voidConfig,
     deps,
-    cfUploaderIsPinned,
     exit,
-    prepareBuildOutput,
-    apiBaseUrl,
-    runWrangler,
-    generatedConfigPath,
-    assertUploaderStillPinned,
-    schemaFacts,
-    initialAuthSecret,
-    approvedHandoffKv,
-    migrations,
-    workerWasMissingBeforeSecretProvisioning,
-    workersDevSubdomain,
     atomic,
+    frameworkPreset,
+    detectedFramework,
+    source,
+    preflight,
+  });
+  const migration = await migrateCloudflareWorker({
+    root,
+    deps,
+    exit,
     cliLog,
-    needsSandbox,
-    appliedMigrations,
-    d1MigrateToken,
     source,
-    desired,
+    preflight,
+    build,
+  });
+  await publishCloudflareWorker({
+    root,
+    deps,
+    exit,
+    cliLog,
+    atomic,
     detectedFramework,
+    initialCloudflareCandidate,
+    source,
+    preflight,
+    build,
+    migration,
   });
-  // The address map — the one thing nobody can find today (0078). Printed whenever the worker
-  // shipped with email set up; a run that went without email already said so at 3b-ii.
-  if (emailMap) {
-    log.message(renderAddressMap(emailMap));
+  // A deploy without email setup already said so during preflight.
+  if (preflight.emailMap) {
+    log.message(renderAddressMap(preflight.emailMap));
   }
   printDeploySuccess();
 }
diff --git a/packages/void/src/cli/deploy-drift.ts b/packages/void/src/cli/deploy-drift.ts
index 4767494aa..ccaaf4188 100644
--- a/packages/void/src/cli/deploy-drift.ts
+++ b/packages/void/src/cli/deploy-drift.ts
@@ -8,20 +8,17 @@ import {
   readdirSync,
   rmSync,
 } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 import { dirname, join, relative } from 'pathslash';
 import { type DatabaseDialect } from '../config.ts';
-import { writeDrizzleConfig } from '../drizzle/config.ts';
+import { PLACEHOLDER_DB_URL, writeDrizzleConfig } from '../drizzle/config.ts';
 import { discoverSchema } from '../drizzle/discover.ts';
 import { collectMigrations } from '../migrations/collect.ts';
 import { listDrizzleArtifacts } from '../migrations/validate.ts';
 import { readProjectPaths } from '../project-paths.ts';
 import { buildEnv } from '../shared/untrusted-env.ts';
-import { log, getErrorMessage } from './deploy-helpers.ts';
-import { scrubWranglerAuthCredentials } from './deploy-transport.ts';
-import { Buffer } from './node-buffer.ts';
-
-const drizzleKitBin = join(fileURLToPath(import.meta.resolve('drizzle-kit')), '..', 'bin.cjs');
+import { log } from './deploy-helpers.ts';
+import { getErrorMessage } from './output.ts';
+import { drizzleKitBin } from './yarn-pnp.ts';
 
 const deployDriftCheckDir = join('.void', 'deploy-drift-check');
 
@@ -70,11 +67,7 @@ export function hasDeploySchemaDrift(root: string, dialect: DatabaseDialect): bo
     const driftAuthSchemaPath = join(driftProjectRoot, '.void', 'better-auth-schema.ts');
     const driftConfigPath = writeDrizzleConfig(
       driftProjectRoot,
-      dialect === 'postgresql'
-        ? 'postgresql://dummy'
-        : dialect === 'mysql'
-          ? 'mysql://dummy'
-          : ':memory:',
+      PLACEHOLDER_DB_URL[dialect],
       dialect,
       {
         additionalSchemas: existsSync(driftAuthSchemaPath) ? [driftAuthSchemaPath] : undefined,
@@ -102,13 +95,11 @@ function runDrizzleKitGenerate(root: string, configPath: string): string {
   const result = spawnSync(process.execPath, [drizzleKitBin, 'generate', '--config', configPath], {
     cwd: root,
     encoding: 'utf-8',
-    // drizzle-kit loads the user's drizzle config + schema (user code); keep the
-    // CF Access service token AND every wrangler-auth credential out of it, matching the
-    // build spawns. Generating migrations needs no Cloudflare credential.
-    env: scrubWranglerAuthCredentials(buildEnv()),
+    // drizzle-kit runs project code, so it gets no credentials.
+    env: buildEnv(),
   });
-  const stderr = bufferToString(result.stderr);
-  const stdout = bufferToString(result.stdout);
+  const stderr = (result.stderr ?? '').trim();
+  const stdout = (result.stdout ?? '').trim();
   const output = [stderr, stdout].filter(Boolean).join('\n').trim();
 
   if (result.error) {
@@ -148,7 +139,7 @@ export function getDeploySchemaDriftMessage(root: string): string {
 }
 
 function formatDeploySchemaDriftCheckError(error: unknown): string {
-  const detail = extractExecErrorOutput(error);
+  const detail = getErrorMessage(error);
   return [
     'Failed to check Drizzle schema drift during deploy.',
     'Run `void db generate` locally, fix any reported issues, review the generated migration, commit it yourself, then rerun `void deploy`.',
@@ -156,39 +147,6 @@ function formatDeploySchemaDriftCheckError(error: unknown): string {
   ].join('\n\n');
 }
 
-function extractExecErrorOutput(error: unknown): string {
-  if (!error || typeof error !== 'object') {
-    return '';
-  }
-
-  const details = [];
-  const stderr = 'stderr' in error ? bufferToString(error.stderr) : '';
-  const stdout = 'stdout' in error ? bufferToString(error.stdout) : '';
-
-  if (stderr) {
-    details.push(stderr);
-  }
-  if (stdout) {
-    details.push(stdout);
-  }
-  const message = 'message' in error ? bufferToString(error.message) : '';
-  if (details.length === 0 && message) {
-    details.push(message);
-  }
-
-  return details.join('\n').trim();
-}
-
-function bufferToString(value: unknown): string {
-  if (typeof value === 'string') {
-    return value.trim();
-  }
-  if (value instanceof Buffer) {
-    return value.toString('utf-8').trim();
-  }
-  return '';
-}
-
 function createDeployDriftProject(root: string, driftProjectRoot: string): void {
   mkdirSync(driftProjectRoot, { recursive: true });
 
diff --git a/packages/void/src/cli/deploy-helpers.ts b/packages/void/src/cli/deploy-helpers.ts
index aacdbdd14..c8ff330b1 100644
--- a/packages/void/src/cli/deploy-helpers.ts
+++ b/packages/void/src/cli/deploy-helpers.ts
@@ -1,6 +1,6 @@
 import { execSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { log as clackLog } from '@voidzero-dev/vite-plus-prompts';
+import { readFileSync } from 'node:fs';
+import { isCancel, log as clackLog, text } from '@voidzero-dev/vite-plus-prompts';
 import { join, resolve } from 'pathslash';
 import { findEnvFile } from '../codegen/env-types.ts';
 import { type DatabaseDialect, type VoidConfig, isNodeTarget } from '../config.ts';
@@ -23,13 +23,12 @@ import {
 } from './deploy-types.ts';
 import { fetchRemoteSecretNames, formatEnvReport, validateProdEnv } from './env-validation.ts';
 import { type CliLogger } from './log-file.ts';
-import { formatCount, pc } from './output.ts';
+import { formatCount, getErrorMessage, pc } from './output.ts';
 import {
   detectPreset,
   formatProjectCommand,
   resolveProjectCommand,
   type StaticPreset,
-  type FrameworkPreset,
 } from './preset.ts';
 import {
   attachSelectedPlatform,
@@ -52,14 +51,13 @@ import type { WrapperFeatures } from './wrapper.ts';
 import { needsWrapper, generateWrapper } from './wrapper.ts';
 
 export const log: Record<
-  'error' | 'info' | 'message' | 'step' | 'success' | 'warn',
+  'error' | 'info' | 'message' | 'step' | 'warn',
   (message: string) => void
 > = {
   error: (message: string) => clackLog.error(formatCloudflareUserMessage(message)),
   info: (message: string) => clackLog.info(formatCloudflareUserMessage(message)),
   message: (message: string) => clackLog.message(formatCloudflareUserMessage(message)),
   step: (message: string) => clackLog.step(formatCloudflareUserMessage(message)),
-  success: (message: string) => clackLog.step(formatCloudflareUserMessage(message)),
   warn: (message: string) => clackLog.warn(formatCloudflareUserMessage(message)),
 };
 
@@ -88,10 +86,6 @@ const EMPTY_BINDINGS = {
   needsSandbox: false,
 };
 
-export function getErrorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
 function readLiveBindingConfigFromDeployment(
   deployment: DeploymentResponse | undefined,
 ): LiveBindingConfig | undefined {
@@ -284,7 +278,7 @@ export async function promptDeployProjectConfig(
   }
   const config = { projectId: result.project.id, slug: result.project.slug };
   if (link) {
-    writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
+    writeProjectConfig(root, attachSelectedPlatform(config, client.apiUrl));
     log.step(`Linked to ${pc.blue(config.slug)}`);
     cliLog?.info('project_linked', { projectId: config.projectId, slug: config.slug });
   } else {
@@ -423,7 +417,7 @@ export async function createProjectFromSlug(
   const project = await client.createProject(slug);
   const config = { projectId: project.id, slug: project.slug };
   if (shouldLinkDeployProject(root, client.apiUrl)) {
-    writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
+    writeProjectConfig(root, attachSelectedPlatform(config, client.apiUrl));
   }
   log.step(`Project created: ${pc.blue(config.slug)}`);
   reportProjectCreationWarnings(project);
@@ -438,9 +432,9 @@ export function getGitCommit(root: string): string | null {
       return githubSha;
     }
 
-    // `git status` can invoke a repo-configured `core.fsmonitor` hook, so keep
-    // the CF Access service-token pair out of these git children too (matches
-    // the build spawns).
+    // `git status` can run a repo-configured `core.fsmonitor` hook, so scrub
+    // credentials like the build spawns. No `localBinRoot`: `git` must never
+    // resolve to a binary shipped in the project's node_modules/.bin.
     const gitEnv = buildEnv();
     // Check if in a git repo
     execSync('git rev-parse --is-inside-work-tree', { cwd: root, stdio: 'ignore', env: gitEnv });
@@ -489,8 +483,7 @@ export function validateDeployMigrations(
 
 /**
  * Ensure a managed external SQL project has Hyperdrive, prompting for the
- * connection string when it is missing. When the resources endpoint is not
- * available, Hyperdrive is checked at deploy time instead.
+ * connection string when it is missing.
  */
 export async function ensureManagedHyperdrive(
   client: PlatformClient,
@@ -501,14 +494,12 @@ export async function ensureManagedHyperdrive(
   try {
     resources = await client.getResources(projectId);
   } catch {
-    // Resources endpoint not available — Hyperdrive will be checked at deploy time
+    // Best effort: the platform checks Hyperdrive again during the deploy.
   }
   if (!resources || resources.some((resource) => resource.type === 'hyperdrive')) {
     return;
   }
-  const { text: promptText, isCancel: isCancelPrompt } =
-    await import('@voidzero-dev/vite-plus-prompts');
-  const connectionString = await promptText({
+  const connectionString = await text({
     message: `Your project uses ${dialect === 'mysql' ? 'MySQL' : 'PostgreSQL'}. Enter your connection string:`,
     placeholder:
       dialect === 'mysql'
@@ -526,7 +517,7 @@ export async function ensureManagedHyperdrive(
       }
     },
   });
-  if (isCancelPrompt(connectionString)) {
+  if (isCancel(connectionString)) {
     log.info('Deploy cancelled.');
     process.exit(0);
   }
@@ -583,67 +574,3 @@ export async function assertEnvSchemaValid(
   }
   throw new DeployEventError('deploy: Aborting because env.ts schema is not satisfied.');
 }
-
-/**
- * Resolve the top-level build output directory.
- *
- * When a framework preset is available, uses its workerDir to derive the
- * parent directory (e.g. "build/server" → "build"). This gives framework-
- * specific error messages when the output is missing.
- *
- * For non-framework (Void app) deploys, defaults to "dist".
- */
-export function resolveDistDir(
-  root: string,
-  fwPreset?: FrameworkPreset,
-  buildCommand?: string,
-): string {
-  if (fwPreset) {
-    // Derive the top-level build dir from the preset's workerDir
-    // e.g. "build/server" → "build", "dist/ssr" → "dist"
-    const topDir = fwPreset.workerDir.split('/')[0];
-    const distDir = join(root, topDir);
-    if (!existsSync(distDir)) {
-      throw new Error(
-        `deploy: Build output directory '${topDir}' not found. Run '${buildCommand ?? fwPreset.buildCommand}' first.`,
-      );
-    }
-    return distDir;
-  }
-  return join(root, 'dist');
-}
-
-/**
- * Resolve the worker output subdirectory name within the build dir.
- *
- * When a framework preset is available, uses the preset's workerDir to
- * derive the subdirectory name and gives a framework-specific error.
- *
- * For non-framework (Void app) deploys, probes for known subdirectories.
- */
-export function resolveWorkerDirName(
-  distDir: string,
-  fwPreset?: FrameworkPreset,
-  buildCommand?: string,
-): string {
-  if (fwPreset) {
-    // Derive the subdirectory from the preset's workerDir
-    // e.g. "build/server" → "server", "dist/ssr" → "ssr"
-    const parts = fwPreset.workerDir.split('/');
-    const subDir = parts.slice(1).join('/');
-    if (!existsSync(join(distDir, subDir))) {
-      throw new Error(
-        `deploy: Worker output '${fwPreset.workerDir}' not found. Run '${buildCommand ?? fwPreset.buildCommand}' first.`,
-      );
-    }
-    return subDir;
-  }
-
-  // Non-framework: probe for known output subdirectories
-  for (const name of ['ssr', 'rsc', 'server']) {
-    if (existsSync(join(distDir, name))) {
-      return name;
-    }
-  }
-  throw new Error('deploy: Worker output not found. Expected dist/ssr/ or dist/rsc/.');
-}
diff --git a/packages/void/src/cli/deploy-managed-events.ts b/packages/void/src/cli/deploy-managed-events.ts
index 2928e270c..4507ab002 100644
--- a/packages/void/src/cli/deploy-managed-events.ts
+++ b/packages/void/src/cli/deploy-managed-events.ts
@@ -1,4 +1,5 @@
 import { createDeployArtifact, createDeployUploadPayload } from '@void/deploy-core';
+import { getContentType } from '@void/edge';
 import { type SpinnerResult } from '@voidzero-dev/vite-plus-prompts';
 import { type NotFoundHandling, type RoutingConfig } from '../config.ts';
 import { getTokenSource } from './auth.ts';
@@ -12,10 +13,10 @@ import { log, DeployEventError } from './deploy-helpers.ts';
 import { type ApplyDeployEventResult, type StreamDeployResult } from './deploy-types.ts';
 import { uploadAssetsToR2, type DirectR2PutItem } from './direct-r2-upload.ts';
 import { type GitDeployMetadata } from './git-metadata.ts';
-import { lintDestinationSplats, lintDuplicateSources, mergeRoutingRules } from './headers.ts';
+import { lintRoutingPhases, mergeRoutingRules } from './headers.ts';
 import { type CliLogger } from './log-file.ts';
 import { formatCount } from './output.ts';
-import { getAssetContentType, type AssetManifestEntry } from './package.ts';
+import { type AssetManifestEntry } from './package.ts';
 import type { DeployEvent, DeployManifest } from './types.ts';
 
 /**
@@ -223,29 +224,38 @@ export async function streamDeployEvents(
  *   3. R2 PUT failures (4xx, 5xx, network) are surfaced with the asset
  *      path + hash so the user can correlate against the JSONL trace.
  */
-export async function streamDirectR2Deploy(
-  client: PlatformClient,
-  projectId: string,
-  manifest: DeployManifest,
-  assetManifest: Record<string, AssetManifestEntry>,
-  assetFiles: Map<string, Buffer>,
-  needed: Array<string>,
-  gitMetadata: GitDeployMetadata | undefined,
-  preflightUsed: boolean,
-  workerFiles: Map<string, Buffer> | undefined,
-  s: SpinnerResult,
-  cliLog?: CliLogger,
-): Promise<StreamDeployResult> {
+export async function streamDirectR2Deploy({
+  client,
+  projectId,
+  manifest,
+  assetManifest,
+  assetFiles,
+  needed,
+  gitMetadata,
+  preflightUsed,
+  workerFiles,
+  spinner: s,
+  cliLog,
+}: {
+  client: PlatformClient;
+  projectId: string;
+  manifest: DeployManifest;
+  assetManifest: Record<string, AssetManifestEntry>;
+  assetFiles: Map<string, Buffer>;
+  needed: Array<string>;
+  gitMetadata?: GitDeployMetadata;
+  /** Whether preflight let the server reuse any stored asset. */
+  preflightUsed: boolean;
+  workerFiles?: Map<string, Buffer>;
+  spinner: SpinnerResult;
+  cliLog?: CliLogger;
+}): Promise<StreamDeployResult> {
   if (needed.length > 0) {
-    // Memory: drop buffers for assets the server already has so peak
-    // memory tracks `needed`, not the full bundle. Skipped entries become
-    // GC-eligible immediately rather than after `finalizeDeploy` returns.
-    // The pre-prune size is captured for the JSONL log only. We materialize
-    // the key list before deleting so the iterator isn't disturbed mid-walk.
+    // Drop buffers the server already has so peak memory tracks `needed`,
+    // not the full bundle.
     const neededPaths = new Set(needed);
     const preBufferCount = assetFiles.size;
-    const allPaths = Array.from(assetFiles.keys());
-    for (const path of allPaths) {
+    for (const path of assetFiles.keys()) {
       if (!neededPaths.has(path)) {
         assetFiles.delete(path);
       }
@@ -269,9 +279,6 @@ export async function streamDirectR2Deploy(
     for (const path of needed) {
       const entry = assetManifest[path];
       if (!entry) {
-        // Should never fire — `needed` is preflight's projection of
-        // assetManifest. Defensive throw makes the cause obvious if a
-        // future preflight regression slips through.
         throw new Error(`internal: preflight returned ${path} but assetManifest has no entry`);
       }
       if (seenBlake3.has(entry.blake3)) {
@@ -287,7 +294,8 @@ export async function streamDirectR2Deploy(
         blake3: entry.blake3,
         md5: entry.md5,
         size: entry.size,
-        contentType: getAssetContentType(path),
+        // Signed into the presigned PUT; dispatch serves with the same table.
+        contentType: getContentType(path),
       };
     });
 
@@ -315,9 +323,6 @@ export async function streamDirectR2Deploy(
       }
       const body = assetFiles.get(path);
       if (!body) {
-        // Defensive — `uniqueNeeded` came from `assetManifest`, which was
-        // constructed from `assetFiles`. If this fires, the upstream
-        // collection diverged from preflight.
         throw new Error(
           `internal: asset ${path} declared in manifest but missing from buffer cache`,
         );
@@ -403,33 +408,18 @@ export function warnUnpublishedRouting(result: StreamDeployResult): void {
   );
 }
 
-/**
- * Merge `_headers` / `_redirects` in `dir` with `void.config.ts` routing rules
- * for a managed deploy, then lint each phase independently: duplicates across
- * phases (redirects vs fallbacks) don't shadow each other, only duplicates
- * within a phase do. Destinations with a literal `*` are flagged because only
- * `:name` tokens are substituted at dispatch time.
- */
+/** Merge `_headers` / `_redirects` in `dir` with `void.config.ts` routing rules, then lint them. */
 export function mergeAndLintRoutingRules(
   dir: string,
   routing: RoutingConfig | undefined,
 ): ReturnType<typeof mergeRoutingRules> {
   const merged = mergeRoutingRules({ dir, routing });
   warnRedundantForceOn3xx(merged.redundantForceOn3xx);
-  lintDuplicateSources(merged.redirectRules, 'redirects/rewrites (pre-asset)');
-  lintDuplicateSources(merged.fallbackRules, 'fallbacks (post-asset)');
-  lintDestinationSplats(merged.redirectRules, 'redirects/rewrites (pre-asset)');
-  lintDestinationSplats(merged.fallbackRules, 'fallbacks (post-asset)');
+  lintRoutingPhases(merged);
   return merged;
 }
 
-/**
- * Emit a single aggregated lint warning when a `_redirects` file contains
- * one or more `!` force suffixes on 3xx entries (e.g. `301!`, `302!`).
- * The `!` is a no-op on redirects — we parse them as if the `!` weren't
- * there — but we nudge the user to clean up for clarity. Silenced when
- * `count === 0`.
- */
+/** Warn once about `!` suffixes on 3xx `_redirects` entries, which are no-ops. */
 export function warnRedundantForceOn3xx(count: number): void {
   if (count === 0) {
     return;
@@ -440,21 +430,9 @@ export function warnRedundantForceOn3xx(count: number): void {
 }
 
 /**
- * Class B/C framework deploys pin `not_found_handling: 'none'`, so
- * `routing.notFound` does nothing there — say so instead of dropping it
- * silently.
- *
- * These presets emit no `run_worker_first`, so Cloudflare's default applies and
- * the asset layer answers before the framework worker: real prerendered files
- * already win. `not_found_handling` only governs what the framework's own
- * `env.ASSETS.fetch()` delegation returns, which is framework-internal
- * plumbing. Honoring the override there would be a behavior change, not a fix —
- * `single-page-application` makes an unmatched delegation return
- * `dist/client/index.html` at **200** (Astro/SvelteKit hybrid builds commonly
- * prerender the root, so real 404s silently become the home page), and
- * `404-page` steals the 404 from the framework's own error route.
- *
- * Silenced when unset.
+ * Class B/C framework deploys pin `not_found_handling: 'none'`, so warn when
+ * `routing.notFound` is set. Honoring it would turn framework 404s into a 200
+ * `index.html` or take the 404 from the framework's own error route.
  */
 export function warnIgnoredNotFoundForFramework(
   notFound: NotFoundHandling | undefined,
diff --git a/packages/void/src/cli/deploy-managed-framework.ts b/packages/void/src/cli/deploy-managed-framework.ts
index e9cf9f3a1..ac850511c 100644
--- a/packages/void/src/cli/deploy-managed-framework.ts
+++ b/packages/void/src/cli/deploy-managed-framework.ts
@@ -52,7 +52,6 @@ export async function runFrameworkDeploy(
   log.info(`${detected.name} framework deploy`);
   cliLog?.info('deploy_mode', { mode: 'framework', framework: detected.name });
 
-  // 1. Build
   const buildCmd = voidConfig.inference?.build ?? formatProjectCommand(root, fwPreset.buildCommand);
   if (!skipBuild) {
     log.step(`Building (${buildCmd})...`);
@@ -68,7 +67,6 @@ export async function runFrameworkDeploy(
     cliLog?.info('build_skipped', { reason: 'skipBuild' });
   }
 
-  // 2. Verify output paths
   const workerDir = join(root, fwPreset.workerDir);
   const assetsDir = join(root, fwPreset.assetsDir);
   const frameworkAssetIgnorePatterns =
@@ -85,9 +83,7 @@ export async function runFrameworkDeploy(
     voidConfig.routing,
   );
 
-  // `assetConfig` below is pinned to `not_found_handling: 'none'` on this path,
-  // so `routing.notFound` is inert. Warned here (outside the packaging spinner)
-  // rather than at the pin itself.
+  // Warn before the packaging spinner starts.
   warnIgnoredNotFoundForFramework(voidConfig.routing?.notFound, detected.name);
 
   if (!existsSync(workerDir)) {
@@ -112,7 +108,7 @@ export async function runFrameworkDeploy(
 
   assertDeploySchemaDriftFree(root, dialect);
 
-  // 4. Collect migrations (before Hyperdrive check so migrations can gate provisioning)
+  // Validate migrations before the Hyperdrive check so migrations can gate provisioning.
   const validatedMigrations = validateDeployMigrations(paths.migrationsDir, analysis.migrations);
 
   // Pre-deploy: ensure Hyperdrive is provisioned for external SQL projects.
@@ -120,7 +116,6 @@ export async function runFrameworkDeploy(
     await ensureManagedHyperdrive(client, config.projectId, dialect);
   }
 
-  // 5. Generate wrapper if needed (crons or queues present)
   const rawJobs = analysis.jobs;
   const rawQueues = analysis.queues;
   const originalEntry = join(workerDir, fwPreset.workerMain);
@@ -135,7 +130,7 @@ export async function runFrameworkDeploy(
   let actualWorkerDir = workerDir;
   let actualWorkerMain = fwPreset.workerMain;
 
-  // Step 1: Bundle if framework has unbundled bare imports (e.g. SvelteKit)
+  // Bundle when the framework leaves bare imports unbundled (e.g. SvelteKit).
   if (fwPreset.bundle) {
     log.step('Bundling worker...');
     const bundleResult = await bundleEntry(root, originalEntry);
@@ -144,34 +139,24 @@ export async function runFrameworkDeploy(
     log.info('Worker bundled');
   }
 
-  // Step 2: Wrap if internal deploy endpoints are needed (in-place, no re-bundling)
+  // Wrap in place, without re-bundling, when internal deploy endpoints are needed.
   if (needsWrapper(wrapperFeatures)) {
     log.step('Generating wrapper...');
     await generateDeployWrapperIfNeeded(root, actualWorkerDir, actualWorkerMain, wrapperFeatures);
     log.info('Wrapper generated');
   }
 
-  // 8. Read wrangler compat settings (void.config.ts > wrangler.jsonc > build output)
-  // Use the original workerDir (not actualWorkerDir) because bundleEntry() may
-  // reassign actualWorkerDir to a temporary output — the plugin-generated
-  // wrangler.json with correct compat settings lives in the original build output.
+  // Read compat settings from the original workerDir: bundleEntry() may move
+  // actualWorkerDir to a temporary output without the generated wrangler.json.
   const wranglerCompat = resolveDeployWranglerCompat(root, voidConfig, workerDir, { dialect });
 
-  // 9. Resolve revalidate + prerender from void.config.ts
   const revalidate = collectRevalidate(voidConfig, null);
   const prerender = voidConfig.routing?.isr === false ? undefined : voidConfig.routing?.prerender;
 
-  // Build manifest-format schedules and queues from raw scans
   const { schedules, queues } = toManifestSchedulesAndQueues(rawJobs, rawQueues);
 
-  // Production env values are remote secrets. Client values are compiled
-  // from schema defaults or the build shell; no dotenv value enters the manifest.
-  const envVars: Record<string, string> = {};
-
-  // 10a. Validate against env.ts schema if present.
   await assertEnvSchemaValid(root, client, config.projectId);
 
-  // 11. Package & deploy
   const s = createSpinner();
   const onProgress = (msg: string) => s.message(msg);
 
@@ -201,10 +186,8 @@ export async function runFrameworkDeploy(
     framework: detected.name,
   });
   const packageStartedAt = Date.now();
-  const neededSet = skipped > 0 ? new Set(needed) : null;
   const packageOptions = {
     bindingNames: analysis.bindingNames,
-    workerMain: actualWorkerMain,
     compatibilityDate: wranglerCompat?.compatibilityDate,
     compatibilityFlags: wranglerCompat?.compatibilityFlags,
     cpuMs: voidConfig.worker?.limits?.cpu_ms,
@@ -220,11 +203,8 @@ export async function runFrameworkDeploy(
     revalidate,
     revalidateQueryAllowlist: voidConfig.routing?.revalidateQueryAllowlist,
     prerender,
-    // Pinned, NOT threaded from `routing.notFound` — see
-    // `warnIgnoredNotFoundForFramework` for why the override must not apply to
-    // Class B/C. The warning above tells the user when they set it anyway.
+    // Not `routing.notFound`; see `warnIgnoredNotFoundForFramework`.
     assetConfig: { not_found_handling: 'none' },
-    vars: envVars,
     packageOptions,
     hashedAssetsPrefix: fwPreset.hashedAssetsPrefix ?? 'assets',
     headerRules,
@@ -242,19 +222,19 @@ export async function runFrameworkDeploy(
   // by the framework via `migration-handler.ts`); the deploy body only
   // needs `manifest.migrations.pending` so the platform knows to invoke
   // the worker's `/__void/migrate` endpoint after dispatch.
-  const result = await streamDirectR2Deploy(
+  const result = await streamDirectR2Deploy({
     client,
-    config.projectId,
+    projectId: config.projectId,
     manifest,
     assetManifest,
     assetFiles,
     needed,
     gitMetadata,
-    neededSet !== null,
+    preflightUsed: skipped > 0,
     workerFiles,
-    s,
+    spinner: s,
     cliLog,
-  );
+  });
 
   note(
     formatDeploySummary({
diff --git a/packages/void/src/cli/deploy-managed-full.ts b/packages/void/src/cli/deploy-managed-full.ts
index 6f9b5065c..6915dec8e 100644
--- a/packages/void/src/cli/deploy-managed-full.ts
+++ b/packages/void/src/cli/deploy-managed-full.ts
@@ -22,14 +22,13 @@ import { requiresSandboxPlatformImage, resolveSandboxConfig } from '../sandbox/c
 import { resolveRemoteMode } from '../shared/env.ts';
 import { buildEnv } from '../shared/untrusted-env.ts';
 import { validateSsrEntry } from '../ssr/entry.ts';
+import { resolveDistDir, resolveWorkerDirName } from './build-output-dir.ts';
 import { PlatformClient } from './client.ts';
 import { assertDeploySchemaDriftFree } from './deploy-drift.ts';
 import {
   resolveFullDeployBuildCommand,
   log,
   getExitCode,
-  resolveDistDir,
-  resolveWorkerDirName,
   resolveDeployLiveBindingConfig,
   hasNonPageBackend,
   hasPrerenderSources,
@@ -88,7 +87,7 @@ export async function runFullDeploy(
 
   assertManagedDurableStateSupported(root);
 
-  // 3. Build (child process to avoid Vite API side effects on bundle output)
+  // Build in a child process to avoid Vite API side effects on bundle output.
   if (!skipBuild) {
     const { label: buildCmd, command: buildExec } = resolveFullDeployBuildCommand(
       root,
@@ -98,9 +97,7 @@ export async function runFullDeploy(
     cliLog?.info('build_start', { command: buildCmd });
     const buildStartedAt = Date.now();
     try {
-      // Pass VOID_DEPLOY_PROJECT_ID so plugin-prerender (running inside this
-      // child vite build) can resolve the Void projectId without relying on
-      // .void/project.json, which may be stale or absent under `--project <slug>`.
+      // VOID_DEPLOY_PROJECT_ID marks a managed build: platform dispatch owns routing and ISR.
       execSync(buildExec, {
         cwd: root,
         stdio: 'inherit',
@@ -118,8 +115,8 @@ export async function runFullDeploy(
     cliLog?.info('build_skipped', { reason: 'skipBuild' });
   }
 
-  // 4. Resolve build output paths from build artifacts (avoids re-resolving
-  // Vite config in the main process — plugins only run once inside the build)
+  // Resolve output paths from build artifacts instead of re-resolving the Vite
+  // config here; plugins run only once, inside the build.
   const frameworkBuildCmd = fwPreset
     ? formatProjectCommand(root, fwPreset.buildCommand)
     : undefined;
@@ -144,7 +141,7 @@ export async function runFullDeploy(
     }
   }
 
-  // 5. Framework mode (Class A — passed from runDeploy)
+  // Class A framework mode, detected by runDeploy.
   const isFrameworkMode = detected != null;
 
   // Managed static prerender is deliberately outside the Vite subprocess. The
@@ -212,7 +209,7 @@ export async function runFullDeploy(
 
   assertDeploySchemaDriftFree(root, dialect);
 
-  // 7. Collect and validate migrations (before Hyperdrive check so migrations can gate provisioning)
+  // Validate migrations before the Hyperdrive check so migrations can gate provisioning.
   const validatedMigrations = validateDeployMigrations(paths.migrationsDir, analysis.migrations);
 
   // Pre-deploy: ensure Hyperdrive is provisioned for external SQL projects.
@@ -332,7 +329,6 @@ export async function runFullDeploy(
             voidToken: await client.createPrerenderToken(config.projectId),
           });
 
-  // 8. Read wrangler compat settings for Cloudflare targets
   const wranglerCompat = resolveDeployWranglerCompat(
     root,
     voidConfig,
@@ -345,13 +341,8 @@ export async function runFullDeploy(
   );
   const workerMain = resolveDeployWorkerMain(voidConfig, join(distDir, workerDirName));
 
-  // Production env values are remote secrets; dotenv is local-only.
-  const envVars: Record<string, string> = {};
-
-  // 9a. Validate against env.ts schema if present.
   await assertEnvSchemaValid(root, client, config.projectId);
 
-  // 10. Package & Upload
   const s = createSpinner();
   const onProgress = (msg: string) => s.message(msg);
 
@@ -396,7 +387,6 @@ export async function runFullDeploy(
     framework: detected?.name,
   });
   const packageStartedAt = Date.now();
-  const neededSet = skipped > 0 ? new Set(needed) : null;
   const voidPackageOptions = {
     compatibilityDate: wranglerCompat?.compatibilityDate,
     compatibilityFlags: wranglerCompat?.compatibilityFlags,
@@ -427,7 +417,6 @@ export async function runFullDeploy(
       ssr: isSsr || hasRoutes || hasMiddleware || hasWebSockets || authEnabled,
       framework: isFrameworkMode ? detected!.name : undefined,
       revalidate,
-      vars: envVars,
       queues,
       prerender: uniquePrerenderPaths,
       assetConfig,
@@ -467,19 +456,19 @@ export async function runFullDeploy(
     mode: 'full',
     durationMs: Date.now() - packageStartedAt,
   });
-  const result = await streamDirectR2Deploy(
+  const result = await streamDirectR2Deploy({
     client,
-    config.projectId,
+    projectId: config.projectId,
     manifest,
     assetManifest,
     assetFiles,
     needed,
     gitMetadata,
-    neededSet !== null,
+    preflightUsed: skipped > 0,
     workerFiles,
-    s,
+    spinner: s,
     cliLog,
-  );
+  });
 
   note(
     formatDeploySummary({
diff --git a/packages/void/src/cli/deploy-managed-static.ts b/packages/void/src/cli/deploy-managed-static.ts
index d8c0ea040..5f29d6c16 100644
--- a/packages/void/src/cli/deploy-managed-static.ts
+++ b/packages/void/src/cli/deploy-managed-static.ts
@@ -137,7 +137,6 @@ export async function runStaticDeploy(
   s.start('Packaging...');
   cliLog?.info('package_start', { mode: 'static' });
   const packageStartedAt = Date.now();
-  const neededSet = skipped > 0 ? new Set(needed) : null;
 
   const manifest = buildStaticManifest({
     appType: preset.appType,
@@ -151,19 +150,18 @@ export async function runStaticDeploy(
     mode: 'static',
     durationMs: Date.now() - packageStartedAt,
   });
-  const result = await streamDirectR2Deploy(
+  const result = await streamDirectR2Deploy({
     client,
-    config.projectId,
+    projectId: config.projectId,
     manifest,
     assetManifest,
     assetFiles,
     needed,
     gitMetadata,
-    neededSet !== null,
-    undefined,
-    s,
+    preflightUsed: skipped > 0,
+    spinner: s,
     cliLog,
-  );
+  });
 
   note(
     formatDeploySummary({ typeLabel, assets: result.assets, unchangedAssets: skipped }),
diff --git a/packages/void/src/cli/deploy-migrations.ts b/packages/void/src/cli/deploy-migrations.ts
index fdc313e07..f90892c23 100644
--- a/packages/void/src/cli/deploy-migrations.ts
+++ b/packages/void/src/cli/deploy-migrations.ts
@@ -6,44 +6,27 @@ import type { VoidAuthMigrationSchema } from '../auth/drizzle.ts';
 import { type DatabaseDialect } from '../config.ts';
 import { openMigrationValidationDatabase } from '../migrations/sqlite-validation.ts';
 import { assertJournalCoherence, validateMigrations } from '../migrations/validate.ts';
+import { isCleanCloudflareExit } from './cloudflare-process.ts';
 import { hasDeploySchemaDrift, getDeploySchemaDriftMessage } from './deploy-drift.ts';
-import { getErrorMessage, log } from './deploy-helpers.ts';
-import { CLOUDFLARE_RESOURCE_LABELS, isCleanWranglerExit } from './deploy-resources.ts';
+import { log } from './deploy-helpers.ts';
+import { CLOUDFLARE_RESOURCE_LABELS } from './deploy-resources.ts';
 import {
   type RequiredAuthTable,
   type TableInfoRow,
   type DeployWranglerRun,
 } from './deploy-types.ts';
-// Type-only: the provision module must load lazily (see `deploy-types.ts`).
+import { getErrorMessage } from './output.ts';
 import type { ProvisionDriftEntry } from './provision.ts';
 
 /**
- * Apply the checked-in migrations to an in-memory SQLite database (`node:sqlite`, a repo
- * dependency — the same driver `auth/node.ts` uses) and assert the effective schema contains
- * every REQUIRED auth table, its columns, AND the constraints that carry correctness. It reads
- * the real POST-migration schema (a token search is defeated by comments/strings/renames/plugin
- * tables) — the identical thing wrangler will apply to remote D1 (SQLite).
+ * Apply the checked-in migrations to an in-memory SQLite database and assert the resulting
+ * schema has every required auth table and column, with its primary key, NOT NULL, UNIQUE and
+ * foreign key constraints. Drizzle's `.unique()` and `.references()` are opt-in, so matching
+ * names alone would accept a weaker schema than the managed path builds.
  *
- * Names alone are not enough: Void ships no auth migration scaffolder, so users hand-write
- * `db/schema.ts` and run `void db generate`, where Drizzle's `.unique()` and `.references()`
- * are both opt-in. A migration set with every right NAME but no unique index on `user.email`
- * and no `session.userId` foreign key is a materially weaker schema than the one the managed
- * path builds (`applySqliteAuthMigrations`), so this gate rejects it.
- *
- * Asserted: column presence, the implicit `id`'s uniqueness (`primaryKey`), `required`
- * (NOT NULL), `unique: true`, and `references` (parent table + column — including that an
- * implicit `REFERENCES "parent"` resolves to the parent's actual PRIMARY KEY). Those
- * reference checks answer only WHICH column a foreign key names; whether SQLite will ACCEPT
- * that parent key is settled by `PRAGMA foreign_key_check` on the migrated (still empty)
- * database, which applies SQLite's own rule rather than a local re-derivation of it.
- * Deliberately NOT asserted — these would reject legitimate schemas:
- *   - column TYPE — SQLite is dynamically typed, and Drizzle's output varies by mode.
- *   - non-unique `index: true` — a performance property, not a correctness one.
- *   - the exact `onDelete` action — over-tight; the reference itself is the invariant.
- *
- * Throws naming the exact offending `table.column` and what is missing (identifiers only,
- * never values), or when a migration cannot even be applied. Exported for unit testing (the
- * `required` set is passed in, so this needs no Better Auth resolution).
+ * Column types, non-unique indexes and `onDelete` actions are not checked, because legitimate
+ * schemas vary there. Throws naming each offending `table.column` (identifiers only, never
+ * values), or when a migration cannot be applied.
  */
 export async function assertMigrationsProduceAuthSchema(
   migrations: Array<{ name: string; sql: string }>,
@@ -51,20 +34,10 @@ export async function assertMigrationsProduceAuthSchema(
 ): Promise<void> {
   const db = await openMigrationValidationDatabase(migrations);
   const quote = (identifier: string): string => `"${identifier.replace(/"/g, '""')}"`;
-  // SQLite resolves identifiers case-insensitively, but `sqlite_master.name` and every PRAGMA
-  // echo back the casing the migration DECLARED. So `CREATE TABLE "User" ("Email" TEXT UNIQUE)`
-  // is the same schema as the emitted `user.email` — lowercase SELECTs resolve against it and
-  // the UNIQUE constraint enforces — and must not read as missing here. Every identifier this
-  // function compares (table, column, unique index member, FK parent) is folded through this
-  // one notion of equality; only the PRAGMA arguments keep the caller's original spelling,
-  // since SQLite resolves those case-insensitively anyway.
+  // SQLite matches identifiers case-insensitively, but PRAGMAs echo the declared casing.
   const foldIdentifier = (identifier: string): string => identifier.toLowerCase();
   const sameIdentifier = (a: string, b: string): boolean => foldIdentifier(a) === foldIdentifier(b);
-  // `PRAGMA table_info`, memoized. A foreign key is validated against the PARENT table's info,
-  // and the parent is not necessarily a table this loop has reached (or will ever reach), so
-  // this must be able to answer for an arbitrary table at any point. SQLite resolves the PRAGMA
-  // argument case-insensitively, so the cache is keyed on the FOLDED name while the query keeps
-  // the caller's spelling. A table no migration created yields `[]`, not an error.
+  // Foreign keys need the parent table's info too. A table no migration created yields `[]`.
   const tableInfoCache = new Map<string, Array<TableInfoRow>>();
   const tableInfoFor = (table: string): Array<TableInfoRow> => {
     const key = foldIdentifier(table);
@@ -76,8 +49,7 @@ export async function assertMigrationsProduceAuthSchema(
     tableInfoCache.set(key, rows);
     return rows;
   };
-  // The table's single-column PRIMARY KEY, or null when it has none or a COMPOSITE one. This is
-  // the ONLY thing SQLite resolves an omitted foreign-key target column to.
+  // SQLite resolves an omitted foreign key target only to a single-column PRIMARY KEY.
   const singleColumnPrimaryKey = (table: string): string | null => {
     const primaryKey = tableInfoFor(table).filter((row) => Number(row.pk) > 0);
     return primaryKey.length === 1 && primaryKey[0] ? primaryKey[0].name : null;
@@ -105,13 +77,8 @@ export async function assertMigrationsProduceAuthSchema(
         problems.push(`table "${req.table}" is missing column(s): ${missing.join(', ')}`);
       }
 
-      // Uniqueness — collect every column SQLite actually enforces as unique, so BOTH
-      // spellings a real project produces are honored: a column-level `email TEXT UNIQUE`
-      // (SQLite materializes an implicit `sqlite_autoindex_*`) and a separate
-      // `CREATE UNIQUE INDEX ... ON user (email)` (what `applySqliteAuthMigrations` emits).
-      // Any single-column, non-partial unique index over the column counts — the index NAME
-      // is never required. A single-column PRIMARY KEY counts too, including the
-      // `INTEGER PRIMARY KEY` rowid alias, which materializes no `origin = 'pk'` index row.
+      // A column is unique through a single-column PRIMARY KEY (including the rowid alias,
+      // which has no index row) or any single-column, non-partial unique index.
       const uniqueColumns = new Set<string>();
       const primaryKey = tableInfo.filter((row) => Number(row.pk) > 0);
       if (primaryKey.length === 1 && primaryKey[0]) {
@@ -124,15 +91,14 @@ export async function assertMigrationsProduceAuthSchema(
         partial?: number;
       }>;
       for (const index of indexes) {
-        // A PARTIAL unique index only constrains the rows matching its WHERE clause, so it
-        // does not make the column globally unique.
+        // A partial unique index constrains only the rows matching its WHERE clause.
         if (Number(index.unique) !== 1 || Number(index.partial ?? 0) !== 0) {
           continue;
         }
         const indexColumns = db.prepare(`PRAGMA index_info(${quote(index.name)})`).all() as Array<{
           name: string | null;
         }>;
-        // A composite unique index constrains the TUPLE, not this column on its own.
+        // A composite unique index constrains the tuple, not this column alone.
         if (indexColumns.length !== 1) {
           continue;
         }
@@ -141,16 +107,8 @@ export async function assertMigrationsProduceAuthSchema(
           uniqueColumns.add(foldIdentifier(only));
         }
       }
-      // The implicit `id` — the parent key every auth foreign key resolves against. SQLite
-      // only accepts a parent key that is uniquely constrained, so a migration that creates
-      // `id` as an ordinary column produces a schema whose FKs are DEAD: `CREATE TABLE`
-      // succeeds, `PRAGMA foreign_key_list` still reports the constraint, and then every
-      // statement touching the child table fails at prepare time with `foreign key mismatch`
-      // under `foreign_keys=ON` (which D1 always enforces) — i.e. auth breaks in production
-      // AFTER a green deploy. PRIMARY KEY and UNIQUE are both valid parent keys, so reuse
-      // `uniqueColumns` (it already accepts the single-column PK, the `INTEGER PRIMARY KEY`
-      // rowid alias, and any single-column non-partial unique index) rather than demanding
-      // PRIMARY KEY specifically.
+      // Auth foreign keys point at `id`. SQLite (and D1, which always enforces foreign keys)
+      // rejects a non-unique parent key at runtime with "foreign key mismatch".
       const notIdentity = req.columns
         .filter(
           (required) =>
@@ -168,24 +126,9 @@ export async function assertMigrationsProduceAuthSchema(
         );
       }
 
-      // NOT NULL — `PRAGMA table_info.notnull` answers it directly, with ONE exception. The
-      // `INTEGER PRIMARY KEY` rowid alias reports `notnull = 0`, but SQLite assigns a rowid on
-      // a NULL insert, so the column can never actually hold NULL; rejecting it would false-
-      // reject a common, legitimate schema.
-      //
-      // The declared type CANNOT decide this on its own. `INTEGER PRIMARY KEY DESC` is not a
-      // rowid alias — a historical SQLite quirk — yet `PRAGMA table_info` reports it
-      // identically to the real alias (`type = INTEGER`, `pk = 1`, `notnull = 0`) while a NULL
-      // insert genuinely stores NULL. What separates them is that a true alias IS the rowid,
-      // so SQLite materializes no primary-key index for it: `PRAGMA index_list` carries an
-      // `origin = 'pk'` row for `DESC`, for `TEXT PRIMARY KEY`, for `INT`/`BIGINT PRIMARY KEY`
-      // and for a composite PK, but none for `INTEGER PRIMARY KEY` / `INTEGER PRIMARY KEY ASC`.
-      // That is the discriminator used here — the absence of the `origin = 'pk'` row, read off
-      // the `index_list` the uniqueness check above already fetched, with no SQL text parsing.
-      // Note the test is the ORIGIN, not the row count: a rowid-alias table may still carry
-      // unrelated `origin = 'u'` / `origin = 'c'` index rows from a column-level UNIQUE or a
-      // `CREATE INDEX`. The single-column-PK and exact-`INTEGER` conditions are kept alongside
-      // it, so nothing widens beyond the one shape SQLite actually aliases to the rowid.
+      // The `INTEGER PRIMARY KEY` rowid alias reports `notnull = 0` but can never hold NULL.
+      // `INTEGER PRIMARY KEY DESC` looks the same in `table_info` yet is not an alias; only a
+      // real alias has no `origin = 'pk'` row in `index_list`.
       const hasPrimaryKeyIndex = indexes.some(
         (index) => String(index.origin ?? '').toLowerCase() === 'pk',
       );
@@ -202,12 +145,8 @@ export async function assertMigrationsProduceAuthSchema(
           .map((row) => foldIdentifier(row.name)),
       );
 
-      // The identity's own NOT NULL. SQLite permits NULL in any PRIMARY KEY column that is not
-      // the rowid alias — a longstanding file-format compatibility quirk — so `id text primary
-      // key` accepts rows carrying NO identity, and more than one of them, because NULLs never
-      // collide under a unique constraint. Reported apart from the ordinary required columns
-      // below: the constraint reads as already satisfied in the migration, so the message has
-      // to name the quirk to be actionable.
+      // SQLite allows NULL in a PRIMARY KEY column other than the rowid alias, so the message
+      // names that quirk.
       const nullableIdentity = req.columns
         .filter(
           (required) =>
@@ -226,7 +165,6 @@ export async function assertMigrationsProduceAuthSchema(
         );
       }
 
-      // Every other column the emitted schema marks `required`.
       const nullableRequired = req.columns
         .filter(
           (required) =>
@@ -258,11 +196,7 @@ export async function assertMigrationsProduceAuthSchema(
         );
       }
 
-      // References — the emitted schema points these columns at a parent row, and without the
-      // foreign key the migrations permit orphaned auth rows (e.g. a session with no user).
-      // `PRAGMA foreign_key_list` returns ONE ROW PER COLUMN, not one per constraint: the rows
-      // of a single constraint share an `id` and are ordered by `seq`. Grouping by `id` is what
-      // makes the width of each constraint visible, and the width is load-bearing — see below.
+      // `PRAGMA foreign_key_list` returns one row per column; rows of one constraint share `id`.
       const foreignKeys = db
         .prepare(`PRAGMA foreign_key_list(${quote(req.table)})`)
         .all() as Array<{
@@ -291,34 +225,17 @@ export async function assertMigrationsProduceAuthSchema(
           sameIdentifier(fk.from, required.column) &&
           typeof fk.table === 'string' &&
           sameIdentifier(fk.table, reference.table);
-        // ONLY a SINGLE-COLUMN foreign key satisfies an auth reference. SQLite applies
-        // MATCH SIMPLE, under which a COMPOSITE foreign key is skipped ENTIRELY whenever ANY
-        // of its child columns is NULL — so `FOREIGN KEY (userId, tenant) REFERENCES
-        // user(id, tenant)` with a nullable `tenant` lets a session naming a nonexistent user
-        // be inserted, exactly the orphan the `references` requirement exists to prevent.
-        // Matching per ROW would accept that constraint through its `userId` member alone.
-        // `PRAGMA foreign_key_check` cannot cover for this either: it reports orphaned DATA,
-        // and the freshly-migrated database it runs against holds no rows.
+        // Only a single-column foreign key counts: under MATCH SIMPLE, SQLite skips a composite
+        // key whenever any of its child columns is NULL.
         const matching = constraints.flatMap((group) =>
           group.length === 1 && group[0] && namesReference(group[0]) ? [group[0]] : [],
         );
         const composite = constraints.some(
           (group) => group.length > 1 && group.some(namesReference),
         );
-        // WHICH COLUMN the foreign key points at — a question of NAMES, and the only
-        // question this block answers. Whether SQLite will ACCEPT that parent key at all is
-        // orthogonal and is settled below by `PRAGMA foreign_key_check`, so nothing here
-        // needs to model SQLite's parent-key rules.
-        //
-        // `to` is NULL when the migration omitted the target column (`REFERENCES "user"`).
-        // SQLite resolves an omitted target ONLY to the parent's single-column PRIMARY KEY,
-        // so the shorthand names the required column only when that column IS the parent's
-        // PRIMARY KEY. The answer lives only in the PARENT's own `table_info`, which is why
-        // this reaches outside the table being validated. This check is load-bearing beyond
-        // the pragma: a foreign key aimed at a perfectly valid parent key that is the WRONG
-        // column (`REFERENCES "user"` where the parent's PRIMARY KEY is `email`, not `id`)
-        // is structurally sound, so `foreign_key_check` passes it — only this comparison
-        // catches it. An EXPLICIT `to` matches by name directly.
+        // This checks only which column the key names; `foreign_key_check` below decides
+        // whether SQLite accepts the parent key. A null `to` (`REFERENCES "user"`) means the
+        // parent's single-column PRIMARY KEY.
         const satisfied = matching.some((fk) => {
           if (fk.to != null) {
             return sameIdentifier(String(fk.to), reference.column);
@@ -348,28 +265,9 @@ export async function assertMigrationsProduceAuthSchema(
         }
       }
 
-      // AUTHORITATIVE structural gate for this table's foreign keys — ask SQLite instead of
-      // re-deriving its parent-key rules here. Those rules are subtler than they look: a
-      // parent key must be a PRIMARY KEY, or a UNIQUE index whose columns AND COLLATING
-      // SEQUENCES match the reference, and an omitted target column resolves only to the
-      // parent's PRIMARY KEY. Hand-modelling them easily lets a schema SQLite rejects pass
-      // (an ordinary parent column; a UNIQUE-only parent under the implicit shorthand; a
-      // unique index declared `COLLATE NOCASE` over a plainly declared column).
-      // `PRAGMA foreign_key_check` applies SQLite's own rule, so a case this file has not
-      // anticipated cannot pass.
-      //
-      // It reports a STRUCTURAL mismatch by THROWING (`foreign key mismatch - "child"
-      // referencing "parent"`), not by returning rows; returned rows mean orphaned DATA,
-      // which a freshly-migrated database holding no rows cannot have, but are surfaced too
-      // so neither outcome is silently dropped. Scoped to this table (the CHILD side) so an
-      // unrelated application table with its own broken foreign key is not this gate's
-      // business. Any other error is a real fault and propagates untouched.
-      //
-      // Why this matters: `CREATE TABLE` accepts a dead foreign key, and `PRAGMA
-      // foreign_key_list` echoes it back as if valid. Only when a statement touches the
-      // child does SQLite fail at PREPARE time with `foreign key mismatch` — under
-      // `foreign_keys=ON`, which D1 always enforces. Without this gate that surfaces as auth
-      // breaking in production AFTER a green deploy.
+      // Let SQLite apply its own parent-key rules. `CREATE TABLE` accepts an invalid parent
+      // key, which then fails at runtime; `foreign_key_check` reports it by throwing
+      // "foreign key mismatch". Any other error propagates.
       try {
         const violations = db
           .prepare(`PRAGMA foreign_key_check(${quote(req.table)})`)
@@ -408,19 +306,9 @@ export async function assertMigrationsProduceAuthSchema(
 }
 
 /**
- * Read the REQUIRED Better Auth schema (tables + columns) from the schema the BUILD
- * actually generated — ground truth, not a facsimile. `writeAuthDatabaseFiles`
- * (plugin-routing.ts) emits `<root>/.void/better-auth-schema.ts` during the build,
- * containing an `export const migrationSchema = { ... } as const;` literal —
- * `JSON.stringify(resolveVoidAuthMigrationSchema(...), null, 2)` derived under the
- * build's real mode, so it already reflects configured table/column RENAMES + PLUGIN
- * tables. The literal's top-level object closes with `}` at column 0, so the
- * `\n} as const;` terminator uniquely bounds the JSON (inner braces are indented).
- * The `id` column is the implicit PRIMARY KEY, so it is prepended to each table's
- * columns — matching `resolveVoidAuthMigrationSchema`'s field set exactly. Each field
- * also carries its `required` (NOT NULL) and `unique` flags and its `references` target,
- * so the check below can assert the CONSTRAINTS the schema requires and not merely the
- * names. Throws a fail-closed error when the artifact is missing/malformed.
+ * Read the required auth tables from the `.void/better-auth-schema.ts` the build emitted, so
+ * renamed and plugin tables are included. Its `migrationSchema` JSON literal closes with
+ * `\n} as const;` because inner braces are indented. Throws when the file is missing or malformed.
  */
 function readEmittedAuthMigrationSchema(root: string): Array<RequiredAuthTable> {
   const schemaPath = join(root, '.void', 'better-auth-schema.ts');
@@ -455,11 +343,7 @@ function readEmittedAuthMigrationSchema(root: string): Array<RequiredAuthTable>
   return migrationSchema.tables.map((table) => ({
     table: table.name,
     columns: [
-      // `id` is the implicit PRIMARY KEY — never carries `unique`/`references` of its own,
-      // and is absent from `fields`, so this synthesized descriptor is the ONLY thing that
-      // represents it. `primaryKey` makes the check assert it is a usable FK parent key
-      // (see {@link RequiredAuthColumn.primaryKey}); `required` makes it assert the column
-      // cannot be NULL, which PRIMARY KEY alone does not guarantee in SQLite.
+      // `id` is the implicit primary key and is absent from `fields`.
       { column: 'id', unique: false, required: true, primaryKey: true },
       ...Object.entries(table.fields).map(([column, field]) => ({
         column,
@@ -473,14 +357,7 @@ function readEmittedAuthMigrationSchema(root: string): Array<RequiredAuthTable>
   }));
 }
 
-/**
- * Default {@link CloudflareDeployDeps.validateAuthMigrations} seam: read the auth
- * schema the BUILD generated ({@link readEmittedAuthMigrationSchema}) and assert the
- * checked-in migrations produce it (applied to in-memory SQLite). Runs POST-build,
- * against ground truth — no auth-config subprocess, no mode/envDir divergence.
- * Throws on any missing table/column (or an unapplyable migration); the caller
- * renders `.message` + fails closed.
- */
+/** Assert after the build that the checked-in migrations produce the emitted auth schema. */
 export async function validateAuthMigrationSchema(
   root: string,
   migrations: Array<{ name: string; sql: string }>,
@@ -505,15 +382,8 @@ export function formatCloudflareDriftMessage(
 }
 
 /**
- * Run the SAME migration validations the MANAGED deploy runs before applying
- * migrations to remote D1 — schema drift (drizzle-kit), journal coherence, and
- * destructive-op-without-pragma — reusing the managed building blocks
- * ({@link hasDeploySchemaDrift} / {@link getDeploySchemaDriftMessage} /
- * `assertJournalCoherence` / `validateMigrations`). Unlike the managed
- * `assertDeploySchemaDriftFree` (which calls `process.exit` itself), this THROWS on
- * any failure so the Cloudflare orchestrator routes the exit through its injectable
- * seam. This is the default of the {@link CloudflareDeployDeps.assertMigrationsDeployable}
- * seam; tests inject a stub to avoid spawning drizzle-kit.
+ * Run the managed deploy's migration checks (schema drift, journal coherence, destructive
+ * statements without a pragma). Throws instead of exiting, so the caller handles the failure.
  */
 export function assertRemoteMigrationsDeployable(
   root: string,
@@ -531,15 +401,9 @@ export function assertRemoteMigrationsDeployable(
 }
 
 /**
- * wrangler 4.131's own migration-file order comparator, reproduced EXACTLY
- * (`compareMigrationPaths` / `compareSegments` / `leadingMigrationNumber`,
- * `wrangler-dist/cli.js` `src/d1/migrations/helpers.ts`): segment-by-segment, comparing each
- * segment's LEADING NUMERIC PREFIX (`parseInt(segment.split('_')[0], 10)`) numerically first,
- * so `2_x.sql` sorts BEFORE `10_x.sql` (lexicographic would invert them). A finite number
- * sorts before a non-numeric segment; equal/both-NaN falls back to lexicographic. This is the
- * exact order `d1 migrations apply` walks (`listFilesRelative(...).sort(compareMigrationPaths)`
- * → `getMigrationNames`), so ordering the gated set the same way tells us what remote D1 will
- * receive, in what order.
+ * The cf CLI's D1 migration order: per path segment, the leading number before `_` compares
+ * numerically (`2_x.sql` before `10_x.sql`), numbers sort before non-numbers, and ties fall
+ * back to string order.
  */
 function leadingWranglerMigrationNumber(relativePath: string): number {
   const firstSegment = relativePath.split('/')[0] ?? '';
@@ -652,21 +516,10 @@ function listWranglerMigrationFiles(directory: string, pattern: string): Array<s
 }
 
 /**
- * Assert the migration files wrangler 4.131 will APPLY — in the ORDER it applies them — equal
- * the gated source set. wrangler resolves its OWN files from the D1 entry's `migrations_dir`
- * (relative to the config-file dir) with either the default `<dir>/*.sql` pattern or the
- * configured `migrations_pattern`, tracks each by its relative `.sql` name, and applies them
- * sorted by its numeric-prefix comparator ({@link compareWranglerMigrationPaths}) — the exact
- * sequence `d1 migrations apply` runs against REMOTE D1. This backend VALIDATES the set
- * `collectMigrations` reads (flat dir, `seed.sql` excluded, sorted lexicographically). Two
- * things must hold: (1) SET equality by name AND content — a stray/extra file (e.g. `seed.sql`,
- * which `collectMigrations` skips but wrangler's `*.sql` matches), a differing dir, or a
- * divergent content would otherwise be applied UNVALIDATED; and (2) ORDER parity — the numeric
- * order wrangler applies must equal Void's gated order position-for-position, so the local
- * runner + deploy gates validate the exact order remote D1 receives (an unpadded prefix like
- * `2_` vs `10_` sorts differently lexicographically-vs-numerically and diverges — reject).
- * Custom patterns are accepted only when their exact result matches that gated set. Exported for
- * unit testing.
+ * Assert the files `d1 migrations apply` would apply from the binding's `migrations_dir` and
+ * `migrations_pattern` match the validated migrations by name and content, and in the same
+ * order. Otherwise a stray file such as `seed.sql`, or an unpadded `2_` vs `10_` prefix, would
+ * reach remote D1 unvalidated or out of order.
  */
 export async function checkWranglerMigrationApplySet(
   configPath: string,
@@ -696,7 +549,6 @@ export async function checkWranglerMigrationApplySet(
   const gatedNames = gated.map((m) => m.name.replace(/\\/g, '/'));
   const gatedContent = new Map(gatedNames.map((name, i) => [name, gated[i]!.sql]));
 
-  // 1) SET equality by name + content.
   const wranglerSet = new Set(wranglerNames);
   const extra = wranglerNames.filter((k) => !gatedContent.has(k));
   const missing = gatedNames.filter((k) => !wranglerSet.has(k)).sort();
@@ -723,8 +575,6 @@ export async function checkWranglerMigrationApplySet(
     return { ok: false, reason: lines.join('\n') };
   }
 
-  // 2) ORDER parity — wrangler's numeric apply order must equal Void's gated (collectMigrations)
-  // order position-for-position, so the order remote D1 receives is the order Void validated.
   const orderDiffers =
     gatedNames.length !== wranglerNames.length ||
     gatedNames.some((name, i) => name !== wranglerNames[i]);
@@ -753,14 +603,10 @@ export async function applyAndVerifyRemoteD1Migrations(
   runWrangler: DeployWranglerRun,
   assertUploaderStillPinned: () => boolean,
 ): Promise<boolean> {
-  // 10. Apply pending migrations to remote D1 — AFTER all local + ground-truth gates pass, so a
-  // failed gate never mutates remote D1. Uses the token resolved + validated at step 8d, and the
-  // pinned root config (`-c`), which targets the account already verified by provision/drift.
+  // Runs only after every local gate passes, so a failed gate never changes remote D1.
   if (d1MigrateToken) {
     log.step('Applying D1 migrations...');
-    // The local migration gates above ran project code (drizzle-kit loaded db/schema.ts), which
-    // could have overwritten the hashed uploader bundle after the last check. Re-verify against the
-    // pre-build baseline immediately before this credentialed, remote-mutating apply.
+    // The local gates ran project code, which could have replaced the pinned uploader.
     if (!assertUploaderStillPinned()) {
       return false;
     }
@@ -770,7 +616,7 @@ export async function applyAndVerifyRemoteD1Migrations(
         { capture: false },
       ),
     );
-    if (!isCleanWranglerExit(migrate)) {
+    if (!isCleanCloudflareExit(migrate)) {
       log.error(
         `deploy: remote D1 migrations failed for "${d1MigrateToken}" (exit ${String(migrate.status)}). ` +
           'Fix the migration and rerun. Note: D1 always enforces foreign_keys=ON — a Drizzle ' +
@@ -779,8 +625,7 @@ export async function applyAndVerifyRemoteD1Migrations(
       return false;
     }
 
-    // Read the structured pending set after apply; a clean apply exit alone does not prove
-    // the schema is current. Recheck integrity before this separate credentialed read.
+    // A clean exit does not prove the schema is current, so read the pending set.
     if (!assertUploaderStillPinned()) {
       return false;
     }
@@ -790,7 +635,7 @@ export async function applyAndVerifyRemoteD1Migrations(
         { capture: true },
       ),
     );
-    if (!isCleanWranglerExit(migrateList)) {
+    if (!isCleanCloudflareExit(migrateList)) {
       log.error(
         `deploy: could not verify the remote migration state for "${d1MigrateToken}" ` +
           `(\`d1 migrations list\` exit ${String(migrateList.status)}). Refusing to deploy against ` +
diff --git a/packages/void/src/cli/deploy-provision.ts b/packages/void/src/cli/deploy-provision.ts
deleted file mode 100644
index 93ce69d5a..000000000
--- a/packages/void/src/cli/deploy-provision.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/** The provision module, loaded lazily inside the Cloudflare fork only. */
-type ProvisionModule = typeof import('./provision.ts');
-
-export let loadedProvisionModule: ProvisionModule | undefined;
-
-/**
- * Dynamically load the provision module (memoized). Called only from the async
- * Cloudflare fork (`runCloudflareDeploy` / `computeDesiredCloudflareResources`)
- * so a managed deploy never imports it — and thus never loads `proper-lockfile`.
- */
-export async function loadProvisionModule(): Promise<ProvisionModule> {
-  loadedProvisionModule ??= await import('./provision.ts');
-  return loadedProvisionModule;
-}
-
-/**
- * The provision module after it has been loaded by the fork, for the SYNC helpers
- * (`resolveDeployTransport` / `deployChildEnv` / `createDeployWranglerRunner`)
- * that cannot await. They only ever run after {@link loadProvisionModule} has
- * resolved inside {@link runCloudflareDeploy}, so this never throws in practice.
- */
-export function requireProvisionModule(): ProvisionModule {
-  if (!loadedProvisionModule) {
-    throw new Error('internal: provision module accessed before it was loaded');
-  }
-  return loadedProvisionModule;
-}
diff --git a/packages/void/src/cli/deploy-resources.ts b/packages/void/src/cli/deploy-resources.ts
index 2d9db3c22..9bee0675f 100644
--- a/packages/void/src/cli/deploy-resources.ts
+++ b/packages/void/src/cli/deploy-resources.ts
@@ -12,13 +12,13 @@ import { type DatabaseDialect, type VoidConfig } from '../config.ts';
 import { collectRevalidate, hasRevalidate } from '../isr-config.ts';
 import { hasEmailHandlers, type EmailHandlersScan } from '../router/email.ts';
 import { DEFAULT_VOID_AI_BINDING } from './deploy-binding-snapshot.ts';
-import { loadProvisionModule } from './deploy-provision.ts';
+import { type CloudflareAuthSecretFailureReason } from './deploy-types.ts';
 import {
-  type CloudflareAuthSecretFailureReason,
-  type DeployWranglerRunResult,
-} from './deploy-types.ts';
-// Type-only: the provision module must load lazily (see `deploy-types.ts`).
-import type { DesiredResourceSet, ProvisionDriftEntry } from './provision.ts';
+  isRealD1Id,
+  isRealKvId,
+  type DesiredResourceSet,
+  type ProvisionDriftEntry,
+} from './provision.ts';
 
 /** Human labels for a drifted resource kind, used in guidance messages. */
 export const CLOUDFLARE_RESOURCE_LABELS: Record<ProvisionDriftEntry['kind'], string> = {
@@ -41,24 +41,13 @@ export class CloudflareAuthSecretError extends Error {
   }
 }
 
-/** True only for a wrangler child that ran to completion with a clean exit 0. */
-export function isCleanWranglerExit(result: DeployWranglerRunResult): boolean {
-  return (
-    result.status === 0 && result.signal == null && (result.error == null || result.error === '')
-  );
-}
-
 const CLOUDFLARE_WORKERS_PAID_URL = 'https://dash.cloudflare.com/?to=/:account/workers/plans';
 
 const CLOUDFLARE_CONTAINERS_PRICING_URL = 'https://developers.cloudflare.com/containers/pricing/';
 
 /**
- * Actionable, output-independent guidance for the Sandbox entitlement probe.
- *
- * A nonzero `wrangler containers list` is intentionally not classified more narrowly: the
- * Containers API uses the same failure surface when the account has no Workers Paid entitlement
- * and when an API token lacks Containers / Cloudchamber permission. Claiming either one as fact
- * would send some users down the wrong path, so the message gives both deterministic remedies.
+ * Guidance for a failed Containers check. Cloudflare reports a missing Workers Paid plan and a
+ * token without Containers permission the same way, so the message gives both remedies.
  */
 export function formatCloudflareSandboxUnavailable(options?: { preflight?: boolean }): string {
   return [
@@ -85,12 +74,8 @@ export function formatCloudflareSandboxUnavailable(options?: { preflight?: boole
 const MAX_WORKER_NAME_LENGTH = 63;
 
 /**
- * Sanitize a raw name into a valid Cloudflare Worker name — the SAME rule
- * `@cloudflare/vite-plugin`'s `toValidWorkerName` applies (lowercase, `_`→`-`,
- * any non `[a-z0-9-]`→`-`, strip leading/trailing dashes, ≤63 chars, empty →
- * `my-worker`). Deriving it identically means the name we pin in the config and
- * the name the build emits into `dist/ssr/wrangler.json` agree, so
- * `wrangler secret list -c <root>` and `wrangler deploy` target one worker.
+ * Same rule as `@cloudflare/vite-plugin`'s `toValidWorkerName`, so the name pinned in the
+ * config matches the name the build emits.
  */
 function toValidWorkerName(raw: string): string {
   const name = raw
@@ -104,22 +89,8 @@ function toValidWorkerName(raw: string): string {
 }
 
 /**
- * Derive a `<worker>-<suffix>` resource name, RESERVING the suffix's budget before
- * the length cap applies.
- *
- * `toValidWorkerName` truncates whatever string it is handed, so
- * `toValidWorkerName(`${workerName}-kv`)` cuts from the RIGHT — the end that carries
- * the suffix. A worker name at or above the cap therefore loses the suffix entirely
- * and every derivation collapses to the bare (truncated) worker name, so `KV` and
- * `ISR_CACHE` would ask for ONE namespace title. Since KV titles are not
- * account-unique and the provisioner matches remote namespaces BY TITLE (re-listing
- * per binding), the second binding would adopt the namespace the first just created:
- * two bindings sharing one namespace and one quota slot.
- *
- * The suffix is kept intact by trimming the BASE to `63 - suffix.length - 1` first.
- * When the suffix survives the plain derivation (every worker name short enough to
- * leave room — the normal case), the result is byte-identical to what it has always
- * been, so no existing app's resource name churns.
+ * `<worker>-<suffix>` within the length cap. A long worker name is trimmed instead of the
+ * suffix, so `KV` and `ISR_CACHE` never derive the same namespace title.
  */
 function suffixedResourceName(workerName: string, suffix: string): string {
   const full = toValidWorkerName(`${workerName}-${suffix}`);
@@ -133,13 +104,8 @@ function suffixedResourceName(workerName: string, suffix: string): string {
 }
 
 /**
- * Derive the worker name the way the CF plugin's `getWorkerNameFromProject` does
- * MINUS the `WRANGLER_CI_OVERRIDE_NAME` precedence: package.json `name` → directory
- * basename → `my-worker`. The override is deliberately NOT consulted — this backend
- * scrubs it from every child env and fences it in the project dotenv (see
- * {@link deployChildEnv} / {@link assertNoConfigOverrideInProjectDotenv}), so the
- * build emits (and the deploy uploads) the non-override name; deriving from the
- * override here would pin a name the scrubbed build never produces.
+ * Worker name as the CF plugin derives it (package.json `name`, then the directory name),
+ * ignoring `WRANGLER_CI_OVERRIDE_NAME`: deploy scrubs that override from the build.
  */
 export function deriveWorkerName(root: string): string {
   let pkgName: string | undefined;
@@ -155,29 +121,13 @@ export function deriveWorkerName(root: string): string {
 }
 
 /**
- * Fail closed when two KV bindings of this deploy would end up on ONE namespace.
- *
- * KV is the only resource kind where a name collision silently WORKS: titles are not
- * account-unique, the provisioner matches remote namespaces BY TITLE, and it re-lists
- * per binding — so a second binding desiring an already-created title adopts that
- * namespace and reports success. Both checks below are cheap and purely local:
- *
- *  1. DESIRED titles must be distinct — catches any future suffix collision at the
- *     source, before a single namespace is created.
- *  2. Already-RECORDED ids must be distinct — an app provisioned before the suffix
- *     budget was reserved can carry two bindings pointing at the same namespace id.
- *     Read-first is keyed by binding and both entries hold a real id, so the
- *     provisioner would skip both forever and never surface it.
- *
- * Scoped to KV (and to the bindings THIS deploy manages): D1/R2/Hyperdrive names live
- * in separate Cloudflare namespaces and are identity-checked against their stored
- * values elsewhere.
+ * Fail when two KV bindings would share one namespace. KV titles are not account-unique and
+ * the provisioner adopts a namespace by title, so check desired titles and recorded ids.
  */
 function assertDistinctKvNamespaces(
   kvNamespaces: Array<{ binding: string; title: string }>,
   config: Record<string, unknown>,
   configPath: string,
-  isRealKvId: (value: unknown) => value is string,
 ): void {
   const bindingByTitle = new Map<string, string>();
   for (const { binding, title } of kvNamespaces) {
@@ -222,15 +172,9 @@ function assertDistinctKvNamespaces(
 }
 
 /**
- * Compute the DESIRED id/name-bearing Cloudflare resources from SOURCE
- * (pre-build, fail-fast) — the single set shared by the provision and drift
- * paths. Consumes the same application analysis as the plugin and managed
- * packaging; provider identities and stored resource names are resolved here.
- *
- * Resource NAMES prefer the value already stored in the root wrangler config
- * (so a re-provision reuses the same database/bucket and the provisioner's
- * stored-name identity check passes); otherwise they default off the worker
- * name. Returns a per-binding REASON map used to explain drift.
+ * Desired Cloudflare resources, computed from source before the build and shared by the
+ * provision and drift paths. Names prefer the value stored in the root config, so a
+ * re-provision reuses the same resource. `reasons` explains each binding in drift messages.
  */
 export async function computeDesiredCloudflareResources(
   root: string,
@@ -240,59 +184,27 @@ export async function computeDesiredCloudflareResources(
 ): Promise<{
   desired: DesiredResourceSet;
   reasons: Map<string, string>;
-  /** Whether Void-managed auth is enabled (drives the auth-migration gate). */
   authEnabled: boolean;
-  /** Resolved database dialect (sqlite → D1, postgresql → Hyperdrive). */
+  /** sqlite uses D1; postgresql and mysql use Hyperdrive. */
   dialect: DatabaseDialect;
-  /** Absolute migrations dir on disk (sourceDir-aware) — used by the migrate gates. */
+  /** Absolute migrations directory (sourceDir-aware). */
   migrationsDir: string;
-  /** Checked-in migrations (`db/migrations/*.sql`) collected pre-build. */
   migrations: Array<{ name: string; sql: string }>;
-  /**
-   * Whether the pre-build inference found Workers AI use in the source — the SAME `needsAI`
-   * signal `shouldBindWorkersAi` (index.ts) gates the emitted AI binding on. Threaded into
-   * {@link verifyGeneratedDeployConfig} to authorize that binding.
-   */
+  /** Source uses Workers AI, which authorizes the emitted AI binding. */
   needsAI: boolean;
   /** Workers AI binding emitted by the build (default `AI`). */
   aiBindingName: string;
-  /**
-   * Whether Void's build emits the sandbox container application — the SAME signal `mergeBindings`
-   * (index.ts) gates emission on: `isSandboxEnabled(config)` (a `sandbox` field in `void.config.ts`) OR
-   * the import walk detecting a `void/sandbox` import (`inferProjectBindings(...).needsSandbox`).
-   * Threaded into {@link verifyGeneratedDeployConfig} (via {@link reconstructExpectedContainers})
-   * to pin the emitted `containers` array.
-   */
+  /** `void.config.ts` enables Sandbox or the source imports `void/sandbox`. */
   needsSandbox: boolean;
   /** Whether the source imports void/live and the build may emit its Durable Object. */
   needsLive: boolean;
   analysis: ApplicationAnalysis;
-  /**
-   * The exact cron trigger schedules Void's build emits into `dist/ssr/wrangler.json`
-   * `triggers.crons`, reconstructed PRE-BUILD from the SAME `scanJobsSync(root, paths.cronsDir)`
-   * scan index.ts derives them from (`scanJobsSync(...).flatMap((job) => job.crons)`). Threaded
-   * into {@link verifyGeneratedDeployConfig} to pin the emitted schedules against a build that
-   * injected, dropped, or retargeted a Cron Trigger.
-   */
+  /** Cron schedules the build emits into `triggers.crons`. */
   expectedCrons: Array<string>;
-  /**
-   * Whether the app uses email at all — inbound `email/` handlers ({@link hasEmailHandlers}) OR
-   * an outbound `void/email` import (the import walk's `needsEmail`, the SAME signal index.ts
-   * gates the dev inbox on). Gates the Mode B email step (3b-ii, design doc 0078); the managed
-   * platform path never reads it.
-   */
+  /** Inbound `email/` handlers or an outbound `void/email` import. */
   needsEmail: boolean;
-  /**
-   * The `email/` handler scan the email step derives `addresses` from — the SAME
-   * `scanEmailHandlersSync(paths.sourceRoot)` index.ts compiles the worker's `email()` export
-   * from, so the routed addresses can never disagree with the dispatcher.
-   */
   emailHandlers: EmailHandlersScan;
 }> {
-  // The id predicates are resolved via the memoized dynamic import so this exported
-  // helper works when called directly in unit tests (outside the fork) without a
-  // static provision edge that would eagerly load the provision lifecycle.
-  const { isRealD1Id, isRealKvId } = await loadProvisionModule();
   const analysis = application
     ? await completeApplicationAnalysis(application)
     : await analyzeApplication(root, { config: voidConfig, environment: 'prod' });
@@ -301,16 +213,7 @@ export async function computeDesiredCloudflareResources(
   const config = parseRootWranglerConfig(configPath);
   const workerName = readWranglerTopLevelString(config, 'name') ?? deriveWorkerName(root);
 
-  // Checked-in migrations count toward the database gate, matching the managed
-  // manifest (`buildVoidManifest`: `needsD1 || needsAuth || hasMigrations`). Without
-  // this a migration-only SQLite app would provision no D1 and silently skip remote
-  // migrations. Collected ONCE pre-build from `db/migrations/` (sourceDir-aware) and
-  // carried through so the migrate step can skip when there are none and run the
-  // deploy gates on the exact same files.
-  // Config-relative migrations dir wrangler will resolve from the config-file dir
-  // (the root). sourceDir moves the files to `<sourceDir>/db/migrations`, so the
-  // written `migrations_dir` must include it — a hardcoded `./db/migrations` would
-  // point wrangler at the wrong (or missing) folder for a sourceDir project.
+  // `migrations_dir` is relative to the root config, and sourceDir moves the folder.
   const migrationsDirRelative = paths.sourceDir
     ? `./${paths.sourceDir}/db/migrations`
     : './db/migrations';
@@ -318,11 +221,7 @@ export async function computeDesiredCloudflareResources(
   const desired: DesiredResourceSet = { kvNamespaces: [], queues: [] };
   const reasons = new Map<string, string>();
 
-  // Database — desired on source-use OR auth OR checked-in migrations (the SAME
-  // predicate the managed manifest applies), with the dialect selecting D1 (sqlite)
-  // vs Hyperdrive (PostgreSQL/MySQL). This keeps provision/drift equivalent to the build:
-  // a migration-only SQLite app still provisions D1, and an unused pg config does
-  // not needlessly require Hyperdrive.
+  // needsDatabase covers source use, auth and checked-in migrations, like the managed manifest.
   const databaseReason = analysis.reasons.database[0]!;
   if (needsDatabase && dialect === 'sqlite') {
     const binding = bindingNames?.d1 ?? 'DB';
@@ -341,8 +240,6 @@ export async function computeDesiredCloudflareResources(
             ? storedName
             : undefined) ||
           suffixedResourceName(workerName, 'db');
-    // Carry the sourceDir-aware config-relative migrations dir so the provisioner
-    // writes the correct `migrations_dir` (it otherwise hardcodes `./db/migrations`).
     desired.d1 = { binding, name, migrationsDir: migrationsDirRelative };
     reasons.set(binding, databaseReason);
   }
@@ -376,9 +273,7 @@ export async function computeDesiredCloudflareResources(
   // Queues (resource names — account-unique; the build binds them for native apps).
   desired.queues = analysis.queues.map((q) => q.name);
 
-  // Hyperdrive (PostgreSQL/MySQL apps) — same database gate as D1, dialect-selected. The
-  // connection string is only consumed on a fresh create; a re-provision reads-first
-  // from the config id and never needs it.
+  // The connection string is used only on create; later runs read the stored id.
   if (needsDatabase && dialect !== 'sqlite') {
     const binding = 'HYPERDRIVE';
     desired.hyperdrive = {
@@ -392,10 +287,7 @@ export async function computeDesiredCloudflareResources(
     );
   }
 
-  // ISR_CACHE (a KV namespace) — self-host-only, not in the import walk. Desired
-  // when the merged revalidate config (void.config.ts `routing.revalidate` + per-page
-  // `export const revalidate`) turns ISR on — the SAME gate the build's `emitIsr`
-  // uses (`plugin-routing.ts`).
+  // ISR_CACHE is not in the import walk; this matches the build's `emitIsr` gate.
   const pageScan = analysis.scan.pages;
   if (hasRevalidate(collectRevalidate(voidConfig, pageScan))) {
     const binding = 'ISR_CACHE';
@@ -403,19 +295,9 @@ export async function computeDesiredCloudflareResources(
     reasons.set(binding, 'routes use `revalidate` (ISR) — needs an ISR_CACHE KV namespace');
   }
 
-  // Every KV binding must own its namespace — both the titles this deploy would
-  // provision and the ids an earlier provision already recorded.
-  assertDistinctKvNamespaces(desired.kvNamespaces, config, configPath, isRealKvId);
+  assertDistinctKvNamespaces(desired.kvNamespaces, config, configPath);
 
-  // Cron trigger schedules — the EXACT expression index.ts emits into `triggers.crons`
-  // (`scanJobsSync(root, paths.cronsDir).flatMap((job) => job.crons)`), from the SAME scan and the
-  // SAME `paths` the build's emission sees, so a legitimate build's emitted schedules multiset-equal
-  // this reconstruction.
   const expectedCrons = [...new Set(analysis.jobs.flatMap((job) => job.crons))];
-
-  // Email — the handler directory is scanned from the SAME sourceRoot index.ts compiles it from
-  // (`scanEmailHandlersSync(paths.sourceRoot)`); outbound-only use shows up as the import walk's
-  // `needsEmail` (a `void/email` import anywhere in the scan dirs).
   const emailHandlers = analysis.email;
 
   return {
@@ -431,10 +313,6 @@ export async function computeDesiredCloudflareResources(
     expectedCrons,
     needsEmail: bindings.needsEmail === true || hasEmailHandlers(emailHandlers),
     emailHandlers,
-    // Mirror index.ts's emission signal EXACTLY: the sandbox container is emitted when
-    // `void.config.ts` enables it OR the source imports `void/sandbox` (the import-walk signal). Using
-    // `isSandboxEnabled` alone would miss an import-only sandbox app (e.g. kitchen-sink) and the
-    // container pin would then FALSE-POSITIVE a legitimate build.
     needsSandbox: bindings.needsSandbox,
     needsLive: bindings.needsLive === true,
   };
diff --git a/packages/void/src/cli/deploy-setup.ts b/packages/void/src/cli/deploy-setup.ts
index f03c19805..444f7d222 100644
--- a/packages/void/src/cli/deploy-setup.ts
+++ b/packages/void/src/cli/deploy-setup.ts
@@ -49,7 +49,7 @@ export async function maybeSetupDeployProject(root: string): Promise<ProjectConf
   });
   if (result.action === 'select') {
     const config = { projectId: result.project.id, slug: result.project.slug };
-    writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
+    writeProjectConfig(root, attachSelectedPlatform(config, client.apiUrl));
     log.step(`Linked project: ${config.slug}`);
     return config;
   }
diff --git a/packages/void/src/cli/deploy-transport.ts b/packages/void/src/cli/deploy-transport.ts
index 0325f20cb..7261ee1e0 100644
--- a/packages/void/src/cli/deploy-transport.ts
+++ b/packages/void/src/cli/deploy-transport.ts
@@ -4,7 +4,12 @@ import { scanWranglerDotenvKeys } from '../shared/dotenv.ts';
 import { CLOUDFLARE_DEPLOY_BUILD_ENV } from '../shared/env.ts';
 import { WRANGLER_AUTH_CREDENTIAL_ENV_VARS } from '../shared/untrusted-env.ts';
 import { CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV } from '../shared/version-metadata.ts';
-import { requireProvisionModule, loadedProvisionModule } from './deploy-provision.ts';
+import {
+  assertNoTransportRedirectInProjectDotenv,
+  deleteEnvVarCaseAware,
+  provisionEnv,
+  resolvePinnedApiBaseUrl,
+} from './provision.ts';
 
 /**
  * Marks a build child as driven by a MANAGED `void deploy`.
@@ -21,15 +26,13 @@ import { requireProvisionModule, loadedProvisionModule } from './deploy-provisio
  * later `void dev` in the same shell.
  *
  * Deliberately NOT set by `runCloudflareDeploy` (`--platform cloudflare`): that flow
- * hands the built output to `wrangler deploy` against the user's own account and IS the
- * self-host path the warning is about. (It rejects framework SSR outright today, so no
- * Class A build reaches it either way.)
+ * deploys the built output to the user's own account and IS the self-host path the
+ * warning is about.
  */
 export const MANAGED_DEPLOY_BUILD_ENV = { VOID_DEPLOY_BUILD: '1' } as const;
 
 /** Remove managed-only build markers from an explicit native Cloudflare child. */
 export function scrubManagedDeployBuildMarkers(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const { deleteEnvVarCaseAware } = requireProvisionModule();
   deleteEnvVarCaseAware(env, 'VOID_DEPLOY_PROJECT_ID');
   deleteEnvVarCaseAware(env, CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV);
   for (const name of Object.keys(MANAGED_DEPLOY_BUILD_ENV)) {
@@ -72,6 +75,13 @@ const DEPLOY_WRANGLER_DOTENV_FILES = ['.env', '.env.local', '.env.', '.env..loca
  */
 const DEPLOY_VITE_DOTENV_FILES = ['.env', '.env.local', '.env.production', '.env.production.local'];
 
+/** The first non-blank ambient selector of a non-top-level worker/config, if any. */
+export function findAmbientConfigOverride(): string | undefined {
+  return ['CLOUDFLARE_ENV', 'CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH'].find((name) =>
+    process.env[name]?.trim(),
+  );
+}
+
 /**
  * FAIL CLOSED when the AMBIENT env selects a non-top-level worker/config for the
  * Cloudflare backend, which deploys the top-level environment of the canonical root
@@ -80,16 +90,15 @@ const DEPLOY_VITE_DOTENV_FILES = ['.env', '.env.local', '.env.production', '.env
  * rather than silently deploy a target the drift-check / provision never reasoned about.
  */
 function assertNoAmbientConfigOverride(): void {
-  const cloudflareEnv = process.env.CLOUDFLARE_ENV;
-  if (typeof cloudflareEnv === 'string' && cloudflareEnv.trim().length > 0) {
+  const override = findAmbientConfigOverride();
+  if (override === 'CLOUDFLARE_ENV') {
     throw new Error(
       'CLOUDFLARE_ENV is set. --platform cloudflare deploys the TOP-LEVEL environment of ' +
         'your root wrangler config only (a named environment can carry a different account, ' +
         'worker name, or binding set). Unset CLOUDFLARE_ENV and retry.',
     );
   }
-  const configPathOverride = process.env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH;
-  if (typeof configPathOverride === 'string' && configPathOverride.trim().length > 0) {
+  if (override) {
     throw new Error(
       'CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH is set. --platform cloudflare builds from the ' +
         'canonical root wrangler config only. Unset it and retry.',
@@ -97,6 +106,29 @@ function assertNoAmbientConfigOverride(): void {
   }
 }
 
+/** Which of `names` the project dotenv `file` declares; win32 keys match case-insensitively. */
+function findDotenvDeclaration(
+  root: string,
+  file: string,
+  names: ReadonlyArray<string>,
+  platform: NodeJS.Platform,
+): string | undefined {
+  const caseInsensitive = platform === 'win32';
+  const rawKeys = scanWranglerDotenvKeys(join(root, file));
+  const keys = caseInsensitive ? new Set([...rawKeys].map((key) => key.toLowerCase())) : rawKeys;
+  return names.find((name) => keys.has(caseInsensitive ? name.toLowerCase() : name));
+}
+
+/** The first dotenv file wrangler reloads that declares `WRANGLER_CI_OVERRIDE_NAME`. */
+export function findWranglerCiOverrideDotenvFile(
+  root: string,
+  platform: NodeJS.Platform = process.platform,
+): string | undefined {
+  return DEPLOY_WRANGLER_DOTENV_FILES.find((file) =>
+    findDotenvDeclaration(root, file, ['WRANGLER_CI_OVERRIDE_NAME'], platform),
+  );
+}
+
 /**
  * FAIL CLOSED when the project's dotenv files declare a deploy-time config-override
  * selector. wrangler / Vite reload dotenv on every command, so a repo dotenv would
@@ -111,27 +143,25 @@ export function assertNoConfigOverrideInProjectDotenv(
   root: string,
   platform: NodeJS.Platform = process.platform,
 ): void {
-  const caseInsensitive = platform === 'win32';
-  const declaresAny = (file: string, names: ReadonlyArray<string>): string | undefined => {
-    const rawKeys = scanWranglerDotenvKeys(join(root, file));
-    const keys = caseInsensitive ? new Set([...rawKeys].map((key) => key.toLowerCase())) : rawKeys;
-    return names.find((name) => keys.has(caseInsensitive ? name.toLowerCase() : name));
-  };
   // WRANGLER_CI_OVERRIDE_NAME reaches the DEPLOY step via wrangler's `--env=` dotenv reload.
-  for (const file of DEPLOY_WRANGLER_DOTENV_FILES) {
-    if (declaresAny(file, ['WRANGLER_CI_OVERRIDE_NAME'])) {
-      throw new Error(
-        `the project file "${file}" sets WRANGLER_CI_OVERRIDE_NAME, which wrangler reloads on ` +
-          `every command and applies AFTER config load to REPLACE the deployed worker name — so ` +
-          `\`wrangler deploy\` would upload a worker whose name was never validated. Remove it from ` +
-          `"${file}" (set it in your shell/CI only if you truly need a CI name override).`,
-      );
-    }
+  const ciOverrideFile = findWranglerCiOverrideDotenvFile(root, platform);
+  if (ciOverrideFile) {
+    throw new Error(
+      `the project file "${ciOverrideFile}" sets WRANGLER_CI_OVERRIDE_NAME, which wrangler reloads on ` +
+        `every command and applies AFTER config load to REPLACE the deployed worker name — so ` +
+        `\`wrangler deploy\` would upload a worker whose name was never validated. Remove it from ` +
+        `"${ciOverrideFile}" (set it in your shell/CI only if you truly need a CI name override).`,
+    );
   }
   // CLOUDFLARE_ENV / CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH reach the BUILD via Vite's
   // production `loadEnv`, whose file set is disjoint from wrangler's `--env=` files.
   for (const file of DEPLOY_VITE_DOTENV_FILES) {
-    const offender = declaresAny(file, ['CLOUDFLARE_ENV', 'CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH']);
+    const offender = findDotenvDeclaration(
+      root,
+      file,
+      ['CLOUDFLARE_ENV', 'CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH'],
+      platform,
+    );
     if (offender) {
       throw new Error(
         `the project file "${file}" sets ${offender}, which the Cloudflare Vite plugin reads at ` +
@@ -151,11 +181,10 @@ export function assertNoConfigOverrideInProjectDotenv(
  * Returns the single resolved API base URL to pin into every child env.
  */
 export function resolveDeployTransport(root: string, rootConfig: Record<string, unknown>): string {
-  const provision = requireProvisionModule();
   assertNoAmbientConfigOverride();
-  provision.assertNoTransportRedirectInProjectDotenv(root);
+  assertNoTransportRedirectInProjectDotenv(root);
   assertNoConfigOverrideInProjectDotenv(root);
-  return provision.resolvePinnedApiBaseUrl(
+  return resolvePinnedApiBaseUrl(
     process.env,
     readWranglerTopLevelString(rootConfig, 'compliance_region'),
   );
@@ -167,27 +196,21 @@ export function resolveDeployTransport(root: string, rootConfig: Record<string,
  * selector incl. `CLOUDFLARE_ENV` + win32 case variants, pins ONE account + API base),
  * then scrubs the deploy-specific config-override selectors on top.
  *
- * This is the env {@link createDeployWranglerRunner} spawns `whoami` / `d1 migrations apply`
- * / `deploy` with, so it deliberately KEEPS the wrangler-auth credentials — only the
- * untrusted-code children layer {@link scrubWranglerAuthCredentials} on top. Exported so a
- * test can assert that directly.
+ * {@link createDeployWranglerRunner} runs the deploy's Cloudflare operations with this
+ * env, so it KEEPS the Cloudflare credentials; only children that run project code layer
+ * {@link scrubWranglerAuthCredentials} on top.
  */
 export function deployChildEnv(
   accountId: string | undefined,
   apiBaseUrl: string,
 ): NodeJS.ProcessEnv {
-  const provision = requireProvisionModule();
-  const env = provision.provisionEnv({ accountId, apiBaseUrl });
+  const env = provisionEnv({ accountId, apiBaseUrl });
   for (const name of DEPLOY_CONFIG_OVERRIDE_ENV_VARS) {
-    provision.deleteEnvVarCaseAware(env, name);
+    deleteEnvVarCaseAware(env, name);
   }
-  // Pin WRANGLER_LOG=log for the whole deploy so wrangler's `d1 migrations list` sentinels
-  // ('No migrations to apply!' / 'Migrations to be applied:'), emitted at logger level
-  // `log`, are NEVER suppressed by an ambient WRANGLER_LOG=none|error|warn|info — otherwise
-  // a declined/partial apply prints no marker and the pending-check would pass open. The
-  // canonical spelling is scrubbed case-aware FIRST so no mixed-case ambient value shadows
-  // the pin on win32; `log` is wrangler's own default level, so normal output is unchanged.
-  provision.deleteEnvVarCaseAware(env, 'WRANGLER_LOG');
+  // Pin Wrangler's default log level. Delete case-aware first so a mixed-case
+  // ambient value cannot shadow the pin on win32.
+  deleteEnvVarCaseAware(env, 'WRANGLER_LOG');
   env.WRANGLER_LOG = 'log';
   // Void owns the browser OAuth lifecycle. Never allow Wrangler to fall back to
   // its plaintext credential file while a Void command is using that session.
@@ -197,32 +220,17 @@ export function deployChildEnv(
 
 /**
  * Delete every {@link WRANGLER_AUTH_CREDENTIAL_ENV_VARS} entry from `env` IN PLACE and
- * return it, for a child that executes UNTRUSTED project code and needs no Cloudflare
- * credential of its own.
- *
- * The case-aware delete lives in the provision module, which ONLY the Cloudflare fork
- * loads (a managed deploy must not pay `proper-lockfile`'s import-time side effects). One
- * caller — `runDrizzleKitGenerate`, via the shared schema-drift check — also runs on the
- * MANAGED path, where that module is legitimately absent, so read the memoized handle
- * directly instead of {@link requireProvisionModule} (which throws when the fork never ran)
- * and fall back to the exact-case delete. That fallback IS the whole rule off win32 (POSIX
- * env keys are case-sensitive); the case-insensitive win32 sweep only matters for the
- * Cloudflare fork, and by the time either call site runs there the module is always loaded.
+ * return it, for a Cloudflare-fork child that executes UNTRUSTED project code.
  */
 export function scrubWranglerAuthCredentials(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const deleteVar =
-    loadedProvisionModule?.deleteEnvVarCaseAware ??
-    ((target: NodeJS.ProcessEnv, name: string): void => {
-      delete target[name];
-    });
   for (const name of WRANGLER_AUTH_CREDENTIAL_ENV_VARS) {
-    deleteVar(env, name);
+    deleteEnvVarCaseAware(env, name);
   }
   // These are not Wrangler credentials, but native Cloudflare builds do not
   // need either one: DATABASE_URL is consumed only by the parent-side
   // provision/migration steps, and VOID_TOKEN belongs to the managed target.
-  deleteVar(env, 'DATABASE_URL');
-  deleteVar(env, 'VOID_TOKEN');
+  deleteEnvVarCaseAware(env, 'DATABASE_URL');
+  deleteEnvVarCaseAware(env, 'VOID_TOKEN');
   return env;
 }
 
@@ -244,10 +252,10 @@ export function buildSchemaProbeEnv(accountId: string, apiBaseUrl: string): Node
   // schema conditioned on this internal marker consistent with the build,
   // this prevents an ambient case variant from shadowing the pinned value on
   // Windows.
-  requireProvisionModule().deleteEnvVarCaseAware(env, CLOUDFLARE_DEPLOY_BUILD_ENV);
+  deleteEnvVarCaseAware(env, CLOUDFLARE_DEPLOY_BUILD_ENV);
   env[CLOUDFLARE_DEPLOY_BUILD_ENV] = '1';
   // Scrub any ambient spelling first (case-aware on win32) so it cannot shadow the pin.
-  requireProvisionModule().deleteEnvVarCaseAware(env, 'NODE_ENV');
+  deleteEnvVarCaseAware(env, 'NODE_ENV');
   env.NODE_ENV = 'production';
   return env;
 }
diff --git a/packages/void/src/cli/deploy-types.ts b/packages/void/src/cli/deploy-types.ts
index bb748d1d2..264c7ae04 100644
--- a/packages/void/src/cli/deploy-types.ts
+++ b/packages/void/src/cli/deploy-types.ts
@@ -26,14 +26,6 @@ import type {
 import { dischargeSelfHostEnvContext, type EmittedWorkerVarsResult } from './env-validation.ts';
 import { type CliLogger } from './log-file.ts';
 import { type DeploymentPlatform } from './project.ts';
-// The provision module pulls in the whole-provision cross-process lock
-// (`proper-lockfile` → `signal-exit`), which patches `process.emit` /
-// `process.reallyExit` and installs exit handlers the moment it is imported. An
-// ordinary MANAGED `void deploy` never enters the Cloudflare-backend fork, so it
-// must not pay that side effect. Keep ONLY erasable `import type` at module scope
-// and load the runtime values with a DYNAMIC `import()` inside the fork
-// (`loadProvisionModule`), so importing this file (which `cli.ts` does for every
-// deploy) never evaluates the provision lifecycle.
 import type { provisionCloudflareResources } from './provision.ts';
 import type { DeployEvent, DeployTargetAdapter } from './types.ts';
 
@@ -48,7 +40,7 @@ export type RunDeployOptions = {
   platform?: Exclude<DeploymentPlatform, 'none'>;
   provision?: boolean;
   /**
-   * Mode B email (0078): fail the deploy — before any upload — instead of continuing
+   * Native Cloudflare email: fail the deploy — before any upload — instead of continuing
    * without email when the mail domain is not set up and the step cannot finish it
    * (CI / non-TTY, a blocker, a declined prompt). `--platform cloudflare` only.
    */
@@ -80,7 +72,7 @@ export type DeployWranglerRunResult = CloudflareCommandResult;
 
 export type DeployWranglerRun = (
   operation: CloudflareOperation,
-  opts: { capture: boolean; input?: string; env?: Record<string, string> },
+  opts: { capture: boolean; input?: string },
 ) => DeployWranglerRunResult | Promise<DeployWranglerRunResult>;
 
 /**
@@ -105,15 +97,13 @@ export interface CloudflareDeployDeps {
   prepareFrameworkArtifact?: typeof prepareCloudflareFrameworkArtifact;
   /** Upload, readiness-probe, and activate the verified Worker Version. */
   activateVersion?: typeof activateCloudflareVersion;
-  /** Read-only metadata transport; writes always use the pinned uploader. */
-  metadataFetch?: typeof globalThis.fetch;
   /**
    * Wrangler-uploader content-hash seam (default: {@link hashWranglerUploader}). Snapshotted
    * BEFORE the build and re-checked AFTER, so a build that overwrote the wrangler bundle the
    * credentialed remote migrate / deploy execute fails closed before either runs.
    */
   hashWranglerUploader?: (root: string) => string | undefined;
-  /** Provisioner seam (default: `provisionCloudflareResources`, loaded dynamically). */
+  /** Provisioner seam (default: `provisionCloudflareResources`). */
   provision?: typeof provisionCloudflareResources;
   /** Parent-side secret-gate discharge seam (default: {@link dischargeSelfHostEnvContext}). */
   dischargeSelfHostEnv?: typeof dischargeSelfHostEnvContext;
@@ -160,14 +150,14 @@ export interface CloudflareDeployDeps {
     env: NodeJS.ProcessEnv,
   ) => EnvSchemaValidateResult | Promise<EnvSchemaValidateResult>;
   /**
-   * Emitted-worker-vars read seam (default: {@link readEmittedWorkerVarsDefault}).
+   * Emitted-worker-vars read seam (default: {@link readEmittedWorkerVars}).
    * Runs POST-build: reads the REAL `vars` map the build baked into
    * `dist/ssr/wrangler.json` — the ground truth the plaintext-server-key + secret gate
    * validate.
    */
   readEmittedWorkerVars?: (root: string) => EmittedWorkerVarsResult;
   /**
-   * Override CI / non-interactive detection for the Mode B email prompt (default: wrangler's
+   * Override CI / non-interactive detection for the email step prompt (default: wrangler's
    * own {@link isWranglerNonInteractiveOrCI}, so Void and wrangler call the same run
    * interactive).
    */
diff --git a/packages/void/src/cli/deploy.ts b/packages/void/src/cli/deploy.ts
index bc2075816..c8b603dda 100644
--- a/packages/void/src/cli/deploy.ts
+++ b/packages/void/src/cli/deploy.ts
@@ -45,24 +45,15 @@ import {
 import { getRequestedProjectSlug } from './resolve-project.ts';
 import type { DeployTarget } from './types.ts';
 
-export { parseRootWranglerConfig } from '@void/deploy-cloudflare';
-
 export function resolveDeploymentPlatform(
   root: string,
   options?: RunDeployOptions,
 ): DeploymentPlatform {
+  // Projects with no saved choice predate the init prompt and keep the Void default.
   return options?.platform ?? readDeploymentPlatform(root) ?? 'void';
 }
 
-/**
- * Run the full deploy pipeline:
- * 1. Check auth
- * 2. Resolve project + deploy mode
- * 3. Build (if needed)
- * 4. Package output
- * 5. Upload to platform
- * 6. Print live URL
- */
+/** Run `void deploy`; a failure carries a summary of the deploy log in its message. */
 export async function runDeploy(root: string, options?: RunDeployOptions): Promise<void> {
   console.log();
 
@@ -108,40 +99,6 @@ export async function runDeploy(root: string, options?: RunDeployOptions): Promi
   }
 }
 
-/**
- * Build a child-process environment with deployment credentials removed.
- *
- * The deploy flow spawns UNTRUSTED user build code (`vite build`, framework
- * preset builds, drizzle-kit loading the user schema) which inherits the
- * spawn env. A shared, long-lived CF Access service token is needed only by
- * this CLI's own API client (which captures the Access headers once at
- * construction and reuses them for every request) — never by the build — so it
- * must not survive into those children, or it would leak to arbitrary repo
- * build scripts/plugins.
- *
- * We scrub it on the CHILD env rather than mutating `process.env`: deleting it
- * from the parent also breaks interactive expired-token re-auth, which reads
- * the trusted readiness-header capture / cloudflared pair-guard AFTER the build
- * step. Managed prerender runs later in this trusted parent process with a
- * dedicated short-lived proxy credential. The deploy token, Cloudflare,
- * Access, and production database credentials never reach arbitrary build
- * scripts or plugins.
- *
- * `localBinRoot` is an explicit OPT-IN, not a default. Build commands are run
- * through a shell (`execSync`) and a user-configured `inference.build` (e.g.
- * `vitepress build && vite build`) names bare binaries that only exist in the
- * project's own `node_modules/.bin`; under the build container's
- * `npx --yes void deploy` that happens to work — npx prepends every ancestor
- * `.bin` itself — but a directly invoked `node_modules/.bin/void deploy` or a
- * globally installed `void` inherits no such PATH and the bare binary fails to
- * resolve. Passing it makes the project's bin dir shadow the system one for
- * that child, so it belongs ONLY on the three build execs. The other callers
- * (`getGitCommit`, the drizzle-kit spawn) exec a system binary or an absolute
- * path and must not hand a dependency-shipped `node_modules/.bin/git` a child
- * process holding `VOID_TOKEN`.
- */
-export { buildEnv } from '../shared/untrusted-env.ts';
-
 const cloudflareDeployTarget: RunDeployTargetAdapter = {
   target: 'cloudflare',
   capabilities: {
@@ -227,8 +184,6 @@ async function runDeployInner(
   options: RunDeployOptions | undefined,
   cliLog: CliLogger,
 ): Promise<void> {
-  // A missing field retains the historical Void behavior. New interactive
-  // init runs always persist an explicit choice, with Cloudflare preselected.
   const link = await maybeLinkCloudflareDeploy(root, options);
   if (link === 'cancelled') {
     log.info('Deployment cancelled.');
@@ -280,27 +235,13 @@ async function runManagedDeploy(
           `deploy: This project is linked to ${savedProject.platformUrl}. Pass --project <slug> to deploy to ${apiUrl} without changing the saved link.`,
         );
       }
-      // 1. Auth — resolve the deploy token by precedence:
-      //   1. explicit `VOID_TOKEN` env  (deliberate override; wins everywhere)
-      //   2. GitHub Actions OIDC exchange  (in Actions, when no explicit token)
-      //   3. saved keychain / config file  (local dev)
-      //
-      // OIDC MUST beat an AMBIENT saved token here. `getToken()` returns the env
-      // token AND a keychain/config-file token, so calling it unconditionally
-      // first would let a leftover `void account login` credential on a self-hosted
-      // / reused runner preempt OIDC. Only consult it before OIDC when the user
-      // supplied an explicit env token; that still applies the shared origin
-      // guard before any platform client can receive the credential. With no env
-      // token, mint OIDC first and consult the saved credential only as fallback.
+      // Token precedence: VOID_TOKEN, then GitHub Actions OIDC, then the saved
+      // login. OIDC must beat the saved login so a leftover `void account login`
+      // on a reused runner cannot preempt it.
       let token = process.env.VOID_TOKEN ? getToken(root) : null;
       if (!token && isGithubActionsOidcAvailable()) {
-        // Running inside GitHub Actions with no explicit VOID_TOKEN: mint a
-        // GitHub OIDC token and exchange it for a short-lived, project-scoped
-        // deploy token. The slug must resolve WITHOUT a platform client (there
-        // is no token yet): --project flag > VOID_PROJECT env > linked
-        // .void/project.json — the same sources the deploy path uses below. A
-        // workflow with `id-token: write` intends OIDC, so an unknown slug is a
-        // hard error — we do NOT silently fall back to a saved token.
+        // A workflow with `id-token: write` intends OIDC, so an unknown slug is a
+        // hard error rather than a fallback to the saved login.
         const slug = requestedProjectSlug ?? linkedProject?.slug;
         if (!slug) {
           throw new Error(
@@ -311,31 +252,23 @@ async function runManagedDeploy(
         const tokenOrigin = getApiUrl(root);
         token = await exchangeGithubOidcForDeployToken(tokenOrigin, slug);
         maskGithubActionsSecret(token);
-        // Keep source accounting and expired-token handling consistent with an
-        // explicit CI token. `buildEnv()` always removes this value before any
-        // project-controlled child starts; managed prerender obtains a separate
-        // proxy-only token from the authenticated platform client.
+        // Treat the exchanged token like an explicit CI token; `buildEnv()`
+        // still removes it from every project-controlled child.
         process.env.VOID_TOKEN = token;
         process.env.VOID_API_URL = tokenOrigin;
         cliLog.info('github_oidc_exchange_success', { slug });
       }
-      // Local dev / non-Actions (or Actions without id-token permission): fall
-      // back to the saved keychain/config token. `getToken()` re-checks
-      // `VOID_TOKEN` first, which is harmlessly unset on this branch.
       token ??= getToken(root);
       if (!token) {
         log.error('No auth token found. Run `void account login` first.');
         process.exit(1);
       }
 
+      // Access credentials stay in `process.env` for the expired-token re-auth
+      // below; `buildEnv()` removes them from each project-controlled child.
       const client = new PlatformClient(token, { root, cliLog });
 
-      // The CF Access service-token pair is intentionally left in `process.env`
-      // so interactive expired-token re-auth (below) can still read it. It is
-      // kept OUT of every untrusted build child instead, via `buildEnv()` on the
-      // spawn env — see that helper for the full rationale.
-
-      // 2. Resolve target project (CLI flag > env var > linked project file)
+      // Resolve the target project: CLI flag > env var > linked project file.
       let config: ProjectConfig | null = null;
 
       if (requestedProjectSlug) {
@@ -413,7 +346,7 @@ async function runManagedDeploy(
         );
       }
 
-      // 3. Resolve deploy app type: void.config.ts > CLI flags > auto-detection
+      // Resolve the app type: void.config.ts > CLI flags > auto-detection.
       const voidConfig = readConfig(root);
       cliLog.info('config_resolved', {
         target: voidConfig.target,
@@ -544,87 +477,15 @@ async function runManagedDeploy(
   }
 }
 
-export {
-  type RunDeployOptions,
-  type DeployWranglerRunResult,
-  type DeployWranglerRun,
-  type CloudflareDeployDeps,
-} from './deploy-types.ts';
-
-export { loadProvisionModule } from './deploy-provision.ts';
-
-export {
-  assertNoConfigOverrideInProjectDotenv,
-  resolveDeployTransport,
-  deployChildEnv,
-} from './deploy-transport.ts';
-
-export {
-  snapshotBindingIdentities,
-  DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS,
-  DEPLOY_PASSTHROUGH_ASSERT_FIELDS,
-  DEPLOY_WHOLE_OBJECT_PINNED_FIELDS,
-  snapshotPassthroughIdentities,
-  snapshotPassthroughRawFields,
-  reconstructExpectedContainers,
-  reconstructExpectedDurableObjectState,
-  hashWranglerUploader,
-  assertWranglerUploaderUnchanged,
-} from './deploy-binding-snapshot.ts';
-
-export { verifyGeneratedDeployConfig } from './deploy-artifact-validation.ts';
-
-export { deriveWorkerName, computeDesiredCloudflareResources } from './deploy-resources.ts';
-
-export {
-  assertMigrationsProduceAuthSchema,
-  validateAuthMigrationSchema,
-  compareWranglerMigrationPaths,
-  checkWranglerMigrationApplySet,
-} from './deploy-migrations.ts';
+export { type RunDeployOptions } from './deploy-types.ts';
 
+export { parseRootWranglerConfig } from '@void/deploy-cloudflare';
+export { resolveDeployTransport } from './deploy-transport.ts';
+export { deriveWorkerName } from './deploy-resources.ts';
+export { checkWranglerMigrationApplySet } from './deploy-migrations.ts';
 export {
   createDeployWranglerRunner,
   isWranglerNonInteractiveOrCI,
   runWranglerAuthToken,
-  ensureCloudflareAuthSecret,
 } from './deploy-cloudflare-auth.ts';
-
-export {
-  runCloudflareDeploy,
-  discoverRootWranglerConfig,
-  formatCloudflareActivationError,
-} from './deploy-cloudflare.ts';
-
-export { prepareCloudflareFrameworkArtifact } from './deploy-cloudflare-static.ts';
-
-export {
-  applyDeployEvent,
-  streamDeployEvents,
-  warnUnpublishedRouting,
-  warnRedundantForceOn3xx,
-  warnIgnoredNotFoundForFramework,
-} from './deploy-managed-events.ts';
-
-export { assembleVoidManifest, runStaticDeploy } from './deploy-managed-static.ts';
-
-export { assertManagedDurableStateSupported } from './deploy-managed-framework.ts';
-
-export { hasDeploySchemaDrift } from './deploy-drift.ts';
-
-export {
-  generateDeployWrapperIfNeeded,
-  ensurePreviouslyDeployedLiveBindingConfig,
-  resolveDeployLiveBindingConfig,
-  resolveDeployWranglerCompat,
-  resolveDeployWorkerMain,
-  promptDeployProjectConfig,
-  resolveStaticBuildCommand,
-  resolveFullDeployBuildCommand,
-  hasPrerenderSources,
-  hasNonPageBackend,
-  resolveStaticDeployPreset,
-  resolveDistDir,
-  resolveWorkerDirName,
-} from './deploy-helpers.ts';
-export type { EmittedWorkerVarsResult } from './env-validation.ts';
+export { discoverRootWranglerConfig } from './deploy-cloudflare.ts';
diff --git a/packages/void/src/cli/domain.ts b/packages/void/src/cli/domain.ts
index 2e1564e3d..16348b95b 100644
--- a/packages/void/src/cli/domain.ts
+++ b/packages/void/src/cli/domain.ts
@@ -3,7 +3,8 @@ import { getToken } from './auth.ts';
 import { type DomainStatusResponse, PlatformClient } from './client.ts';
 import type { DomainArgs } from './domain-args.ts';
 import { printSuccess, note, pc } from './output.ts';
-import { readDeploymentPlatform, readProjectConfig } from './project.ts';
+import { readDeploymentPlatform } from './project.ts';
+import { resolveCommandProjectId } from './resolve-project.ts';
 
 export async function runDomainCommand(root: string, args: DomainArgs): Promise<void> {
   const platform = readDeploymentPlatform(root);
@@ -22,35 +23,17 @@ export async function runDomainCommand(root: string, args: DomainArgs): Promise<
 
   const client = new PlatformClient(token, { root });
 
-  const requestedSlug = args.projectSlug ?? process.env.VOID_PROJECT?.trim();
-  let projectId: string | undefined;
-
-  if (requestedSlug) {
-    const projects = await client.listProjects();
-    const project = projects.find((p) => p.slug === requestedSlug);
-    if (!project) {
-      log.error(`project: No project found with slug '${requestedSlug}'.`);
-      process.exit(1);
-    }
-    projectId = project.id;
-  } else {
-    const config = readProjectConfig(root);
-    if (!config) {
-      log.error('No linked project. Run `void project link` or pass --project <name>.');
-      process.exit(1);
-    }
-    projectId = config.projectId;
-  }
+  const projectId = await resolveCommandProjectId(client, root, args.projectSlug);
 
   switch (args.subcommand) {
     case 'add':
-      return domainAdd(client, projectId!, args.hostname!);
+      return domainAdd(client, projectId, args.hostname!);
     case 'delete':
-      return domainRemove(client, projectId!, args.hostname!);
+      return domainRemove(client, projectId, args.hostname!);
     case 'list':
-      return domainList(client, projectId!);
+      return domainList(client, projectId);
     case 'status':
-      return domainStatus(client, projectId!, args.hostname!, args.verbose === true);
+      return domainStatus(client, projectId, args.hostname!, args.verbose === true);
   }
 }
 
diff --git a/packages/void/src/cli/email-args.ts b/packages/void/src/cli/email-args.ts
index 32be36be7..f82462c36 100644
--- a/packages/void/src/cli/email-args.ts
+++ b/packages/void/src/cli/email-args.ts
@@ -12,9 +12,8 @@ export const emailSubcommands: Array<SubcommandDef> = [
   { name: 'destinations', description: 'List verified recipient addresses for outbound mail' },
   { name: 'allow', arg: '<address>', description: 'Add a recipient and trigger CF verification' },
   { name: 'disallow', arg: '<address>', description: 'Remove a verified recipient' },
-  // The first (and only) nested group: the verb is collected as the arg so
-  // `domain list` completes in the interactive prompt; `domain add` then
-  // errors naming the missing <domain>, the same as a typed invocation.
+  // The verb is collected as the arg so `domain list` completes in the interactive prompt;
+  // `domain add` then errors naming the missing <domain>, like a typed invocation.
   {
     name: 'domain',
     arg: '<add|status|list|sync|rotate-secret|remove>',
@@ -43,15 +42,10 @@ const EMAIL_SUBCOMMANDS = [
   'setup',
 ] as const;
 
-export const EMAIL_DOMAIN_VERBS = [
-  'add',
-  'status',
-  'list',
-  'sync',
-  'rotate-secret',
-  'remove',
-] as const;
-export type EmailDomainVerb = (typeof EMAIL_DOMAIN_VERBS)[number];
+const SUBDOMAIN_ADD_ONLY = 'email: --subdomain applies to `void email domain add` only.';
+
+const EMAIL_DOMAIN_VERBS = ['add', 'status', 'list', 'sync', 'rotate-secret', 'remove'] as const;
+type EmailDomainVerb = (typeof EMAIL_DOMAIN_VERBS)[number];
 
 export interface EmailArgs {
   subcommand: (typeof EMAIL_SUBCOMMANDS)[number];
@@ -59,20 +53,12 @@ export interface EmailArgs {
   domainVerb?: EmailDomainVerb;
   /** The domain positional of a domain verb (absent for `domain list`). */
   domain?: string;
-  /**
-   * `--subdomain <label|host>` on `domain add`: which subdomain to register
-   * instead of the `mail.<domain>` the MX decision proposes (design doc 0078,
-   * "[change with --subdomain]").
-   */
+  /** `--subdomain` on `domain add`, which the command refuses. */
   subdomain?: string;
   projectSlug?: string;
   limit?: number;
   address?: string;
-  /**
-   * `--platform cloudflare`: the developer's own account (design doc 0078, Mode B).
-   * `--platform void` names the Void platform explicitly; leaving the flag off means the
-   * same.
-   */
+  /** `cloudflare` is the developer's own account; `void` (the default) is the Void platform. */
   platform?: 'cloudflare' | 'void';
 }
 
@@ -107,10 +93,8 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
   }
 
   let limit: number | undefined;
-  // Raw values, one per occurrence, so a repeated flag is reported as repeated even when
-  // its final value would have been accepted — the same precedence `void deploy` keeps.
-  // `--project` is collected the same way, so a wrapper's override and a caller's cannot
-  // silently disagree about which project `void email disallow` mutates.
+  // One raw value per occurrence, so a repeated flag is an error even when its last value
+  // is valid (the same rule as `void deploy`).
   const projectValues: Array<string> = [];
   const platformValues: Array<string> = [];
   const subdomainValues: Array<string> = [];
@@ -118,14 +102,12 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
 
   const rest = args.slice(1);
   for (let i = 0; i < rest.length; i++) {
-    // `--project` and `--limit` take the same missing-value path as `--platform`: a bare
-    // flag must not fall through as a positional, which the read-only subcommands never
-    // reject.
+    // A bare flag must not fall through as a positional, which the read-only subcommands
+    // never reject.
     if (rest[i] === '--project' || rest[i]?.startsWith('--project=')) {
       const { value, next } = readFlagValue(rest, i, '--project');
-      // `--project=` and `--project ''` (an empty shell variable) read as a bare flag:
-      // an empty slug is not nullish, so `runEmailCommand` would otherwise skip
-      // `VOID_PROJECT` and act on the linked project as if no override was given.
+      // An empty value (`--project=`, an empty shell variable) is missing: `''` is not
+      // nullish, so `runEmailCommand` would skip `VOID_PROJECT` and use the linked project.
       if (value === undefined || value.trim() === '') {
         throw new Error('email: --project requires a value (a project name).');
       }
@@ -153,8 +135,6 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
       throw new Error("email: Unknown option '--backend'.");
     } else if (rest[i] === '--subdomain' || rest[i]?.startsWith('--subdomain=')) {
       const { value, next } = readFlagValue(rest, i, '--subdomain');
-      // Same missing-value rule as --project: a bare flag or an empty shell
-      // variable reads as no value, not as the next flag's name.
       if (value === undefined || value.trim() === '') {
         throw new Error('email: --subdomain requires a value (a subdomain label or host).');
       }
@@ -165,7 +145,6 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
     }
   }
 
-  // Same rule as `void deploy`: `--project` at most once.
   if (projectValues.length > 1) {
     throw new Error('email: --project can only be specified once.');
   }
@@ -188,10 +167,8 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
   }
   const subdomain = subdomainValues[0];
 
-  // The nested `domain` group parses its own positionals (verb + domain) and
-  // returns early — the one-positional rule below would read the verb as the
-  // address. Mode B needs none of this group (0078,
-  // "Mode B" under custom domains), so it is Void-platform-only.
+  // The `domain` group parses its own positionals (verb + domain); the one-positional
+  // rule below would read the verb as the address.
   if (subcommand === 'domain') {
     if (platform === 'cloudflare') {
       throw new Error(
@@ -201,11 +178,9 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
     return parseEmailDomainArgs(positional, { projectSlug, limit, platform, subdomain });
   }
   if (subdomain !== undefined) {
-    throw new Error('email: --subdomain applies to `void email domain add` only.');
+    throw new Error(SUBDOMAIN_ADD_ONLY);
   }
 
-  // `void email allow|disallow` takes exactly one address; extras are an
-  // error rather than silently ignored.
   if (positional.length > 1) {
     throw new Error(
       `email: \`void email ${subcommand}\` takes exactly one positional argument (got ${positional.length}: ${positional.map((p) => JSON.stringify(p)).join(', ')}).`,
@@ -218,11 +193,8 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
     throw new Error(`email: Usage: void email ${subcommand} <address> [--project <name>].`);
   }
 
-  // The Cloudflare platform reads the local project (void.json, email/, wrangler.jsonc)
-  // and the developer's own wrangler session — it never resolves a Void project, so
-  // `--project` would name a destination it cannot use. Only `status` and `setup`
-  // have a Mode B shape; the platform-only subcommands reject the flag outright.
-  // `--platform void` is the default spelled out, so it is accepted everywhere.
+  // `--platform cloudflare` reads the local project and the developer's own Cloudflare
+  // session, never a Void project, so `--project` has nothing to select.
   if (platform === 'cloudflare') {
     if (subcommand !== 'status' && subcommand !== 'setup') {
       throw new Error(
@@ -245,11 +217,8 @@ export function parseEmailArgs(args: Array<string>): EmailArgs {
 }
 
 /**
- * The nested `void email domain <verb> [<domain>]` group. positional[0] is the
- * verb, positional[1] the domain — `list` takes no domain, every other verb
- * requires exactly one. Shape validation of the domain itself is the command's
- * job (and ultimately the api's — its regex is authoritative); the parser only
- * counts positionals, exactly as it does for `allow <address>`.
+ * `void email domain <verb> [<domain>]`. The parser only counts positionals; the command
+ * and the API validate the domain itself.
  */
 function parseEmailDomainArgs(
   positional: ReadonlyArray<string>,
@@ -267,7 +236,7 @@ function parseEmailDomainArgs(
     );
   }
   if (flags.subdomain !== undefined && verb !== 'add') {
-    throw new Error('email: --subdomain applies to `void email domain add` only.');
+    throw new Error(SUBDOMAIN_ADD_ONLY);
   }
   const domain = positional[1];
   if (verb === 'list') {
diff --git a/packages/void/src/cli/email-cloudflare.ts b/packages/void/src/cli/email-cloudflare.ts
index 124747e1a..9dfd9ecef 100644
--- a/packages/void/src/cli/email-cloudflare.ts
+++ b/packages/void/src/cli/email-cloudflare.ts
@@ -1,54 +1,10 @@
-import type { CloudflareOperation, CloudflareCommandResult } from '@void/deploy-cloudflare';
 /**
- * Mode B email — the developer's OWN Cloudflare account (`void deploy --platform
- * cloudflare`). Design doc 0078, "Mode B — the developer's own Cloudflare account".
- *
- * Four pure-ish units, every Cloudflare touch injected so unit tests run on fakes:
- *
- *   deriveAddresses      email/ scan + domain  →  wrangler `addresses` (+ refusals)
- *   preflightEmail       read-only probes      →  one `EmailPreflight` state object
- *   renderEmailChecklist preflight             →  the block shown before the one Enter
- *   applyEmailSetup      preflight             →  only the rows not ready, in order,
- *                                                  returning the wrangler.jsonc patch
- *
- * Both callers (`void deploy --platform cloudflare` step 3b-ii and `void email
- * setup|status --platform cloudflare`) borrow the session bearer through the deploy
- * runner's `runWranglerAuthToken` and gate the prompt on `isWranglerNonInteractiveOrCI`
- * (both in `cli/deploy-cloudflare-auth.ts`), so the two never disagree.
- *
- * Rules that hold the whole thing together (0078 "The flow, by lane"):
- *
- *   - Void never refreshes, stores or forwards a token. Everything with a wrangler
- *     command goes through the injected runner (the deploy runner, pinned wrangler).
- *     The login session's bearer is borrowed via `getSessionBearer()` (backed by
- *     `wrangler auth token --json`) ONLY for the calls wrangler has no command for —
- *     subdomain routing enable, the subaddressing PATCH, and the `GET /zones?name=`
- *     zone classification — and it is dropped after each call. `fetchWithSessionBearer`
- *     is the ONLY function that ever receives the token; nothing here logs it, embeds
- *     it in a printed line, or places it in an error.
- *   - Rules and the catch-all are wrangler's job: Void derives `addresses`, writes the
- *     root config, and the existing `wrangler deploy` applies the plan. Void PRUNES an
- *     address already routed elsewhere so that plan is never destructive (decision 12).
- *   - `addresses` is written only when routing is ready for the domain, and deleted
- *     (never `[]`, which would delete every owned rule) otherwise (decision 11).
- *   - Void owns the whole top-level `addresses` array in Mode B; entries Void did not
- *     derive skip the email step for the deploy, array untouched (decision 13).
- *   - `ready` means no ACCOUNT work is left. Routing rules are `wrangler deploy`'s own
- *     (`rulesPending`), and the two CONFIG rows — `addresses` against the pruned set,
- *     `vars.__VOID_EMAIL_FROM` against `email.from` — are reconciled by a plain file write
- *     on every deploy, never behind the prompt (`addressesStale`, `sender`). A sending
- *     onboarding the committed `send_email` binding remembers as refused (Workers Free)
- *     is settled, not work: the binding is written only by a run that already attempted
- *     it. `void email setup` offers the retry (`sendingRetryable`); the deploy never does.
- *   - The session gate reads `whoami --json`: a `wrangler login` session must carry both
- *     email scopes; an API token (`CLOUDFLARE_API_TOKEN`, the CI credential) cannot list
- *     its permissions, so it is gated by the reads, which fail closed; a Global API Key is
- *     refused by name (no single bearer for the two REST-only calls).
- *
- * Email reads return structured Cloudflare data through the private command adapter.
- * Invalid data fails closed: the row reads `unknown` and the checklist directs the
- * developer to `void email setup`. Failed commands retain their API error codes.
+ * Email on the developer's own Cloudflare account, shared by `void deploy --platform cloudflare`
+ * and `void email setup|status --platform cloudflare`. Every Cloudflare call is injected:
+ * `deriveAddresses` maps handlers to `addresses`, `preflightEmail` reads state without writing,
+ * `renderEmailChecklist` shows it, and `applyEmailSetup` runs only the rows not ready.
  */
+import type { CloudflareOperation, CloudflareCommandResult } from '@void/deploy-cloudflare';
 import { isRecord } from '@void/deploy-core';
 import type { EmailHandlersScan } from '../router/email.ts';
 import { findBindingNameOwner } from './wrangler.ts';
@@ -59,20 +15,13 @@ export const SEND_EMAIL_BINDING = 'SEND_EMAIL';
 /** The root-config `vars` key carrying `void.config.ts` `email.from` into the worker. */
 export const EMAIL_FROM_VAR = '__VOID_EMAIL_FROM';
 
-/** Cloudflare's public API base — the same one `wrangler` targets by default. */
-export const CLOUDFLARE_API_BASE_URL = 'https://api.cloudflare.com/client/v4';
+const CLOUDFLARE_API_BASE_URL = 'https://api.cloudflare.com/client/v4';
 
-/** The wrangler session scopes Mode B needs (`whoami --json` `tokenPermissions`). */
-export const REQUIRED_EMAIL_SCOPES: ReadonlyArray<string> = [
-  'email_routing:write',
-  'email_sending:write',
-];
+/** OAuth scopes the session needs (`whoami` `tokenPermissions`). */
+const REQUIRED_EMAIL_SCOPES: ReadonlyArray<string> = ['email_routing:write', 'email_sending:write'];
 
-/**
- * Cloudflare Email API error codes this module classifies (0078 "error map").
- * Everything else is reported verbatim.
- */
-export const CF_EMAIL_ERROR_CODES: Readonly<Record<number, string>> = {
+/** Cloudflare Email API error codes with a known meaning; others are reported verbatim. */
+const CF_EMAIL_ERROR_CODES: Readonly<Record<number, string>> = {
   2062: 'Email Routing is not enabled on this zone',
   2040: 'already onboarded for Email Sending',
   2036: 'account is not entitled to Email Sending',
@@ -107,29 +56,24 @@ export interface EmailDns {
 export type EmailFetch = typeof fetch;
 
 /**
- * Everything `preflightEmail` / `applyEmailSetup` need. Every Cloudflare touch is a
- * seam; `getSessionBearer` resolves `null` when the session cannot be borrowed
- * (`wrangler auth token` failed) — never throws through to the deploy.
+ * Inputs for `preflightEmail` / `applyEmailSetup`. `getSessionBearer` resolves `null` when
+ * the session cannot be borrowed.
  */
 export interface EmailCloudflareInputs {
   handlers: EmailHandlersScan;
-  /** `void.config.ts` `email.from` — the ONLY domain input (decision 9). */
+  /** `void.config.ts` `email.from` — the only domain input. */
   from: string;
   /** The worker name `wrangler deploy` uploads as (rules are matched to it). */
   workerName: string;
   /** The reconciled effective account id the deploy is pinned to. */
   accountId: string;
   /** Existing root-config `send_email` array (verbatim), if any. */
-  existingSendEmail?: Array<{ name?: unknown }> | null;
+  existingSendEmail?: Array<{ name?: unknown }>;
   /** Existing root-config top-level `addresses` array (verbatim), if any. */
   existingAddresses?: unknown;
   /** Existing root-config `vars` object (verbatim) — `__VOID_EMAIL_FROM` is compared to `from`. */
-  existingVars?: Record<string, unknown> | null;
-  /**
-   * Root-config shapes the writer would refuse (`findEmailConfigConflicts`), computed by
-   * the caller from the parsed root config; each becomes an `all` blocker so the refusal
-   * lands BEFORE the Enter rather than after the account was changed.
-   */
+  existingVars?: Record<string, unknown>;
+  /** Writer refusals (`findEmailConfigConflicts`); each blocks before the account changes. */
   configConflicts?: Array<string>;
   /** Number of source files calling `sendEmail()` — shown in the header line only. */
   sendEmailFiles?: number;
@@ -143,12 +87,8 @@ export interface EmailCloudflareInputs {
 }
 
 /**
- * The root-config shapes `writeProvisionedWranglerConfig` refuses for the two names Mode
- * B writes — `SEND_EMAIL` into `send_email`, `__VOID_EMAIL_FROM` into `vars` — read from
- * the parsed root config BEFORE anything is asked, so a collision with another binding
- * type (or a malformed `send_email` / `vars`) refuses the step up front instead of after
- * the account was changed. Same guard as the writer's, which stays the last line of
- * defence (the file can change between preflight and write).
+ * Config shapes the writer would refuse for `SEND_EMAIL` and `__VOID_EMAIL_FROM`, checked
+ * before anything is asked. The writer keeps the same guard, since the file can change first.
  */
 export function findEmailConfigConflicts(config: Record<string, unknown>): Array<string> {
   // A Set: one malformed field is reported by both lookups (the owner scan reads every field).
@@ -172,6 +112,23 @@ export function findEmailConfigConflicts(config: Record<string, unknown>): Array
   return [...conflicts];
 }
 
+/** The `EmailCloudflareInputs` fields read from the parsed root config. */
+export function emailConfigInputs(
+  rootConfig: Record<string, unknown>,
+): Pick<
+  EmailCloudflareInputs,
+  'existingSendEmail' | 'existingAddresses' | 'existingVars' | 'configConflicts'
+> {
+  return {
+    existingSendEmail: Array.isArray(rootConfig.send_email)
+      ? (rootConfig.send_email as Array<{ name?: unknown }>)
+      : undefined,
+    existingAddresses: rootConfig.addresses,
+    existingVars: isRecord(rootConfig.vars) ? rootConfig.vars : undefined,
+    configConflicts: findEmailConfigConflicts(rootConfig),
+  };
+}
+
 // ── Derivation ─────────────────────────────────────────────────────────────────
 
 export type EmailDomainMode = 'apex' | 'subdomain';
@@ -190,10 +147,8 @@ export interface DerivedEmailAddresses {
  * also accepts the display-name form (`Acme <noreply@mail.acme.com>`, see `config.ts`),
  * so the address inside `<…>` is read when present.
  *
- * Validated per LABEL, not as one character class: the host is handed to wrangler as a
- * positional (`email routing settings <host>`), where a label starting with `-` is read
- * by yargs as a flag (`--config.evil` becomes an option and the domain positional goes
- * missing), and an empty label (`..acme.com`) is not a name at all.
+ * Validated per label, so an empty label or one that starts with `-` never reaches a
+ * Cloudflare command argument.
  */
 export function emailFromDomain(from: string): string | null {
   const bracketed = /<([^<>]*)>\s*$/.exec(from.trim());
@@ -282,19 +237,14 @@ export function deriveAddresses(
 
 // ── Structured command results ────────────────────────────────────────────────
 
-/**
- * `wrangler whoami --json` — the fields Mode B reads. `tokenPermissions` is filled from
- * the STORED `wrangler login` state only (4.131 `getTokenPermissions` → `getScopes`), so
- * it describes the credential in use only when `authType` is `OAuth Token`; under
- * `CLOUDFLARE_API_TOKEN` it is absent (or, with a stale login file beside the env token,
- * it describes the file, not the token).
- */
+/** The session fields read from the `auth.whoami` operation. */
 export interface WhoamiJson {
   loggedIn: boolean;
-  /** `OAuth Token` | `User API Token` | `Account API Token` | `Global API Key` (4.131 `getAuthType`). */
+  /** `OAuth Token` | `API Token` | `Global API Key`. */
   authType?: string;
   email?: string;
   accounts?: Array<{ id: string; name: string }>;
+  /** Session scopes; checked only for an OAuth session. */
   tokenPermissions?: Array<string>;
 }
 
@@ -516,7 +466,7 @@ export interface EmailPreflight {
   /**
    * True when the root `addresses` array (absent, or Void's own) is not the pruned set
    * below — a local, prompt-free rewrite, never account work, so it does not gate `ready`.
-   * A stale entry left in place reaches wrangler's plan as a `conflict` (decision 12).
+   * A stale entry left in place reaches wrangler's plan as a `conflict`.
    */
   addressesStale: boolean;
   derived: DerivedEmailAddresses;
@@ -526,22 +476,14 @@ export interface EmailPreflight {
   rulesPending: Array<string>;
   blockers: Array<EmailPreflightBlocker>;
   /**
-   * True when Email Sending onboarding is still on the table: the row is `pending` and no
-   * sending-scoped blocker stands in the way — exactly when apply would make its one
-   * `wrangler email sending enable` call (the checklist's `onboard … for Email Sending`
-   * row). With the binding committed such a row is SETTLED (`ready` stays true; see the
-   * memory rule in `preflightEmail`), so this is what `void email setup` offers as its own
-   * prompt — the retry after a Workers Paid upgrade — instead of running it unasked. ONE
-   * field, computed here, so the offer and apply's call cannot drift.
+   * True when apply would make its `sending enable` call: the row is pending and no
+   * sending blocker applies. With the binding committed the row is settled, so
+   * `void email setup` offers this retry as its own prompt.
    */
   sendingRetryable: boolean;
   /**
-   * True when nothing is left for APPLY to do on the account — no prompt, zero calls —
-   * with one remembered exception: a sending row the committed binding records as refused
-   * (`sendingRetryable`), which apply WOULD retry, so the deploy never runs apply on a
-   * ready preflight and `void email setup` asks first. Routing rules are wrangler's
-   * (`rulesPending` is informational), and the two config rows (`sender`,
-   * `addressesStale`) are reconciled by a plain file write.
+   * True when apply has no account work left, apart from a `sendingRetryable` row. Routing
+   * rules (`rulesPending`) and the config rows (`sender`, `addressesStale`) are not account work.
    */
   ready: boolean;
 }
@@ -553,8 +495,8 @@ function mxState(exchanges: Array<string>): 'empty' | 'cloudflare' | 'foreign' {
   return exchanges.every((x) => /\.mx\.cloudflare\.net\.?$/i.test(x)) ? 'cloudflare' : 'foreign';
 }
 
-async function probeMx(
-  dns: EmailDns,
+export async function probeMx(
+  dns: Pick<EmailDns, 'resolveMx'>,
   name: string,
 ): Promise<{ state: 'empty' | 'cloudflare' | 'foreign' | 'unknown'; exchanges: Array<string> }> {
   try {
@@ -601,10 +543,8 @@ function shortId(id: string): string {
 }
 
 /**
- * Read-only preflight. Order matters only for cost: public DNS first (free), then
- * `whoami` (no network beyond wrangler's own), then the three `wrangler email` reads,
- * then — if the bearer can be borrowed — the two GETs that have no wrangler command.
- * Nothing here writes.
+ * Read-only preflight: session, zone, public DNS, the provider reads and, when the bearer
+ * can be borrowed, the two REST reads that have no command. Nothing here writes.
  */
 export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<EmailPreflight> {
   const domain = emailFromDomain(inputs.from);
@@ -660,25 +600,13 @@ export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<Ema
     block('all', conflict);
   }
 
-  // 1. Session: logged in, and — for a browser (OAuth) session — both email scopes
-  //    (0078: a session that predates wrangler 4.81 has neither; the pinned wrangler's
-  //    default `login` scope set carries both, one browser Allow). An API token's
-  //    permissions are not enumerable (`tokenPermissions` never describes it), so the gate
-  //    is the reads below: a refused read fails closed as an `unknown` row. A Global API
-  //    Key has no single bearer `auth token` can hand over, so the subaddressing rows could
-  //    never read; it is refused up front, by name.
-  //
-  //    Every blocker names `void cloudflare login` (AGENTS.md: Cloudflare operations are
-  //    described through Void, never as a wrangler command). That command is a no-op on a
-  //    session `whoami --json` already reads cleanly — it re-uses the existing session
-  //    rather than re-consenting — so a session that IS readable but insufficient (the
-  //    scope and Global API Key branches) says what to clear first: `void cloudflare
-  //    logout`, or the CLOUDFLARE_API_KEY pair, which wrangler prefers over both an OAuth
-  //    session and CLOUDFLARE_API_TOKEN.
+  // 1. Session. An OAuth session must carry both email scopes. An API token's permissions
+  //    cannot be listed, so the reads below gate it and fail closed. A Global API Key has no
+  //    bearer to borrow, so it is refused by name. `void cloudflare login` reuses a readable
+  //    session, so an insufficient one is told what to clear first.
   const whoami = await run({ type: 'auth.whoami' });
   const who = isHardFailure(whoami) || whoami.status !== 0 ? null : parseWhoamiJson(whoami.data);
   if (!who) {
-    // `whoami --json` failed or printed no session.
     pre.session.state = 'unknown';
     block('all', 'could not read the Cloudflare session — run `void cloudflare login`');
   } else if (!who.loggedIn) {
@@ -717,9 +645,8 @@ export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<Ema
     ? ' (an API token needs Email Routing Edit + Email Sending Edit on the zone and account)'
     : '';
 
-  // 2. Zone: walk the labels the way wrangler's own `resolveDomain` does, through
-  //    `email routing settings <candidate>` — the first candidate that is a zone in the
-  //    pinned account is the apex, and its data also carries routing status + zone id.
+  // 2. Zone: the first label candidate that `email routing settings` finds in the pinned
+  //    account is the apex; its data also carries routing status and the zone id.
   let settings: RoutingSettings | null = null;
   let settingsMiss = false;
   if (pre.session.state === 'ok') {
@@ -771,12 +698,10 @@ export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<Ema
     pre.sending.dnsConflicts.push(`(DNS lookup failed for _dmarc.${domain} / cf-bounce.${domain})`);
   }
 
-  // 4. The bearer, borrowed once for the two reads wrangler has no command for:
-  //    `GET /zones?name=<apex>` (documented zone authority — WITHOUT `account.id`, so a
-  //    zone in another account is told apart from one not on Cloudflare, and `type`
-  //    refuses partial/secondary zones) and `GET /zones/{z}/email/routing`
-  //    (`support_subaddress`, which the settings command does not return). A `null` bearer
-  //    leaves both rows `unknown`; nothing about the deploy fails on that.
+  // 4. The bearer, borrowed once for two reads with no command: `GET /zones?name=` (without
+  //    `account.id`, so a zone in another account is told apart from a missing one, and
+  //    `type` refuses partial/secondary zones) and `GET /zones/{z}/email/routing`
+  //    (`support_subaddress`). A `null` bearer leaves both rows `unknown`.
   let bearer: string | null = null;
   if (pre.session.state === 'ok') {
     bearer = await inputs.getSessionBearer().catch(() => null);
@@ -862,7 +787,7 @@ export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<Ema
   const mode = pre.mode;
 
   // 5. Routing status. On the apex, `ready` is the only good state. `unlocked` /
-  //    `misconfigured*` mean its locked records changed — print, never re-lock (0078).
+  //    `misconfigured*` mean its locked records changed — print, never re-lock.
   if (settings) {
     if (mode === 'apex') {
       pre.routing = {
@@ -993,7 +918,7 @@ export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<Ema
     );
   }
 
-  // 8. The config rows: `send_email` binding and `addresses` ownership (decision 13).
+  // 8. The config rows: `send_email` binding and `addresses` ownership.
   const existingSendEmail = inputs.existingSendEmail ?? [];
   const names = existingSendEmail.map((e) => (typeof e?.name === 'string' ? e.name : ''));
   if (names.includes(SEND_EMAIL_BINDING)) {
@@ -1009,14 +934,8 @@ export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<Ema
     const existing = Array.isArray(inputs.existingAddresses)
       ? inputs.existingAddresses.map((a) => (typeof a === 'string' ? a.toLowerCase() : String(a)))
       : ['(not an array)'];
-    // The candidate set is THIS scan's derivation. Void records no provenance for the
-    // entries it wrote on an earlier deploy (the array carries no marker), so an entry
-    // left behind by a deleted handler and a hand-written one are the same thing here:
-    // both are `unknown`, and the whole step is skipped with the array untouched
-    // (decision 13). With no handlers left at all the candidate set is empty and every
-    // committed entry is `unknown` — the rule stays routed to this worker. Whether such
-    // a leftover should instead be Void-managed (pruned, or `[]` when nothing is left) is
-    // decision 13's other branch; see the deploy step's note above `patch.addresses`.
+    // Void records no provenance for entries it wrote earlier, so a leftover from a deleted
+    // handler reads like a hand-written entry: the step is skipped and the array left alone.
     const candidates = new Set(pre.derived.addresses);
     const unknown = existing.filter((a) => !candidates.has(a));
     if (unknown.length > 0) {
@@ -1042,30 +961,10 @@ export async function preflightEmail(inputs: EmailCloudflareInputs): Promise<Ema
     senderVar === inputs.from ? 'ready' : senderVar === undefined ? 'absent' : 'stale';
   pre.rulesPending = pre.rules.absent.filter((a) => pre.addresses.includes(a));
 
-  // Ready = nothing left for apply to do on the ACCOUNT. A refused handler and a pruned
-  // address are `!` rows, not work; a sending-scoped blocker is something Void cannot act
-  // on, so it does not keep every later deploy prompting. Routing rules are created by
-  // `wrangler deploy` from the written `addresses`, so a rule not there yet is not apply's
-  // work either (`rulesPending`); the same goes for the config rows, which a plain file
-  // write reconciles without a prompt.
-  //
-  // A sending row still pending WITH the binding committed is settled too — the committed
-  // binding is the memory of a refused onboarding. `sending settings` answers not-found
-  // for "Workers Free" and for "Paid, never onboarded" alike, so no read tells the two
-  // apart; only the mutating `sending enable` does. And `applyEmailSetup` writes
-  // `send_email` ONLY on a run that has already made that call: the binding goes in once
-  // routing or sending came up, and `enable` runs on every apply whose sending row is not
-  // ready and not blocked. So binding present + sending pending reads "attempted and
-  // refused" (Workers Free, `10105`). Without this rule the refusal came back on every
-  // deploy — a prompt in a TTY, "cannot ask" in CI, `--require-email` refused forever,
-  // `void email status` exit 1 — against a setup that is complete for inbound (replies
-  // go through the native `message.reply()`, never the binding) and sends to verified
-  // destinations. The cost: a later Workers Paid upgrade is not picked up by the deploy;
-  // `void email setup` offers the retry (`sendingRetryable`). A binding committed by hand
-  // reads the same way — the developer chose it. Note that with the binding present every
-  // sending state is settled today (`unknown` always carries a sending-scoped blocker), so
-  // the row gates `ready` only through the binding; the three terms stay apart because
-  // each is settled for a different reason.
+  // A sending-scoped blocker is not work Void can act on. A pending sending row with the
+  // binding committed is settled too: no read tells Workers Free from "never onboarded", but
+  // apply writes `send_email` only on a run that already tried `sending enable`, so the binding
+  // records a refused onboarding. `void email setup` offers the retry (`sendingRetryable`).
   const sendingBlocked = pre.blockers.some((b) => b.scope === 'sending');
   pre.sendingRetryable = pre.sending.state === 'pending' && !sendingBlocked;
   const sendingSettled =
@@ -1085,15 +984,14 @@ type ZoneRecord = { id: string; name: string; type?: string; account?: { id?: st
 
 // ── Checklist ──────────────────────────────────────────────────────────────────
 
-/** Column padding for the checklist; an overflowing cell gets three spaces (0078 transcript). */
+/** Column padding for the checklist; an overflowing cell gets three spaces. */
 function pad(text: string, width: number): string {
   return text.length >= width ? `${text}   ` : text.padEnd(width);
 }
 
 /**
- * The block shown before the one Enter — status rows, then the `+`/`!` change list
- * under the "This changes YOUR Cloudflare account" line (0078 transcript). Blockers
- * render as `✘` rows at the end so the developer sees why nothing will be asked.
+ * The block shown before the confirmation: status rows, then the `+`/`!` change list.
+ * Blockers render as `✘` rows at the end so the developer sees why nothing will be asked.
  */
 export function renderEmailChecklist(pre: EmailPreflight): string {
   const apex = pre.apex ?? '?';
@@ -1332,9 +1230,9 @@ export async function fetchWithSessionBearer(
 // ── Apply ──────────────────────────────────────────────────────────────────────
 
 /**
- * The root-config patch Mode B writes. Shape-compatible with the `sendEmail` /
- * `addresses` / `vars` members of `ProvisionedWranglerPatch` (`cli/wrangler.ts`):
- * `addresses: null` deletes the key (never `[]`), `undefined` leaves it untouched.
+ * The config patch email setup writes; a subset of `ProvisionedWranglerPatch`.
+ * `addresses: null` deletes the key (never `[]`, which deletes every owned rule);
+ * `undefined` leaves it untouched.
  */
 export interface EmailWranglerPatch {
   sendEmail?: { name: string };
@@ -1349,34 +1247,24 @@ export interface EmailApplyResult {
   routingReady: boolean;
   subaddressingReady: boolean;
   sendingReady: boolean;
-  /** True when `addresses` was NOT written this run and the key is deleted instead. */
-  addressesWithheld: boolean;
   /**
-   * The inbound rows, together: routing ready AND subaddressing on AND `addresses`
-   * written. Routing alone is not "set up" — a refused subaddressing PATCH withholds
-   * `addresses` (no bearer call may fail, decision 11), so the next deploy creates no
-   * rule at all, and until the flag is on `support+T-42@` matches no rule for `support@`.
-   * `void email setup` exits 0 on this; `--require-email` gates on it plus the binding —
-   * the sending row needs no term there, because the binding this same run writes is what
-   * the next preflight reads as the memory of a refused onboarding (see `preflightEmail`).
-   * ONE field, computed here, so the two callers cannot drift.
+   * Routing ready, subaddressing on, and `addresses` written. `void email setup` exits 0 on
+   * this, and `--require-email` gates on it plus the binding.
    */
   inboundReady: boolean;
 }
 
 /**
- * Run ONLY the rows preflight found not ready, in 0078 order:
+ * Run only the rows preflight found not ready:
  *
- *   routing   apex → `wrangler email routing enable <apex>`
- *             subdomain → bearer POST /zones/{z}/email/routing/dns { name }   [UNVERIFIED]
- *   subaddr   bearer PATCH /zones/{z}/email/routing { support_subaddress: true } [UNVERIFIED]
- *             (both paths — wrangler has no command for it)
- *   sending   `wrangler email sending enable <domain>`; `[code: 2040]` = already
- *             onboarded → ok; any other failure → hint line, continue without sending
+ *   routing   apex → `email routing enable <apex>`
+ *             subdomain → bearer POST /zones/{z}/email/routing/dns { name }
+ *   subaddr   bearer PATCH /zones/{z}/email/routing { support_subaddress: true }
+ *   sending   `email sending enable <domain>`; code 2040 (already onboarded) is ok;
+ *             any other failure prints a hint and continues without sending
  *
- * Any bearer failure (no bearer, or a non-2xx) prints the dashboard fallback line and
- * WITHHOLDS `addresses` this run — never a deploy failure (decision 11). A preflight
- * with an `all` blocker applies nothing and returns an empty patch.
+ * A failed bearer call prints the dashboard fallback and withholds `addresses` this run;
+ * it never fails the deploy. An `all` blocker applies nothing and returns an empty patch.
  */
 export async function applyEmailSetup(
   pre: EmailPreflight,
@@ -1389,7 +1277,6 @@ export async function applyEmailSetup(
     routingReady: pre.routing.state === 'ready',
     subaddressingReady: pre.subaddressing.state === 'on',
     sendingReady: pre.sending.state === 'ready',
-    addressesWithheld: false,
     inboundReady: false,
   };
   const blocked = pre.blockers.filter((b) => b.scope === 'all');
@@ -1475,19 +1362,15 @@ export async function applyEmailSetup(
         );
       }
     } else if (apexRoutingOff) {
-      // A subdomain is added to a zone that ALREADY routes (Cloudflare's Subdomains form
-      // lives under an enabled apex). What the `name`-bearing POST does against a zone
-      // whose routing is off is unmeasured, and the one outcome that would matter — the
-      // zone itself being enabled, locking MX over the apex's live mail — is exactly what
-      // the apex refusal exists to prevent. So no call is made; `addresses` is withheld.
+      // A subdomain can only be added to a zone that already routes. Calling here could
+      // enable the zone itself and lock MX over the apex's live mail, so no call is made.
       lines.push(
         `  ✘ routing   ${pre.domain}: Email Routing is not enabled on ${apex} — a subdomain can only be added to a zone that already routes; Void never enables routing on the apex from the subdomain path`,
       );
       lines.push(`    ${subdomainDashboardFallback(apex, pre.domain)}`);
     } else {
-      // [UNVERIFIED] POST …/email/routing/dns { name } enables routing on a subdomain
-      // (OpenAPI body field `name`; wrangler's own `routing enable` calls the deprecated
-      // POST …/routing/enable which is apex-only). See 0078 "Still unverified" 1.
+      // Per the OpenAPI spec, POST …/email/routing/dns { name } enables routing on a
+      // subdomain; the `email.routing.enable` operation is apex-only.
       const response = await withBearer('POST', `/zones/${pre.zone.zoneId}/email/routing/dns`, {
         name: pre.domain,
       });
@@ -1501,8 +1384,7 @@ export async function applyEmailSetup(
     }
   }
 
-  // 2. Subaddressing — per-zone, off by default, no wrangler command (0078 measured).
-  //    [UNVERIFIED] PATCH with the OAuth session; see 0078 "Still unverified" 2.
+  // 2. Subaddressing: per zone, off by default, and reachable only through the REST API.
   if (!result.subaddressingReady && !bearerFailed && !apexRoutingOff) {
     const response = await withBearer('PATCH', `/zones/${pre.zone.zoneId}/email/routing`, {
       support_subaddress: true,
@@ -1558,29 +1440,26 @@ export async function applyEmailSetup(
     result.patch.sendEmail = { name: SEND_EMAIL_BINDING };
     result.patch.vars = { [EMAIL_FROM_VAR]: pre.from };
   }
-  result.addressesWithheld = bearerFailed || !result.routingReady;
-  if (!result.addressesWithheld && pre.addresses.length > 0) {
+  const addressesWithheld = bearerFailed || !result.routingReady;
+  if (!addressesWithheld && pre.addresses.length > 0) {
     result.patch.addresses = pre.addresses;
   } else {
     result.patch.addresses = null;
-    if (result.addressesWithheld && pre.addresses.length > 0) {
+    if (addressesWithheld && pre.addresses.length > 0) {
       lines.push(
         `  ! config    addresses withheld this run (${bearerFailed ? 'session-bearer step failed' : 'routing not ready'}); no routing rule is created for ${pre.addresses.join(', ')}`,
       );
     }
   }
-  if (result.patch.sendEmail || result.patch.addresses !== undefined) {
-    lines.push('  ✔ config    void.lock.json updated');
-  }
-  result.inboundReady =
-    result.routingReady && result.subaddressingReady && !result.addressesWithheld;
+  lines.push('  ✔ config    void.lock.json updated');
+  result.inboundReady = result.routingReady && result.subaddressingReady && !addressesWithheld;
   return result;
 }
 
 // ── Address map ────────────────────────────────────────────────────────────────
 
 /**
- * The post-deploy block (0078 transcript):
+ * The post-deploy block:
  *
  *     inbound   support@mail.acme.com  →  email/support+[ticket].ts
  *     outbound  sendEmail() from support@mail.acme.com
diff --git a/packages/void/src/cli/email.ts b/packages/void/src/cli/email.ts
index 131d983cf..85ac8f34e 100644
--- a/packages/void/src/cli/email.ts
+++ b/packages/void/src/cli/email.ts
@@ -1,6 +1,7 @@
 import { execSync } from 'node:child_process';
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { setTimeout as delay } from 'node:timers/promises';
 import { parseRootWranglerConfig, readWranglerTopLevelString } from '@void/deploy-cloudflare';
 import { confirm, isCancel, log, password } from '@voidzero-dev/vite-plus-prompts';
 import { join } from 'pathslash';
@@ -8,13 +9,17 @@ import { readConfig } from '../config.ts';
 import { readProjectPaths } from '../project-paths.ts';
 import { scanEmailHandlersSync } from '../router/email.ts';
 import { getToken, openBrowser } from './auth.ts';
-import { PlatformApiError, PlatformClient, type EmailDomainResponse } from './client.ts';
+import {
+  PlatformApiError,
+  PlatformClient,
+  type EmailDomainResponse,
+  type EmailOperationResponse,
+} from './client.ts';
 import {
   createDeployWranglerRunner,
   deriveWorkerName,
   discoverRootWranglerConfig,
   isWranglerNonInteractiveOrCI,
-  loadProvisionModule,
   resolveDeployTransport,
   runWranglerAuthToken,
 } from './deploy.ts';
@@ -22,8 +27,9 @@ import type { EmailArgs } from './email-args.ts';
 import {
   applyEmailSetup,
   createNodeEmailDns,
-  findEmailConfigConflicts,
+  emailConfigInputs,
   preflightEmail,
+  probeMx,
   renderAddressMap,
   renderEmailChecklist,
   type EmailCloudflareInputs,
@@ -33,11 +39,11 @@ import {
   type EmailWranglerRun,
 } from './email-cloudflare.ts';
 import { printSuccess, createSpinner, note, pc } from './output.ts';
-import { readProjectConfig } from './project.ts';
+import { resolveCommandProjectId } from './resolve-project.ts';
 import { writeProvisionedWranglerConfig } from './wrangler.ts';
 
 export async function runEmailCommand(root: string, args: EmailArgs): Promise<void> {
-  // Mode B (design doc 0078) never touches the Void platform: no token, no project.
+  // The developer's own Cloudflare account needs no Void token or project.
   if (args.platform === 'cloudflare') {
     return runEmailCloudflareCommand(root, args);
   }
@@ -62,39 +68,21 @@ export async function runEmailCommand(root: string, args: EmailArgs): Promise<vo
 
   const client = new PlatformClient(token, { root });
 
-  const requestedSlug = args.projectSlug ?? process.env.VOID_PROJECT?.trim();
-  let projectId: string | undefined;
-
-  if (requestedSlug) {
-    const projects = await client.listProjects();
-    const project = projects.find((p) => p.slug === requestedSlug);
-    if (!project) {
-      log.error(`project: No project found with slug '${requestedSlug}'.`);
-      process.exit(1);
-    }
-    projectId = project.id;
-  } else {
-    const config = readProjectConfig(root);
-    if (!config) {
-      log.error('No linked project. Run `void project link` or pass --project <name>.');
-      process.exit(1);
-    }
-    projectId = config.projectId;
-  }
+  const projectId = await resolveCommandProjectId(client, root, args.projectSlug);
 
   switch (args.subcommand) {
     case 'usage':
-      return emailUsage(client, projectId!);
+      return emailUsage(client, projectId);
     case 'logs':
-      return emailLogs(client, projectId!, args.limit);
+      return emailLogs(client, projectId, args.limit);
     case 'destinations':
-      return emailDestinations(client, projectId!);
+      return emailDestinations(client, projectId);
     case 'allow':
-      return emailAllow(client, projectId!, args.address!);
+      return emailAllow(client, projectId, args.address!);
     case 'disallow':
-      return emailDisallow(client, projectId!, args.address!);
+      return emailDisallow(client, projectId, args.address!);
     case 'domain':
-      return runEmailDomainCommand(client, projectId!, args);
+      return runEmailDomainCommand(client, projectId, args);
   }
 }
 
@@ -203,20 +191,13 @@ export async function emailLogs(
   note(lines.join('\n'), 'Email Logs');
 }
 
-// ── Custom domains on the customer's own Cloudflare zone (0078) ──────────────
+// ── Custom domains on the customer's own Cloudflare zone ──────────────────────
 //
-// `void email domain add|status|list|sync|remove`. The api owns the
-// orchestration (contract 7); the CLI owns the MX-decision render, the
-// scoped API token (the template link +
-// clipboard watch below as the permanent fallback), and the result render.
-// The pasted API token is held in
-// memory, POSTed once, and never printed, logged, or persisted locally.
+// The API token is held in memory, sent once, and never printed, logged, or stored locally.
 
 /**
- * The dashboard template link's permission groups (contract 8). Every key
- * rides every link — there is no apex-only key, because `Zone Settings Edit`
- * gates the routing POST on both paths; `zone: read` is what the zone lookup
- * needs. URL-encoded by `URL.searchParams`.
+ * Permission groups prefilled in the dashboard token link. `zone_settings: edit` gates
+ * the routing POST; `zone: read` serves the zone lookup.
  */
 const CF_TOKEN_TEMPLATE_PERMISSION_GROUPS = [
   { key: 'zone', type: 'read' },
@@ -226,7 +207,7 @@ const CF_TOKEN_TEMPLATE_PERMISSION_GROUPS = [
   { key: 'zone_settings', type: 'edit' },
 ] as const;
 
-/** The three-click template link — the scoped token path (0078, "Creating the token in three clicks"). */
+/** Dashboard link that prefills the scoped API token form. */
 export function buildCfApiTokenTemplateUrl(domain: string): string {
   const url = new URL('https://dash.cloudflare.com/profile/api-tokens');
   url.searchParams.set('permissionGroupKeys', JSON.stringify(CF_TOKEN_TEMPLATE_PERMISSION_GROUPS));
@@ -240,24 +221,19 @@ export function buildCfApiTokenTemplateUrl(domain: string): string {
 /** 'refused' and 'unknown' are both rejected; 'refused' names a known foreign prefix in the error. */
 export type CfApiTokenShape = 'cfut' | 'legacy' | 'refused' | 'unknown';
 
-// The current format (Cloudflare's token-formats doc, 2026): the `cfut_`
-// prefix, 40 characters, then a CRC32 checksum. The doc pins the 40 but not
-// the checksum's exact rendered length, so the tail is bounded loosely —
-// `GET /user/tokens/verify` is the real gate, not this regex.
+// `cfut_`, 40 characters, then a CRC32 checksum whose rendered length is not documented,
+// so the tail is loose. `GET /user/tokens/verify` is the real gate, not this regex.
 const CFUT_TOKEN_PATTERN = /^cfut_[A-Za-z0-9_-]{44,64}$/;
 // Pre-2026 tokens: an unprefixed 40-character string. Still accepted by CF.
 const LEGACY_CF_TOKEN_PATTERN = /^[A-Za-z0-9_-]{40}$/;
-// Other dashboards' tokens are refused WITHOUT a network call (0078) —
-// pasting the wrong site's token is the common mistake, and naming it beats
-// a CF 401. `cfk_` is Cloudflare's own global key, also not a scoped token.
+// Another service's token is named without a network call instead of surfacing as a CF 401.
+// `cfk_` is Cloudflare's global key, not a scoped token.
 const REFUSED_TOKEN_PREFIXES = ['ghp_', 'github_pat_', 'sk-', 'xox', 'cfk_'] as const;
 
 /** Shape-only classification of a clipboard or pasted value. Never logs the value. */
 export function classifyCfApiTokenShape(value: string): CfApiTokenShape {
   const token = value.trim();
-  // Refused FIRST: `ghp_` + 36 chars is exactly the legacy 40-char shape, and
-  // 0078's rule is that another dashboard's token is refused without a
-  // network call — the refusal wins over the legacy-shape coincidence.
+  // Refused prefixes first: `ghp_` + 36 chars also matches the legacy 40-char shape.
   if (REFUSED_TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix))) {
     return 'refused';
   }
@@ -270,8 +246,6 @@ export function classifyCfApiTokenShape(value: string): CfApiTokenShape {
   return 'unknown';
 }
 
-// Clipboard helpers — the read side mirrors the write side in account-cmd.ts
-// (pbcopy / clip / xclip); wl-paste/wl-copy cover Wayland sessions.
 function readClipboard(): string | null {
   const platform = process.platform;
   const command =
@@ -310,18 +284,15 @@ function clearClipboard(): void {
       }
     }
   } catch {
-    // Best-effort: a headless session has nothing to clear, and a failure
-    // here must not fail the add (the doc says so once, below).
+    // Best-effort: a failure here must not fail the add.
   }
 }
 
 export type CfTokenVerification = 'active' | 'inactive' | 'unknown';
 
 /**
- * The CLI-side active check from 0078's clipboard sequence. 'unknown' means
- * the check could not run (no network, a CF error) — the caller proceeds and
- * lets the platform verify authoritatively, never treating a network blip as
- * a bad token. The token itself is never logged.
+ * Local active check. 'unknown' means the check could not run (network or CF error); the
+ * caller proceeds and the platform verifies authoritatively. The token is never logged.
  */
 async function verifyCfApiToken(token: string): Promise<CfTokenVerification> {
   let res: Response;
@@ -360,57 +331,11 @@ export function isValidEmailDomainInput(domain: string): boolean {
   return /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/.test(domain);
 }
 
-/**
- * Where `--subdomain` lands: a bare label nests under the positional domain
- * (`mx` → `mx.acme.com`), a full host is taken as-is but must stay under it.
- * Throws on anything else — the user named a domain this add cannot register.
- */
-export function resolveEmailDomainTarget(
-  domain: string,
-  subdomain?: string,
-): { emailDomain: string; forced: boolean } {
-  if (subdomain === undefined) {
-    return { emailDomain: domain, forced: false };
-  }
-  const candidate = subdomain.trim().toLowerCase().replace(/\.$/, '');
-  const resolved = candidate.includes('.') ? candidate : `${candidate}.${domain}`;
-  if (!isValidEmailDomainInput(resolved)) {
-    throw new Error(`email: invalid --subdomain value '${subdomain}'.`);
-  }
-  if (resolved === domain || !resolved.endsWith(`.${domain}`)) {
-    throw new Error(`email: --subdomain must name a subdomain of ${domain} (got '${subdomain}').`);
-  }
-  return { emailDomain: resolved, forced: true };
-}
-
-/**
- * Local public-DNS MX read. [] = no records, null = could not read. The
- * local answer only steers the default and the render — the platform
- * re-checks over public DNS and its answer is authoritative, so a
- * split-horizon resolver never blocks a valid setup here.
- */
-async function lookupMxForRender(
-  dns: Pick<EmailDns, 'resolveMx'>,
-  name: string,
-): Promise<Array<string> | null> {
-  try {
-    const records = await dns.resolveMx(name);
-    return records
-      .slice()
-      .sort((a, b) => a.priority - b.priority)
-      .map((r) => r.exchange.replace(/\.$/, '').toLowerCase());
-  } catch (err) {
-    const code = (err as { code?: unknown } | null)?.code;
-    return code === 'ENODATA' || code === 'ENOTFOUND' ? [] : null;
-  }
-}
-
 type EnterRace = { promise: Promise<'enter'>; stop: () => void };
 
 /**
- * The "Enter switches paths" race from 0078's flow. The default reads one
- * cooked-mode line from stdin; `stop` removes the listener so a losing race
- * cannot eat the first keystroke of a later prompt.
+ * Resolves when Enter is pressed during the clipboard watch. `stop` removes the listener so
+ * a losing race cannot eat the first keystroke of a later prompt.
  */
 function createEnterRace(waitForEnter?: () => Promise<unknown>): EnterRace {
   if (waitForEnter) {
@@ -452,9 +377,9 @@ export interface EmailDomainAddDeps {
   /** The Enter keypress that switches paths (default: one stdin line). */
   waitForEnter?: () => Promise<unknown>;
   watchIntervalMs?: number;
-  /** Default 10 minutes (0078's clipboard watch bound). */
+  /** Default 10 minutes. */
   watchTimeoutMs?: number;
-  /** Sleep between reconcile polls after a lost add answer (default: setTimeout). */
+  /** Sleep between reconcile polls after a lost answer (default: setTimeout). */
   sleep?: (ms: number) => Promise<void>;
   /** Default: wrangler's interactivity gate, same as `void email setup`. */
   isInteractive?: boolean;
@@ -475,28 +400,62 @@ async function defaultPasteToken(): Promise<string | null> {
 type EmailDomainCredential = { kind: 'api_token'; apiToken: string };
 
 /**
- * Lost-answer reconcile bounds for `domain add`: attempt-count bounded (not
- * wall clock) so the worst case is finite and tests are deterministic. The
- * API's pre-insert phase is DB-only but takes tens of ms to seconds of
- * Hyperdrive RTTs, and a lost answer does not stop the API worker — a single
- * immediate status read can 404 while the POST is still committing.
+ * Lost-answer reconcile bounds: attempt-count bounded so the worst case is finite. A lost
+ * answer does not stop the API worker, so one immediate status read can 404 while the
+ * request is still committing.
  */
-const ADD_RECONCILE_ATTEMPTS = 15;
-const ADD_RECONCILE_INTERVAL_MS = 1000;
+const RECONCILE_ATTEMPTS = 15;
+const RECONCILE_INTERVAL_MS = 1000;
+
+/**
+ * After an add or rotate request fails without a definitive refusal, poll its operation by
+ * attempt id and print it. Returns undefined when the operation never appears.
+ */
+async function reconcileEmailOperation(
+  error: unknown,
+  client: Pick<PlatformClient, 'getEmailOperation'>,
+  projectId: string,
+  attemptId: string,
+  title: string,
+  sleep: (ms: number) => Promise<void> = delay,
+): Promise<EmailOperationResponse | undefined> {
+  if (error instanceof PlatformApiError && [400, 403, 404, 409].includes(error.status)) {
+    throw error;
+  }
+  for (let attempt = 0; attempt < RECONCILE_ATTEMPTS; attempt++) {
+    if (attempt > 0) {
+      await sleep(RECONCILE_INTERVAL_MS);
+    }
+    let operation: EmailOperationResponse;
+    try {
+      operation = await client.getEmailOperation(projectId, attemptId);
+    } catch {
+      continue;
+    }
+    note(
+      [
+        `Operation:   ${operation.operationId}`,
+        `Status:      ${operation.status}`,
+        `Inbound:     ${operation.readiness.inbound.status}`,
+        `Outbound:    ${operation.readiness.outbound.status}`,
+        `Credential:  ${operation.readiness.management.status}`,
+      ].join('\n'),
+      title,
+    );
+    return operation;
+  }
+  return undefined;
+}
 
 export async function emailDomainAdd(
   client: Pick<
     PlatformClient,
-    | 'addEmailDomain'
-    | 'getEmailDomain'
-    | 'getEmailOperation'
-    | 'getEmailSettings'
-    | 'listEmailDomains'
+    'addEmailDomain' | 'getEmailOperation' | 'getEmailSettings' | 'listEmailDomains'
   >,
   projectId: string,
   rawDomain: string,
-  subdomain: string | undefined,
   deps: EmailDomainAddDeps = {},
+  subdomain?: string,
 ): Promise<void> {
   const exit = deps.exit ?? ((code: number): never => process.exit(code));
   const fail = (message: string): never => {
@@ -513,22 +472,17 @@ export async function emailDomainAdd(
       'email: Platform-managed custom email requires a Cloudflare zone apex because inbound email uses its catch-all. Omit --subdomain, choose an unused zone apex, or use the platform shared mail address.',
     );
   }
-  let target: { emailDomain: string; forced: boolean };
-  try {
-    target = resolveEmailDomainTarget(domain, subdomain);
-  } catch (err) {
-    return fail(err instanceof Error ? err.message : String(err));
-  }
 
-  // Keep the requested apex. The server checks DNS and zone authority again.
+  // A foreign MX on the apex stops here; an unreadable one is left to the platform, which
+  // re-checks over public DNS.
   const dns = deps.dns ?? (await createNodeEmailDns());
-  const decideTarget = async (): Promise<void> => {
-    const mx = await lookupMxForRender(dns, domain);
-    if (mx === null) {
+  const checkApexMx = async (): Promise<void> => {
+    const mx = await probeMx(dns, domain);
+    if (mx.state === 'unknown') {
       log.info(
         `MX        could not read ${domain}'s MX from here — the platform decides over public DNS.`,
       );
-    } else if (mx.some((exchange) => !/\.mx\.cloudflare\.net$/i.test(exchange))) {
+    } else if (mx.state === 'foreign') {
       fail(
         `email: ${domain} already receives mail from another provider. Platform custom inbound email requires an unused Cloudflare zone apex; choose another apex or use the platform shared mail address.`,
       );
@@ -537,49 +491,34 @@ export async function emailDomainAdd(
     }
   };
 
-  // On an administrator-managed platform owners normally hold no Cloudflare
-  // credential, so there is no grant to open a browser for. The handoff does
-  // DNS and the two platform GETs, never a Cloudflare call or browser flow. A
-  // row the owner registered before the switch stays theirs to renew
-  // (ownership table: add on an owner row), so that owner flow continues for
-  // an existing target.
-  let renewal: string | undefined;
+  // On an administrator-managed platform new domains go to the administrator. An owner row
+  // registered before the switch stays the owner's to renew.
+  let renewal = false;
   const settings = await client.getEmailSettings(projectId);
   if (settings.domains.management === 'admin') {
     const rows = await client.listEmailDomains(projectId);
-    const candidates = [target.emailDomain];
-    const existing = candidates
-      .map((candidate) =>
-        rows.find((row) => row.domain === candidate && row.managed_by !== 'admin'),
-      )
-      .find((row) => row !== undefined);
-    if (!existing) {
-      await decideTarget();
+    renewal = rows.some((row) => row.domain === domain && row.managed_by !== 'admin');
+    if (!renewal) {
+      await checkApexMx();
       const project = settings.domains.projectSlug ?? projectId;
       log.info(
         [
           'Email domains on this platform are managed by its administrator.',
           'Ask them to run:',
           '',
-          `  void platform email domain-add ${target.emailDomain} --project ${project}`,
+          `  void platform email domain-add ${domain} --project ${project}`,
           '',
           '`void email domain list` and `void email domain status` keep working here.',
         ].join('\n'),
       );
       return exit(0);
     }
-    // The pre-switch row IS the target: Email Routing itself put MX on the
-    // apex it serves, so the MX decision below would retarget a renewal.
-    renewal = existing.domain;
-    target = { emailDomain: existing.domain, forced: true };
   }
 
-  // A renewal keeps its stored target: Email Routing itself put MX on the
-  // apex it serves, so the MX decision would retarget it.
-  if (renewal !== undefined) {
-    log.info(`Updating ${renewal} with a scoped credential; the platform will reconcile setup.`);
+  if (renewal) {
+    log.info(`Updating ${domain} with a scoped credential; the platform will reconcile setup.`);
   } else {
-    await decideTarget();
+    await checkApexMx();
   }
 
   // Token creation needs a browser or a masked paste prompt.
@@ -593,17 +532,13 @@ export async function emailDomainAdd(
   let credential: EmailDomainCredential;
   {
     log.info(
-      `Create a Cloudflare API token restricted to the account and DNS zone containing ${target.emailDomain}. In the resource selectors, replace All accounts and All zones with those exact resources. Workers Scripts Write still applies to every Worker in the selected account.`,
+      `Create a Cloudflare API token restricted to the account and DNS zone containing ${domain}. In the resource selectors, replace All accounts and All zones with those exact resources. Workers Scripts Write still applies to every Worker in the selected account.`,
     );
-    const url = buildCfApiTokenTemplateUrl(target.emailDomain);
+    const url = buildCfApiTokenTemplateUrl(domain);
     const readClip = deps.readClipboard ?? readClipboard;
     const clearClip = deps.clearClipboard ?? clearClipboard;
     const verify = deps.verifyToken ?? verifyCfApiToken;
-    const openUrl =
-      deps.openUrl ??
-      ((u: string): void => {
-        void import('node:child_process').then(({ execFile }) => openBrowser(u, execFile));
-      });
+    const openUrl = deps.openUrl ?? openBrowser;
     const snapshot = readClip();
     if (snapshot === null) {
       log.info('No clipboard tool found here — paste the token instead.');
@@ -630,9 +565,8 @@ export async function emailDomainAdd(
       const interval = deps.watchIntervalMs ?? 1000;
       const snapshotTrimmed = snapshot.trim();
       const enterDuringWatch = createEnterRace(deps.waitForEnter);
-      // Either race outcome must stop the poll branch: an orphaned loop would
-      // keep reading the clipboard on ref'd timers to the deadline (and could
-      // verify a later token-shaped value) after the flow has moved on.
+      // Either race outcome must stop the poll branch, or an orphaned loop keeps reading the
+      // clipboard (and could verify a later token) after the flow has moved on.
       let watchSettled = false;
       let watchTimer: ReturnType<typeof setTimeout> | undefined;
       outcome = await Promise.race([
@@ -649,8 +583,7 @@ export async function emailDomainAdd(
               continue;
             }
             const shape = classifyCfApiTokenShape(value);
-            // Wrong shape (another vendor's token included): nothing — still
-            // waiting, and never a network call for it (0078's branch table).
+            // Wrong shape, including another vendor's token: keep waiting, no network call.
             if (shape === 'refused' || shape === 'unknown') {
               continue;
             }
@@ -680,7 +613,6 @@ export async function emailDomainAdd(
     if (outcome.type === 'token') {
       clearClip();
       watchSpinner?.stop('Token received — the clipboard copy was cleared.');
-      // Said once, per 0078: a clipboard manager's history is outside our reach.
       log.info('A clipboard manager may keep its own history — clear it there if you run one.');
       credential = { kind: 'api_token', apiToken: outcome.token };
     } else {
@@ -689,7 +621,6 @@ export async function emailDomainAdd(
       );
       const pasted = await (deps.pasteToken ?? defaultPasteToken)();
       if (pasted === null) {
-        // Esc: cancel with nothing stored anywhere (0078's branch table).
         log.info('Cancelled — nothing was stored anywhere.');
         return;
       }
@@ -718,14 +649,14 @@ export async function emailDomainAdd(
 
   const scopeConfirmed = await (
     deps.confirmScope ??
-    (async (domain: string) => {
+    (async (name: string) => {
       const answer = await confirm({
-        message: `Is this token restricted to the Cloudflare account and DNS zone containing ${domain}?`,
+        message: `Is this token restricted to the Cloudflare account and DNS zone containing ${name}?`,
         initialValue: false,
       });
       return !isCancel(answer) && answer === true;
     })
-  )(target.emailDomain);
+  )(domain);
   if (!scopeConfirmed) {
     return fail(
       'email: restrict the token to the selected account and zone before adding the domain. Nothing was submitted to the platform.',
@@ -737,50 +668,34 @@ export async function emailDomainAdd(
   let row: EmailDomainResponse;
   try {
     row = await client.addEmailDomain(projectId, {
-      domain: target.emailDomain,
+      domain,
       apiToken: credential.apiToken,
       attemptId,
     });
   } catch (error) {
-    if (error instanceof PlatformApiError && [400, 403, 404, 409].includes(error.status)) {
-      throw error;
-    }
-    const sleep =
-      deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
-    for (let attempt = 0; attempt < ADD_RECONCILE_ATTEMPTS; attempt++) {
-      if (attempt > 0) {
-        await sleep(ADD_RECONCILE_INTERVAL_MS);
-      }
-      let operation;
-      try {
-        operation = await client.getEmailOperation(projectId, attemptId);
-      } catch {
-        continue;
-      }
-      note(
-        [
-          `Operation:   ${operation.operationId}`,
-          `Status:      ${operation.status}`,
-          `Inbound:     ${operation.readiness.inbound.status}`,
-          `Outbound:    ${operation.readiness.outbound.status}`,
-          `Credential:  ${operation.readiness.management.status}`,
-        ].join('\n'),
-        'Email Setup',
-      );
-      if (operation.error) {
-        log.error(operation.error);
-      }
-      log.info(`Run \`void email domain status ${target.emailDomain}\` to inspect setup.`);
-      if (operation.status === 'completed') {
-        printSuccess(`Email domain ${target.emailDomain} configured.`);
-        return;
-      }
+    const operation = await reconcileEmailOperation(
+      error,
+      client,
+      projectId,
+      attemptId,
+      'Email Setup',
+      deps.sleep,
+    );
+    if (!operation) {
       return fail(
-        `email: setup is ${operation.status}; operation ${operation.operationId} retains its confirmed progress on the platform.`,
+        `email: setup outcome is unknown (operation ${attemptId}). Nothing was revoked. Check \`void email domain status ${domain}\` before starting another setup.`,
       );
     }
+    if (operation.error) {
+      log.error(operation.error);
+    }
+    log.info(`Run \`void email domain status ${domain}\` to inspect setup.`);
+    if (operation.status === 'completed') {
+      printSuccess(`Email domain ${domain} configured.`);
+      return;
+    }
     return fail(
-      `email: setup outcome is unknown (operation ${attemptId}). Nothing was revoked. Check \`void email domain status ${target.emailDomain}\` before starting another setup.`,
+      `email: setup is ${operation.status}; operation ${operation.operationId} retains its confirmed progress on the platform.`,
     );
   }
   log.info(
@@ -910,42 +825,26 @@ export async function emailDomainRotateSecret(
   try {
     row = await client.rotateEmailDomainSecret(projectId, domain, attemptId);
   } catch (error) {
-    if (error instanceof PlatformApiError && [400, 403, 404, 409].includes(error.status)) {
-      throw error;
+    const operation = await reconcileEmailOperation(
+      error,
+      client,
+      projectId,
+      attemptId,
+      'Email Secret Rotation',
+      deps.sleep,
+    );
+    if (!operation) {
+      throw new Error(
+        `email: secret rotation outcome is unknown (operation key ${attemptId}); inspect \`void email domain status ${domain}\` before starting another rotation.`,
+      );
     }
-    const sleep =
-      deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
-    for (let attempt = 0; attempt < ADD_RECONCILE_ATTEMPTS; attempt++) {
-      if (attempt > 0) {
-        await sleep(ADD_RECONCILE_INTERVAL_MS);
-      }
-      let operation;
-      try {
-        operation = await client.getEmailOperation(projectId, attemptId);
-      } catch {
-        continue;
-      }
-      note(
-        [
-          `Operation:   ${operation.operationId}`,
-          `Status:      ${operation.status}`,
-          `Inbound:     ${operation.readiness.inbound.status}`,
-          `Outbound:    ${operation.readiness.outbound.status}`,
-          `Credential:  ${operation.readiness.management.status}`,
-        ].join('\n'),
-        'Email Secret Rotation',
+    if (operation.status !== 'completed') {
+      throw new Error(
+        `email: secret rotation ${operation.status}; inspect operation ${operation.operationId}`,
       );
-      if (operation.status !== 'completed') {
-        throw new Error(
-          `email: secret rotation ${operation.status}; inspect operation ${operation.operationId}`,
-        );
-      }
-      printSuccess('Zone ingress secret rotated and verified on the deployed Worker.');
-      return;
     }
-    throw new Error(
-      `email: secret rotation outcome is unknown (operation key ${attemptId}); inspect \`void email domain status ${domain}\` before starting another rotation.`,
-    );
+    printSuccess('Zone ingress secret rotated and verified on the deployed Worker.');
+    return;
   }
   printEmailDomainOutcome(row);
   if (row.operationStatus !== 'completed') {
@@ -983,7 +882,7 @@ async function runEmailDomainCommand(
 ): Promise<void> {
   switch (args.domainVerb) {
     case 'add':
-      return emailDomainAdd(client, projectId, args.domain!, args.subdomain);
+      return emailDomainAdd(client, projectId, args.domain!, {}, args.subdomain);
     case 'status':
       return emailDomainStatus(client, projectId, args.domain!);
     case 'list':
@@ -997,23 +896,19 @@ async function runEmailDomainCommand(
   }
 }
 
-// ── Mode B: the developer's own Cloudflare account ─────────────────────────────
+// ── --platform cloudflare: the developer's own Cloudflare account ───────────────
 
-/**
- * Seams for {@link runEmailCloudflareCommand}, so the command is unit-testable with no
- * wrangler, network, DNS, terminal, or Cloudflare account — the same pattern the deploy
- * orchestrator's `CloudflareDeployDeps` uses.
- */
+/** Test seams for {@link runEmailCloudflareCommand}. */
 export interface EmailCloudflareCommandDeps {
-  /** wrangler runner for the read-only probes and the `email … enable` writes. */
+  /** Runner for the provider reads and the `enable` writes. */
   runWrangler?: EmailWranglerRun;
-  /** The session-bearer bridge (default: `wrangler auth token --json`, logs off). */
+  /** The session-bearer bridge (default: `runWranglerAuthToken`). */
   getSessionBearer?: () => Promise<string | null>;
   fetchImpl?: EmailFetch;
   dns?: EmailDns;
-  /** Override the interactivity gate (default: wrangler's own, `!isWranglerNonInteractiveOrCI()`). */
+  /** Override the interactivity gate (default: `!isWranglerNonInteractiveOrCI()`). */
   isInteractive?: boolean;
-  /** The one Enter (default: clack `confirm`, default Yes). */
+  /** Setup confirmation (default: clack `confirm`, default Yes). */
   confirm?: (message: string) => Promise<boolean>;
   /** Block printer for the checklist / address map (default: clack `log.message`). */
   print?: (block: string) => void;
@@ -1026,10 +921,8 @@ interface EmailWranglerConfigContext {
 }
 
 /**
- * Wrangler discovers config files by walking parent directories. A standalone email command in
- * an app with no root config must still run in an explicit empty config context, otherwise an
- * unrelated ancestor config can select the wrong account. The real project path remains separate:
- * setup writes there only after it succeeds, while status leaves the project untouched.
+ * Wrangler finds config by walking parent directories, so an app with no root config runs in
+ * an empty temporary one; otherwise an unrelated ancestor config could select the wrong account.
  */
 function createEmailWranglerConfigContext(configPath: string): EmailWranglerConfigContext {
   if (existsSync(configPath)) {
@@ -1051,18 +944,15 @@ function createEmailWranglerConfigContext(configPath: string): EmailWranglerConf
 }
 
 /**
- * `void email setup --platform cloudflare` and `void email status --platform cloudflare`.
+ * `void email setup|status --platform cloudflare`.
  *
- * `setup` is the deploy's step 3b-ii on its own: preflight → checklist → the one Enter →
- * apply → write the root wrangler.jsonc. It exists for CI: a non-interactive deploy that
- * finds email not ready prints the checklist and says to run this once, commit
- * wrangler.jsonc, and redeploy. Rules and the catch-all stay wrangler's job — the next
- * `void deploy --platform cloudflare` applies the plan from the written `addresses`. It
- * is also the ONLY place a sending onboarding the committed binding remembers as refused
- * (Workers Free) is retried — on its own prompt, after a Workers Paid upgrade; the deploy
- * reads that row as settled and never retries it.
+ * `setup` runs the deploy's email step on its own: preflight, checklist, one confirmation,
+ * apply, then a write of the generated Cloudflare config and void.lock.json. A CI deploy that
+ * finds email not ready says to run it once locally, commit void.lock.json, and redeploy; the
+ * next deploy creates the routing rules from `addresses`. It is also the only place that
+ * retries a sending onboarding the committed binding records as refused (Workers Free).
  *
- * `status` is the preflight alone, printed, exit 1 when not ready.
+ * `status` prints the preflight and exits 1 when email is not ready.
  */
 export async function runEmailCloudflareCommand(
   root: string,
@@ -1123,13 +1013,12 @@ async function runEmailCloudflareCommandInConfig(
     return exit(1);
   };
 
-  // 1. Inputs from the local project: `email.from` is the ONLY domain input (decision 9).
+  // 1. Inputs from the local project: `email.from` is the only domain input.
   const { from, handlers } = project;
 
   // 2. The same pinned transport + account + worker name as `void deploy --platform
   //    cloudflare`, so every wrangler child here consults the account the deploy will.
   const rootConfig = parseRootWranglerConfig(configPath);
-  await loadProvisionModule();
   let apiBaseUrl: string;
   try {
     apiBaseUrl = resolveDeployTransport(root, rootConfig);
@@ -1150,23 +1039,14 @@ async function runEmailCloudflareCommandInConfig(
   }
   const workerName = readWranglerTopLevelString(rootConfig, 'name') ?? deriveWorkerName(root);
   const runWrangler = deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl);
-  // The same bearer bridge the deploy's step 3b-ii uses: `wrangler auth token --json` on the
-  // pinned runner, WRANGLER_WRITE_LOGS=false so the token never reaches wrangler's on-disk log.
   const getSessionBearer =
     deps.getSessionBearer ?? (() => runWranglerAuthToken(runWrangler, wranglerConfigPath));
-  const sendEmail = rootConfig.send_email;
   const inputs: EmailCloudflareInputs = {
     handlers,
     from,
     workerName,
     accountId,
-    existingSendEmail: Array.isArray(sendEmail) ? (sendEmail as Array<{ name?: unknown }>) : null,
-    existingAddresses: rootConfig.addresses,
-    existingVars:
-      rootConfig.vars && typeof rootConfig.vars === 'object' && !Array.isArray(rootConfig.vars)
-        ? (rootConfig.vars as Record<string, unknown>)
-        : null,
-    configConflicts: findEmailConfigConflicts(rootConfig),
+    ...emailConfigInputs(rootConfig),
     configPath: wranglerConfigPath,
     apiBaseUrl,
     runWrangler,
@@ -1204,12 +1084,8 @@ async function runEmailCloudflareCommandInConfig(
     return exit(1);
   }
 
-  // 4. The one Enter. An `all` blocker means nothing can be applied; a ready preflight
-  //    needs no prompt (apply makes zero calls and the config write is idempotent) — with
-  //    one exception: a sending row the committed binding remembers as refused (Workers
-  //    Free; `sendingRetryable`, see `preflightEmail`). Apply WOULD make that one `sending
-  //    enable` call again, so it is offered as its own prompt — the retry after a Workers
-  //    Paid upgrade, which the deploy never attempts — and is never run unasked.
+  // 4. Confirm. A ready preflight needs no prompt, except a sending onboarding the committed
+  //    binding records as refused: apply would retry it, so it gets its own prompt.
   if (pre.blockers.some((b) => b.scope === 'all')) {
     return fail('email: nothing was changed — fix the ✘ rows above and rerun.');
   }
@@ -1235,7 +1111,7 @@ async function runEmailCloudflareCommandInConfig(
     }
   }
 
-  // 5. Apply, then write the root config through the one comment-preserving writer.
+  // 5. Apply, then write the config patch.
   const out = await applyEmailSetup(pre, inputs);
   if (out.lines.length > 0) {
     print(out.lines.join('\n'));
@@ -1257,14 +1133,8 @@ async function runEmailCloudflareCommandInConfig(
       pendingLabel: '(no rule yet)',
     }),
   );
-  // The inbound rows, not routing alone: a refused subaddressing PATCH after a successful
-  // enable withholds `addresses`, so the next deploy creates no rule and `+tag` mail
-  // matches nothing — "set up" would be false, and CI's `--require-email` (which gates on
-  // the same `inboundReady`) would refuse the deploy this command exists to prepare. A
-  // sending row that stays pending (Workers Free) is NOT a failure here: inbound is
-  // complete, `addresses` is committed, the plan hint above is the warning, and the
-  // binding written alongside is what the next preflight reads as the memory of that
-  // refusal — so `void email status` and `--require-email` read this state as set up too.
+  // Inbound must be complete, as `--require-email` checks the same `inboundReady`. A sending
+  // row left pending (Workers Free) is not a failure: the written binding records it.
   if (!out.inboundReady) {
     const missing = !out.routingReady
       ? `Email Routing on ${pre.domain} is not ready`
diff --git a/packages/void/src/cli/env-schema-probe.ts b/packages/void/src/cli/env-schema-probe.ts
index 3d77f7988..3d6db5d8a 100644
--- a/packages/void/src/cli/env-schema-probe.ts
+++ b/packages/void/src/cli/env-schema-probe.ts
@@ -5,72 +5,37 @@ import { findEnvFile } from '../codegen/env-types.ts';
 import type { SelfHostSchemaFacts, SelfHostSchemaFailureReason } from './env-validation.ts';
 
 /**
- * The self-host `void deploy --platform cloudflare` orchestrator validates the REAL
- * build artifact (`dist/ssr/wrangler.json` `vars`) instead of predicting it. Two
- * pieces still need project code, and BOTH run here — in an ISOLATED SUBPROCESS —
- * because the orchestrator runs in a credential-bearing PARENT (CF Access service
- * token / `CLOUDFLARE_API_TOKEN` in `process.env`) and must NOT evaluate arbitrary
- * project code in-process:
- *
- *   1. `facts` — the env-INSENSITIVE server and required key names, fixed by
- *      env.ts's structure.
- *   2. `validate-emitted` — validate the REAL emitted worker `vars` (post-build
- *      ground truth) against the schema's Standard-Schema validators and return the
- *      FAILING key NAMES only. A required var shipped with an INVALID value (fails
- *      the validator) must fail the deploy closed before any remote mutation, not
- *      only at worker boot.
- *
- * Three hardening rules apply to the child:
- *   - the framed result is written to a DEDICATED file descriptor (fd 3), NOT
- *     stdout, so anything the user's code prints while evaluating can never
- *     truncate or interleave with the result;
- *   - the caller scrubs the FULL wrangler-auth credential set from the child env
- *     (neither derivation needs credentials);
- *   - the parent NEVER captures the child's stdout/stderr — they are IGNORED
- *     (fds 1 + 2), never buffered — so a leaking env.ts / validator cannot print a
- *     raw secret to the terminal or CI log, and every failure surfaces as a stable
- *     classification only.
+ * Runs the project's env.ts for the self-host deploy in a child process. The caller
+ * passes the build env with Cloudflare credentials removed. Two operations: `facts`
+ * (server and required key names) and `validate-emitted` (emitted vars that fail the
+ * schema). The child writes its result to fd 3 and its stdout/stderr are ignored, so
+ * user output cannot corrupt the result or print a secret into the deploy log.
+ * Anything unexpected fails closed.
  */
 
-/** argv[2] sentinel that switches this module from library import to child-process entry. */
+/** argv[2] marker that runs this module as the child. */
 const PROBE_MARKER = '__void-deploy-env-schema-probe__';
 
-/** The dedicated fd the child writes its framed result to (see stdio config below). */
 const RESULT_FD = 3;
 
-/** The two operations the child can perform, selected by the parent. */
 type EnvSchemaProbeOp = 'facts' | 'validate-emitted';
 
-/** Input handed to the child (JSON in argv[3]). Path only — no env values cross here. */
 export type EnvSchemaProbeInput = { root: string };
 
-/** Full child input (adds the operation discriminant to {@link EnvSchemaProbeInput}). */
 type ChildInput = { op: EnvSchemaProbeOp; root: string };
 
-/**
- * The structured result of the `facts` operation. `ok` carries the env-insensitive
- * schema facts; `schema-error` surfaces a values-free env.ts/validator failure.
- */
 export type EnvSchemaProbeResult =
   | { kind: 'ok'; facts: SelfHostSchemaFacts }
   | { kind: 'schema-error'; reason: SelfHostSchemaFailureReason };
 
-/**
- * The structured result of the `validate-emitted` operation. `invalid-keys` carries
- * the FAILING key NAMES only (never a value); `schema-error` surfaces a values-free
- * env.ts/validator failure.
- */
 export type EnvSchemaValidateResult =
   | { kind: 'invalid-keys'; invalidKeys: Array<string> }
   | { kind: 'schema-error'; reason: SelfHostSchemaFailureReason };
 
-/** The full union any child operation can emit — narrowed by the public wrappers. */
 type EnvSchemaProbeRawResult = EnvSchemaProbeResult | EnvSchemaValidateResult;
 
-/** Minimal structural shape of a `spawnSync`-style result (injectable in tests). */
 export type EnvSchemaProbeSpawnResult = {
   status: number | null;
-  /** The fd-3 buffer (the framed result) — dedicated so stdout noise can't truncate it. */
   fd3: string | null;
   error?: Error | null;
   signal?: NodeJS.Signals | null;
@@ -82,14 +47,6 @@ export type EnvSchemaProbeSpawn = (
   options: { cwd: string; env: NodeJS.ProcessEnv },
 ) => EnvSchemaProbeSpawnResult;
 
-/**
- * Default spawner: run THIS module as a child and read ONLY the dedicated fd-3
- * result. stdin is ignored, stdout/stderr are IGNORED (fds 1 + 2) so a broken /
- * leaking env.ts can never print a raw secret to the terminal or a captured CI log,
- * and fd 3 is a pipe carrying the framed JSON result. `spawnSync`'s `output` array
- * is indexed by fd, so `output[3]` is the result channel — isolated from stdout
- * entirely (and unaffected by ignoring fds 1 + 2).
- */
 const defaultSpawn: EnvSchemaProbeSpawn = (command, args, options) => {
   const result = spawnSync(command, args, {
     cwd: options.cwd,
@@ -106,19 +63,7 @@ const defaultSpawn: EnvSchemaProbeSpawn = (command, args, options) => {
   };
 };
 
-/**
- * Spawn THIS module as a child (`node <self> <marker> <json>`) under the scrubbed
- * `env` for one operation, and return its framed fd-3 result. The child inherits
- * ONLY `env` (the caller scrubs the full wrangler-auth credential set), so the
- * arbitrary project code never sees the parent's credentials. `import.meta.url` is
- * this module's own path — a named build entry (`dist/cli/env-schema-probe.mjs`),
- * stable in source and dist — so the child re-enters here and hits the {@link
- * PROBE_MARKER} branch. Throws (caller fails closed) on a spawn error, a signal-kill,
- * a nonzero exit, or a missing/unparseable result — exactly the cases where the
- * project code itself could not be evaluated. NEVER echoes the child's
- * stdout/stderr (never captured), so no env value the child may have printed can
- * reach the thrown error.
- */
+/** Run this module as the child for one operation and parse its fd-3 result. */
 async function spawnEnvSchemaProbe(
   op: EnvSchemaProbeOp,
   input: EnvSchemaProbeInput,
@@ -138,8 +83,6 @@ async function spawnEnvSchemaProbe(
     throw new Error(`the env-schema probe was killed by signal ${result.signal}`);
   }
   if (result.status !== 0) {
-    // The child's stdout/stderr is never captured, so there is nothing to echo —
-    // only the stable exit code (no env value can ride along).
     throw new Error(`the env-schema probe exited with code ${String(result.status)}.`);
   }
   const parsed = parseProbeResult(result.fd3 ?? '');
@@ -149,10 +92,7 @@ async function spawnEnvSchemaProbe(
   return parsed;
 }
 
-/**
- * PARENT side (`facts`): return the env-insensitive schema facts. Runs pre-build so
- * a broken env.ts fails fast, before any account operation.
- */
+/** Runs before the build so a broken env.ts fails before any account operation. */
 export async function resolveEnvSchemaFactsViaSubprocess(
   input: EnvSchemaProbeInput,
   env: NodeJS.ProcessEnv,
@@ -171,11 +111,7 @@ export async function resolveEnvSchemaFactsViaSubprocess(
   return result;
 }
 
-/**
- * PARENT side (`validate-emitted`): validate the REAL emitted worker `vars` against
- * the schema validators and return the FAILING key NAMES only. Runs post-build so
- * the values validated are exactly what the worker ships.
- */
+/** Runs after the build so it validates exactly the vars the Worker ships. */
 export async function validateEmittedVarsViaSubprocess(
   input: EnvSchemaProbeInput,
   env: NodeJS.ProcessEnv,
@@ -191,12 +127,6 @@ export async function validateEmittedVarsViaSubprocess(
   return result;
 }
 
-/**
- * Parse the child's framed result from the DEDICATED fd-3 channel. The whole buffer
- * is the JSON result (nothing else writes to fd 3), so no sentinel scan is needed:
- * config/env.ts stdout noise lives on a different fd and can never reach here. Returns undefined on a missing/unparseable/ill-shaped result
- * so the caller fails closed.
- */
 function parseProbeResult(fd3: string): EnvSchemaProbeRawResult | undefined {
   const trimmed = fd3.trim();
   if (!trimmed) {
@@ -236,7 +166,6 @@ function parseProbeResult(fd3: string): EnvSchemaProbeRawResult | undefined {
   return undefined;
 }
 
-/** Structural guard for the values-free facts the child returns. */
 function isSchemaFacts(value: unknown): value is SelfHostSchemaFacts {
   if (!value || typeof value !== 'object') {
     return false;
@@ -251,15 +180,10 @@ function isSchemaFacts(value: unknown): value is SelfHostSchemaFacts {
   );
 }
 
-/** Write the framed result to the dedicated fd 3 (synchronous → flushed before exit). */
 function emitResult(result: EnvSchemaProbeRawResult): void {
   writeSync(RESULT_FD, JSON.stringify(result));
 }
 
-/**
- * CHILD side (`facts`): import the user's env.ts and derive its structural schema
- * facts. The import stays isolated because env.ts is arbitrary project code.
- */
 async function runFactsChild(root: string): Promise<void> {
   const { deriveSelfHostSchemaFacts, SelfHostSchemaError } = await import('./env-validation.ts');
   try {
@@ -274,13 +198,7 @@ async function runFactsChild(root: string): Promise<void> {
   }
 }
 
-/**
- * CHILD side (`validate-emitted`): read the REAL emitted worker `vars` the build
- * baked into `dist/ssr/wrangler.json` (ground truth), validate them against the
- * schema's validators, and emit the FAILING key NAMES only. The parent already
- * confirmed the artifact exists, so a read failure here is a probe-infrastructure
- * fault → fail closed as a values-free schema error.
- */
+/** The parent already found the emitted config, so a read failure here fails closed. */
 async function runValidateEmittedChild(root: string): Promise<void> {
   const { computeInvalidEmittedKeys, readEmittedWorkerVars, SelfHostSchemaError } =
     await import('./env-validation.ts');
@@ -301,7 +219,6 @@ async function runValidateEmittedChild(root: string): Promise<void> {
   }
 }
 
-/** Dispatch the child to the requested operation. */
 async function runEnvSchemaProbeChild(rawInput: string): Promise<void> {
   const input = JSON.parse(rawInput) as ChildInput;
   if (input.op === 'validate-emitted') {
@@ -311,11 +228,7 @@ async function runEnvSchemaProbeChild(rawInput: string): Promise<void> {
   await runFactsChild(input.root);
 }
 
-// Child-process entry: only when invoked as `node <self> <marker> <json>`. A normal
-// library import (the CLI loading the parent-side helper) has a different argv[2], so
-// this never runs in the parent and never eagerly loads Vite / env-validation / env.ts.
-// On ANY unexpected failure the child exits nonzero with NO raw echo — the parent
-// fails closed on the exit code alone.
+// Child entry. Any unexpected failure exits nonzero; the parent fails closed on that.
 if (process.argv[2] === PROBE_MARKER) {
   runEnvSchemaProbeChild(process.argv[3] ?? 'null').then(
     () => process.exit(0),
diff --git a/packages/void/src/cli/env-validation.ts b/packages/void/src/cli/env-validation.ts
index 311ad56cb..55279c555 100644
--- a/packages/void/src/cli/env-validation.ts
+++ b/packages/void/src/cli/env-validation.ts
@@ -1,17 +1,11 @@
-/**
- * Shared env-schema validation for CLI commands.
- *
- * Loads the user's `env.ts` (which calls `defineEnv` as a side effect),
- * validates the local `.env` or remote production-secret state, and
- * validates each declared key against the registered schema.
- *
- * Used by both `void deploy` (hard error on missing prod env) and
- * `void env check` (CI/pre-push validation).
- */
+/** Env-schema validation for `void env check`, `void secret`, and both deploy paths. */
 import { spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
-import type { CloudflareOperation } from '@void/deploy-cloudflare';
-import { parse as parseJsonc, type ParseError } from 'jsonc-parser';
+import {
+  parseRootWranglerConfig,
+  readWranglerTopLevelString,
+  type CloudflareOperation,
+} from '@void/deploy-cloudflare';
 import { dirname, join, resolve } from 'pathslash';
 import { findEnvFile } from '../codegen/env-types.ts';
 import { loadUserEnvFile } from '../host/load-user-env.ts';
@@ -147,10 +141,8 @@ export async function validateProdEnv(
   const merged: Record<string, unknown> = { ...local, ...shell };
 
   const report = await mod.validateAllEnv(merged);
-  // Remote secrets are present on the deployed worker but not readable here,
-  // so we can't run the user's validator against the real value. Treat any
-  // server schema key that is only missing but present remotely as OK —
-  // the boot-time `_validateEnvOnce` will validate the real value per isolate.
+  // Remote secret values are unreadable here, so a missing server key that exists
+  // remotely passes; the Worker validates the real value at boot.
   const remoteSet = new Set(options.remoteSecrets ?? []);
   if (remoteSet.size > 0 && report.missing.length > 0) {
     report.missing = report.missing.filter((key) => isClientEnvKey(key) || !remoteSet.has(key));
@@ -161,7 +153,6 @@ export async function validateProdEnv(
   return { hasSchema: true, report };
 }
 
-/** Format an EnvValidationReport into a human-readable multi-line string. */
 export function formatEnvReport(report: EnvValidationReport): string {
   const lines: Array<string> = [];
   if (report.missing.length > 0) {
@@ -195,37 +186,15 @@ export async function fetchRemoteSecretNames(
   }
 }
 
-// ---------------------------------------------------------------------------
-// Self-host (`void deploy --platform cloudflare`) secrets preflight units.
-//
-// The managed platform path gates secrets via `assertEnvSchemaValid` (deploy.ts)
-// against the platform's secret store. The self-host path bypasses the platform
-// entirely, so it needs its own safety units over the REAL build artifact
-// (`dist/ssr/wrangler.json` `vars`), defined further below:
-//   `deriveSelfHostEnvContextFromVars` + `dischargeSelfHostEnvContext` — GATE:
-//      the platform-free analogue of `assertEnvSchemaValid`, sourcing remote
-//      secret names from `wrangler secret list` instead of the platform API.
-// Both consume ground truth (the emitted map), never a pre-build facsimile.
-// ---------------------------------------------------------------------------
+// Self-host (`void deploy --platform cloudflare`) secret gate. It checks the vars the
+// build emitted and the remote secret names. Its errors name keys only, never values.
 
-/** Minimal structural view of a Standard Schema validator's probe entrypoint. */
 type SchemaProbe = StandardSchemaV1<unknown, unknown>['~standard'];
 
 /**
- * The required-key set, derived independently of how any validator treats
- * the empty string. A key is required iff its validator REJECTS the ABSENT
- * value (probe with `undefined`) — the SAME notion of "required" the managed
- * gate uses (a key lands in `validateAllEnv().missing` when its absent value
- * yields issues; `_getSchemaDefaults` probes `undefined` the exact same way).
- * Requiredness is NEVER inferred from whether `""` validates, so a schema that
- * ACCEPTS `""` (e.g. a bare Zod `z.string()`) is still correctly required.
- *
- * Runs the user's validators (arbitrary code), so callers MUST invoke this
- * inside {@link withSchemaBoundary}: a validator that THROWS synchronously or
- * REJECTS (async) on the probe surfaces as a values-free structural error, and
- * the awaited async probe can never float as an unhandled rejection carrying a
- * value. A NORMAL rejection (an `{ issues }` Result, not a thrown/rejected
- * error) simply marks the key required.
+ * A key is required when its validator rejects `undefined`. Do not judge by `""`:
+ * a bare `z.string()` accepts it but is still required. Validators are user code,
+ * so call this inside {@link withSchemaBoundary}.
  */
 async function requiredSchemaKeys(schema: Record<string, unknown>): Promise<Set<string>> {
   const required = new Set<string>();
@@ -240,22 +209,7 @@ async function requiredSchemaKeys(schema: Record<string, unknown>): Promise<Set<
   return required;
 }
 
-/**
- * The values-free provenance of a var's WINNING value. The self-host gate reads
- * ground truth — the REAL worker `vars` the build emitted into
- * `dist/ssr/wrangler.json` — so every present key's source is `emitted`. Only the
- * KIND is ever surfaced (never a value), so a configured-empty error can name the
- * source without echoing anything sensitive.
- */
-export type VarSource = { kind: 'emitted' };
-
-/**
- * Result of one `wrangler secret list` invocation. Same structured-provenance
- * contract as the provisioner's `RunWranglerResult` (cli/provision.ts): a
- * non-null `signal` or a present `error` means the child did NOT run to
- * completion, so its buffered output is unreliable and must NEVER be read as
- * "no secrets exist" — only `status === 0` with clean provenance may be parsed.
- */
+/** Only `status === 0` with no `signal` or `error` may be parsed as a list. */
 export type SecretListRunResult = {
   data?: unknown;
   errorCode?: number;
@@ -263,179 +217,50 @@ export type SecretListRunResult = {
   stdout: string;
   stderr: string;
   status: number;
-  /** Non-null ONLY when the child was terminated by a signal — a HARD failure. */
   signal?: NodeJS.Signals | null;
-  /** The spawn-error message when the child could not start — a HARD failure. */
   error?: string | null;
 };
 
-/**
- * Injectable seam over spawning `wrangler secret list` — same pattern as the
- * provisioner's `RunWrangler`. The default ({@link createDefaultSecretListRunner})
- * spawns the real wrangler CLI; unit tests inject a stub so no real wrangler
- * and no network runs. Sync stubs are fine — the caller `Promise.resolve`s.
- */
 export type RunSecretList = (
   args: CloudflareOperation,
 ) => SecretListRunResult | Promise<SecretListRunResult>;
 
-/**
- * The stable, values-free classification of a hard secret-list failure.
- * The child inherits `process.env`, so a wrangler/OS/config diagnostic can
- * embed an env value; the raw rejection/stderr/stdout text is therefore used
- * only INTERNALLY (worker-not-found classification) and NEVER copied into a
- * thrown error. Every {@link SelfHostSecretListError} instead carries one of
- * these codes plus safe scalars (exit code / signal name), so neither the
- * message, the attached fields, nor the JSON serialization can echo a value.
- *   - `spawn-error`      — the child could not be launched (runner threw, or
- *                          reported a spawn `error`).
- *   - `nonzero-exit`     — clean nonzero exit (wrangler's own error).
- *   - `signal`           — terminated by a signal (includes the timeout SIGKILL).
- *   - `malformed-output` — exit 0 but stdout was not the expected JSON array of
- *                          `{ name }` secret objects.
- *   - `account-mismatch` — config-vs-requested account gate (thrown before any
- *                          spawn; its message names the account IDs, which are
- *                          caller/config identifiers, not wrangler output).
- *   - `name-mismatch`    — config-vs-pinned worker-name gate (thrown before any
- *                          spawn; its message names the worker names, which are
- *                          caller/config identifiers, not wrangler output).
- */
-export type SecretListFailureReason =
-  | 'spawn-error'
-  | 'nonzero-exit'
-  | 'signal'
-  | 'malformed-output'
-  | 'account-mismatch'
-  | 'name-mismatch';
+type SecretListFailureReason = 'spawn-error' | 'nonzero-exit' | 'signal' | 'malformed-output';
 
-/** Wrangler-run failure reasons (excludes the pre-spawn account/name gates). */
-type SecretListRunFailureReason = Exclude<
-  SecretListFailureReason,
-  'account-mismatch' | 'name-mismatch'
->;
-
-/** Safe scalars attached to a {@link SelfHostSecretListError} — never wrangler output. */
-export type SecretListFailureDetail = {
-  /** The child's exit code, when it exited (nonzero-exit). */
-  exitCode?: number;
-  /** The terminating signal name, when killed (signal). */
-  signal?: string;
-};
+type SecretListFailureDetail = { exitCode?: number; signal?: string };
 
 /**
- * Hard failure fetching the remote secret list (spawn error, signal, nonzero
- * exit, timeout, or malformed output). DISTINCT from
- * {@link SelfHostEnvValidationError}: this means "we could not learn what
- * secrets exist" (fail closed), never "a required secret is missing".
- *
- * The message and attached fields are values-free by construction: only
- * the structural {@link SecretListFailureReason} code and safe scalars
- * ({@link SecretListFailureDetail}) are exposed. Raw wrangler output (stderr,
- * stdout, rejection/spawn-error text) is NEVER stored here, so no env value the
- * child may have echoed can reach `Error.message`, the `reason`/`detail`
- * fields, or their JSON serialization — even under `VOID_ENV_UNMASK`.
+ * The remote secret names could not be read, so the gate fails closed. Messages never
+ * include provider output: the child inherits `process.env` and can echo a value.
  */
 export class SelfHostSecretListError extends Error {
   override name = 'SelfHostSecretListError';
-  /** Stable, values-free failure classification. */
-  readonly reason: SecretListFailureReason;
-  /** Safe scalars (exit code / signal name) — never contain wrangler output. */
-  readonly detail: SecretListFailureDetail;
-  // Explicit fields (not TS parameter properties) so this module type-strips under
-  // plain Node — the build-context probe imports it in a subprocess.
-  constructor(
-    message: string,
-    reason: SecretListFailureReason,
-    detail: SecretListFailureDetail = {},
-  ) {
-    super(message);
-    this.reason = reason;
-    this.detail = detail;
-  }
 }
 
-/**
- * FIRST-DEPLOY specialization of {@link SelfHostSecretListError}: the remote
- * secret list could not be fetched because the worker has NOT been deployed
- * yet. wrangler 4.131's `secret list` catches the API worker-not-found error
- * (codes 10007 / 10090 — `WORKER_NOT_FOUND` / `WORKER_LEGACY_ENVIRONMENT_NOT_FOUND`,
- * per `isWorkerNotFoundError` in wrangler-dist/cli.js) and rethrows a `UserError`
- * ("… not found. If this is a new Worker, run `wrangler deploy` first to create
- * it."), exiting nonzero. Rather than surface that circular "deploy first" dead
- * end, this carries the still-unsatisfied required key NAMES plus a
- * worker-not-found flag so the deploy orchestrator can render actionable
- * `wrangler secret put <NAME>` bootstrap guidance (wrangler can `secret put` to
- * a draft worker). Still a HARD, fail-closed error — subclassing keeps existing
- * `instanceof SelfHostSecretListError` fail-closed handling intact.
- */
+/** The Worker has not been deployed yet, so its secrets cannot be listed. */
 export class SelfHostFirstDeployError extends SelfHostSecretListError {
   override name = 'SelfHostFirstDeployError';
-  /** Always true — distinguishes this from a generic list failure structurally. */
-  readonly workerNotFound = true;
-  /** Required schema key NAMES still unsatisfied locally (values-free). */
-  readonly missingKeys: Array<string>;
-  constructor(message: string, missingKeys: Array<string>, exitCode?: number) {
-    // Structurally still a nonzero-exit; `message` is the values-free
-    // first-deploy guidance and `missingKeys` carries the names.
-    super(message, 'nonzero-exit', { exitCode });
-    this.missingKeys = missingKeys;
-  }
 }
 
-/**
- * The env schema is not satisfied for a self-host production deploy: required
- * keys are missing from remote worker secrets, values are invalid, or an EMPTY
- * plaintext assignment would
- * shadow a remote secret. The message and the attached `report` carry the
- * offending key NAMES plus stable, values-free reason codes only — never raw
- * input, never resolved values — so nothing on this path can echo a secret
- * (see {@link selfHostEnvError}), even under `VOID_ENV_UNMASK`.
- */
+/** Required keys are missing or shipped values are invalid. */
 export class SelfHostEnvValidationError extends Error {
   override name = 'SelfHostEnvValidationError';
-  readonly report: EnvValidationReport;
-  constructor(message: string, report: EnvValidationReport) {
-    super(message);
-    this.report = report;
-  }
 }
 
-/**
- * The stable, values-free classification of a self-host schema failure.
- * env.ts evaluation and Standard-Schema validators run ARBITRARY user code that
- * can embed an env value in a thrown/rejected error (its `message`, `stack`, or
- * `cause`), and `VOID_ENV_UNMASK` disables redaction — so the original error is
- * never surfaced. Every {@link SelfHostSchemaError} instead carries only one of
- * these codes plus fixed text, so neither its message, its `reason` field, nor
- * its JSON serialization can echo a value.
- *   - `schema-load-failed`      — importing/evaluating the user's env.ts threw.
- *   - `schema-validation-error` — a registered validator threw or rejected while
- *                                 checking a production value.
- */
 export type SelfHostSchemaFailureReason = 'schema-load-failed' | 'schema-validation-error';
 
-/**
- * A self-host schema evaluation/validation step threw. DISTINCT from
- * {@link SelfHostEnvValidationError} (which means "a required value is missing
- * or invalid", carrying key names): this means the schema machinery itself
- * raised — env.ts failed to evaluate, or a validator threw/rejected rather than
- * returning issues. Values-free by construction: the original error's
- * message/stack/cause are DROPPED at the boundary and only the structural
- * {@link SelfHostSchemaFailureReason} code + fixed guidance survive, so no env
- * value the user's code may have embedded can reach the thrown error, even
- * under `VOID_ENV_UNMASK`.
- */
+/** env.ts or a validator threw. The original error is dropped: it can embed a value. */
 export class SelfHostSchemaError extends Error {
   override name = 'SelfHostSchemaError';
-  /** Stable, values-free failure classification. */
   readonly reason: SelfHostSchemaFailureReason;
+  // Explicit fields (not TS parameter properties) so this module type-strips under
+  // plain Node — the env-schema probe child imports it.
   constructor(message: string, reason: SelfHostSchemaFailureReason) {
     super(message);
     this.reason = reason;
   }
 }
 
-/** The fixed, values-free message for each schema-failure reason. */
 export function selfHostSchemaFailureMessage(reason: SelfHostSchemaFailureReason): string {
   switch (reason) {
     case 'schema-load-failed':
@@ -451,17 +276,7 @@ export function selfHostSchemaFailureMessage(reason: SelfHostSchemaFailureReason
   }
 }
 
-/**
- * Values-free boundary around EVERY self-host schema evaluation +
- * validation step. `loadSchema` evaluates the user's env.ts and each
- * `validateProdEnv` / `validateAllEnv` pass runs the registered validators —
- * all arbitrary code that can throw/reject an error EMBEDDING an env value in
- * its message, stack, or cause (and `VOID_ENV_UNMASK` disables redaction). Any
- * throw/reject from `fn` is caught, its original message/stack/cause DROPPED,
- * and a fixed structural {@link SelfHostSchemaError} rethrown in its place. The
- * managed `validateProdEnv` itself is NEVER wrapped — only the self-host call
- * sites pass through here.
- */
+/** Replace any error from user code with a values-free {@link SelfHostSchemaError}. */
 async function withSchemaBoundary<T>(
   reason: SelfHostSchemaFailureReason,
   fn: () => Promise<T>,
@@ -469,90 +284,27 @@ async function withSchemaBoundary<T>(
   try {
     return await fn();
   } catch {
-    // Drop the caught error entirely (message/stack/cause) — it may carry a
-    // value — and rethrow only the structural, values-free classification.
     throw new SelfHostSchemaError(selfHostSchemaFailureMessage(reason), reason);
   }
 }
 
-/**
- * The structured, VALUES-FREE outcome of the self-host env DERIVATION — everything
- * decidable from the emitted worker vars + schema facts WITHOUT a network
- * round-trip, so the parent discharges it with only pure work + one `wrangler
- * secret list`. Carries KEY NAMES + source kinds ONLY — never a value.
- */
 export type SelfHostEnvContext = {
-  /** Whether the project registered an env schema at all (no schema → nothing to gate). */
   hasSchema: boolean;
-  /**
-   * Required keys the effective build map assigns an EMPTY string (`K=""`). The build
-   * bakes these as plaintext `vars` that win over a same-named remote secret, so they
-   * FAIL CLOSED unconditionally — the parent throws before any wrangler spawn.
-   */
-  presentEmptyRequired: Array<string>;
-  /** Per-empty-key WINNING source kind so the parent names it — never a value. */
-  presentEmptySources: Record<string, VarSource>;
-  /** Required keys the effective build map does NOT set — the only state a remote secret discharges. */
+  /** Required keys not in the emitted vars. Only a remote secret can satisfy them. */
   absentRequired: Array<string>;
-  /** Present-non-empty keys the schema REJECTED — malformed, never dischargeable by a secret. */
+  /** Keys whose emitted value failed the schema. A remote secret cannot fix these. */
   invalidKeys: Array<string>;
 };
 
-export type SelfHostProdEnvResult = {
-  hasSchema: boolean;
-  /**
-   * Remote secret names consulted via `wrangler secret list`, or `null` when
-   * wrangler was never invoked (no schema, or the effective build map already
-   * satisfied every required key present-and-non-empty).
-   */
-  remoteSecretNames: Array<string> | null;
-};
-
-/** A no-schema {@link SelfHostEnvContext} — nothing to gate. */
-function emptyEnvContext(): SelfHostEnvContext {
-  return {
-    hasSchema: false,
-    presentEmptyRequired: [],
-    presentEmptySources: {},
-    absentRequired: [],
-    invalidKeys: [],
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Post-build ground-truth self-host units.
-//
-// The `void deploy --platform cloudflare` gate validates the REAL build artifact
-// the build emits — `dist/ssr/wrangler.json` `vars` (the plaintext worker vars).
-// It needs only ONE
-// piece of project-derived data: the env-INSENSITIVE server and required key
-// names. Those are derived once in an isolated subprocess; everything else is pure
-// parent work over the emitted map.
-// ---------------------------------------------------------------------------
-
-/**
- * The env-INSENSITIVE structural facts the self-host secret gate needs from the
- * project's env schema: whether a schema is registered, every server key, and the
- * REQUIRED key names (validators that reject the absent value). These are fixed by
- * env.ts's structure and require no dotenv loading.
- */
+/** Schema structure the gate needs, read once in the env-schema probe child. */
 export type SelfHostSchemaFacts = {
-  /** Whether the project registered an env schema at all (no schema → nothing to gate). */
   hasSchema: boolean;
-  /** Every server-only schema key. These may never be emitted as plaintext vars. */
+  /** Server-only keys. These may never be emitted as plaintext vars. */
   serverKeys: Array<string>;
-  /** Required key NAMES — validator rejects `undefined`. Values-free. */
   requiredKeys: Array<string>;
 };
 
-/**
- * Derive the {@link SelfHostSchemaFacts} by importing the user's env.ts. Runs
- * ARBITRARY project code (env.ts evaluation) + the registered validators' probes,
- * so the caller MUST run this in an ISOLATED SUBPROCESS ({@link
- * ../cli/env-schema-probe.ts}) under a scrubbed env. Throws only a values-free
- * {@link SelfHostSchemaError} (via {@link withSchemaBoundary}) when the schema
- * machinery itself fails; the derived names/flags are returned as values-free data.
- */
+/** Imports the user's env.ts, so callers run it in the env-schema probe child. */
 export async function deriveSelfHostSchemaFacts(root: string): Promise<SelfHostSchemaFacts> {
   const envFile = findEnvFile(root);
   if (envFile == null) {
@@ -572,60 +324,30 @@ export async function deriveSelfHostSchemaFacts(root: string): Promise<SelfHostS
 }
 
 /**
- * Build the values-free {@link SelfHostEnvContext} from the REAL worker `vars` the
- * build emitted into `dist/ssr/wrangler.json` (ground truth — never a facsimile)
- * plus the env-insensitive {@link SelfHostSchemaFacts}. PURE (no project code, no
- * I/O): the parent runs this AFTER the build with the real emitted map, so the
- * gate reads exactly what the worker ships.
- *   - a required key present with an EMPTY value (`K=""` or `K=null`) → SHADOWS a
- *     same-named remote secret with an unusable value → fail closed ALWAYS
- *     (`presentEmptyRequired`). Both spellings are treated the same because the
- *     schema validators classify `null` and `""` as "missing" (not "invalid"), so
- *     they would otherwise slip past both the invalid-value probe and the absent
- *     fence while still shadowing the remote secret.
- *   - a required key ABSENT from the emitted vars → the only state a remote secret
- *     can discharge (`absentRequired`).
- * `invalidKeys` is populated separately from the value-validation probe (the parent
- * folds it in); a PRESENT, NON-EMPTY value that fails the schema validator lands there.
+ * Build the gate context from the emitted vars. The caller has already rejected
+ * server keys emitted as plaintext vars, so a required key here is only absent or not.
  */
 export function deriveSelfHostEnvContextFromVars(
   emittedVars: Record<string, unknown>,
   facts: SelfHostSchemaFacts,
 ): SelfHostEnvContext {
   if (!facts.hasSchema) {
-    return emptyEnvContext();
-  }
-  // `null` and `""` are the two "present but unusable" shapes a parsed wrangler.json var can
-  // take that the schema validators bucket as "missing" — treat both as an empty shadow.
-  const isEmptyShadow = (value: unknown): boolean => value === '' || value === null;
-  const presentEmptyRequired = facts.requiredKeys.filter(
-    (key) => Object.hasOwn(emittedVars, key) && isEmptyShadow(emittedVars[key]),
-  );
-  const absentRequired = facts.requiredKeys.filter((key) => !Object.hasOwn(emittedVars, key));
-  const presentEmptySources: Record<string, VarSource> = {};
-  for (const key of presentEmptyRequired) {
-    presentEmptySources[key] = { kind: 'emitted' };
+    return { hasSchema: false, absentRequired: [], invalidKeys: [] };
   }
   return {
     hasSchema: true,
-    presentEmptyRequired,
-    presentEmptySources,
-    absentRequired,
+    absentRequired: facts.requiredKeys.filter((key) => !Object.hasOwn(emittedVars, key)),
     invalidKeys: [],
   };
 }
 
-/** The REAL worker `vars` the build baked into `dist/ssr/wrangler.json`, or a fail-closed reason. */
 export type EmittedWorkerVarsResult =
   | { ok: true; vars: Record<string, unknown> }
   | { ok: false; reason: string };
 
 /**
- * Follow the CF plugin's deploy pointer (`.wrangler/deploy/config.json` →
- * `configPath`) to the generated wrangler config the build emitted, and return it
- * parsed. Shared by the parent's ground-truth reads and the isolated
- * `validate-emitted` probe child, so both resolve the SAME artifact. Returns a
- * fail-closed reason (never throws) when the pointer/config is missing or malformed.
+ * Follow the CF plugin's deploy pointer (`.wrangler/deploy/config.json`) to the
+ * generated config. Returns a fail-closed reason instead of throwing.
  */
 function readGeneratedWranglerConfig(
   root: string,
@@ -661,24 +383,15 @@ function readGeneratedWranglerConfig(
   }
 }
 
-/**
- * Read the REAL `vars` map the build baked into `dist/ssr/wrangler.json` (ground
- * truth — the exact plaintext the worker ships). A missing `vars` field is an empty
- * map (a worker with no vars), not a failure; a missing/malformed artifact fails
- * closed. The self-host orchestrator reads this in the parent; the `validate-emitted`
- * probe reads it in the child to run the schema validators against those exact
- * values in isolation.
- */
+/** Read the `vars` the build emitted into the generated Worker config. */
 export function readEmittedWorkerVars(root: string): EmittedWorkerVarsResult {
   const resolved = readGeneratedWranglerConfig(root);
   if (!resolved.ok) {
     return resolved;
   }
   const vars = resolved.config.vars;
-  // An ABSENT `vars` field is a worker with no vars → empty map (not a failure). But a
-  // PRESENT-but-malformed `vars` (a scalar, null, or array) must FAIL CLOSED rather than be
-  // silently normalized to `{}`: normalizing would make every required key read as "absent"
-  // and let a remote secret discharge it, hiding a genuinely broken build artifact.
+  // A malformed `vars` must fail closed: read as `{}`, every required key would look
+  // absent and a remote secret could satisfy it.
   if (vars === undefined) {
     return { ok: true, vars: {} };
   }
@@ -692,26 +405,10 @@ export function readEmittedWorkerVars(root: string): EmittedWorkerVarsResult {
 }
 
 /**
- * Validate the REAL emitted worker `vars` against the registered schema's
- * validators and return the FAILING key NAMES only (values-free). A key FAILS iff
- * the validator REJECTS the value it was SHIPPED WITH — the UNION of:
- *   - `report.invalid` (a PRESENT, NON-EMPTY value the validator rejected), plus
- *   - the `report.missing` keys that are STILL PRESENT in `emittedVars` (the key
- *     exists in the emitted map with value `null`/`""`). `validateAllEnv` buckets a
- *     REJECTED `undefined`/`null`/`""` as "missing", not "invalid" (see
- *     `runtime/env-public.ts` — `isMissing = raw === undefined || raw === null || raw
- *     === ''`), so an OPTIONAL-with-validator key shipped as `""`/`null` (e.g.
- *     `z.url().optional()`, which rejects those but the required-empty fence in
- *     `deriveSelfHostEnvContextFromVars` — `requiredKeys` only — never covers) would
- *     otherwise slip EVERY gate and boot-reject the deployed worker.
- * A `report.missing` key ABSENT from `emittedVars` is NEVER counted: it is a
- * genuinely-unset REQUIRED secret that a same-named remote `wrangler secret list`
- * secret can still discharge, so it stays with the context's absent fence rather than
- * becoming a hard invalid. Runs the user's validators (arbitrary code), so the caller
- * MUST run this in the isolated {@link ../cli/env-schema-probe.ts} subprocess; a
- * validator that THROWS/REJECTS surfaces as a values-free {@link SelfHostSchemaError}
- * via {@link withSchemaBoundary}. NEVER reads `report.invalid[].messages` (which can
- * embed the offending value) — only the key names leave here.
+ * Validate the emitted vars and return the failing key names. `validateAllEnv` reports
+ * a rejected `""` or `null` as missing, so a missing key that was shipped counts as
+ * invalid; a key that was not shipped is left for the remote-secret check. Runs user
+ * validators, so callers run it in the env-schema probe child.
  */
 export async function computeInvalidEmittedKeys(
   root: string,
@@ -729,9 +426,6 @@ export async function computeInvalidEmittedKeys(
     mod.validateAllEnv(emittedVars),
   );
   const invalid = new Set<string>(report.invalid.map((entry) => entry.key));
-  // A rejected value the runtime bucketed as "missing" still fails closed WHEN THE KEY
-  // WAS SHIPPED (present in the emitted map) — otherwise it is a genuinely-absent
-  // required secret a remote secret can still discharge, so leave it to the fences.
   for (const key of report.missing) {
     if (Object.hasOwn(emittedVars, key)) {
       invalid.add(key);
@@ -740,28 +434,9 @@ export async function computeInvalidEmittedKeys(
   return Array.from(invalid).sort((a, b) => a.localeCompare(b));
 }
 
-/** Build a values-free invalid {@link EnvValidationReport} from key names only. */
-function invalidEnvReport(missing: Array<string>, invalidKeys: Array<string>): EnvValidationReport {
-  return {
-    valid: false,
-    missing,
-    invalid: invalidKeys.map((key) => ({ key, messages: [SELF_HOST_INVALID_REASON] })),
-    values: new Map(),
-  };
-}
-
 /**
- * DISCHARGE half of the self-host gate — PURE parent work over the values-free
- * {@link SelfHostEnvContext}, plus at most one `wrangler secret list`. Runs NO
- * project code, NO `loadEnv`, and imports NO env.ts, so the parent never
- * evaluates arbitrary code with live credentials in scope. Applies three fences:
- *   - a PRESENT-EMPTY required key fails closed ALWAYS, before any wrangler spawn;
- *   - the pinned worker `name` is reconciled against the config's `name`, and the
- *     target account against the config's `account_id`, BOTH BEFORE `secret list`
- *     is spawned;
- *   - an ABSENT required key is discharged only by a same-named remote secret,
- *     else fails closed ({@link SelfHostFirstDeployError} on a not-yet-deployed
- *     worker, carrying the missing names + `wrangler secret put` guidance).
+ * Fail unless every required key is shipped or set as a remote secret, and no shipped
+ * value is invalid. Lists remote secrets only when a required key is absent.
  */
 export async function dischargeSelfHostEnvContext(
   context: SelfHostEnvContext,
@@ -769,61 +444,36 @@ export async function dischargeSelfHostEnvContext(
     root: string;
     configPath: string;
     accountId?: string;
-    /**
-     * The worker name the deploy pinned (deploy.ts step 5). `wrangler secret list`
-     * resolves the worker from the config's top-level `name`, which a post-build
-     * probe can rewrite — so the config's `name` is reconciled against this before
-     * any spawn, mirroring the `account_id` reconcile.
-     */
+    /** The Worker name the deploy pinned; the config's `name` must still match it. */
     workerName?: string;
     runWrangler?: RunSecretList;
-    timeoutMs?: number;
   },
-): Promise<SelfHostProdEnvResult> {
+): Promise<void> {
   if (!context.hasSchema) {
-    return { hasSchema: false, remoteSecretNames: null };
-  }
-
-  // PRESENT-and-EMPTY required keys fail closed ALWAYS — remote membership is
-  // irrelevant. Names the key + its actual source, never a value.
-  if (context.presentEmptyRequired.length > 0) {
-    throw emptyAssignmentError(context.presentEmptyRequired, context.presentEmptySources);
-  }
-
-  const invalidKeys = context.invalidKeys;
-  if (context.absentRequired.length === 0) {
-    // Every required key is present-and-non-empty; a remote secret could not
-    // change the outcome — no wrangler call. Invalid local values still fail closed.
-    if (invalidKeys.length > 0) {
-      throw selfHostEnvError(invalidEnvReport([], invalidKeys));
-    }
-    return { hasSchema: true, remoteSecretNames: null };
+    return;
   }
-
-  const remoteSecretNames = await listSelfHostSecretNames(options, context.absentRequired);
-
-  const remoteSet = new Set(remoteSecretNames);
-  const stillMissing = context.absentRequired.filter((key) => !remoteSet.has(key));
-  if (stillMissing.length > 0 || invalidKeys.length > 0) {
-    throw selfHostEnvError(invalidEnvReport(stillMissing, invalidKeys));
+  const remote =
+    context.absentRequired.length > 0
+      ? new Set(await listSelfHostSecretNames(options, context.absentRequired))
+      : new Set<string>();
+  const missing = context.absentRequired.filter((key) => !remote.has(key));
+  if (missing.length > 0 || context.invalidKeys.length > 0) {
+    throw selfHostEnvError(missing, context.invalidKeys);
   }
-  return { hasSchema: true, remoteSecretNames };
 }
 
 /**
- * Read the pinned config's top-level `account_id` and reconcile it with
- * the caller's requested account, mirroring the provisioner's account gate
- * (provision.ts `provisionCloudflareResourcesLocked`). wrangler 4.131 gives the
- * config's `account_id` PRECEDENCE over `CLOUDFLARE_ACCOUNT_ID`, so a real
- * config-vs-requested mismatch is a fail-closed error (thrown BEFORE any spawn).
- * Returns the ONE effective account to pin (config wins, else requested), or
- * undefined when neither is set (wrangler then resolves it as it normally would).
+ * Fail closed when the config pins a different account than the deploy, since the
+ * list could then read another account's secrets. Returns the account to pin.
  */
 function reconcileSelfHostAccount(
   configPath: string,
   requestedAccountId: string | undefined,
 ): string | undefined {
-  const configAccountId = readConfigAccountId(configPath);
+  const configAccountId = readWranglerTopLevelString(
+    parseRootWranglerConfig(configPath),
+    'account_id',
+  );
   if (configAccountId && requestedAccountId && configAccountId !== requestedAccountId) {
     throw new SelfHostSecretListError(
       `env: Cloudflare account mismatch — "${configPath}" pins account_id ` +
@@ -834,33 +484,20 @@ function reconcileSelfHostAccount(
         `${JSON.stringify(requestedAccountId)} — a same-named secret there could falsely pass this ` +
         `preflight. Reconcile them (correct or remove the config's account_id, or deploy to the ` +
         `pinned account) and retry.`,
-      'account-mismatch',
     );
   }
   return configAccountId ?? requestedAccountId;
 }
 
 /**
- * Reconcile the config's top-level worker `name` against the name the deploy PINNED
- * (deploy.ts step 5 writes `name: workerName` into the root config before the build).
- * `wrangler secret list` resolves the worker from the config's `name`
- * (`getLegacyScriptName`: `args.name ?? config.name` — we pass no `--name`), so a
- * config whose `name` was CHANGED after it was pinned would make the gate list secrets
- * for a DIFFERENT worker than the deploy ships — and a same-named secret there could
- * falsely pass this preflight while the pinned worker deploys WITHOUT it.
- *
- * Fires ONLY when the config actually declares a `name` that DIFFERS from a passed
- * pinned name (the same "both set and differ" guard as {@link reconcileSelfHostAccount})
- * — post-pin the config's `name` IS `workerName`, so a later divergence is exactly the
- * laundering signal, while an undefined pinned name or an undeclared config `name` never
- * trips a legitimate deploy. Thrown BEFORE any spawn (its message names worker names,
- * which are caller/config identifiers, never wrangler output).
+ * The list resolves the Worker from the config's `name`. If project code changed it
+ * after the deploy pinned it, the list would read another Worker's secrets.
  */
 function reconcileSelfHostWorkerName(
   configPath: string,
   pinnedWorkerName: string | undefined,
 ): void {
-  const configName = readConfigName(configPath);
+  const configName = readWranglerTopLevelString(parseRootWranglerConfig(configPath), 'name');
   if (configName && pinnedWorkerName && configName !== pinnedWorkerName) {
     throw new SelfHostSecretListError(
       `env: Cloudflare worker name mismatch — "${configPath}" declares name ` +
@@ -870,100 +507,21 @@ function reconcileSelfHostWorkerName(
         `${JSON.stringify(pinnedWorkerName)} — a same-named secret there could falsely pass this ` +
         `preflight. The config's name was changed after it was pinned; rebuild from a clean ` +
         `checkout, then rerun.`,
-      'name-mismatch',
     );
   }
 }
 
-/** UTF-8 BOM, stripped before JSONC parsing (matches provision.ts readRootConfig). */
-const UTF8_BOM = '';
-
-/** True when `value` is a non-array object (JSONC-parsed config record). */
-function isConfigRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-/**
- * Parse the resolved root wrangler config (`-c` target) into a top-level record,
- * mirroring the provisioner's `readRootConfig` (jsonc-parser, BOM-stripped,
- * trailing commas allowed). We read the SAME file the deploy pins via `-c` and
- * force top-level via `--env=`, so its top-level fields are exactly what
- * wrangler's `secret list` and the build both resolve. An unreadable/malformed
- * config yields undefined — callers then fall back safely (no account gate / no
- * root-wrangler var layer), and wrangler itself later fails on a truly broken
- * config with a distinct fail-closed {@link SelfHostSecretListError}.
- */
-function parseRootConfig(configPath: string): Record<string, unknown> | undefined {
-  if (!existsSync(configPath)) {
-    return undefined;
-  }
-  let raw: string;
-  try {
-    raw = readFileSync(configPath, 'utf-8');
-  } catch {
-    return undefined;
-  }
-  const content = raw.startsWith(UTF8_BOM) ? raw.slice(UTF8_BOM.length) : raw;
-  const errors: Array<ParseError> = [];
-  const parsed = parseJsonc(content, errors, { allowTrailingComma: true });
-  if (errors.length > 0 || !isConfigRecord(parsed)) {
-    return undefined;
-  }
-  return parsed;
-}
-
-/**
- * Read the top-level `account_id` string from the resolved wrangler config
- * (`-c` target). Same file/parse as {@link parseRootConfig}; this is exactly the
- * account wrangler's `secret list` will resolve. An unreadable/malformed config
- * yields undefined (no reconciliation gate).
- */
-function readConfigAccountId(configPath: string): string | undefined {
-  const parsed = parseRootConfig(configPath);
-  if (!parsed) {
-    return undefined;
-  }
-  const accountId = parsed.account_id;
-  return typeof accountId === 'string' && accountId.length > 0 ? accountId : undefined;
-}
-
-/**
- * Read the top-level `name` string from the resolved wrangler config (`-c` target).
- * Same file/parse as {@link parseRootConfig}; this is exactly the worker name
- * wrangler's `secret list` will resolve. An unreadable/malformed config or an
- * absent/empty `name` yields undefined (no reconciliation gate).
- */
-function readConfigName(configPath: string): string | undefined {
-  const parsed = parseRootConfig(configPath);
-  if (!parsed) {
-    return undefined;
-  }
-  const name = parsed.name;
-  return typeof name === 'string' && name.length > 0 ? name : undefined;
-}
-
-/**
- * Stable, values-free reason code stamped on every invalid key on the
- * self-host path. The raw validator message (e.g. `Expected a number, got
- * "not-a-number"`) can EMBED the offending input, and redaction preserves
- * benign values / can be disabled via `VOID_ENV_UNMASK`, so the message text is
- * never surfaced here — only the key name and this fixed code.
- */
+/** Shown instead of validator messages, which can embed the rejected value. */
 const SELF_HOST_INVALID_REASON = 'failed schema validation';
 
-/**
- * Build the hard error for an unsatisfied schema from KEY NAMES + the
- * stable {@link SELF_HOST_INVALID_REASON} code ONLY. It never reads
- * `report.invalid[].messages` (which can embed raw input) and never resolved
- * `report.values`, and it attaches a freshly-sanitized report of the same
- * shape — so neither the thrown message, the attached report, nor its JSON
- * serialization can echo a value, even with `VOID_ENV_UNMASK` set.
- */
-function selfHostEnvError(report: EnvValidationReport): SelfHostEnvValidationError {
+function selfHostEnvError(
+  missingKeys: Array<string>,
+  invalidKeys: Array<string>,
+): SelfHostEnvValidationError {
   const sortNames = (names: Array<string>): Array<string> =>
     [...names].sort((a, b) => a.localeCompare(b));
-  const missing = sortNames(report.missing);
-  const invalidKeys = sortNames(report.invalid.map((i) => i.key));
+  const missing = sortNames(missingKeys);
+  const invalid = sortNames(invalidKeys);
 
   const lines: Array<string> = [];
   if (missing.length > 0) {
@@ -972,90 +530,21 @@ function selfHostEnvError(report: EnvValidationReport): SelfHostEnvValidationErr
       lines.push(`  • ${key}`);
     }
   }
-  if (invalidKeys.length > 0) {
+  if (invalid.length > 0) {
     if (lines.length > 0) {
       lines.push('');
     }
     lines.push('Invalid env vars:');
-    for (const key of invalidKeys) {
+    for (const key of invalid) {
       lines.push(`  • ${key} (${SELF_HOST_INVALID_REASON})`);
     }
   }
   if (missing.length > 0) {
     lines.push('', 'Set each missing production secret with `void secret put <NAME>`.');
   }
-  // Sanitized report: key names + the fixed reason code, no messages, no values.
-  const safeReport: EnvValidationReport = {
-    valid: report.valid,
-    missing: report.missing,
-    invalid: report.invalid.map((i) => ({ key: i.key, messages: [SELF_HOST_INVALID_REASON] })),
-    values: new Map(),
-  };
-  return new SelfHostEnvValidationError(lines.join('\n'), safeReport);
+  return new SelfHostEnvValidationError(lines.join('\n'));
 }
 
-/**
- * The values-free description of a var's WINNING source, used to name the
- * ACTUAL origin of a configured-empty key in the remediation. Only the source
- * KIND is ever surfaced — never a value. The self-host gate reads ground truth
- * (`dist/ssr/wrangler.json` `vars`), so every present key's source is `emitted`.
- */
-function describeVarSource(source: VarSource | undefined): string {
-  switch (source?.kind) {
-    case 'emitted':
-      return 'the built worker config (`dist/ssr/wrangler.json` `vars`)';
-    default:
-      // Unreachable — a present key always has a recorded source. Fall back to a
-      // generic, values-free phrasing rather than naming a wrong source.
-      return 'your build env configuration';
-  }
-}
-
-/**
- * The hard error for a REQUIRED key set to an EMPTY value (`FOO=""`) in
- * the effective build map. Values-free (key names + source KIND/filename only),
- * thrown ALWAYS — independent of whether the key exists as a remote secret. The
- * build bakes the empty string into plaintext `vars`, and wrangler 4.131 gives a
- * config var precedence over a same-named remote secret (`checkRemoteSecretsOverride`
- * in wrangler-dist/cli.js warns "… will replace these remote secrets with the
- * configuration values"), so shipping this would ship an empty value for a
- * required secret (overwriting a remote one if it exists). The remedy is to
- * REMOVE the empty assignment, not `secret put`. The remediation names each
- * key's source (its {@link VarSource} provenance).
- */
-function emptyAssignmentError(
-  keys: Array<string>,
-  sources: Record<string, VarSource>,
-): SelfHostEnvValidationError {
-  const sorted = [...keys].sort((a, b) => a.localeCompare(b));
-  const lines = [
-    'Empty value for a required env var:',
-    ...sorted.map((key) => `  • ${key} (from ${describeVarSource(sources[key])})`),
-    '',
-    'These keys are REQUIRED by your env schema but assigned an EMPTY value in the source noted ' +
-      'above. The build bakes the empty value into the worker config as a plaintext var, and ' +
-      'Cloudflare gives a config var precedence over any same-named remote secret — so the deploy ' +
-      'would ship an empty value for a required secret (overwriting a remote secret if one exists).',
-    '',
-    'Remove the empty assignment (so a remote secret can take effect), or set a real value:',
-    ...sorted.map((key) => `  • ${key} — from ${describeVarSource(sources[key])}`),
-  ];
-  const safeReport: EnvValidationReport = {
-    valid: false,
-    missing: sorted,
-    invalid: [],
-    values: new Map(),
-  };
-  return new SelfHostEnvValidationError(lines.join('\n'), safeReport);
-}
-
-/**
- * Actionable, values-free bootstrap guidance for the FIRST-DEPLOY case:
- * the worker does not exist yet, so its remote secrets can't be listed. Lists
- * the still-unsatisfied required key NAMES and the `wrangler secret put <NAME>`
- * command that bootstraps each on the draft worker (wrangler can `secret put`
- * before a worker's first deploy). Key names only — no values.
- */
 function firstDeployMessage(missingKeys: Array<string>): string {
   const sorted = [...missingKeys].sort((a, b) => a.localeCompare(b));
   const names = sorted.length > 0 ? sorted : ['<NAME>'];
@@ -1070,21 +559,12 @@ function firstDeployMessage(missingKeys: Array<string>): string {
   ].join('\n');
 }
 
-/** Select the generated top-level Worker config for structured secret discovery. */
 function secretListOperation(configPath: string): CloudflareOperation {
   return { type: 'secret.list', configPath };
 }
 
-/**
- * Build the THROWN message for a wrangler-run failure from the structural
- * reason code + safe scalars ONLY. It NEVER interpolates `result.stderr`,
- * `result.stdout`, a spawn-error string, or a rejection message — those are
- * unconstrained (the child inherits `process.env`) and could embed an env
- * value. Where wrangler's own diagnostics would help, the message tells the
- * user to retry through Void rather than echoing its output here.
- */
 function secretListFailureMessage(
-  reason: SecretListRunFailureReason,
+  reason: SecretListFailureReason,
   detail: SecretListFailureDetail,
 ): string {
   const base = 'env: `wrangler secret list` could not confirm the remote secrets';
@@ -1112,31 +592,16 @@ function secretListFailureMessage(
   }
 }
 
-/** Construct a values-free {@link SelfHostSecretListError} for a run failure. */
 function secretListError(
-  reason: SecretListRunFailureReason,
+  reason: SecretListFailureReason,
   detail: SecretListFailureDetail = {},
 ): SelfHostSecretListError {
-  return new SelfHostSecretListError(secretListFailureMessage(reason, detail), reason, detail);
+  return new SelfHostSecretListError(secretListFailureMessage(reason, detail));
 }
 
 /**
- * Run `wrangler secret list` through the seam and parse STRICTLY, failing
- * CLOSED: any signal, spawn error, nonzero exit, unparseable stdout, or
- * malformed list member throws {@link SelfHostSecretListError}. A failure here
- * is never interpreted as "no secrets exist" — that would let a deploy proceed
- * with required secrets actually missing on the worker.
- *
- * A completed failure with a typed missing-Worker code is a
- * DISTINCT, structured {@link SelfHostFirstDeployError} carrying the still
- * unsatisfied required `missingKeys` + `void secret put` bootstrap guidance,
- * instead of the generic "list exited nonzero" dead end.
- *
- * Raw child output (stderr/stdout, spawn-error text, rejection messages)
- * does not participate in missing-Worker classification. Every THROWN
- * error carries only a structural {@link SecretListFailureReason} code and safe
- * scalars (exit code / signal name), so no env value the child may have echoed
- * can reach the error's message, fields, or JSON — even under `VOID_ENV_UNMASK`.
+ * Run the list and parse it strictly: any failure throws rather than reading as
+ * "no secrets". Runner and provider text is never surfaced, since it can embed values.
  */
 async function fetchSelfHostSecretNames(
   run: RunSecretList,
@@ -1147,17 +612,12 @@ async function fetchSelfHostSecretNames(
   try {
     result = await Promise.resolve(run(secretListOperation(configPath)));
   } catch {
-    // The runner threw — the child produced no usable result. The rejection
-    // message is unconstrained (could embed a value), so it is DROPPED; only
-    // the structural code survives.
     throw secretListError('spawn-error');
   }
   if (result.error != null && result.error !== '') {
-    // Spawn-error string is unconstrained wrangler/OS text — dropped.
     throw secretListError('spawn-error');
   }
   if (result.signal != null) {
-    // Signal name is a safe scalar; stderr is NOT surfaced.
     throw secretListError('signal', { signal: String(result.signal) });
   }
   if (typeof result.status !== 'number' || result.status !== 0) {
@@ -1168,7 +628,7 @@ async function fetchSelfHostSecretNames(
       result.status! > 0 &&
       ([10007, 10090].includes(result.errorCode ?? 0) || result.failure === 'not-found')
     ) {
-      throw new SelfHostFirstDeployError(firstDeployMessage(missingKeys), missingKeys, exitCode);
+      throw new SelfHostFirstDeployError(firstDeployMessage(missingKeys));
     }
     throw secretListError('nonzero-exit', { exitCode });
   }
@@ -1178,8 +638,8 @@ async function fetchSelfHostSecretNames(
   }
   const names: Array<string> = [];
   for (const member of parsed) {
-    // Whole-list validation: ANY malformed member fails the entire call. A
-    // partially-parsed list could vouch for secrets we never actually saw.
+    // One malformed member fails the whole list: a partial list could vouch for
+    // secrets that were never seen.
     const name =
       member !== null && typeof member === 'object' && !Array.isArray(member)
         ? (member as { name?: unknown }).name
@@ -1192,14 +652,7 @@ async function fetchSelfHostSecretNames(
   return names;
 }
 
-/**
- * List one pinned self-host Worker's remote secret names. Reconciles the root
- * config's worker/account identity before spawning wrangler, then delegates to
- * the same strict, values-free parser used by the production env gate.
- *
- * Exported so deploy-owned secret provisioning can share the exact same
- * first-deploy and malformed-output classification without duplicating it.
- */
+/** List the pinned Worker's remote secret names after checking the config's identity. */
 export async function listSelfHostSecretNames(
   options: {
     root: string;
@@ -1207,7 +660,6 @@ export async function listSelfHostSecretNames(
     accountId?: string;
     workerName?: string;
     runWrangler?: RunSecretList;
-    timeoutMs?: number;
   },
   missingKeys: Array<string> = [],
 ): Promise<Array<string>> {
@@ -1215,47 +667,27 @@ export async function listSelfHostSecretNames(
   const effectiveAccountId = reconcileSelfHostAccount(options.configPath, options.accountId);
   const run =
     options.runWrangler ??
-    createDefaultSecretListRunner(options.root, {
-      accountId: effectiveAccountId,
-      timeoutMs: options.timeoutMs,
-    });
+    createDefaultSecretListRunner(options.root, { accountId: effectiveAccountId });
   return fetchSelfHostSecretNames(run, options.configPath, missingKeys);
 }
 
-/**
- * Hard timeout for one `wrangler secret list` invocation — same bound as the
- * provisioner's per-command timeout. A hung wrangler must never hang the
- * whole deploy preflight.
- */
+/** A hung list must not hang the deploy. */
 const SECRET_LIST_TIMEOUT_MS = 120_000;
 
 /**
- * Default {@link RunSecretList}: resolves wrangler's REAL CLI entry
- * (`wrangler-dist/cli.js`, not the signal-swallowing `bin` wrapper) via
- * {@link resolveCloudflareOperationArgv} and spawns it ASYNC with `shell: false`, so every
- * argv element is passed literally (no shell → no metacharacter injection) and
- * the event loop stays free. A hard timeout SIGKILLs a hung child; the result
- * carries `{status, signal, error}` provenance so the caller fails closed on
- * anything but a clean exit 0.
- *
- * Deliberately simpler than the provisioner's runner: this is a ONE-SHOT
- * READ-ONLY query outside the provision lock — no lock heartbeat to protect,
- * nothing a lingering child could mutate — so the group-kill/quarantine
- * machinery is unnecessary. If the SIGKILL cannot be confirmed (close never
- * fires), a bounded fallback settles the call as a HARD failure anyway.
+ * Default {@link RunSecretList}: spawn the Cloudflare operation process without a
+ * shell. A timeout SIGKILLs a hung child; anything but a clean exit 0 fails closed.
  */
 export function createDefaultSecretListRunner(
   root: string,
   options?: {
-    /** Pinned into the child's `CLOUDFLARE_ACCOUNT_ID` when provided. */
     accountId?: string;
-    /** Test seam — the argv launcher. Defaults to the real wrangler CLI entry. */
+    /** Test seam for the argv launcher. */
     launcher?: Array<string>;
-    /** Test seam — the hard timeout. Defaults to {@link SECRET_LIST_TIMEOUT_MS}. */
     timeoutMs?: number;
   },
 ): RunSecretList {
-  const launcher = options?.launcher ?? resolveCloudflareOperationArgv(root);
+  const launcher = options?.launcher ?? resolveCloudflareOperationArgv();
   const timeoutMs = options?.timeoutMs ?? SECRET_LIST_TIMEOUT_MS;
   const [command, ...prefix] = launcher;
   return (args) =>
@@ -1290,18 +722,15 @@ export function createDefaultSecretListRunner(
         resolvePromise(decodeCloudflareOperationResult(result));
       };
       const timeoutNote = `env: wrangler secret list exceeded the ${timeoutMs}ms timeout`;
-      // REFERENCED timers (no unref): the outcome must keep the event loop
-      // alive until it is known; both are cleared in settle().
+      // Referenced timers keep the process alive until the outcome is known.
       const commandTimer = setTimeout(() => {
         timedOut = true;
         try {
           child.kill('SIGKILL');
         } catch {
-          // fall through to the fallback timer — settle as a hard failure below
+          // The fallback timer below settles as a hard failure.
         }
-        // Fail-safe: if `close` never fires (kill failed / unkillable child),
-        // settle as a HARD failure — never leave the preflight hanging, and
-        // never read the partial output as a result.
+        // If `close` never fires, settle as a hard failure rather than hang.
         killFallbackTimer = setTimeout(() => {
           settle({
             stdout,
@@ -1319,8 +748,7 @@ export function createDefaultSecretListRunner(
         settle({
           stdout,
           stderr: timedOut ? [stderr, timeoutNote].filter(Boolean).join('\n') : stderr,
-          // A signal-killed child reports `code: null` — normalize to a
-          // nonzero status AND carry the signal, so no path reads it as clean.
+          // A signal-killed child reports `code: null`; keep it nonzero.
           status: typeof code === 'number' ? code : -1,
           signal: signal ?? (timedOut ? 'SIGKILL' : null),
         });
@@ -1329,21 +757,10 @@ export function createDefaultSecretListRunner(
 }
 
 /**
- * Child env for the spawned `wrangler secret list`. Mirrors deploy.ts's
- * `buildEnv` (not imported — deploy.ts imports this module): the CF Access
- * service-token pair is for the Void platform API client only and must never
- * leak into a spawned wrangler. Pins `WRANGLER_LOG_SANITIZE=true` (same as the
- * provisioner) and the caller's account id when provided. Unlike the
- * provisioner's `provisionEnv`, ambient transport env (`CLOUDFLARE_API_BASE_URL`
- * etc.) is left untouched: this preflight has no second transport to keep in
- * lockstep, and scrubbing would silently redirect a staging/FedRAMP user's
- * `secret list` at the production endpoint.
- *
- * Windows environment keys are CASE-INSENSITIVE (same hazard `provisionEnv`
- * guards): an ambient mixed-case spelling (`Cloudflare_Account_Id`) could
- * shadow an exact-case pin, so on win32 every case-variant of a scrubbed or
- * pinned key is removed first. Exported (with a platform seam) for direct
- * unit testing of that case rule; production callers pass no platform.
+ * Child env for the default runner: drops the CF Access credentials (Void API only),
+ * forces sanitized logs, and pins the account. Ambient transport env such as
+ * `CLOUDFLARE_API_BASE_URL` is kept so a staging or FedRAMP endpoint still applies.
+ * Windows env keys are case-insensitive, so there every case variant is removed.
  */
 export function secretListEnv(accountId?: string, platform?: NodeJS.Platform): NodeJS.ProcessEnv {
   const env: NodeJS.ProcessEnv = { ...process.env };
diff --git a/packages/void/src/cli/gen.ts b/packages/void/src/cli/gen.ts
index abb38e882..2e951d3ec 100644
--- a/packages/void/src/cli/gen.ts
+++ b/packages/void/src/cli/gen.ts
@@ -1,26 +1,17 @@
 import { spawnSync } from 'node:child_process';
-import {
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  unlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { fileURLToPath } from 'node:url';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { log, select, isCancel, cancel } from '@voidzero-dev/vite-plus-prompts';
 import { join, dirname, relative } from 'pathslash';
 import { ensureProjectTsconfig } from '../codegen/project-tsconfig.ts';
-import { readConfig, getDatabaseDialect } from '../config.ts';
-import { writeDrizzleConfig } from '../drizzle/config.ts';
+import { readConfig, getDatabaseDialect, type DatabaseDialect } from '../config.ts';
+import { PLACEHOLDER_DB_URL, writeDrizzleConfig } from '../drizzle/config.ts';
+import { snapshotDrizzleOutputs } from '../drizzle/generate.ts';
 import { collectMigrations, readJournal } from '../migrations/collect.ts';
-import { assertJournalCoherence, listDrizzleArtifacts } from '../migrations/validate.ts';
+import { assertJournalCoherence } from '../migrations/validate.ts';
 import { readProjectPaths } from '../project-paths.ts';
 import type { GenArgs } from './gen-args.ts';
 import { printSuccess } from './output.ts';
-import { buildDrizzleKitSpawnEnv } from './yarn-pnp.ts';
-
-const drizzleKitBin = join(fileURLToPath(import.meta.resolve('drizzle-kit')), '..', 'bin.cjs');
+import { buildDrizzleKitSpawnEnv, drizzleKitBin } from './yarn-pnp.ts';
 
 export async function runGenCommand(root: string, args: GenArgs): Promise<void> {
   console.log();
@@ -105,126 +96,62 @@ type ColumnSpec = {
   nullable: boolean;
 };
 
-function drizzleColumnDef(col: ColumnSpec): string {
-  const { name, type } = col;
-  const notNull = col.nullable ? '' : '.notNull()';
-  switch (type) {
-    case 'string':
-    case 'text':
-      return `  ${name}: text("${name}")${notNull},`;
-    case 'integer':
-      return `  ${name}: integer("${name}")${notNull},`;
-    case 'boolean':
-      return `  ${name}: integer("${name}", { mode: "boolean" })${notNull}.default(false),`;
-    case 'real':
-      return `  ${name}: real("${name}")${notNull},`;
-    default:
-      return `  ${name}: text("${name}"),`;
-  }
-}
-
-function drizzleImportsForColumns(columns: Array<ColumnSpec>): Array<string> {
-  const types = new Set<string>(['text', 'integer']);
-  for (const col of columns) {
-    switch (col.type) {
-      case 'string':
-      case 'text':
-        types.add('text');
-        break;
-      case 'integer':
-        types.add('integer');
-        break;
-      case 'boolean':
-        types.add('integer');
-        break;
-      case 'real':
-        types.add('real');
-        break;
-      default:
-        types.add('text');
-    }
-  }
-  return [...types].sort();
-}
+type ColumnBuilder = { fn: string; options?: string };
+
+const TEXT_COLUMN: ColumnBuilder = { fn: 'text' };
+
+// Types without a builder (`datetime`, `blob`) fall back to a plain `text()` column.
+const COLUMN_BUILDERS: Record<DatabaseDialect, Partial<Record<string, ColumnBuilder>>> = {
+  sqlite: {
+    string: TEXT_COLUMN,
+    text: TEXT_COLUMN,
+    integer: { fn: 'integer' },
+    boolean: { fn: 'integer', options: '{ mode: "boolean" }' },
+    real: { fn: 'real' },
+  },
+  postgresql: {
+    string: TEXT_COLUMN,
+    text: TEXT_COLUMN,
+    integer: { fn: 'integer' },
+    boolean: { fn: 'boolean' },
+    real: { fn: 'doublePrecision' },
+  },
+  mysql: {
+    string: TEXT_COLUMN,
+    text: TEXT_COLUMN,
+    integer: { fn: 'int' },
+    boolean: { fn: 'boolean' },
+    real: { fn: 'double' },
+  },
+};
 
-function drizzleColumnDefPg(col: ColumnSpec): string {
-  const { name, type } = col;
-  const notNull = col.nullable ? '' : '.notNull()';
-  switch (type) {
-    case 'string':
-    case 'text':
-      return `  ${name}: text("${name}")${notNull},`;
-    case 'integer':
-      return `  ${name}: integer("${name}")${notNull},`;
-    case 'boolean':
-      return `  ${name}: boolean("${name}")${notNull}.default(false),`;
-    case 'real':
-      return `  ${name}: doublePrecision("${name}")${notNull},`;
-    default:
-      return `  ${name}: text("${name}"),`;
-  }
-}
+const BASE_IMPORTS: Record<DatabaseDialect, Array<string>> = {
+  sqlite: ['text', 'integer'],
+  postgresql: ['text', 'serial', 'timestamp'],
+  mysql: ['int', 'text', 'timestamp'],
+};
 
-function drizzleImportsForColumnsPg(columns: Array<ColumnSpec>): Array<string> {
-  const types = new Set<string>(['text', 'serial', 'timestamp']);
-  for (const col of columns) {
-    switch (col.type) {
-      case 'string':
-      case 'text':
-        types.add('text');
-        break;
-      case 'integer':
-        types.add('integer');
-        break;
-      case 'boolean':
-        types.add('boolean');
-        break;
-      case 'real':
-        types.add('doublePrecision');
-        break;
-      default:
-        types.add('text');
-    }
+function drizzleColumnDef(dialect: DatabaseDialect, col: ColumnSpec): string {
+  const { name } = col;
+  const builder = COLUMN_BUILDERS[dialect][col.type];
+  if (!builder) {
+    return `  ${name}: text("${name}"),`;
   }
-  return [...types].sort();
-}
-
-function drizzleColumnDefMySql(col: ColumnSpec): string {
-  const { name, type } = col;
+  const args = builder.options ? `"${name}", ${builder.options}` : `"${name}"`;
   const notNull = col.nullable ? '' : '.notNull()';
-  switch (type) {
-    case 'string':
-    case 'text':
-      return `  ${name}: text("${name}")${notNull},`;
-    case 'integer':
-      return `  ${name}: int("${name}")${notNull},`;
-    case 'boolean':
-      return `  ${name}: boolean("${name}")${notNull}.default(false),`;
-    case 'real':
-      return `  ${name}: double("${name}")${notNull},`;
-    default:
-      return `  ${name}: text("${name}"),`;
-  }
+  const defaultValue = col.type === 'boolean' ? '.default(false)' : '';
+  return `  ${name}: ${builder.fn}(${args})${notNull}${defaultValue},`;
 }
 
-function drizzleImportsForColumnsMySql(columns: Array<ColumnSpec>): Array<string> {
-  const types = new Set<string>(['int', 'text', 'timestamp']);
+function drizzleImportsForColumns(
+  dialect: DatabaseDialect,
+  columns: Array<ColumnSpec>,
+): Array<string> {
+  const imports = new Set(BASE_IMPORTS[dialect]);
   for (const col of columns) {
-    switch (col.type) {
-      case 'integer':
-        types.add('int');
-        break;
-      case 'boolean':
-        types.add('boolean');
-        break;
-      case 'real':
-        types.add('double');
-        break;
-      default:
-        types.add('text');
-    }
+    imports.add(COLUMN_BUILDERS[dialect][col.type]?.fn ?? 'text');
   }
-  return [...types].sort();
+  return [...imports].sort();
 }
 
 // ---------------------------------------------------------------------------
@@ -283,87 +210,52 @@ async function resolveValidator(root: string): Promise<Validator> {
   return choice as Validator;
 }
 
-function validatorTypeFor(validator: Validator, col: ColumnSpec): string {
-  if (validator === 'valibot') {
-    return valibotType(col);
-  }
-  if (validator === 'zod') {
-    return zodType(col);
-  }
-  // arktype handled separately via string syntax
-  return arktypeType(col);
-}
+type SchemaValidator = Exclude<Validator, 'none'>;
 
-function valibotType(col: ColumnSpec): string {
-  let base: string;
-  switch (col.type) {
-    case 'string':
-    case 'text':
-    case 'datetime':
-      base = 'v.string()';
-      break;
-    case 'integer':
-    case 'real':
-      base = 'v.number()';
-      break;
-    case 'boolean':
-      base = 'v.boolean()';
-      break;
-    case 'blob':
-      base = 'v.instance(Blob)';
-      break;
-    default:
-      base = 'v.string()';
-  }
-  return col.nullable ? `v.optional(${base})` : base;
-}
+type ValidatorTypes = {
+  string: string;
+  number: string;
+  boolean: string;
+  blob: string;
+  optional: (base: string) => string;
+};
 
-function zodType(col: ColumnSpec): string {
-  let base: string;
-  switch (col.type) {
-    case 'string':
-    case 'text':
-    case 'datetime':
-      base = 'z.string()';
-      break;
-    case 'integer':
-    case 'real':
-      base = 'z.number()';
-      break;
-    case 'boolean':
-      base = 'z.boolean()';
-      break;
-    case 'blob':
-      base = 'z.instanceof(Blob)';
-      break;
-    default:
-      base = 'z.string()';
-  }
-  return col.nullable ? `${base}.optional()` : base;
-}
+const VALIDATOR_TYPES: Record<SchemaValidator, ValidatorTypes> = {
+  valibot: {
+    string: 'v.string()',
+    number: 'v.number()',
+    boolean: 'v.boolean()',
+    blob: 'v.instance(Blob)',
+    optional: (base) => `v.optional(${base})`,
+  },
+  zod: {
+    string: 'z.string()',
+    number: 'z.number()',
+    boolean: 'z.boolean()',
+    blob: 'z.instanceof(Blob)',
+    optional: (base) => `${base}.optional()`,
+  },
+  arktype: {
+    string: 'string',
+    number: 'number',
+    boolean: 'boolean',
+    blob: 'instanceof Blob',
+    optional: (base) => `${base} | undefined`,
+  },
+};
 
-function arktypeType(col: ColumnSpec): string {
-  let base: string;
-  switch (col.type) {
-    case 'string':
-    case 'text':
-    case 'datetime':
-      base = 'string';
-      break;
-    case 'integer':
-    case 'real':
-      base = 'number';
-      break;
-    case 'boolean':
-      base = 'boolean';
-      break;
-    case 'blob':
-      base = 'instanceof Blob';
-      break;
-    default:
-      base = 'string';
-  }
-  return col.nullable ? `${base} | undefined` : base;
+// Column types not listed here (`string`, `text`, `datetime`) validate as strings.
+const VALUE_KINDS: Partial<Record<string, 'number' | 'boolean' | 'blob'>> = {
+  integer: 'number',
+  real: 'number',
+  boolean: 'boolean',
+  blob: 'blob',
+};
+
+function validatorType(validator: SchemaValidator, col: ColumnSpec): string {
+  const types = VALIDATOR_TYPES[validator];
+  const base = types[VALUE_KINDS[col.type] ?? 'string'];
+  return col.nullable ? types.optional(base) : base;
 }
 
 function getImportLine(validator: Validator): string | null {
@@ -379,12 +271,14 @@ function getImportLine(validator: Validator): string | null {
   }
 }
 
-function getBodySchema(validator: Validator, columns: Array<ColumnSpec>): string {
+function getBodySchema(validator: SchemaValidator, columns: Array<ColumnSpec>): string {
   if (validator === 'arktype') {
-    const fields = columns.map((c) => `    ${c.name}: "${arktypeType(c)}",`).join('\n');
+    const fields = columns
+      .map((c) => `    ${c.name}: "${validatorType(validator, c)}",`)
+      .join('\n');
     return `type({\n${fields}\n  })`;
   }
-  const fields = columns.map((c) => `    ${c.name}: ${validatorTypeFor(validator, c)},`).join('\n');
+  const fields = columns.map((c) => `    ${c.name}: ${validatorType(validator, c)},`).join('\n');
   const prefix = validator === 'valibot' ? 'v' : 'z';
   return `${prefix}.object({\n${fields}\n  })`;
 }
@@ -511,59 +405,43 @@ async function runModel(root: string, name: string, columns: Array<ColumnSpec>):
   const modelPath = join(schemaDir, `${name}.ts`);
 
   // 1. Generate Drizzle table definition
+  const colDefs = columns.map((col) => drizzleColumnDef(dialect, col));
+  const columnImports = drizzleImportsForColumns(dialect, columns).join(', ');
   let content: string;
   if (dialect === 'postgresql') {
-    const colDefs = columns.map((col) => drizzleColumnDefPg(col));
-    const columnImports = drizzleImportsForColumnsPg(columns);
-    const allCols = [
+    content = [
+      `import { pgTable, ${columnImports} } from "void/schema-pg";`,
+      '',
+      `export const ${name} = pgTable("${name}", {`,
       `  id: serial("id").primaryKey(),`,
       ...colDefs,
       `  createdAt: timestamp("created_at").notNull().defaultNow(),`,
       `  updatedAt: timestamp("updated_at").notNull().defaultNow(),`,
-    ];
-
-    content = [
-      `import { pgTable, ${columnImports.join(', ')} } from "void/schema-pg";`,
-      '',
-      `export const ${name} = pgTable("${name}", {`,
-      ...allCols,
       '});',
       '',
     ].join('\n');
   } else if (dialect === 'mysql') {
-    const colDefs = columns.map((col) => drizzleColumnDefMySql(col));
-    const columnImports = drizzleImportsForColumnsMySql(columns);
-    const allCols = [
+    content = [
+      `import { mysqlTable, ${columnImports} } from "void/schema-mysql";`,
+      '',
+      `export const ${name} = mysqlTable("${name}", {`,
       `  id: int("id").autoincrement().primaryKey(),`,
       ...colDefs,
       `  createdAt: timestamp("created_at").notNull().defaultNow(),`,
       `  updatedAt: timestamp("updated_at").notNull().defaultNow(),`,
-    ];
-
-    content = [
-      `import { mysqlTable, ${columnImports.join(', ')} } from "void/schema-mysql";`,
-      '',
-      `export const ${name} = mysqlTable("${name}", {`,
-      ...allCols,
       '});',
       '',
     ].join('\n');
   } else {
-    const colDefs = columns.map((col) => drizzleColumnDef(col));
-    const columnImports = drizzleImportsForColumns(columns);
-    const allCols = [
-      `  id: integer("id").primaryKey({ autoIncrement: true }),`,
-      ...colDefs,
-      '  createdAt: text("created_at").notNull().default(sql`(datetime(\'now\'))`),',
-      '  updatedAt: text("updated_at").notNull().default(sql`(datetime(\'now\'))`),',
-    ];
-
     content = [
-      `import { sqliteTable, ${columnImports.join(', ')} } from "void/schema-d1";`,
+      `import { sqliteTable, ${columnImports} } from "void/schema-d1";`,
       `import { sql } from "void/db";`,
       '',
       `export const ${name} = sqliteTable("${name}", {`,
-      ...allCols,
+      `  id: integer("id").primaryKey({ autoIncrement: true }),`,
+      ...colDefs,
+      '  createdAt: text("created_at").notNull().default(sql`(datetime(\'now\'))`),',
+      '  updatedAt: text("updated_at").notNull().default(sql`(datetime(\'now\'))`),',
       '});',
       '',
     ].join('\n');
@@ -605,27 +483,9 @@ function runMigration(root: string, name: string): void {
   const migrationsDir = readProjectPaths(root).migrationsDir;
   mkdirSync(migrationsDir, { recursive: true });
 
-  // Drift / partial-state gate. Run the same check the rest of the db
-  // commands (`void db status`, `migrate`, `reset`, `deploy`) use as their
-  // preflight, BEFORE any other guard and BEFORE writing any file. This is
-  // the first line of defense and it subsumes several footguns in one pass:
-  //   - `_journal.json` missing but `meta/*_snapshot.json` or `migrations.js`
-  //     still on disk (partial drizzle-kit state — a botched merge / manual
-  //     cleanup that would otherwise let us write a new .sql file the rest
-  //     of the CLI immediately rejects).
-  //   - Journal entries that don't line up with the `.sql` files on disk
-  //     (orphan file / missing file drift).
-  // Must run BEFORE the bundled-mode guard below: when `migrations.js`
-  // survived a bad merge but `_journal.json` is missing, the bundled guard
-  // would otherwise advise "delete migrations.js" and leave the project in
-  // a bare-legacy + orphan-SQL state on the next run. Surfacing the partial
-  // state here points the user at the correct recovery (restore the journal
-  // OR delete all drizzle artifacts) before we look at the bundle at all.
-  // Collect BEFORE the new scaffold so the check sees only pre-existing
-  // state. Bare-legacy (no journal, no artifacts) and the playground
-  // placeholder shape (`entries: []`, no artifacts) are silent-passes in
-  // `assertJournalCoherence`, which is exactly the behavior `gen migration`
-  // wants here.
+  // The same preflight as the other db commands, before any write. It runs
+  // before the bundle check so a leftover migrations.js without a journal
+  // gets the partial-state recovery advice.
   const currentMigrations = collectMigrations(migrationsDir);
   try {
     assertJournalCoherence(migrationsDir, currentMigrations);
@@ -634,28 +494,8 @@ function runMigration(root: string, name: string): void {
     process.exit(1);
   }
 
-  // Refuse to scaffold migrations into a project that uses drizzle-kit's
-  // bundled migration format (`drizzle-kit generate --bundle`, used by
-  // Expo/`durable-sqlite`). Bundled mode emits a `migrations.js` file
-  // alongside `_journal.json` that hard-codes one `import m0000 from
-  // './<tag>.sql'` line per journal entry plus an `{ journal, migrations:
-  // { m0000, m0001, ... } }` export. Drizzle's runtime bundled migrator
-  // iterates `journal.entries` and looks up `migrations[\`m${idx}\`]` by
-  // padded idx. If we append a new journal entry without also adding a
-  // matching `m000N` export to `migrations.js`, the next migration run
-  // blows up at runtime with `Missing migration: <tag>`.
-  //
-  // Rewriting `migrations.js` from here would lock us to drizzle-kit's
-  // exact emit format (import path, padding, trailing comma) and break
-  // silently whenever drizzle-kit bumps that format. Shelling out to
-  // `drizzle-kit generate` doesn't help either — it runs a schema diff, not
-  // a bundle-rebuild from existing SQL. Refusing with a helpful error is
-  // the only honest option: it turns a silent runtime failure into a
-  // deterministic CLI error with a clear recovery path. Fail fast, before
-  // any file write or journal mutation, so there's nothing to roll back.
-  // By the time we get here, `assertJournalCoherence` has already cleared
-  // the partial-state shape (journal missing + bundle on disk), so this
-  // guard only fires on a coherent drizzle state with the bundle present.
+  // Bundled mode needs a matching `m000N` import in migrations.js for every
+  // journal entry, and only drizzle-kit can regenerate that file.
   const bundlePath = join(migrationsDir, 'migrations.js');
   if (existsSync(bundlePath)) {
     log.error(
@@ -668,64 +508,15 @@ function runMigration(root: string, name: string): void {
     process.exit(1);
   }
 
-  // Integrate with a drizzle-managed project by delegating to
-  // `drizzle-kit generate --custom --name <name>`. Drizzle-kit is the
-  // source of truth for both `_journal.json` and `meta/<prefix>_snapshot.
-  // json`, and running it here guarantees three things we cannot produce
-  // in-process without re-implementing a schema compiler:
-  //
-  //   1. A fresh `<timestamp>_<name>.sql` stub under `db/migrations/`
-  //      (drizzle-kit writes an empty `.sql` for `--custom`).
-  //   2. An updated `_journal.json` with a new entry appended (new idx,
-  //      new timestamp, inherited version/breakpoints).
-  //   3. A new `meta/<prefix>_snapshot.json` that is a snapshot of the
-  //      **current** `db/schema.ts`, NOT a clone of the previous
-  //      snapshot.
-  //
-  // Bullet 3 is the whole reason we delegate. Cloning the previous
-  // snapshot in-process would leave the new journal entry pointing at a
-  // stale schema state: if the user had changed `db/schema.ts` before
-  // running `void gen migration` to hand-write the matching DDL, the next
-  // `void db generate` / `drizzle-kit generate` would diff the current
-  // schema against the stale snapshot and re-emit the same DDL the custom
-  // migration had already applied. drizzle-kit's own `generate --custom`
-  // path uses its schema-compilation pipeline, so the emitted snapshot
-  // always matches what drizzle-kit would produce on the next invocation.
-  //
-  // We still verify up front that the snapshot matching the last journal
-  // entry is on disk. Without it drizzle-kit would fail with its own
-  // (less actionable) error; the preflight gives the user a cleaner
-  // message and keeps the refusal consistent with the other `void db`
-  // commands.
-  //
-  // By the time we get here, `assertJournalCoherence` has already
-  // rejected the partial-state shape (missing journal + leftover
-  // snapshots), drift between journal tags and `.sql` files on disk, AND
-  // a structurally invalid `entries` shape (non-array). The bundled-mode
-  // guard above has already refused the `migrations.js` case. This block
-  // handles two remaining drizzle shapes:
-  //   - Journal with entries (the normal case): delegate to drizzle-kit.
-  //   - Empty-entries journal + stale snapshot files: a weird state that
-  //     should have been caught earlier. Refuse defensively — we have no
-  //     snapshot tied to an entry we can chain from.
-  // A journal with `entries: []` AND no accompanying artifacts is the
-  // kitchen-sink playground placeholder and falls through to the bare-
-  // legacy write path below.
+  // With journal entries, delegate to `drizzle-kit generate --custom`: it also
+  // snapshots the current schema, so the next `void db generate` does not
+  // re-emit DDL that the custom migration already applies.
   const existingJournal = readJournal(migrationsDir);
   if (existingJournal !== undefined && existingJournal.entries.length > 0) {
     const lastEntry = existingJournal.entries[existingJournal.entries.length - 1];
     const metaDir = join(migrationsDir, 'meta');
-    // Derive the previous snapshot filename from `lastEntry.tag`, not from
-    // a directory listing. Drizzle-kit's snapshot files are named
-    // `<prefix>_snapshot.json`, where `<prefix>` matches the journal tag's
-    // prefix under either the `timestamp` or `index` drizzle-kit naming
-    // conventions — both are the portion before the first underscore. A
-    // directory-sort-then-last-entry approach would pick up stale snapshots
-    // left behind by a merge or manual cleanup (e.g. a lex-higher rogue
-    // file lurking under `meta/`) and diff the next `void db generate`
-    // against the wrong baseline, re-emitting already-applied schema
-    // changes. Using the journal tag binds us to the snapshot drizzle-kit
-    // actually wrote alongside that entry — the only safe baseline.
+    // Use the snapshot named by the last journal tag, not the newest file in
+    // meta/, which may be a stale leftover.
     const lastSnapshotPrefix = lastEntry.tag.split('_')[0];
     const prevSnapshotPath = join(metaDir, `${lastSnapshotPrefix}_snapshot.json`);
     if (!existsSync(prevSnapshotPath)) {
@@ -738,41 +529,11 @@ function runMigration(root: string, name: string): void {
       process.exit(1);
     }
 
-    // Snapshot `_journal.json` bytes up front so a mid-spawn failure can
-    // byte-restore the file. Drizzle-kit is atomic on success but a
-    // partial write on a crashed invocation would otherwise brick the
-    // project — every subsequent `void db` command then crashes in
-    // `readJournal` / `assertJournalCoherence`.
-    const journalPath = join(metaDir, '_journal.json');
-    const originalJournalBytes: Buffer | null = existsSync(journalPath)
-      ? readFileSync(journalPath)
-      : null;
-    const snapshotsBefore = new Set(
-      readdirSync(metaDir).filter((f) => f.endsWith('_snapshot.json')),
-    );
+    const rollBack = snapshotDrizzleOutputs(migrationsDir);
     const sqlFilesBefore = new Set(readdirSync(migrationsDir).filter((f) => f.endsWith('.sql')));
 
-    // The journal is authoritative once it exists. `existingJournal.
-    // dialect` is the dialect drizzle-kit committed to when the first migration
-    // was generated; every subsequent snapshot under `meta/` is chained off
-    // that same dialect. Reading the dialect from `void.config.ts` and passing it
-    // to `drizzle-kit generate --custom` risks writing a new snapshot in the
-    // WRONG dialect if the user edited `void.config.ts`'s `database` field without
-    // dropping the existing migrations. The next `void db generate` would then
-    // diff against an incompatible chain and corrupt the project.
-    //
-    // Cross-check that the two agree. If they disagree, refuse — the only
-    // correct recovery is an explicit one (revert void.config.ts, or drop
-    // db/migrations/ and regenerate).
-    //
-    // Whitelist the dialects Void supports instead of collapsing anything unknown
-    // to sqlite. A hand-edited or merge-corrupted journal with e.g.
-    // `mysql`, `pg`, or an empty dialect would otherwise silently be
-    // treated as sqlite, producing either a sqlite snapshot on top of
-    // a non-sqlite chain or a confusing "void.config.ts is configured for
-    // X but journal says sqlite" cross-check message. Refuse loudly
-    // instead so the user restores the journal (or drops db/migrations/)
-    // on their terms.
+    // The existing snapshot chain was built for the journal's dialect. Refuse
+    // rather than append a snapshot in a different dialect.
     let journalDialect: 'sqlite' | 'postgresql' | 'mysql';
     if (existingJournal.dialect === 'sqlite') {
       journalDialect = 'sqlite';
@@ -803,27 +564,11 @@ function runMigration(root: string, name: string): void {
     const additionalSchemas = existsSync(authSchemaPath) ? [authSchemaPath] : undefined;
     const configPath = writeDrizzleConfig(
       root,
-      journalDialect === 'postgresql'
-        ? 'postgresql://dummy'
-        : journalDialect === 'mysql'
-          ? 'mysql://dummy'
-          : ':memory:',
+      PLACEHOLDER_DB_URL[journalDialect],
       journalDialect,
       { additionalSchemas },
     );
 
-    // Under Yarn Berry PnP, there is no `node_modules` tree —
-    // dependencies live inside ZIP archives (`.yarn/cache/*.zip`) and are
-    // resolved through `.pnp.cjs`, which patches `fs` +
-    // `Module._resolveFilename` to handle the virtual paths. Plain `node
-    // drizzle-kit` cannot load that resolver, so drizzle-kit fails to
-    // resolve `void/schema-d1` from the user's `db/schema.ts`. The
-    // shared helper walks ancestors for the PnP markers and returns a
-    // child env with `NODE_OPTIONS` pre-populated with the right
-    // `--require` / `--experimental-loader` flags. Non-PnP projects get
-    // a plain clone of `process.env`.
-    const childEnv = buildDrizzleKitSpawnEnv(root);
-
     const result = spawnSync(
       process.execPath,
       [drizzleKitBin, 'generate', '--config', configPath, '--custom', '--name', name],
@@ -832,42 +577,13 @@ function runMigration(root: string, name: string): void {
         stdio: 'pipe',
         encoding: 'utf-8',
         shell: process.platform === 'win32',
-        env: childEnv,
+        // Yarn PnP projects need the PnP loader to resolve `void/schema-*`.
+        env: buildDrizzleKitSpawnEnv(root),
       },
     );
 
     if (result.error || result.status !== 0) {
-      // Rollback: byte-restore the journal and unlink any new files
-      // drizzle-kit may have written before it failed. Best-effort — if
-      // restore itself fails, surface the original error anyway because
-      // that's the actionable one.
-      if (originalJournalBytes !== null) {
-        try {
-          writeFileSync(journalPath, originalJournalBytes);
-        } catch {
-          // Swallow: surfacing the original failure is more useful.
-        }
-      }
-      if (existsSync(metaDir)) {
-        for (const f of readdirSync(metaDir)) {
-          if (f.endsWith('_snapshot.json') && !snapshotsBefore.has(f)) {
-            try {
-              unlinkSync(join(metaDir, f));
-            } catch {
-              // Swallow.
-            }
-          }
-        }
-      }
-      for (const f of readdirSync(migrationsDir)) {
-        if (f.endsWith('.sql') && !sqlFilesBefore.has(f)) {
-          try {
-            unlinkSync(join(migrationsDir, f));
-          } catch {
-            // Swallow.
-          }
-        }
-      }
+      rollBack();
       const detail = [result.stderr, result.stdout].filter(Boolean).join('\n').trim();
       log.error(
         [
@@ -880,8 +596,6 @@ function runMigration(root: string, name: string): void {
       process.exit(1);
     }
 
-    // Locate the newly-created .sql file (there should be exactly one
-    // added) so we can tell the user where their custom migration lives.
     const newSqlFile = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .find((f) => !sqlFilesBefore.has(f));
@@ -893,25 +607,6 @@ function runMigration(root: string, name: string): void {
     return;
   }
 
-  // Defensive guard: empty journal accompanied by stale drizzle artifacts
-  // is a weird partial shape. `assertJournalCoherence` should have caught
-  // this earlier (an empty-entries journal plus leftover `meta/*_snapshot.
-  // json` is the same partial-state flavor it rejects elsewhere), but
-  // surface a clear refusal here so we never fall through to bare-legacy
-  // and strand a new .sql file in a project that cannot integrate it.
-  if (existingJournal !== undefined && existingJournal.entries.length === 0) {
-    const drizzleArtifacts = listDrizzleArtifacts(migrationsDir);
-    if (drizzleArtifacts.length > 0) {
-      log.error(
-        'db/migrations/meta/_journal.json has empty entries but stale drizzle-kit snapshots are on disk.',
-      );
-      log.error(
-        'Restore the journal entries from version control (or run `void db generate`), or delete the stale drizzle artifacts and rerun.',
-      );
-      process.exit(1);
-    }
-  }
-
   const timestamp = getMigrationTimestamp(migrationsDir);
   const tag = `${timestamp}_${name}`;
   const filePath = join(migrationsDir, `${tag}.sql`);
diff --git a/packages/void/src/cli/generated-wrangler-config.ts b/packages/void/src/cli/generated-wrangler-config.ts
index 68df1c0a4..67973e268 100644
--- a/packages/void/src/cli/generated-wrangler-config.ts
+++ b/packages/void/src/cli/generated-wrangler-config.ts
@@ -1,14 +1,21 @@
 import { readFileSync } from 'node:fs';
 import { parse, type ParseError } from 'jsonc-parser';
 
-/** Parse a generated Wrangler JSON/JSONC config without accepting a partial parse. */
-export function readGeneratedWranglerConfigFile(path: string): Record<string, unknown> {
-  const raw = readFileSync(path, 'utf8');
-  const content = raw.startsWith('\uFEFF') ? raw.slice(1) : raw;
+/** Parse JSON/JSONC text with an optional BOM; undefined unless it is one valid object. */
+export function parseJsoncObject(text: string): Record<string, unknown> | undefined {
   const errors: Array<ParseError> = [];
-  const parsed: unknown = parse(content, errors, { allowTrailingComma: true });
+  const parsed: unknown = parse(text.replace(/^\uFEFF/, ''), errors, { allowTrailingComma: true });
   if (errors.length > 0 || parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    throw new Error('Invalid Wrangler JSON/JSONC config.');
+    return undefined;
   }
   return parsed as Record<string, unknown>;
 }
+
+/** Parse a generated Wrangler JSON/JSONC config without accepting a partial parse. */
+export function readGeneratedWranglerConfigFile(path: string): Record<string, unknown> {
+  const parsed = parseJsoncObject(readFileSync(path, 'utf8'));
+  if (!parsed) {
+    throw new Error('Invalid Wrangler JSON/JSONC config.');
+  }
+  return parsed;
+}
diff --git a/packages/void/src/cli/github-args.ts b/packages/void/src/cli/github-args.ts
index 8fa2ca6fe..555161de4 100644
--- a/packages/void/src/cli/github-args.ts
+++ b/packages/void/src/cli/github-args.ts
@@ -27,6 +27,8 @@ export const githubSubcommands: Array<SubcommandDef> = [
   { name: 'join', description: "Join your organization's shared GitHub App installations" },
 ];
 
+type Executor = 'container' | 'github_actions';
+
 export type GithubArgs =
   | { subcommand: 'install' }
   | { subcommand: 'installations' }
@@ -38,14 +40,14 @@ export type GithubArgs =
       installationId?: string;
       repo?: string;
       branch?: string;
-      executor?: 'container' | 'github_actions';
+      executor?: Executor;
       workflowPath?: string;
     }
   | {
       subcommand: 'update';
       projectName: string;
       branch?: string;
-      executor?: 'container' | 'github_actions';
+      executor?: Executor;
       workflowPath?: string;
     }
   | {
@@ -58,31 +60,60 @@ export type GithubArgs =
       yes?: boolean;
     };
 
-export function parseGithubArgs(args: Array<string>): GithubArgs {
-  const [subcommand, ...rest] = args;
-
-  if (subcommand === 'install') {
-    if (rest.length > 0) {
-      throw new Error(`github: Unexpected argument '${rest[0]}'.`);
-    }
-    return { subcommand };
+function parseExecutor(value: string): Executor {
+  if (value !== 'container' && value !== 'github_actions') {
+    throw new Error('github: invalid --executor (expected container|github_actions).');
   }
+  return value;
+}
 
-  if (subcommand === 'installations') {
-    if (rest.length > 0) {
-      throw new Error(`github: Unexpected argument '${rest[0]}'.`);
+/**
+ * Parses `[project] [flags]`, where `--project <name>` is an alias for the
+ * positional. Value flags require a non-blank value and receive it untrimmed.
+ */
+function parseProjectArgs(
+  rest: Array<string>,
+  valueFlags: Record<string, (value: string) => void>,
+  booleanFlags: Record<string, () => void> = {},
+): string {
+  let projectName = '';
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (Object.hasOwn(booleanFlags, arg)) {
+      booleanFlags[arg]();
+      continue;
     }
-    return { subcommand };
-  }
-
-  if (subcommand === 'link') {
-    if (rest.length > 0) {
-      throw new Error(`github: Unexpected argument '${rest[0]}'.`);
+    if (arg !== '--project' && !Object.hasOwn(valueFlags, arg)) {
+      if (arg.startsWith('-') || projectName) {
+        throw new Error(`github: Unexpected argument '${arg}'.`);
+      }
+      projectName = arg;
+      continue;
+    }
+    const value = rest[++i];
+    if (value === undefined || value.trim() === '') {
+      throw new Error(`github: ${arg} requires a value.`);
+    }
+    if (arg !== '--project') {
+      valueFlags[arg](value);
+    } else if (projectName) {
+      throw new Error(`github: Unexpected argument '${value}'.`);
+    } else {
+      projectName = value;
     }
-    return { subcommand };
   }
+  return projectName;
+}
+
+export function parseGithubArgs(args: Array<string>): GithubArgs {
+  const [subcommand, ...rest] = args;
 
-  if (subcommand === 'join') {
+  if (
+    subcommand === 'install' ||
+    subcommand === 'installations' ||
+    subcommand === 'link' ||
+    subcommand === 'join'
+  ) {
     if (rest.length > 0) {
       throw new Error(`github: Unexpected argument '${rest[0]}'.`);
     }
@@ -90,211 +121,54 @@ export function parseGithubArgs(args: Array<string>): GithubArgs {
   }
 
   if (subcommand === 'connect') {
-    let projectName = '';
-    let installationId: string | undefined;
-    let repo: string | undefined;
-    let branch: string | undefined;
-    let executor: 'container' | 'github_actions' | undefined;
-    let workflowPath: string | undefined;
-
-    for (let i = 0; i < rest.length; i++) {
-      const arg = rest[i];
-      if (arg === '--installation') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --installation requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --installation requires a value.');
-        }
-        installationId = value;
-      } else if (arg === '--repo') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --repo requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --repo requires a value.');
-        }
-        repo = value;
-      } else if (arg === '--branch') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --branch requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --branch requires a value.');
-        }
-        branch = value;
-      } else if (arg === '--project') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --project requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --project requires a value.');
-        }
-        if (projectName) {
-          throw new Error(`github: Unexpected argument '${value}'.`);
-        }
-        projectName = value;
-      } else if (arg === '--executor') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --executor requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --executor requires a value.');
-        }
-        if (value !== 'container' && value !== 'github_actions') {
-          throw new Error('github: invalid --executor (expected container|github_actions).');
-        }
-        executor = value;
-      } else if (arg === '--workflow') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --workflow requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --workflow requires a value.');
-        }
-        workflowPath = value.trim();
-      } else if (arg.startsWith('-')) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else if (projectName) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else {
-        projectName = arg;
-      }
-    }
-
-    return { subcommand, projectName, installationId, repo, branch, executor, workflowPath };
+    const parsed: Extract<GithubArgs, { subcommand: 'connect' }> = { subcommand, projectName: '' };
+    parsed.projectName = parseProjectArgs(rest, {
+      '--installation': (value) => {
+        parsed.installationId = value;
+      },
+      '--repo': (value) => {
+        parsed.repo = value;
+      },
+      '--branch': (value) => {
+        parsed.branch = value;
+      },
+      '--executor': (value) => {
+        parsed.executor = parseExecutor(value);
+      },
+      '--workflow': (value) => {
+        parsed.workflowPath = value.trim();
+      },
+    });
+    return parsed;
   }
 
   if (subcommand === 'update') {
-    let projectName = '';
-    let branch: string | undefined;
-    let executor: 'container' | 'github_actions' | undefined;
-    let workflowPath: string | undefined;
-
-    for (let i = 0; i < rest.length; i++) {
-      const arg = rest[i];
-      if (arg === '--branch') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --branch requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --branch requires a value.');
-        }
-        // Store the trimmed branch so the no-op check and the PATCH both use the
-        // canonical name — a padded value like 'main ' would never match
-        // refs/heads/main at OIDC exchange time and would cancel in-flight builds
-        // for the old branch.
-        branch = value.trim();
-      } else if (arg === '--project') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --project requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --project requires a value.');
-        }
-        if (projectName) {
-          throw new Error(`github: Unexpected argument '${value}'.`);
-        }
-        projectName = value;
-      } else if (arg === '--executor') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --executor requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --executor requires a value.');
-        }
-        if (value !== 'container' && value !== 'github_actions') {
-          throw new Error('github: invalid --executor (expected container|github_actions).');
-        }
-        executor = value;
-      } else if (arg === '--workflow') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --workflow requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --workflow requires a value.');
-        }
-        workflowPath = value.trim();
-      } else if (arg.startsWith('-')) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else if (projectName) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else {
-        projectName = arg;
-      }
-    }
-
-    return { subcommand, projectName, branch, executor, workflowPath };
+    const parsed: Extract<GithubArgs, { subcommand: 'update' }> = { subcommand, projectName: '' };
+    parsed.projectName = parseProjectArgs(rest, {
+      // Trimmed so the no-op check and the PATCH both use the canonical branch name.
+      '--branch': (value) => {
+        parsed.branch = value.trim();
+      },
+      '--executor': (value) => {
+        parsed.executor = parseExecutor(value);
+      },
+      '--workflow': (value) => {
+        parsed.workflowPath = value.trim();
+      },
+    });
+    return parsed;
   }
 
   if (subcommand === 'status') {
-    let projectName = '';
-
-    for (let i = 0; i < rest.length; i++) {
-      const arg = rest[i];
-      if (arg === '--project') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --project requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --project requires a value.');
-        }
-        if (projectName) {
-          throw new Error(`github: Unexpected argument '${value}'.`);
-        }
-        projectName = value;
-      } else if (arg.startsWith('-')) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else if (projectName) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else {
-        projectName = arg;
-      }
-    }
-
-    return { subcommand, projectName };
+    return { subcommand, projectName: parseProjectArgs(rest, {}) };
   }
 
   if (subcommand === 'disconnect') {
-    let projectName = '';
     let yes = false;
-
-    for (let i = 0; i < rest.length; i++) {
-      const arg = rest[i];
-      if (arg === '--yes' || arg === '-y') {
-        yes = true;
-      } else if (arg === '--project') {
-        if (i + 1 >= rest.length) {
-          throw new Error('github: --project requires a value.');
-        }
-        const value = rest[++i]!;
-        if (value.trim() === '') {
-          throw new Error('github: --project requires a value.');
-        }
-        if (projectName) {
-          throw new Error(`github: Unexpected argument '${value}'.`);
-        }
-        projectName = value;
-      } else if (arg.startsWith('-')) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else if (projectName) {
-        throw new Error(`github: Unexpected argument '${arg}'.`);
-      } else {
-        projectName = arg;
-      }
-    }
-
+    const confirm = () => {
+      yes = true;
+    };
+    const projectName = parseProjectArgs(rest, {}, { '--yes': confirm, '-y': confirm });
     return { subcommand, projectName, yes };
   }
 
diff --git a/packages/void/src/cli/github-cmd.ts b/packages/void/src/cli/github-cmd.ts
index e407670a7..c397a448a 100644
--- a/packages/void/src/cli/github-cmd.ts
+++ b/packages/void/src/cli/github-cmd.ts
@@ -21,10 +21,6 @@ import { platformErrorMessage } from './platform-errors.ts';
 import { readProjectConfig } from './project.ts';
 import { getRequestedProjectSlug, resolveProjectBySlug } from './resolve-project.ts';
 
-// ---------------------------------------------------------------------------
-// Pure helpers (exported for unit tests)
-// ---------------------------------------------------------------------------
-
 /**
  * The workflow file `void init --github` scaffolds and the platform default for
  * a connection's OIDC deploy pin. Kept in sync with the server default
@@ -70,11 +66,8 @@ export function describeConnectError(status: number, errorCode: string | undefin
 }
 
 /**
- * Like {@link describeConnectError}, but for `void github update`. The update
- * flow starts from an EXISTING connection, so a 404 "connection not found"
- * (the project has no GitHub connection, or it was disconnected between the
- * read and the write) is the common case and gets a "connect first" message.
- * Everything else defers to the shared connect mapping.
+ * Like {@link describeConnectError}, but maps a 404 "connection not found" to a
+ * "connect first" message.
  */
 export function describeUpdateError(status: number, errorCode: string | undefined): string | null {
   const code = errorCode ?? '';
@@ -144,10 +137,8 @@ export function formatInstallations(installations: Array<GithubInstallation>): s
 }
 
 /**
- * Render a GitHub connection as an aligned key/value block for `void github
- * status`. The workflow file is the OIDC deploy pin — it is only read for
- * github_actions builds (container builds never use it), so it is annotated as
- * unused when the executor is container to avoid implying it is active.
+ * Render a GitHub connection for `void github status`. Container builds never
+ * read the workflow file, so it is marked unused for them.
  */
 export function formatConnection(connection: GithubConnection): string {
   const row = (label: string, value: string): string => `  ${label.padEnd(16)}${value}`;
@@ -164,10 +155,6 @@ export function formatConnection(connection: GithubConnection): string {
   return rows.join('\n');
 }
 
-// ---------------------------------------------------------------------------
-// Main command
-// ---------------------------------------------------------------------------
-
 export async function runGithubCommand(root: string, args: GithubArgs): Promise<void> {
   const token = getToken(root);
   if (!token) {
@@ -196,20 +183,10 @@ export async function runGithubCommand(root: string, args: GithubArgs): Promise<
   }
 }
 
-// ---------------------------------------------------------------------------
-// install
-// ---------------------------------------------------------------------------
-
 /**
- * `void github install` — print the GitHub App install URL and open it.
- *
- * If the account has no linked GitHub identity, the server returns a 403 with
- * the stable code `github_identity_required`. Rather than telling the
- * user to `void account login` (which risks forking into a second account), we run
- * the link flow inline and retry the install URL exactly once.
- *
- * `linkIdentity` is injectable so tests can supply a fake linker instead of
- * starting a real localhost callback server / browser.
+ * `void github install`. Without a linked GitHub identity the server returns a
+ * 403 `github_identity_required`; link inline and retry once rather than send the
+ * user to `void account login`, which risks creating a second account.
  */
 export async function runInstall(
   client: PlatformClient,
@@ -250,22 +227,13 @@ export async function runInstall(
   }
 
   log.message(`Open this URL to install the Void GitHub App:\n${pc.blue(url)}`);
-  const { execFile } = await import('node:child_process');
-  openBrowser(url, execFile);
+  openBrowser(url);
   log.message('After installing, run `void github connect` to link a repository to your project.');
 }
 
-// ---------------------------------------------------------------------------
-// link
-// ---------------------------------------------------------------------------
-
 /**
- * Link the current Void account (the logged-in CLI token holder) to a GitHub
- * identity. Drives the platform's 3-endpoint link flow with a localhost +
- * PKCE handshake, mirroring `void account login`.
- *
- * The success path is non-exiting so a caller (`github install` after a 403
- * for a GitHub-less account) can continue; only error paths exit/throw.
+ * Link the logged-in Void account to a GitHub identity. Returns on success so
+ * `github install` can continue after linking.
  */
 export async function runGithubLink(client: PlatformClient): Promise<void> {
   const verifier = createCodeVerifier();
@@ -317,17 +285,9 @@ export async function runGithubLink(client: PlatformClient): Promise<void> {
   }
 }
 
-// ---------------------------------------------------------------------------
-// join
-// ---------------------------------------------------------------------------
-
 /**
- * Browser round-trip (localhost + PKCE) that joins the caller to their
- * organization's shared GitHub App installations. Returns the number of
- * installations joined. Throws PlatformApiError — including the 503
- * `github_oauth_not_configured` — so callers own the user-facing handling
- * (`runGithubJoin` prints and exits; the connect auto-join fallback falls
- * through to its install-first error).
+ * Join the caller to their organization's shared GitHub App installations and
+ * return how many were joined. Errors are left to the caller.
  */
 export async function performGithubJoin(client: PlatformClient): Promise<number> {
   const verifier = createCodeVerifier();
@@ -386,10 +346,6 @@ export async function runGithubJoin(client: PlatformClient): Promise<void> {
   }
 }
 
-// ---------------------------------------------------------------------------
-// installations
-// ---------------------------------------------------------------------------
-
 async function runInstallations(client: PlatformClient): Promise<void> {
   const installations = await client.listGithubInstallations();
   if (installations.length === 0) {
@@ -399,25 +355,9 @@ async function runInstallations(client: PlatformClient): Promise<void> {
   log.message(formatInstallations(installations));
 }
 
-// ---------------------------------------------------------------------------
-// connect
-// ---------------------------------------------------------------------------
-
 /**
- * Per-repo connect authorization round-trip for a non-owner org member.
- *
- * When the connect route returns 403 `connect_authorization_required`,
- * the member has no proof they can access the specific repo under the shared
- * installation. This drives the same localhost + PKCE handshake as
- * {@link runGithubLink}/{@link runGithubJoin}, but against the platform's
- * connect-authorize route: the callback mints and returns the grant IN
- * the redirect URL (`?connect_grant=…`), so there is no separate `/complete`
- * POST — `finalize` just reads the grant out of the callback query. A
- * `?error=repo_not_accessible` callback is mapped to a friendly per-repo message
- * by `describeError`, which rejects out of the handshake (no grant, no retry).
- *
- * Returns the grant plus the PKCE verifier the caller must echo to the connect
- * route so the platform can bind the grant to this exchange.
+ * Per-repo authorization for an org member who cannot yet prove repo access.
+ * The grant arrives in the callback URL; the caller sends it with the verifier.
  */
 async function runGithubConnectAuthorize(
   client: PlatformClient,
@@ -540,14 +480,8 @@ export async function runConnect(
 ): Promise<void> {
   const isTTY = process.stdin.isTTY === true;
 
-  // -------------------------------------------------------------------------
-  // 1. Resolve project
-  // -------------------------------------------------------------------------
   const projectId = await resolveGithubProjectId(root, client, args.projectName, 'connect', isTTY);
 
-  // -------------------------------------------------------------------------
-  // 2. Resolve installation
-  // -------------------------------------------------------------------------
   const listActiveInstallations = async () =>
     (await client.listGithubInstallations()).filter((i) => i.status === 'active');
 
@@ -632,9 +566,6 @@ export async function runConnect(
     installation = installations.find((i) => i.installation_id === picked)!;
   }
 
-  // -------------------------------------------------------------------------
-  // 3. Resolve repo full name
-  // -------------------------------------------------------------------------
   let repoFullName: string;
 
   if (args.repo) {
@@ -682,9 +613,6 @@ export async function runConnect(
     repoFullName = await promptRepoFullName(root);
   }
 
-  // -------------------------------------------------------------------------
-  // 4. Resolve branch
-  // -------------------------------------------------------------------------
   const branchDefault = args.branch ?? collectGitDeployMetadata(root, null).gitRef ?? 'main';
 
   let branch: string;
@@ -706,10 +634,6 @@ export async function runConnect(
     branch = (input as string).trim() || branchDefault;
   }
 
-  // -------------------------------------------------------------------------
-  // 5. Executor (build backend). Non-interactive defaults to `container`;
-  //    TTY prompts so a first-time connect is explicit.
-  // -------------------------------------------------------------------------
   let executor: 'container' | 'github_actions';
   if (args.executor !== undefined) {
     executor = args.executor;
@@ -731,15 +655,8 @@ export async function runConnect(
     executor = picked as 'container' | 'github_actions';
   }
 
-  // -------------------------------------------------------------------------
-  // 6. Workflow file (github_actions only — this is the per-connection OIDC
-  //    deploy pin; container builds never read it). Flag wins; otherwise TTY
-  //    prompts, defaulting to the scaffolded workflow.
-  //
-  //    Only carry a prompted value forward when it DIFFERS from the default, so
-  //    accepting the default leaves `workflowPath` undefined → the field is not
-  //    sent → the server applies its own (identical) default.
-  // -------------------------------------------------------------------------
+  // Container builds never read the workflow file. A prompted value equal to the
+  // default stays unset, so the server applies its own default.
   let workflowPath = args.workflowPath;
   if (executor === 'github_actions' && args.workflowPath === undefined && isTTY) {
     const input = await text({
@@ -764,9 +681,6 @@ export async function runConnect(
     }
   }
 
-  // -------------------------------------------------------------------------
-  // 7. Connect
-  // -------------------------------------------------------------------------
   const attemptConnect = (extra?: { connectGrant: string; codeVerifier: string }) =>
     client.connectGithub(projectId, {
       installationId: installation.installation_id,
@@ -785,18 +699,14 @@ export async function runConnect(
     }
     if (err.status === 403 && err.code === 'connect_authorization_required') {
       if (!isTTY) {
-        // The authorize round-trip opens a browser and blocks on a localhost callback
-        // (auth.ts, up to a 5-min timeout). A non-interactive shell (CI) has no browser,
-        // so fail closed immediately with an actionable message instead of hanging until
-        // the callback times out — same posture as the --branch / --repo guards above.
+        // Authorization waits for a browser callback, so fail now instead of
+        // hanging until it times out.
         log.error(
           'connect: this installation requires per-repo authorization, which needs an interactive browser sign-in. Run `void github connect` locally to authorize, then retry.',
         );
         process.exit(1);
       }
-      // Organization participant: prove per-repo access via an authorize round-trip,
-      // then retry the connect EXACTLY ONCE with the resulting grant. This MUST
-      // come before the generic error display so users can authorize the repository.
+      // Prove per-repo access, then retry the connect once with the grant.
       const grant = await runGithubConnectAuthorize(
         client,
         installation.installation_id,
@@ -813,9 +723,8 @@ export async function runConnect(
           retryErr.status === 403 &&
           retryErr.code === 'invalid connect grant'
         ) {
-          // A fresh grant should be accepted; this code means it was rejected
-          // (expired, or the browser identity differs from the linked one). Do
-          // NOT fall through to the generic 403 "no project access" message.
+          // The grant expired or the browser identity differs from the linked
+          // one; the generic 403 message would wrongly blame project access.
           log.error(
             'connect: GitHub authorization failed or expired. Run `void github connect` again.',
           );
@@ -836,10 +745,6 @@ export async function runConnect(
   printSuccess(`Connected ${repoFullName} (${branch}) → project. Push to ${branch} to deploy.`);
 }
 
-// ---------------------------------------------------------------------------
-// update
-// ---------------------------------------------------------------------------
-
 export async function runGithubUpdate(
   root: string,
   client: PlatformClient,
@@ -847,10 +752,7 @@ export async function runGithubUpdate(
 ): Promise<void> {
   const isTTY = process.stdin.isTTY === true;
 
-  // Non-TTY needs at least one flag to act on — there is nothing to prompt for.
-  // Guard BEFORE any project resolution or connection read so this usage error
-  // never depends on API state (e.g. a disconnected project must not surface the
-  // "connect first" 404 message in place of the missing-flags error).
+  // Check before any API call so this usage error never depends on API state.
   if (
     !isTTY &&
     args.branch === undefined &&
@@ -863,16 +765,8 @@ export async function runGithubUpdate(
     process.exit(1);
   }
 
-  // -------------------------------------------------------------------------
-  // 1. Resolve project
-  // -------------------------------------------------------------------------
   const projectId = await resolveGithubProjectId(root, client, args.projectName, 'update', isTTY);
 
-  // -------------------------------------------------------------------------
-  // 2. Fetch the current connection. A missing connection (404) means the
-  //    project was never connected — mirror the API's 404 semantics and point
-  //    the user at `connect` instead of a raw error.
-  // -------------------------------------------------------------------------
   let current: GithubConnection;
   try {
     current = await client.getGithubConnection(projectId);
@@ -887,14 +781,8 @@ export async function runGithubUpdate(
     throw err;
   }
 
-  // -------------------------------------------------------------------------
-  // 3. Resolve the new branch + executor. TTY defaults to the current value;
-  //    non-TTY requires at least one flag (nothing to prompt for).
-  // -------------------------------------------------------------------------
   let branch: string;
   let executor: 'container' | 'github_actions';
-  // Effective workflow path — the flag wins; a github_actions TTY prompt (below)
-  // can override it; otherwise it stays the current value (no change).
   let workflowPath = args.workflowPath ?? current.workflow_path;
 
   if (isTTY) {
@@ -931,9 +819,7 @@ export async function runGithubUpdate(
       executor = picked as 'container' | 'github_actions';
     }
 
-    // Prompt for the deploy workflow file when the resulting executor is
-    // github_actions and --workflow was not passed. Defaults to the current
-    // path; container builds never read workflow_path so there is nothing to ask.
+    // Container builds never read the workflow file, so there is nothing to ask.
     if (executor === 'github_actions' && args.workflowPath === undefined) {
       const input = await text({
         message: 'Deploy workflow file:',
@@ -954,15 +840,10 @@ export async function runGithubUpdate(
       workflowPath = (input as string).trim() || current.workflow_path;
     }
   } else {
-    // The missing-flags guard at the top of this function already guaranteed at
-    // least one of --branch / --executor / --workflow is present in non-TTY mode.
     branch = args.branch ?? current.branch;
     executor = args.executor ?? current.build_executor;
   }
 
-  // -------------------------------------------------------------------------
-  // 4. Build a patch carrying ONLY the fields that actually changed.
-  // -------------------------------------------------------------------------
   const patch: {
     branch?: string;
     buildExecutor?: 'container' | 'github_actions';
@@ -974,16 +855,10 @@ export async function runGithubUpdate(
   if (executor !== current.build_executor) {
     patch.buildExecutor = executor;
   }
-  // Change workflow_path only when the effective value (from --workflow or the
-  // github_actions prompt above) differs from the stored value. Accepting the
-  // current value at the prompt leaves it unchanged, so nothing is sent.
   if (workflowPath !== current.workflow_path) {
     patch.workflowPath = workflowPath;
   }
 
-  // -------------------------------------------------------------------------
-  // 5. No-op guard — never hit the API when nothing changed.
-  // -------------------------------------------------------------------------
   if (
     patch.branch === undefined &&
     patch.buildExecutor === undefined &&
@@ -995,9 +870,6 @@ export async function runGithubUpdate(
     return;
   }
 
-  // -------------------------------------------------------------------------
-  // 6. Update.
-  // -------------------------------------------------------------------------
   let updated: GithubConnection;
   try {
     updated = await client.updateGithubConnection(projectId, patch);
@@ -1008,7 +880,6 @@ export async function runGithubUpdate(
         log.error(`update: ${message}`);
         process.exit(1);
       }
-      throw err;
     }
     throw err;
   }
@@ -1018,16 +889,7 @@ export async function runGithubUpdate(
   );
 }
 
-// ---------------------------------------------------------------------------
-// status
-// ---------------------------------------------------------------------------
-
-/**
- * `void github status [project]` — print the current GitHub connection (repo,
- * branch, build executor, deploy workflow). Read-only; never mutates. Project
- * resolution mirrors connect/update; a 404 means the project was never
- * connected and points the user at `connect`.
- */
+/** `void github status [project]`: print the project's GitHub connection. */
 export async function runStatus(
   root: string,
   client: PlatformClient,
@@ -1035,16 +897,8 @@ export async function runStatus(
 ): Promise<void> {
   const isTTY = process.stdin.isTTY === true;
 
-  // -------------------------------------------------------------------------
-  // 1. Resolve project
-  // -------------------------------------------------------------------------
   const projectId = await resolveGithubProjectId(root, client, args.projectName, 'status', isTTY);
 
-  // -------------------------------------------------------------------------
-  // 2. Fetch and display the connection. A missing connection (404) means the
-  //    project was never connected — reuse the update 404 mapping to point the
-  //    user at `connect` instead of a raw error.
-  // -------------------------------------------------------------------------
   let connection: GithubConnection;
   try {
     connection = await client.getGithubConnection(projectId);
@@ -1062,17 +916,9 @@ export async function runStatus(
   log.message(formatConnection(connection));
 }
 
-// ---------------------------------------------------------------------------
-// disconnect
-// ---------------------------------------------------------------------------
-
 /**
- * `void github disconnect [project]` — remove a project's GitHub connection so
- * pushes no longer auto-deploy. The server (DELETE /projects/:id/github)
- * terminalizes any in-flight builds (revoking their deploy tokens) before
- * dropping the connection row. Destructive, so a TTY run confirms first; --yes
- * skips the prompt and is REQUIRED in a non-interactive shell. A project with no
- * connection is already in the goal state — report it and exit 0.
+ * `void github disconnect [project]`. The server cancels in-flight builds before
+ * it removes the connection, so a TTY run confirms first.
  */
 export async function runGithubDisconnect(
   root: string,
@@ -1081,9 +927,6 @@ export async function runGithubDisconnect(
 ): Promise<void> {
   const isTTY = process.stdin.isTTY === true;
 
-  // -------------------------------------------------------------------------
-  // 1. Resolve project
-  // -------------------------------------------------------------------------
   const projectId = await resolveGithubProjectId(
     root,
     client,
@@ -1092,20 +935,13 @@ export async function runGithubDisconnect(
     isTTY,
   );
 
-  // -------------------------------------------------------------------------
-  // 2. Fetch the current connection. A 404 "connection not found" means the
-  //    project already has no connection — disconnect's goal state — so report
-  //    success and stop. Other errors (403 forbidden, 404 project not found)
-  //    map through the shared connect error strings and exit 1.
-  // -------------------------------------------------------------------------
   let connection: GithubConnection;
   try {
     connection = await client.getGithubConnection(projectId);
   } catch (err) {
     if (err instanceof PlatformApiError) {
-      const body = parsePlatformErrorBody(err.body);
-      const code = body?.error ?? body?.message ?? '';
-      if (err.status === 404 && code.includes('connection not found')) {
+      // No connection is already the goal state.
+      if (err.status === 404 && err.code?.includes('connection not found')) {
         log.info('This project is not connected to a GitHub repository. Nothing to disconnect.');
         return;
       }
@@ -1118,11 +954,6 @@ export async function runGithubDisconnect(
     throw err;
   }
 
-  // -------------------------------------------------------------------------
-  // 3. Confirm — this cancels in-flight builds and drops the connection. --yes
-  //    skips the prompt; a non-interactive shell has nothing to prompt, so it
-  //    must pass --yes (fail closed, same posture as connect/update).
-  // -------------------------------------------------------------------------
   if (!args.yes) {
     if (!isTTY) {
       log.error(
@@ -1144,9 +975,6 @@ export async function runGithubDisconnect(
     }
   }
 
-  // -------------------------------------------------------------------------
-  // 4. Disconnect.
-  // -------------------------------------------------------------------------
   try {
     await client.deleteGithubConnection(projectId);
   } catch (err) {
diff --git a/packages/void/src/cli/github-oidc.ts b/packages/void/src/cli/github-oidc.ts
index b4a105d1d..36c8b3af1 100644
--- a/packages/void/src/cli/github-oidc.ts
+++ b/packages/void/src/cli/github-oidc.ts
@@ -1,11 +1,5 @@
 /**
- * GitHub Actions OIDC → Void deploy-token exchange.
- *
- * When `void deploy` runs inside GitHub Actions with no explicit `VOID_TOKEN`,
- * the CLI mints a short-lived GitHub OIDC token (audience `void`) and exchanges
- * it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived, project-scoped
- * Void deploy token. Doing the exchange in-process lets the scaffolded workflow
- * collapse to a single `void deploy` step — no curl/jq token-exchange step.
+ * GitHub Actions OIDC → Void deploy-token exchange for `void deploy` without `VOID_TOKEN`.
  *
  * Server contract (platform `POST /auth/github-oidc` handler):
  *   request  { oidcToken: string, project: string }   (project = slug)
@@ -13,15 +7,10 @@
  */
 
 import { cfAccessHeaders } from '../shared/cf-access.ts';
-import { ensureCloudflaredToken } from './cf-access.ts';
+import { ensurePlatformAccessToken } from './cf-access.ts';
 
 const OIDC_AUDIENCE = 'void';
 
-/**
- * True when the process is running inside GitHub Actions with the OIDC token
- * request endpoint available — i.e. the workflow granted
- * `permissions: id-token: write`, so GitHub injected the request URL + token.
- */
 export function isGithubActionsOidcAvailable(env: NodeJS.ProcessEnv = process.env): boolean {
   return (
     env.GITHUB_ACTIONS === 'true' &&
@@ -32,19 +21,6 @@ export function isGithubActionsOidcAvailable(env: NodeJS.ProcessEnv = process.en
   );
 }
 
-/**
- * Mint a GitHub Actions OIDC token (audience `void`) and exchange it for a
- * short-lived, project-scoped Void deploy token.
- *
- * Two hops:
- *   1. GET  $ACTIONS_ID_TOKEN_REQUEST_URL&audience=void  (Bearer request token)
- *        → `.value` is the OIDC JWT.
- *   2. POST $apiUrl/auth/github-oidc  { oidcToken, project }
- *        → `.token` is the Void deploy token.
- *
- * Throws a clear, actionable error (including the HTTP status and server error
- * body when available) on any non-OK response or missing field.
- */
 export async function exchangeGithubOidcForDeployToken(
   apiUrl: string,
   project: string,
@@ -62,10 +38,7 @@ export async function exchangeGithubOidcForDeployToken(
   return exchangeOidcTokenAtApi(apiUrl, project, oidcToken);
 }
 
-/**
- * GET the GitHub Actions OIDC token for audience `void`. GitHub's request URL
- * already carries a query string, so `audience` is appended alongside it.
- */
+/** GitHub's request URL already has a query string, so `audience` is added to it. */
 async function requestGithubOidcToken(requestUrl: string, requestToken: string): Promise<string> {
   const url = new URL(requestUrl);
   url.searchParams.set('audience', OIDC_AUDIENCE);
@@ -108,16 +81,8 @@ async function exchangeOidcTokenAtApi(
   project: string,
   oidcToken: string,
 ): Promise<string> {
-  const base = apiUrl.endsWith('/') ? apiUrl.slice(0, -1) : apiUrl;
-  const url = `${base}/auth/github-oidc`;
-
-  // This POST hits the Void API (which may be the Access-gated staging host)
-  // before any PlatformClient exists, so it must carry CF Access credentials
-  // itself — exactly like every other CLI → Void-API call (PlatformClient
-  // ctor, exchangeLoginCode). `ensureCloudflaredToken` no-ops for prod/ungated
-  // hosts and when the service-token pair or CF_ACCESS_TOKEN is already set;
-  // `cfAccessHeaders` returns {} when no CF Access env is present (prod path).
-  ensureCloudflaredToken(apiUrl);
+  const url = `${apiUrl}/auth/github-oidc`;
+  ensurePlatformAccessToken(apiUrl);
 
   let res: Response;
   try {
@@ -153,11 +118,7 @@ async function exchangeOidcTokenAtApi(
   return token;
 }
 
-/**
- * Emit a GitHub Actions `::add-mask::` workflow command so `value` is redacted
- * from workflow logs. No-op when not running inside GitHub Actions. GitHub reads
- * workflow commands from stdout.
- */
+/** Redact `value` from GitHub Actions logs; GitHub reads workflow commands from stdout. */
 export function maskGithubActionsSecret(value: string, env: NodeJS.ProcessEnv = process.env): void {
   if (env.GITHUB_ACTIONS !== 'true' || !value) {
     return;
diff --git a/packages/void/src/cli/headers.ts b/packages/void/src/cli/headers.ts
index ab486993c..69c76801f 100644
--- a/packages/void/src/cli/headers.ts
+++ b/packages/void/src/cli/headers.ts
@@ -103,23 +103,14 @@ export function parseHeadersFile(dir: string): Array<HeaderRule> | undefined {
 }
 
 /**
- * Parse a `_redirects` file.
+ * Parse a `_redirects` file: `source destination [status]` per line (status
+ * defaults to 302, `#` starts a comment). Keeps 3xx redirects and 200 rewrites.
  *
- * Format: `source destination [status]` per line (status defaults to 302).
- * Lines starting with # are comments. Includes 3xx redirects and 200 rewrites.
- *
- * Force suffix (`!`) semantics:
- *   - On status 200: toggles `force: true` (Netlify-compat). The plain form
- *     fires only when the static asset would 404; the force form fires
- *     unconditionally, overriding any matching static asset.
- *   - On 3xx (301/302/307/308): silently stripped. A redirect always changes
- *     the URL, so `!` is redundant. We count these in `redundantForceOn3xx`
- *     so the deploy command can surface a single aggregated lint warning
- *     rather than one per line — Netlify users pasting their `_redirects`
- *     file shouldn't be punished for harmless cruft.
+ * A `!` suffix on 200 sets `force`, so the rewrite applies even when a static
+ * asset matches. On a 3xx it is a no-op, stripped and counted in
+ * `redundantForceOn3xx`.
  *
  * Returns `undefined` when the file doesn't exist or yields no valid rules.
- * Otherwise returns `{rules, redundantForceOn3xx}`.
  */
 export function parseRedirectsFile(dir: string): ParsedRedirects | undefined {
   const filePath = join(dir, '_redirects');
@@ -148,11 +139,7 @@ export function parseRedirectsFile(dir: string): ParsedRedirects | undefined {
 
     const [rawSource, destination, statusStr] = parts;
 
-    // Optional `https://host/path` prefix: split into `{ host, path }`. The
-    // resulting path replaces the source for the rest of the per-line
-    // validation; `host` (when set) flows onto the rule and is enforced at
-    // dispatch as a Host filter. Rules with malformed hosts are dropped with
-    // a warning so the rest of the file still deploys.
+    // An optional `https://host` prefix becomes a Host filter on the rule.
     const parsedSource = parseHostPrefixedSource(rawSource);
     if ('error' in parsedSource) {
       voidWarn(
@@ -162,11 +149,8 @@ export function parseRedirectsFile(dir: string): ParsedRedirects | undefined {
     }
     const { host, path: source } = parsedSource;
 
-    // The dispatch worker compiles each `*` into a `(?<splat>...)` capture
-    // group; two of them in one pattern yield a duplicate-group-name RegExp
-    // error at startup. Skip with a clear warning so other rules in the file
-    // still deploy, matching the "skip + warn" pattern used for invalid
-    // destinations below.
+    // Each `*` compiles to a `(?<splat>...)` group, and a RegExp cannot repeat
+    // a group name.
     if (countSplats(source) > 1) {
       voidWarn(
         `Skipping _redirects entry "${rawSource} ${destination}${statusStr ? ` ${statusStr}` : ''}" (line ${lineNumber}): source must contain at most one "*" wildcard (captured as :splat).`,
@@ -182,13 +166,8 @@ export function parseRedirectsFile(dir: string): ParsedRedirects | undefined {
         if (status === 200) {
           force = true;
         } else if (status >= 300 && status < 400) {
-          // `!` on a 3xx is a no-op — redirects always change the URL.
-          // Accept silently (stripping the suffix) and tally for the
-          // deploy-time aggregated lint so users can clean up if they want.
           redundantForceOn3xx++;
         }
-        // Non-200/non-3xx with `!` falls through to the status range check
-        // below, which skips non-200 non-3xx codes entirely.
       } else {
         status = parseInt(statusStr, 10);
       }
@@ -196,10 +175,8 @@ export function parseRedirectsFile(dir: string): ParsedRedirects | undefined {
       status = 302;
     }
 
-    // Include redirects (3xx) and rewrites (200). Status-200 entries are
-    // internal rewrites; proxy-style rules pointing at an external URL are
-    // not supported — skip them with a warning to match the "internal paths
-    // only" contract enforced for `routing.rewrites` in void.json.
+    // Status 200 is an internal rewrite. External (proxy) destinations are not
+    // supported, as with `routing.rewrites` in void.config.ts.
     if (status === 200) {
       if (!destination.startsWith('/')) {
         voidWarn(
@@ -239,11 +216,8 @@ export function parseRedirectsFile(dir: string): ParsedRedirects | undefined {
 }
 
 /**
- * Split parsed `_redirects` rules into "always-apply" and "asset-miss only"
- * buckets. Rules with `status: 200` and `force === false` are fallbacks — they
- * should only fire when the static asset resolver would 404. All other rules
- * (3xx redirects and forced `200!` rewrites) stay in the "always" bucket and
- * are merged with `routing.rewrites` / `routing.redirects` from void.json.
+ * Split `_redirects` rules into rules that always apply and fallbacks: unforced
+ * 200 rewrites, which apply only when no static asset matches.
  */
 export function splitRedirectRulesByForce(rules: Array<DevRedirectRule> | undefined): {
   always: Array<DevRedirectRule>;
@@ -265,33 +239,8 @@ export function splitRedirectRulesByForce(rules: Array<DevRedirectRule> | undefi
 }
 
 /**
- * Merge file-based rules (`_redirects`, `_headers`) in `dir` with routing
- * rules from `void.json`. Shared between the deploy pipeline and the dev
- * plugin so both surfaces produce identical rule tables.
- *
- * Ordering for routing rules (redirects/rewrites/fallbacks): `void.json`
- * rules first, then `_redirects` file rules. Because the router evaluates
- * routing rules with first-match-wins semantics, `void.json` entries
- * override `_redirects` entries for the same source — matching the
- * documented precedence (`docs/guide/edge/rewrites.md`). This holds even
- * though `_redirects` is conceptually "closer to the build output".
- *
- * Header rules use the inverse order — `_redirects`/`_headers` last —
- * because header rules are last-match-wins (`_headers` is Netlify-style
- * last-wins). The asymmetry is intentional and matches dispatch.
- *
- * Phase split:
- *   - `_redirects` `200!` (force) + 3xx entries → `redirectRules` (always-fire)
- *   - `_redirects` plain `200`           entries → `fallbackRules` (asset-miss)
- *   - `routing.redirects` + `routing.rewrites`    → `redirectRules`
- *   - `routing.fallbacks`                         → `fallbackRules`
- *
- * Returns `fallbackRules === undefined` when empty, meaning "no post-asset
- * phase".
- *
- * Duplicate linting is NOT called here (callers decide which warning surface
- * to use — CLI vs. Vite logger). `redundantForceOn3xx` is returned raw for
- * the same reason.
+ * Merge `_redirects` and `_headers` in `dir` with `routing` from void.config.ts.
+ * Deploy and dev share it so both build the same rule tables; callers lint them.
  */
 export function mergeRoutingRules(opts: {
   dir: string | null;
@@ -318,12 +267,10 @@ export function mergeRoutingRules(opts: {
   const cfgRewrites = convertRewritesConfig(routing?.rewrites);
   const cfgFallbacks = convertFallbacksConfig(routing?.fallbacks);
 
-  // Header rules: last-match-wins (mirrors `_headers` semantics). `void.json`
-  // entries are emitted last so they override `_headers` for the same pattern.
+  // Header rules are last-match-wins, so config rules go last to override `_headers`.
   const headerRules: Array<HeaderRule> = [...(fileHeaders ?? []), ...(cfgHeaders ?? [])];
-  // Routing rules: first-match-wins (mirrors `_redirects`/`vercel.json`
-  // semantics). `void.json` entries are emitted first so they override
-  // `_redirects` for the same source.
+  // Routing rules are first-match-wins, so config rules go first to override
+  // `_redirects`.
   const redirectRules: Array<DevRedirectRule> = [
     ...(cfgRedirects ?? []),
     ...(cfgRewrites ?? []),
@@ -341,20 +288,22 @@ export function mergeRoutingRules(opts: {
 }
 
 /**
- * Warn when a rule's `destination` contains a literal `*`. The platform's
- * `substituteParams` only replaces `:name` tokens (e.g. `:splat`, `:id`) —
- * bare `*` in destinations is a literal character, not a capture reference,
- * and will silently pass through to the rewritten/redirected URL.
- *
- * Users who write `/old/*` → `/new/*` almost always intended `:splat` to
- * reflect the captured portion of the source wildcard. Surface the mistake
- * with a single aggregated warning at the same surface as
- * `lintDuplicateSources` — per-phase, near the merge site — rather than
- * failing the deploy: a `*` in a destination is well-formed output, just
- * probably not what was meant.
- *
- * Only reported once per rule — the count of `*` in the destination is
- * irrelevant, a single occurrence is already suspicious.
+ * Lint each phase on its own: only duplicates within a phase shadow each other,
+ * so a redirect and a fallback with the same source are fine.
+ */
+export function lintRoutingPhases(rules: {
+  redirectRules: Array<DevRedirectRule>;
+  fallbackRules: Array<DevRedirectRule> | undefined;
+}): void {
+  lintDuplicateSources(rules.redirectRules, 'redirects/rewrites (pre-asset)');
+  lintDuplicateSources(rules.fallbackRules, 'fallbacks (post-asset)');
+  lintDestinationSplats(rules.redirectRules, 'redirects/rewrites (pre-asset)');
+  lintDestinationSplats(rules.fallbackRules, 'fallbacks (post-asset)');
+}
+
+/**
+ * Warn about a literal `*` in a destination. Destinations substitute only
+ * `:name` params such as `:splat`, so a `*` passes through unchanged.
  */
 export function lintDestinationSplats(
   rules: Array<DevRedirectRule> | undefined,
@@ -378,24 +327,8 @@ export function lintDestinationSplats(
 }
 
 /**
- * Warn when the same `source` pattern appears more than once within a single
- * merged phase (pre-asset `redirectRules` or post-asset `fallbackRules`).
- *
- * Sources are scoped to the phase: a pattern appearing once in redirects and
- * once in fallbacks is *not* a collision, because those lists run in separate
- * phases and don't shadow each other. Within a single phase the dispatcher
- * uses first-match-wins semantics, so a duplicate silently hides the later
- * entry. This lint never fails the deploy; it surfaces the collision so the
- * user can decide whether to fix it.
- *
- * Only exact string duplicates are reported. Subset-shadow cases (e.g. `/*`
- * overshadowing `/docs`) are out of scope — pattern-aware analysis would be
- * both harder and noisier.
- *
- * Emits a single aggregated warning summarizing every duplicated source, each
- * annotated with the `origin` of every occurrence (e.g. `_redirects:12` vs
- * `void.json#routing.rewrites`). Aggregation avoids a wall of per-pair
- * warnings on configs with many collisions.
+ * Warn when one phase repeats an exact `source`: first match wins, so the later
+ * rule never applies. Phases run separately, so callers lint each one.
  */
 export function lintDuplicateSources(
   rules: Array<DevRedirectRule> | undefined,
diff --git a/packages/void/src/cli/help.ts b/packages/void/src/cli/help.ts
index 74a70f747..833b778bb 100644
--- a/packages/void/src/cli/help.ts
+++ b/packages/void/src/cli/help.ts
@@ -1,7 +1,5 @@
-import { readFileSync } from 'node:fs';
 import { outro } from '@voidzero-dev/vite-plus-prompts';
-import { join } from 'pathslash';
-import { getPackageDir } from './agents.ts';
+import { getOwnVersion } from './agents.ts';
 import { asciiArts } from './ascii.ts';
 import { operatorCommands, operatorGroups } from './operator-args.ts';
 import { categoryTitle, helpLine, note, pc, sectionTitle } from './output.ts';
@@ -92,28 +90,9 @@ function operatorHelpTree(): HelpTree {
                     command: `--${flag} <value>`,
                     description,
                   })),
-                  ...(entry.booleans ?? []).map((flag) => ({
+                  ...Object.entries(entry.booleans ?? {}).map(([flag, description]) => ({
                     command: `--${flag}`,
-                    description:
-                      flag === 'follow'
-                        ? 'Poll new logs until interrupted or the build ends'
-                        : flag === 'ended'
-                          ? 'Attest that the original provider execution has ended'
-                          : flag === 'public-apps'
-                            ? 'Manage public app rules without identity policies'
-                            : flag === 'protect-new-projects'
-                              ? 'Protect newly created projects by default'
-                              : flag === 'check' && group === 'zero-trust'
-                                ? 'Also check the saved settings against Cloudflare Access (several API calls)'
-                                : flag === 'token-stdin' && group === 'zero-trust'
-                                  ? 'Read the Access management API token from stdin'
-                                  : flag === 'token-stdin' && group === 'email'
-                                    ? entry.action === 'domain-remove'
-                                      ? 'Read a replacement Cloudflare token for blocked project cleanup from stdin'
-                                      : 'Read a scoped Cloudflare API token from stdin'
-                                    : flag === 'all'
-                                      ? 'Rotate every project'
-                                      : 'Read a full API session from stdin for explicit operator session exchange',
+                    description,
                   })),
                 ],
               },
@@ -961,7 +940,7 @@ const HELP_TREE: HelpTree = {
           ),
         },
       },
-      // Mode B (design doc 0078): both read the local project + your wrangler session,
+      // Native Cloudflare email: both read the local project + your wrangler session,
       // never a Void project, so neither takes `--project`.
       status: {
         summary: 'Show the email setup state and address map. Exit 1 when not ready.',
@@ -1495,7 +1474,7 @@ export function printGlobalHelp(): void {
 }
 
 export function printVoidHeader(): void {
-  const version = JSON.parse(readFileSync(join(getPackageDir(), 'package.json'), 'utf-8')).version;
+  const version = getOwnVersion();
   const art = asciiArts[Math.floor(Math.random() * asciiArts.length)];
   console.log(pc.blue(`${art}  v${version}\n`));
 }
diff --git a/packages/void/src/cli/init.ts b/packages/void/src/cli/init.ts
index 9499bb395..3229a8a32 100644
--- a/packages/void/src/cli/init.ts
+++ b/packages/void/src/cli/init.ts
@@ -1,16 +1,8 @@
 import { spawnSync } from 'node:child_process';
-import {
-  readFileSync,
-  writeFileSync,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  rmdirSync,
-  unlinkSync,
-} from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
+import { isRecord } from '@void/deploy-core';
 import type { PlatformDiscoveryDocument } from '@void/platform';
 import { log, confirm, isCancel, cancel, select, text } from '@voidzero-dev/vite-plus-prompts';
 import { parse, type ParseError } from 'jsonc-parser';
@@ -20,10 +12,16 @@ import { createProjectTsconfig, ensureProjectTsconfig } from '../codegen/project
 import { TYPED_CONFIG_FILE } from '../config-loader.ts';
 import { canRewriteVoidProjectConfig, writeVoidProjectConfig } from '../config-write.ts';
 import { getDatabaseDialect, readConfig, type DatabaseDialect } from '../config.ts';
-import { writeDrizzleConfig } from '../drizzle/config.ts';
+import { PLACEHOLDER_DB_URL, writeDrizzleConfig } from '../drizzle/config.ts';
+import { snapshotDrizzleOutputs } from '../drizzle/generate.ts';
 import { detectFramework, type DetectedFramework } from '../plugin-inference.ts';
 import { readProjectPaths } from '../project-paths.ts';
-import { detectAgents, getPackageDir } from './agents.ts';
+import {
+  hasPackageDependency,
+  readPackageJson,
+  type PackageDependencyField,
+} from '../shared/package-json.ts';
+import { detectAgents, getOwnVersion, getPackageDir } from './agents.ts';
 import { connectCloudflare } from './cloudflare-connect.ts';
 import { maybeSetupDeployProject } from './deploy-setup.ts';
 import { maybeScaffoldEnvTs } from './env-scaffold.ts';
@@ -56,6 +54,7 @@ import { patchViteConfigWithVoidPlugin } from './vite-config-patch.ts';
 import { LATEST_KNOWN_COMPAT_DATE, writeProvisionedWranglerConfig } from './wrangler.ts';
 import {
   buildDrizzleKitSpawnEnv,
+  drizzleKitBin,
   findInstalledYarnPnpRuntime,
   hasLocalLockfile,
 } from './yarn-pnp.ts';
@@ -133,11 +132,9 @@ const EMPTY_PROJECT_ALLOWED_ENTRIES = new Set([
 ]);
 
 const PNPM_ALLOWED_BUILDS = ['esbuild', 'sharp', 'workerd'] as const;
-const drizzleKitBin = join(fileURLToPath(import.meta.resolve('drizzle-kit')), '..', 'bin.cjs');
 
-// Dependencies/scripts that can be left behind by a Void Pages starter after
-// the user deletes app files and runs `void init` again. These keep that retry
-// in the greenfield starter path instead of the existing-project patch path.
+// Packages a previous Void Pages starter can leave behind, so re-running init
+// after deleting the app files still takes the starter path.
 const EMPTY_PROJECT_ALLOWED_PACKAGES = new Set([
   'void',
   'hono',
@@ -161,10 +158,8 @@ const EMPTY_PROJECT_ALLOWED_PACKAGES = new Set([
   '@void/solid',
 ]);
 
-// A package with only `void` and/or an adapter can still be a preinstall shape
-// (`pnpm add -D void @void/svelte` before init). Once starter runtime/tooling
-// packages like `svelte` or `vite-plus` are present, require an adapter too so
-// we only accept manifests that look like a previous Void Pages starter.
+// Only `void` and adapters may be a preinstall (`pnpm add -D void @void/svelte`);
+// other starter packages such as `svelte` also require an adapter.
 const EMPTY_PROJECT_ALLOWED_ADAPTER_PACKAGES = new Set([
   '@void/react',
   '@void/vue',
@@ -179,9 +174,8 @@ const EMPTY_PROJECT_BASE_PACKAGES = new Set([
   '@void/solid',
 ]);
 
-// Known starter scripts are allowed for scaffold detection and are replaced
-// with the newly selected toolchain's commands during scaffoldPagesApp().
-// Custom scripts make the package an existing project instead.
+// scaffoldPagesApp() replaces these starter scripts; custom scripts make the
+// package an existing project.
 const EMPTY_PROJECT_ALLOWED_SCRIPTS: Record<string, Set<string> | undefined> = {
   test: undefined,
   dev: new Set(['vite', 'vp dev']),
@@ -225,10 +219,7 @@ type TsconfigInheritancePatch = {
 };
 
 function asRecord(value: unknown): JsonObject | null {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    return null;
-  }
-  return value as JsonObject;
+  return isRecord(value) ? value : null;
 }
 
 function parseJsoncFile(path: string): JsonObject | null {
@@ -621,7 +612,6 @@ async function resolveInitRoot(root: string): Promise<string> {
 type ProjectState = {
   hasTypescript: boolean;
   hasTsconfig: boolean;
-  hasGithubWorkflows: boolean;
   hasRoutes: boolean;
   hasMigrations: boolean;
   hasPages: boolean;
@@ -637,8 +627,7 @@ function parsePackageManagerField(pkg: unknown): ProjectState['packageManager']
   if (typeof raw !== 'string') {
     return undefined;
   }
-  // Corepack spec: "name@version[+sha.<hash>]". Take the portion before the
-  // first `@` and trim whitespace; reject anything that isn't a known PM name.
+  // Corepack spec: "name@version[+sha.<hash>]".
   const name = raw.split('@', 1)[0]?.trim();
   if (name === 'npm' || name === 'pnpm' || name === 'yarn' || name === 'bun') {
     return name;
@@ -647,30 +636,11 @@ function parsePackageManagerField(pkg: unknown): ProjectState['packageManager']
 }
 
 /**
- * Returns `true` when a project should be treated as pnpm-managed for
- * purposes of installing build-script allowlists and picking a
- * `workspace:` rewrite strategy. We honor BOTH local signals — a committed
- * `pnpm-lock.yaml`, a local `pnpm-workspace.yaml`, or a Corepack
- * `packageManager: pnpm` pin in `package.json` — AND the same signals on
- * any ancestor workspace root.
- *
- * Ancestor walking matters for pnpm workspace subpackages: pnpm writes the
- * lockfile at the workspace root, not per-package, and many subpackages
- * omit their own `packageManager` field in favor of the workspace root's.
- * A subpackage with a `workspace:*` dep in its `package.json` but no local
- * pnpm markers is still pnpm-managed if the enclosing workspace root has
- * `pnpm-workspace.yaml`, a `pnpm-lock.yaml`, or `packageManager: pnpm@...`.
- *
- * Local non-pnpm signals MUST outrank the ancestor walk. A bun
- * or yarn subproject nested under a pnpm workspace ancestor is still
- * bun/yarn — its local `bun.lockb` / `yarn.lock` / `package-lock.json` or
- * a local Corepack pin for bun/yarn/npm proves the ancestor's pnpm shape
- * does not govern this subpackage. `detectProjectState` would pick
- * bun/yarn for such a project and try to install with that manager, so
- * the pnpm check must not inherit ancestor workspace state too eagerly.
+ * Whether pnpm manages `root`. pnpm keeps the lockfile and Corepack pin at the
+ * workspace root, so a member without local markers inherits them, but a local
+ * lockfile or pin for another manager always wins.
  */
 function isPnpmProject(root: string, pkg: JsonObject): boolean {
-  // 1. Strong local pnpm signals — immediate true.
   if (existsSync(join(root, 'pnpm-lock.yaml'))) {
     return true;
   }
@@ -682,10 +652,6 @@ function isPnpmProject(root: string, pkg: JsonObject): boolean {
     return true;
   }
 
-  // 2. Strong local non-pnpm signals — refuse to walk ancestors. A local
-  //    lockfile or Corepack pin for a different manager means this
-  //    package is governed by that manager, even if an ancestor is a
-  //    pnpm workspace root.
   if (localPm === 'bun' || localPm === 'yarn' || localPm === 'npm') {
     return false;
   }
@@ -693,30 +659,12 @@ function isPnpmProject(root: string, pkg: JsonObject): boolean {
     return false;
   }
 
-  // 3. Pristine subpackage with no local package-manager markers at
-  //    all — only now is it safe to walk ancestors looking for a pnpm
-  //    workspace root.
   return hasAncestorPnpmMarkers(root);
 }
 
 /**
- * Returns `true` when `start` is a declared member of an ancestor pnpm
- * workspace. Used to detect pnpm workspace subpackages whose enclosing
- * workspace root is pnpm-managed even when the subpackage has no local
- * pnpm signals.
- *
- * An ancestor `pnpm-workspace.yaml` / `pnpm-lock.yaml` /
- * Corepack pnpm pin alone is NOT proof that `start` is governed by
- * that repo's pnpm install. A scratch app nested under a pnpm
- * monorepo is a separate project when its path doesn't match the
- * workspace globs; treating it as a member would make
- * `ensureVoidDependency` / `scaffoldPagesApp` disagree with the local
- * install, which uses the standalone fallback path.
- *
- * Delegate workspace membership to `findWorkspaceRoot` +
- * `isWorkspaceSubpackage` — the same check used by the
- * workspace-subpackage skip path in `runInitCommand` — so the two
- * paths can't disagree.
+ * Whether `start` is a declared member of a pnpm-managed ancestor workspace.
+ * A scratch app outside the workspace globs is a separate project.
  */
 function hasAncestorPnpmMarkers(start: string): boolean {
   const workspaceRoot = findWorkspaceRoot(start);
@@ -726,9 +674,6 @@ function hasAncestorPnpmMarkers(start: string): boolean {
   if (!isWorkspaceSubpackage(workspaceRoot, start)) {
     return false;
   }
-  // We're a declared member. Confirm the containing workspace is
-  // pnpm-shaped — a yarn/npm/bun workspace root with a matching glob
-  // should not push us onto the pnpm branch.
   if (existsSync(join(workspaceRoot, 'pnpm-workspace.yaml'))) {
     return true;
   }
@@ -743,37 +688,15 @@ function hasAncestorPnpmMarkers(start: string): boolean {
         return true;
       }
     } catch {
-      // unreadable workspace-root package.json — treat as "not pnpm"
+      // An unreadable root package.json is not a pnpm pin.
     }
   }
   return false;
 }
 
 /**
- * Walk up from `start` checking each ancestor directory for a
- * `node_modules/void/package.json`. Mirrors Node's module resolution
- * algorithm for the `void` package name — returns true as soon as any
- * ancestor has `void` installed, false only when the entire chain is
- * empty. Used by the demo install gate so workspace subpackages whose
- * `void` is hoisted at the workspace root are detected as already
- * installed and we don't trigger a spurious subpackage install.
- *
- * PnP rationale: in a Yarn Berry PnP workspace, dependencies resolve
- * via `.pnp.cjs` at the workspace root and there is no `node_modules`
- * tree — not in the subpackage, not in ancestors. By the time we call
- * this, `scaffoldDemo`/`ensureVoidDependency` has added `void` to the
- * subpackage's `package.json` (or verified it was already there), and
- * under PnP the workspace-root install is what wires up resolution.
- *
- * A committed-but-unfetched `.pnp.cjs` is NOT proof that
- * `yarn install` has run. Yarn Berry repos commonly commit `.pnp.cjs`
- * but gitignore `.yarn/cache/*.zip` (zero-install is opt-in), so a
- * fresh clone has the runtime file on disk while the archives it
- * points at are missing. The stricter `findInstalledYarnPnpRuntime`
- * also requires a post-install marker next to the runtime
- * (`.yarn/install-state.gz` or a populated `.yarn/cache`). Without it,
- * we fall through and return false so the caller triggers the install
- * step before attempting to spawn drizzle-kit.
+ * Whether `void` resolves from `start`, through an ancestor `node_modules`
+ * (hoisted workspace installs) or an installed Yarn PnP runtime.
  */
 export function isVoidResolvableFrom(start: string): boolean {
   let dir = start;
@@ -787,29 +710,9 @@ export function isVoidResolvableFrom(start: string): boolean {
     }
     dir = parent;
   }
-  // PnP supersedes node_modules resolution. If any ancestor has the
-  // PnP runtime files AND the post-install marker in the same
-  // directory, void MAY resolve through PnP at runtime.
-  //
-  // An installed PnP runtime still isn't proof that `void`
-  // is currently on the dependency graph. Branch switches and edits
-  // to package.json can leave stale PnP data where void has been
-  // removed; `.pnp.cjs` still exists but the current install target
-  // has no void entry. Spawn a tiny probe under the PnP loaders to
-  // verify resolution succeeds in the same env drizzle-kit will
-  // later run under.
-  //
-  // The probe must match the shape of the installed PnP
-  // runtime. When only `.pnp.loader.mjs` is present, `--require` is
-  // NOT injected by `buildDrizzleKitSpawnEnv` — only
-  // `--experimental-loader` is — and Node's CJS `require.resolve`
-  // does not consult the ESM loader chain, so a CJS probe returns
-  // `MODULE_NOT_FOUND` even when `void` IS resolvable via the loader.
-  // Branch the probe shape on `.pnp.cjs` presence: CJS probe when the
-  // CJS shim is loaded, ESM probe (`import.meta.resolve`) when only
-  // the loader is loaded. `import.meta.resolve` goes through the
-  // PnP loader's `resolve` hook and throws synchronously when the
-  // specifier cannot be resolved, which surfaces as a non-zero exit.
+  // PnP data can be stale (void removed on another branch), so probe under the
+  // loaders drizzle-kit will use. With only `.pnp.loader.mjs`, CJS
+  // `require.resolve` skips the ESM loader, so probe with `import.meta.resolve`.
   const installed = findInstalledYarnPnpRuntime(start);
   if (installed !== undefined) {
     const probeArgs = installed.pnpCjs
@@ -827,13 +730,8 @@ export function isVoidResolvableFrom(start: string): boolean {
 }
 
 /**
- * Walks ancestors from `start` looking for workspace-root markers: a
- * `pnpm-workspace.yaml` next to a `package.json`, or a `package.json`
- * whose top-level `workspaces` field exists (array or object). Returns
- * the discovered workspace root path if `start` is a subpackage inside
- * such a workspace, or `undefined` when it is not. Stops at the
- * filesystem root. Skips `start` itself — a root with its own
- * `workspaces` field is its own root, not a subpackage.
+ * Nearest ancestor of `start` (excluding `start`) with a `pnpm-workspace.yaml`
+ * or a `package.json#workspaces` field.
  */
 function findWorkspaceRoot(start: string): string | undefined {
   let dir = dirname(start);
@@ -846,7 +744,7 @@ function findWorkspaceRoot(start: string): string | undefined {
           return dir;
         }
       } catch {
-        // unreadable parent package.json — fall through and keep walking
+        // Keep walking past an unreadable package.json.
       }
     }
     if (existsSync(join(dir, 'pnpm-workspace.yaml'))) {
@@ -861,18 +759,8 @@ function findWorkspaceRoot(start: string): string | undefined {
 }
 
 /**
- * Read the declared workspace-member glob patterns from a workspace root.
- * Supports:
- *   - `pnpm-workspace.yaml` — extracts patterns under the top-level
- *     `packages:` key via a regex matcher (no `js-yaml` dep). Only the
- *     `packages:` key is used; pnpm-specific keys like `catalog:` are
- *     ignored.
- *   - `package.json#workspaces` — either an array of patterns or a
- *     `{ packages: [...] }` object form (npm/yarn/bun convention).
- *
- * Returns an empty array if no patterns are declared or parsing fails —
- * callers should treat that as "can't verify membership" and fall back
- * to the fresh-clone install path.
+ * Member globs from `pnpm-workspace.yaml#packages` or `package.json#workspaces`
+ * (an array or `{ packages }`). Empty when none can be read.
  */
 function readWorkspacePatterns(workspaceRoot: string): Array<string> {
   const pnpmWorkspacePath = join(workspaceRoot, 'pnpm-workspace.yaml');
@@ -905,16 +793,7 @@ function readWorkspacePatterns(workspaceRoot: string): Array<string> {
   return [];
 }
 
-/**
- * Strip a trailing YAML line comment from a raw line while preserving
- * `#` characters that live inside single- or double-quoted scalars.
- * YAML treats `#` as a comment marker only when it is preceded by
- * whitespace (or is the first column) AND it is not inside a quoted
- * scalar. Flow-style inline quoting is handled by a plain state machine
- * — no escape sequence support, because real-world workspace globs
- * never contain escaped quotes. A naive `/\s+#.*$/` strip would
- * truncate quoted values like `- "path #hash/*"`.
- */
+/** Strip a trailing YAML comment, keeping `#` inside quotes (`- "path #hash/*"`). */
 function stripYamlLineComment(line: string): string {
   let inSingle = false;
   let inDouble = false;
@@ -948,23 +827,8 @@ function stripYamlLineComment(line: string): string {
 }
 
 /**
- * Minimal YAML extractor for the `packages:` key of a
- * `pnpm-workspace.yaml`. Supports both the block-style form:
- *
- *   packages:
- *     - 'packages/*'
- *     - "apps/*"
- *     - docs
- *
- * and the flow-style (inline) form:
- *
- *   packages: ['packages/*', "apps/*"]
- *   packages: [packages/*]
- *
- * Anything else (other top-level keys, comments, nested blocks) is
- * ignored. This intentionally does NOT pull in `js-yaml` — the
- * surface area we need is tiny and the real YAML we see in practice
- * uses one of these two shapes.
+ * Read the `packages:` list of a `pnpm-workspace.yaml` in block (`- 'apps/*'`)
+ * or flow (`packages: ['apps/*']`) form.
  */
 export function extractPnpmWorkspacePackages(yaml: string): Array<string> {
   const lines = yaml.split(/\r?\n/);
@@ -973,11 +837,6 @@ export function extractPnpmWorkspacePackages(yaml: string): Array<string> {
   for (const rawLine of lines) {
     const line = stripYamlLineComment(rawLine);
 
-    // Flow-style: `packages: [<items>]` on a single line. Values may
-    // be quoted (`'...'` or `"..."`) or unquoted. Whitespace around
-    // brackets and commas is tolerated. Escaped quotes inside the
-    // flow value are not supported because no real-world workspace
-    // pattern uses them.
     const inlineMatch = line.match(/^\s*packages\s*:\s*\[(.*)\]\s*$/);
     if (inlineMatch) {
       const inner = inlineMatch[1];
@@ -988,7 +847,6 @@ export function extractPnpmWorkspacePackages(yaml: string): Array<string> {
           patterns.push(unquoted);
         }
       }
-      // Inline form is self-contained — end any in-progress block.
       inPackages = false;
       continue;
     }
@@ -1013,14 +871,7 @@ export function extractPnpmWorkspacePackages(yaml: string): Array<string> {
   return patterns;
 }
 
-/**
- * Expand brace groups in a workspace glob pattern. Supports the forms
- * that appear in real workspace manifests, like `{apps,packages}/*`
- * and nested forms like `{apps,packages}/{core,web}`. Returns an array
- * of expanded patterns with no braces. No-op for patterns that don't
- * contain `{...}`. Does not support escaped braces or nested braces
- * inside a group (neither appears in real workspace manifests).
- */
+/** Expand `{a,b}` brace groups, including several groups in one pattern. */
 function expandBraces(pattern: string): Array<string> {
   const match = pattern.match(/^([^{}]*)\{([^{}]*)\}(.*)$/);
   if (!match) {
@@ -1032,7 +883,6 @@ function expandBraces(pattern: string): Array<string> {
     .map((s) => s.trim())
     .filter((s) => s.length > 0);
   if (options.length === 0) {
-    // Empty group like `{}` — pass through unchanged.
     return [pattern];
   }
   const results: Array<string> = [];
@@ -1044,31 +894,13 @@ function expandBraces(pattern: string): Array<string> {
   return results;
 }
 
-/**
- * Match a path against a workspace glob pattern. Supports the forms
- * that appear in real workspace manifests:
- *   - Literal path: `packages/void`              → exact match.
- *   - Leading `./`: `./packages/*`               → stripped before matching.
- *   - Single-segment glob: `packages/*`          → one segment under prefix.
- *   - Partial-segment glob: `packages/*-app`     → regex within a segment.
- *   - Recursive glob: `packages/**`              → any depth under prefix.
- *   - Brace expansion: `{apps,packages}/*`       → expanded before matching.
- * Does not support character classes or extended globs — those don't
- * appear in any workspace manifest we've seen, and adding a full
- * minimatch pulls in a dep we don't need.
- */
+// Supports *, **, ./ and {a,b} braces; ?, [...] and extglobs are matched literally.
 function matchesWorkspacePattern(relPath: string, pattern: string): boolean {
-  // Brace expansion first: `{apps,packages}/*` becomes
-  // `['apps/*', 'packages/*']`, then ANY expansion matching the path
-  // counts. Real workspace manifests use this form frequently.
   const expansions = expandBraces(pattern);
   return expansions.some((p) => matchesSingleWorkspacePattern(relPath, p));
 }
 
 function matchesSingleWorkspacePattern(relPath: string, pattern: string): boolean {
-  // Normalize: strip leading `./`, then leading/trailing slashes, then
-  // split into segments. `./packages/*` is a common shape in real
-  // `pnpm-workspace.yaml` / `package.json#workspaces` files.
   const normalizedPattern = pattern.replace(/^\.\/+/, '');
   const pathSegs = relPath
     .replace(/^\/+|\/+$/g, '')
@@ -1094,11 +926,7 @@ function compilePatternSegment(seg: string): CompiledSegment {
   if (!seg.includes('*')) {
     return { kind: 'literal', value: seg };
   }
-  // Any segment with `*` characters (but not the whole-segment `**`
-  // globstar): convert to an anchored regex where each `*` matches any
-  // characters except `/`. Regex metacharacters in the literal parts
-  // are escaped first. Supports `packages/*`, `packages/*-app`,
-  // `packages/app-*`, and mixed forms like `*/foo-*`.
+  // Each `*` matches any characters except `/`.
   const re = new RegExp(
     '^' +
       seg
@@ -1119,9 +947,7 @@ function matchSegments(
   while (qi < pat.length) {
     const seg = pat[qi];
     if (seg.kind === 'globstar') {
-      // Recursive: consume zero or more path segments until the rest
-      // matches, or we run out. An empty pattern tail (`**` is the
-      // last segment) matches any remaining path including empty.
+      // A trailing `**` matches any remaining path, including none.
       if (qi === pat.length - 1) {
         return true;
       }
@@ -1139,43 +965,21 @@ function matchSegments(
       if (seg.value !== path[pi]) {
         return false;
       }
-    } else {
-      // Regex segment: match the single path segment against the
-      // compiled regex. Covers both `*` (which compiles to `[^/]*`)
-      // and partial globs like `*-app`.
-      if (!seg.re.test(path[pi])) {
-        return false;
-      }
+    } else if (!seg.re.test(path[pi])) {
+      return false;
     }
     pi++;
     qi++;
   }
-  // Pattern fully matched: path must also be fully consumed.
   return pi === path.length;
 }
 
 /**
- * Verify that `root` is actually a declared member of the workspace
- * rooted at `workspaceRoot`. An ancestor workspace root found by
- * `findWorkspaceRoot` is not enough — a standalone app nested under a
- * monorepo (e.g. `repo/scratch/my-app` inside a repo whose
- * `pnpm-workspace.yaml` only lists `packages/*`) is NOT a workspace
- * subpackage, and treating it as one leaves the demo scaffold in a
- * broken state: install is skipped, `generateStarterMigration` is
- * skipped, and the user ends up with unresolved `void` imports.
- *
- * Supports positive and negation (`!pattern`) patterns. A path is
- * considered a member if it matches at least one positive pattern and
- * no negation pattern.
- *
- * Returns `false` if no patterns are declared at all — callers treat
- * that as "not a subpackage" so the fresh-clone install path still runs.
+ * Whether `root` matches a workspace glob and no `!` glob. A nested app outside
+ * the globs is a separate project.
  */
 function isWorkspaceSubpackage(workspaceRoot: string, root: string): boolean {
   const relPath = relative(workspaceRoot, root);
-  // `root === workspaceRoot` means we're AT the workspace root, not
-  // inside it. `findWorkspaceRoot` already skips `start` itself so this
-  // shouldn't normally fire, but be defensive.
   if (relPath === '' || relPath.startsWith('..')) {
     return false;
   }
@@ -1198,15 +1002,7 @@ function isWorkspaceSubpackage(workspaceRoot: string, root: string): boolean {
   return matched;
 }
 
-/**
- * Returns true iff `root` is structurally a declared member of an
- * ancestor workspace — regardless of whether the subpackage manages its
- * own install via a local lockfile or Corepack pin. This is the signal
- * Step 8 (GitHub Actions) uses: `.github/workflows/*` files are only
- * read from the repository root, so dropping them under a subpackage
- * root is always wrong, whether or not the subpackage self-manages
- * install.
- */
+/** Workspace membership, even when the member manages its own install. */
 function isInsideWorkspaceSubpackage(root: string): boolean {
   const workspaceRoot = findWorkspaceRoot(root);
   if (workspaceRoot === undefined) {
@@ -1216,20 +1012,12 @@ function isInsideWorkspaceSubpackage(root: string): boolean {
 }
 
 /**
- * Returns the workspace root if `root` should defer its install +
- * starter migration to a parent workspace install — i.e. it is a
- * declared member of an ancestor workspace AND has no local lockfile or
- * non-pnpm Corepack pin claiming it manages its own install. Returns
- * undefined when `root` is either not a subpackage at all, or is a
- * leaf-managed project nested inside a workspace.
- *
- * This is the single source of truth used by both the starter and the
- * demo branches in `runInitCommand` so they can never disagree about
- * whether to skip install/migration.
+ * The workspace root that should install for `root`: set when `root` is a
+ * member without its own lockfile or non-pnpm Corepack pin, as in `isPnpmProject`.
  */
 function resolveWorkspaceDeferral(
   root: string,
-  pkg: JsonObject | undefined,
+  pkg: JsonObject | null,
 ): { workspaceRoot: string } | undefined {
   const workspaceRoot = findWorkspaceRoot(root);
   if (workspaceRoot === undefined) {
@@ -1241,10 +1029,6 @@ function resolveWorkspaceDeferral(
   if (hasLocalLockfile(root)) {
     return undefined;
   }
-  // A local Corepack pin for a non-pnpm manager is the same kind of
-  // self-management signal as a local lockfile — `isPnpmProject` already
-  // treats it as a refusal to walk ancestors. Mirror it here so the
-  // two helpers can never disagree.
   const localPm = parsePackageManagerField(pkg);
   if (localPm === 'bun' || localPm === 'yarn' || localPm === 'npm') {
     return undefined;
@@ -1275,23 +1059,10 @@ export function detectProjectState(root: string): ProjectState {
   } else if (existsSync(join(root, 'bun.lock')) || existsSync(join(root, 'bun.lockb'))) {
     packageManager = 'bun';
   } else if (existsSync(join(root, 'pnpm-workspace.yaml'))) {
-    // No lockfile yet, but `pnpm-workspace.yaml` at the project root is a
-    // strong local pnpm signal — it is the same marker `isPnpmProject()`
-    // treats as authoritative above. Fresh pnpm workspaces (no lockfile,
-    // no Corepack pin) still need `pnpm install`, not `npm install`: the
-    // rest of the demo / starter code paths already treat the repo as pnpm
-    // via `isPnpmProject`, and falling through to `npm install` here would
-    // either reject `workspace:` specs outright or leave a stray
-    // `package-lock.json` behind in a pnpm workspace.
+    // A fresh pnpm workspace has no lockfile yet; npm would reject its
+    // `workspace:` specs.
     packageManager = 'pnpm';
   } else {
-    // No lockfile and no pnpm-workspace.yaml — honor
-    // `package.json#packageManager` (Corepack field) for pnpm, yarn, and
-    // bun before defaulting to npm. Fresh pnpm workspaces with committed
-    // `packageManager` pins but no lockfile would get their `workspace:`
-    // specs rejected by npm, and fresh Yarn projects would get an
-    // `npm install` that creates the wrong lockfile and bypasses Yarn's
-    // linker/plugin settings.
     const field = parsePackageManagerField(pkg);
     if (field === 'pnpm' || field === 'yarn' || field === 'bun') {
       packageManager = field;
@@ -1304,7 +1075,6 @@ export function detectProjectState(root: string): ProjectState {
   return {
     hasTypescript,
     hasTsconfig: existsSync(join(root, 'tsconfig.json')),
-    hasGithubWorkflows: existsSync(join(root, '.github', 'workflows')),
     hasRoutes: existsSync(paths.routesDir),
     hasMigrations: existsSync(paths.migrationsDir) || existsSync(join(root, 'migrations')),
     hasPages: existsSync(paths.pagesDir),
@@ -1333,44 +1103,27 @@ function detectPagesFramework(root: string): ScaffoldFramework | undefined {
   });
 }
 
-function readPackageJson(root: string): JsonObject | undefined {
-  try {
-    const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-    return asRecord(pkg) ?? undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-const DEPENDENCY_FIELDS = [
+const DEPENDENCY_FIELDS: ReadonlyArray<PackageDependencyField> = [
   'dependencies',
   'devDependencies',
   'peerDependencies',
   'optionalDependencies',
-] as const;
-
-function getDeclaredDependencySpec(root: string, packageName: string): string | undefined {
-  const pkg = readPackageJson(root);
-  if (!pkg) {
-    return undefined;
-  }
-
-  for (const field of DEPENDENCY_FIELDS) {
-    const group = asRecord(pkg[field]);
-    if (typeof group?.[packageName] === 'string') {
-      return group[packageName] as string;
-    }
-  }
-
-  return undefined;
-}
+];
 
+/** The first declared spec for `packageName`, in `DEPENDENCY_FIELDS` order. */
 function resolveScaffoldDependencySpec(
   root: string,
   packageName: string,
   fallbackVersion: string,
 ): string {
-  return getDeclaredDependencySpec(root, packageName) || fallbackVersion;
+  const pkg = readPackageJson(root);
+  for (const field of DEPENDENCY_FIELDS) {
+    const spec = asRecord(pkg?.[field])?.[packageName];
+    if (typeof spec === 'string') {
+      return spec || fallbackVersion;
+    }
+  }
+  return fallbackVersion;
 }
 
 function defaultPackageName(root: string): string {
@@ -1927,17 +1680,9 @@ function getWorkflowSetupSteps(
 }
 
 /**
- * Scaffold the GitHub Actions workflow that deploys via GitHub OIDC — no
- * long-lived secret stored in the repo. `void deploy` itself detects GitHub
- * Actions, mints an OIDC token (audience `void`), exchanges it at
- * `POST $VOID_API_URL/auth/github-oidc` for a short-lived, project-scoped deploy
- * token, and uses it — so the workflow is a single `void deploy` step (no
- * curl/jq). `permissions: id-token: write` is still required: it is what lets
- * the job (and thus the CLI) mint the OIDC token.
- *
- * `slug` is the linked project slug when known (from `.void/project.json`);
- * otherwise a `${{ vars.VOID_PROJECT }}` placeholder is emitted with a comment
- * telling the user to set the repository variable.
+ * The deploy workflow. Void deploys exchange a GitHub OIDC token (`id-token: write`)
+ * at deploy time, so no long-lived token is stored. Without a `slug`, the workflow
+ * reads a `vars.VOID_PROJECT` repository variable.
  */
 export function getWorkflowYaml(
   root: string,
@@ -2080,15 +1825,8 @@ function setupGithubActions(
 }
 
 /**
- * Bake a resolved project slug into an already-written `void-deploy.yml`.
- *
- * Step 8 (GitHub Actions) runs BEFORE Step 9 (project link), so when a user
- * links a project during the same interactive init the workflow was written
- * with the `${{ vars.VOID_PROJECT }}` placeholder. Once the link resolves a
- * slug, rewrite the placeholder `env.VOID_PROJECT` block in place so the user
- * does not also have to set a repository variable. No-op (returns `false`)
- * when the workflow is missing or the placeholder is not present (e.g. the
- * slug was already known at scaffold time, or the user declined linking).
+ * Replace the `vars.VOID_PROJECT` placeholder in `void-deploy.yml` with a slug
+ * linked after the workflow was written. Returns false when there is none.
  */
 function patchWorkflowProjectSlug(root: string, slug: string): boolean {
   const workflowPath = join(root, '.github', 'workflows', 'void-deploy.yml');
@@ -2096,8 +1834,7 @@ function patchWorkflowProjectSlug(root: string, slug: string): boolean {
     return false;
   }
   const yaml = readFileSync(workflowPath, 'utf-8');
-  // The placeholder block emitted by `getWorkflowYaml` is three lines: two
-  // 2-space-indented comment lines followed by the placeholder value line.
+  // The placeholder block that `getWorkflowYaml` emits.
   const placeholderBlock =
     '  # Set a VOID_PROJECT repository variable to your project slug\n' +
     '  # (Settings → Secrets and variables → Actions → Variables).\n' +
@@ -2215,7 +1952,7 @@ function resolvePnpmConfigRoot(root: string, pkg: JsonObject): string {
   return root;
 }
 
-function ensurePnpmAllowBuilds(root: string, pkg: JsonObject): boolean {
+function ensurePnpmAllowBuilds(root: string, pkg: JsonObject): void {
   const configRoot = resolvePnpmConfigRoot(root, pkg);
   const workspacePath = join(configRoot, 'pnpm-workspace.yaml');
   const before = existsSync(workspacePath) ? readFileSync(workspacePath, 'utf-8') : '';
@@ -2231,9 +1968,7 @@ function ensurePnpmAllowBuilds(root: string, pkg: JsonObject): boolean {
         ? 'Updated pnpm-workspace.yaml with approved builds'
         : `Updated ${relative(root, workspacePath)} with approved builds`,
     );
-    return true;
   }
-  return false;
 }
 
 function installProjectDependencies(
@@ -2269,46 +2004,12 @@ export function generateStarterMigration(
   starterMode: Exclude<ScaffoldStarterMode, 'static'>,
 ): void {
   const dialect = starterMode;
-  const configPath = writeDrizzleConfig(
-    root,
-    dialect === 'postgresql'
-      ? 'postgresql://dummy'
-      : dialect === 'mysql'
-        ? 'mysql://dummy'
-        : ':memory:',
-    dialect,
-  );
+  const configPath = writeDrizzleConfig(root, PLACEHOLDER_DB_URL[dialect], dialect);
 
-  // Snapshot everything drizzle-kit might touch so a
-  // mid-write crash can't leave partial artifacts that wedge
-  // subsequent `void db` commands on the journal coherence check.
-  // Mirrors the rollback pattern in `gen.ts`'s
-  // `runMigration`, but extended for the "migrations dir
-  // doesn't exist yet" case that only the starter path hits.
-  const migrationsDir = readProjectPaths(root).migrationsDir;
-  const metaDir = join(migrationsDir, 'meta');
-  const journalPath = join(metaDir, '_journal.json');
-  const migrationsDirExistedBefore = existsSync(migrationsDir);
-  const metaDirExistedBefore = existsSync(metaDir);
-  const originalJournalBytes: Buffer | null = existsSync(journalPath)
-    ? readFileSync(journalPath)
-    : null;
-  const snapshotsBefore = metaDirExistedBefore
-    ? new Set(readdirSync(metaDir).filter((f) => f.endsWith('_snapshot.json')))
-    : new Set<string>();
-  const sqlFilesBefore = migrationsDirExistedBefore
-    ? new Set(readdirSync(migrationsDir).filter((f) => f.endsWith('.sql')))
-    : new Set<string>();
+  const rollBack = snapshotDrizzleOutputs(readProjectPaths(root).migrationsDir);
 
   log.step('Generating initial Drizzle migration');
-  // Under Yarn Berry PnP, the spawned `node drizzle-kit` child cannot
-  // resolve `void/schema-d1` from the user's `db/schema.ts` without
-  // the PnP loaders patched onto `fs` / `Module._resolveFilename`.
-  // `buildDrizzleKitSpawnEnv` detects ancestor `.pnp.cjs` /
-  // `.pnp.loader.mjs` and injects the right `NODE_OPTIONS` flags so
-  // the child behaves the same as if we had run `yarn node
-  // drizzle-kit generate`. Non-PnP projects get a plain clone of
-  // `process.env`.
+  // Adds the Yarn PnP loaders drizzle-kit needs to resolve `void/schema-d1`.
   const result = spawnSync(process.execPath, [drizzleKitBin, 'generate', '--config', configPath], {
     cwd: root,
     stdio: 'pipe',
@@ -2317,78 +2018,8 @@ export function generateStarterMigration(
     env: buildDrizzleKitSpawnEnv(root),
   });
 
-  const failed = Boolean(result.error) || result.status !== 0;
-  if (failed) {
-    // Best-effort byte-restore of the journal + unlink of any fresh
-    // files drizzle-kit may have planted before it crashed. Swallow
-    // cleanup errors — the original spawn failure is the actionable
-    // signal; a cleanup bug should not shadow it.
-    if (originalJournalBytes !== null) {
-      try {
-        writeFileSync(journalPath, originalJournalBytes);
-      } catch {
-        // Swallow: surfacing the original failure is more useful.
-      }
-    } else if (!metaDirExistedBefore && existsSync(metaDir)) {
-      // meta/ didn't exist before — nuke anything drizzle-kit planted
-      // inside it and remove the dir itself.
-      try {
-        for (const f of readdirSync(metaDir)) {
-          try {
-            unlinkSync(join(metaDir, f));
-          } catch {
-            // Swallow.
-          }
-        }
-        try {
-          rmdirSync(metaDir);
-        } catch {
-          // Swallow.
-        }
-      } catch {
-        // Swallow: a failed readdir is not a useful signal here.
-      }
-    }
-    if (metaDirExistedBefore && existsSync(metaDir)) {
-      for (const f of readdirSync(metaDir)) {
-        if (f.endsWith('_snapshot.json') && !snapshotsBefore.has(f)) {
-          try {
-            unlinkSync(join(metaDir, f));
-          } catch {
-            // Swallow.
-          }
-        }
-      }
-    }
-    if (!migrationsDirExistedBefore && existsSync(migrationsDir)) {
-      // migrations/ didn't exist before — nuke any fresh sql files.
-      // Intentionally do NOT rmdir the directory itself: a subsequent
-      // retry wants it to exist, and leaving an empty dir behind is
-      // harmless.
-      try {
-        for (const f of readdirSync(migrationsDir)) {
-          if (f.endsWith('.sql')) {
-            try {
-              unlinkSync(join(migrationsDir, f));
-            } catch {
-              // Swallow.
-            }
-          }
-        }
-      } catch {
-        // Swallow.
-      }
-    } else if (migrationsDirExistedBefore && existsSync(migrationsDir)) {
-      for (const f of readdirSync(migrationsDir)) {
-        if (f.endsWith('.sql') && !sqlFilesBefore.has(f)) {
-          try {
-            unlinkSync(join(migrationsDir, f));
-          } catch {
-            // Swallow.
-          }
-        }
-      }
-    }
+  if (result.error || result.status !== 0) {
+    rollBack();
   }
 
   if (result.error) {
@@ -2488,21 +2119,12 @@ function scaffoldPagesApp(
     ensureDependency('devDependencies', name, version);
   }
 
-  // The pnpm build approval setup must run for workspace
-  // subpackages too. `detectProjectState` only checks LOCAL markers and
-  // returns `'npm'` for a subpackage without its own lockfile / pin,
-  // but `isPnpmProject(root, pkg)` walks ancestors and verifies
-  // membership. Gate the allowlist on the ancestor-aware check
-  // so the workspace gets `allowBuilds` and its
-  // better-sqlite3 / esbuild / sharp / workerd postinstalls run on the next
-  // workspace-root `pnpm install`.
+  // `detectProjectState` reads only local markers; `isPnpmProject` also covers
+  // pnpm workspace members, which need the root `allowBuilds`.
   if (isPnpmProject(root, pkg)) {
     ensurePnpmAllowBuilds(root, pkg);
   }
-  // The Corepack pin is ONLY for the standalone pnpm case. In a
-  // workspace subpackage the pin lives on the workspace root's
-  // package.json; duplicating it per-package confuses Corepack and can
-  // conflict with the root pin on future upgrades.
+  // Workspace members keep their Corepack pin on the workspace root.
   if (
     packageManager === 'pnpm' &&
     resolveWorkspaceDeferral(root, pkg) === undefined &&
@@ -2542,22 +2164,11 @@ function scaffoldPagesApp(
   return dependencyAdded;
 }
 
-type ExistingProjectPackageSetupResult = {
-  dependencyAdded: boolean;
-  packageJsonMutated: boolean;
-};
-
-function hasDeclaredDependency(pkg: JsonObject, name: string): boolean {
-  return DEPENDENCY_FIELDS.some((field) => {
-    const group = asRecord(pkg[field]);
-    return typeof group?.[name] === 'string';
-  });
-}
-
+/** Returns whether a dependency was added. */
 function ensureExistingProjectPackage(
   root: string,
   options: { plainViteSetup?: boolean } = {},
-): ExistingProjectPackageSetupResult {
+): boolean {
   const packageJsonPath = join(root, 'package.json');
   const voidSpec = resolveScaffoldDependencySpec(root, 'void', getOwnVersion());
   const plainViteSetup = options.plainViteSetup ?? true;
@@ -2605,18 +2216,20 @@ function ensureExistingProjectPackage(
 
   const devDependencies = asRecord(pkg.devDependencies) ?? {};
   pkg.devDependencies = devDependencies;
-  if (!hasDeclaredDependency(pkg, 'void')) {
+  if (!hasPackageDependency(pkg, 'void', DEPENDENCY_FIELDS)) {
     devDependencies.void = voidSpec;
     changed = true;
     dependencyAdded = true;
   }
-  if (plainViteSetup && !hasDeclaredDependency(pkg, 'vite')) {
+  if (plainViteSetup && !hasPackageDependency(pkg, 'vite', DEPENDENCY_FIELDS)) {
     devDependencies.vite = SCAFFOLD_BASE_DEV_DEPENDENCIES.vite;
     changed = true;
     dependencyAdded = true;
   }
 
-  const pnpmConfigChanged = isPnpmProject(root, pkg) ? ensurePnpmAllowBuilds(root, pkg) : false;
+  if (isPnpmProject(root, pkg)) {
+    ensurePnpmAllowBuilds(root, pkg);
+  }
 
   if (changed) {
     writeFileSync(packageJsonPath, JSON.stringify(pkg, null, 2) + '\n');
@@ -2631,7 +2244,7 @@ function ensureExistingProjectPackage(
     );
   }
 
-  return { dependencyAdded, packageJsonMutated: changed || pnpmConfigChanged };
+  return dependencyAdded;
 }
 
 function getBasicVoidViteConfig(): string {
@@ -2720,39 +2333,24 @@ function ensureExistingProjectViteConfig(root: string, framework?: DetectedFrame
   log.step(`Added voidPlugin() to ${configPath}`);
 }
 
-function setupExistingProject(
-  root: string,
-  framework?: DetectedFramework,
-): {
-  dependencyAdded: boolean;
-  packageJsonMutated: boolean;
-} {
+/** Returns whether a dependency was added. */
+function setupExistingProject(root: string, framework?: DetectedFramework): boolean {
   log.info('Existing project detected. Configuring Void...');
-  const packageResult = ensureExistingProjectPackage(root, {
+  const dependencyAdded = ensureExistingProjectPackage(root, {
     plainViteSetup: framework?.class !== 'c',
   });
   ensureExistingProjectViteConfig(root, framework);
-  return packageResult;
+  return dependencyAdded;
 }
 
 /**
- * Scaffolds the minimal "SQL → types → handler → fetch" demo into an
- * existing project. The demo files import from `void/db` and
- * `void/schema-d1`, so `void` MUST be present in `package.json` before
- * the caller runs `installProjectDependencies` +
- * `generateStarterMigration`; otherwise `drizzle-kit generate` cannot
- * resolve the schema imports. This function ensures `void` is declared,
- * preserving whatever spec is already there or adding the current CLI
- * version used by greenfield scaffolds.
- * `scaffoldPagesApp` has the same contract via its template; we just
- * replicate the "ensure void dep" slice here for the demo path.
+ * Scaffolds the "SQL → types → handler → fetch" demo into an existing project.
+ * `setupExistingProject` has already declared `void` in `package.json`.
  */
-function scaffoldDemo(root: string): { packageJsonMutated: boolean } {
+function scaffoldDemo(root: string): void {
   const devCommand = getDevCommand(root);
   const paths = readProjectPaths(root);
 
-  const packageJsonMutated = ensureVoidDependency(root);
-
   mkdirSync(paths.dbDir, { recursive: true });
   writeFileSync(
     paths.schemaFile,
@@ -2810,108 +2408,6 @@ console.log(posts);
       'Try changing the migration or handler — types update automatically.',
     'Type Safety Demo',
   );
-
-  return { packageJsonMutated };
-}
-
-/**
- * Ensures `void` is declared in `package.json`, creating the file if it
- * does not exist. This is a narrow, scaffoldDemo-specific helper:
- * `scaffoldPagesApp` handles greenfield projects via
- * `createPagesStarterTemplate` (which knows about adapters,
- * devDependencies, scripts, etc.); `scaffoldDemo` only needs enough in
- * `package.json` for `drizzle-kit generate` to resolve `void/schema-d1`
- * via `node_modules/void` after install.
- */
-export function ensureVoidDependency(root: string): boolean {
-  const packageJsonPath = join(root, 'package.json');
-  const voidSpec = resolveScaffoldDependencySpec(root, 'void', getOwnVersion());
-
-  let pkg: JsonObject = {};
-  let existedBefore = false;
-  if (existsSync(packageJsonPath)) {
-    existedBefore = true;
-    try {
-      pkg = asRecord(JSON.parse(readFileSync(packageJsonPath, 'utf-8'))) ?? {};
-    } catch {
-      throw new Error('Could not parse package.json while scaffolding demo');
-    }
-  }
-
-  const fallbackName = defaultPackageName(root);
-  let changed = !existedBefore;
-  if (!pkg.name || typeof pkg.name !== 'string') {
-    pkg.name = fallbackName;
-    changed = true;
-  }
-  // Only stamp `private: true` when we're creating `package.json` from
-  // scratch. Flipping an existing project that intentionally omits
-  // `private` (e.g. an app or library meant to be published to a registry)
-  // to `private: true` silently changes its publish semantics; the demo
-  // scaffold only needs `void` in `devDependencies`, not a publishability
-  // flip.
-  if (!existedBefore && pkg.private === undefined) {
-    pkg.private = true;
-    changed = true;
-  }
-  // Only stamp `type: "module"` when we're creating `package.json` from
-  // scratch. Flipping an existing CommonJS project (where `type` is absent)
-  // to ESM is a breaking change for any sibling `.js` scripts, tests, or
-  // tooling that rely on `require`-based resolution; the demo scaffold only
-  // needs `void` in `devDependencies`, not a module-system rewrite.
-  if (!existedBefore && !pkg.type) {
-    pkg.type = 'module';
-    changed = true;
-  }
-
-  if (
-    !pkg.devDependencies ||
-    typeof pkg.devDependencies !== 'object' ||
-    Array.isArray(pkg.devDependencies)
-  ) {
-    pkg.devDependencies = {};
-  }
-  if (
-    !pkg.dependencies ||
-    typeof pkg.dependencies !== 'object' ||
-    Array.isArray(pkg.dependencies)
-  ) {
-    pkg.dependencies = {};
-  }
-  const devDependencies = asRecord(pkg.devDependencies) ?? {};
-  pkg.devDependencies = devDependencies;
-
-  // Only touch `void` if it's not already declared in any dependency
-  // group (deps, devDeps, peerDeps, optionalDeps).
-  if (!hasDeclaredDependency(pkg, 'void')) {
-    devDependencies.void = voidSpec;
-    changed = true;
-  }
-
-  // Mirror `scaffoldPagesApp`'s pnpm build approval config. pnpm requires
-  // build scripts to be approved through `allowBuilds`; without this, the freshly scaffolded
-  // demo breaks on first local DB / dev commands because
-  // `better-sqlite3`/`esbuild`/`sharp`/`workerd` never run their postinstall
-  // build steps. Honor both pnpm signals via `isPnpmProject` — a committed
-  // `pnpm-lock.yaml` OR a `package.json#packageManager: pnpm` Corepack pin,
-  // which `detectProjectState` and `runInitCommand` also treat as pnpm.
-  const pnpmConfigChanged = isPnpmProject(root, pkg) ? ensurePnpmAllowBuilds(root, pkg) : false;
-
-  if (changed) {
-    writeFileSync(packageJsonPath, JSON.stringify(pkg, null, 2) + '\n');
-    log.step(
-      existedBefore
-        ? 'Ensured void is in package.json devDependencies'
-        : 'Created package.json with void as a devDependency',
-    );
-  }
-
-  return changed || pnpmConfigChanged;
-}
-
-function getOwnVersion(): string {
-  const pkg = JSON.parse(readFileSync(join(getPackageDir(), 'package.json'), 'utf-8'));
-  return pkg.version;
 }
 
 const MARKER_VERSION_SOURCE =
@@ -3037,35 +2533,15 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
       scaffoldToolchain,
     );
 
-    // If this empty directory sits inside a declared workspace subpackage
-    // we cannot run a leaf `installProjectDependencies` here: the fallback
-    // package manager would pollute the workspace with a stray
-    // `node_modules` / lockfile that conflicts with the workspace
-    // manager's hoisting, or reject the install outright on `workspace:`
-    // specs. Defer to the user's next workspace install via
-    // `workspaceSubpackageSkip` and surface a note. The skip also covers
-    // `generateStarterMigration` (drizzle-kit cannot resolve
-    // `void/schema-d1` from a subpackage with no resolved deps yet).
-    //
-    // The skip decision routes through `resolveWorkspaceDeferral` for
-    // consistency with the demo branch below — both branches honor the
-    // same local-lockfile / Corepack veto. `(!voidResolvable || scaffoldWroteDeps)`
-    // is defense in depth: in practice `scaffoldWroteDeps` is always
-    // true when this branch runs because `isScaffoldableEmptyProject`
-    // only whitelists `void` + adapter packages while the starter
-    // template additionally injects `hono` / framework lib / `vite` /
-    // `typescript`, so `scaffoldPagesApp`'s `ensureDependency()` is
-    // guaranteed to flip `dependencyAdded` to true. The `!voidResolvable`
-    // disjunct keeps the gate correct even if a future template lands
-    // a smaller dep set.
+    // A workspace member installs from the workspace root: a leaf install would
+    // leave a stray lockfile or reject `workspace:` specs, and drizzle-kit needs
+    // the installed deps for the starter migration.
     const deferral = resolveWorkspaceDeferral(root, readPackageJson(root));
     const voidResolvable = isVoidResolvableFrom(root);
     if (deferral && (!voidResolvable || scaffoldWroteDeps)) {
       workspaceSubpackageSkip = true;
       const relRoot = relative(deferral.workspaceRoot, root) || '.';
-      // Static starter mode does not scaffold a `db/schema.ts` (see
-      // `template.ts:156`), so the `void db generate` follow-up is
-      // meaningless there — only emit it for the db-backed starter modes.
+      // The static starter has no database schema to generate from.
       const dbFollowUp =
         starterMode === 'static'
           ? ''
@@ -3076,11 +2552,6 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
         'Workspace subpackage',
       );
     } else if (scaffoldWroteDeps || !voidResolvable) {
-      // Non-subpackage case (or hoisted-void subpackage with no
-      // package.json drift): run install when we either added deps OR
-      // when `void` is not yet resolvable from disk. The latter covers
-      // the pre-declared-deps path that `isScaffoldableEmptyProject`
-      // permits.
       scaffoldAddedDependencies = true;
     }
     if (starterMode !== 'static') {
@@ -3093,10 +2564,9 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
   const pagesFramework = scaffoldedPagesFramework ?? detectPagesFramework(root);
 
   if (!targeted && !didScaffoldStarter) {
-    const existingSetup = setupExistingProject(root, framework);
+    const dependencyAdded = setupExistingProject(root, framework);
     const voidResolvable = isVoidResolvableFrom(root);
-    const needsInstall = existingSetup.dependencyAdded || !voidResolvable;
-    if (needsInstall) {
+    if (dependencyAdded || !voidResolvable) {
       const deferral = resolveWorkspaceDeferral(root, readPackageJson(root));
       if (deferral) {
         workspaceSubpackageSkip = true;
@@ -3113,7 +2583,6 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
     }
   }
 
-  // Step 1: TypeScript / tsconfig
   if (!targeted || initArgs?.tsconfig) {
     state.typescriptWanted = true;
     setupTsconfig(root, state, pagesFramework);
@@ -3131,7 +2600,6 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
     ensureVoidWorkerCompatibilityDate(root);
   }
 
-  // Step 2: Cloudflare config for class B/C meta-frameworks
   if (framework) {
     setupWranglerConfig(root, framework);
   }
@@ -3139,12 +2607,11 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
     migrateFrameworkAdapterPaths(root);
   }
 
-  // Step 3: Database dialect
   if (!targeted && !didScaffoldStarter) {
     applyDatabaseSetup(root, await promptDatabaseSetup(root));
   }
 
-  // Steps 4–5: Agent instructions and skills are part of every init.
+  // Agent instructions and skills are part of every init.
   await injectAgentBlock(root, newProject);
 
   const agents = detectAgents(root);
@@ -3155,12 +2622,10 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
     log.info('Bundled Void docs: node_modules/void/docs/');
   }
 
-  // Step 6: Demo code (only in full interactive flow, not for meta-frameworks)
+  // Demo code only in the full flow, and not for meta-frameworks.
   if (!targeted && !framework) {
     if (didScaffoldStarter || state.hasRoutes || state.hasMigrations || state.hasPages) {
       log.info('Project already has pages, routes, or migrations, skipping demo');
-    } else if (!state.typescriptWanted) {
-      // Demo requires TypeScript for the type pipeline
     } else {
       const scaffold = await confirm({
         message: 'Scaffold demo code? (migration + API route + frontend fetch)',
@@ -3170,64 +2635,25 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
         process.exit(0);
       }
       if (scaffold) {
-        const { packageJsonMutated } = scaffoldDemo(root);
-        // `generateStarterMigration` spawns drizzle-kit, which resolves
-        // `void/schema-d1` through Node's ancestor `node_modules` walk.
-        // The demo install is only necessary when that resolution would
-        // fail — i.e. `void` is not present anywhere from `root` upward.
-        // `scaffoldDemo` (via `ensureVoidDependency`) may write `void`
-        // to the local `package.json` even when `void` is already
-        // hoisted at an ancestor `node_modules/void`; that manifest
-        // update alone does NOT justify an install here. In hoisted
-        // monorepos `isVoidResolvableFrom` returns true via the ancestor
-        // walk, so we skip the install — which is important because
-        // workspace subpackages with `workspace:` specs often reject
-        // `npm install` outright. Fresh clones where `node_modules/void`
-        // is entirely missing still trigger the install via
-        // `!voidResolvable`.
-        //
-        // `resolveWorkspaceDeferral` is the single source of truth for
-        // "is this a workspace subpackage that should defer install to
-        // the root?" — it honors local lockfiles and Corepack pins so
-        // a leaf-managed nested project does NOT take the skip path.
+        scaffoldDemo(root);
+        // The existing-project step already queued any install or workspace deferral the demo needs.
         const voidResolvable = isVoidResolvableFrom(root);
         const deferral = resolveWorkspaceDeferral(root, readPackageJson(root));
-        if (deferral && (!voidResolvable || packageJsonMutated)) {
-          // Workspace subpackage: either we need an install
-          // (`!voidResolvable`) or `ensureVoidDependency` mutated
-          // `package.json` so the workspace lockfile is now stale.
-          // Either way we can't run a leaf `npm install` (would reject
-          // `workspace:` specs and pollute the workspace), and we can't
-          // safely run the starter migration before the user has
-          // reconciled their lockfile.
-          workspaceSubpackageSkip = true;
+        if (deferral && !voidResolvable) {
           const relRoot = relative(deferral.workspaceRoot, root) || '.';
-          const headline = voidResolvable
-            ? `\`void\` is already hoisted at an ancestor node_modules, but \`./${relRoot}/package.json\` was updated.\nRun your workspace install from ${deferral.workspaceRoot} to sync the lockfile,`
-            : `Run your workspace install from ${deferral.workspaceRoot} to pick up the new \`void\` dep,`;
           note(
             `Scaffolded the starter demo in ./${relRoot}.\n\n` +
-              `${headline}\n` +
+              `Run your workspace install from ${deferral.workspaceRoot} to pick up the new \`void\` dep,\n` +
               `then run \`void db generate\` from ./${relRoot} to create the initial migration.`,
             'Workspace subpackage',
           );
-        } else if (!voidResolvable || packageJsonMutated) {
-          // Non-subpackage case. We also enter this branch when
-          // `packageJsonMutated` is true even if `void` was already
-          // resolvable, because `scaffoldDemo()` added a new `void` entry
-          // to the child's `package.json` and the lockfile needs to be
-          // reconciled. Without this install, CI frozen-install (or
-          // `pnpm install --frozen-lockfile`, `npm ci`,
-          // `yarn install --immutable`) would fail the integrity check.
-          scaffoldAddedDependencies = true;
         }
         scaffoldedStarterMode = 'sqlite';
       }
     }
   }
 
-  // Step 8: Deployment platform. Targeted init commands retain their focused,
-  // non-interactive behavior and do not change the saved preference.
+  // Targeted runs keep the saved deployment preference without prompting.
   const deploymentPlatform = !targeted
     ? await promptDeploymentPlatform(root)
     : readDeploymentPlatform(root);
@@ -3240,25 +2666,12 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
     voidPlatformDiscovery = await ensureVoidPlatformConnection(root);
   }
 
-  // Step 9: GitHub Actions for either configured deployment target.
-  // Skip when `root` is a workspace subpackage: `setupGithubActions` would
-  // write `.github/workflows/deploy.yml` under the subpackage root, but
-  // GitHub only reads `.github/workflows/*` from the repository root, so
-  // the workflow would be silently ignored. The user has to set this up
-  // from the workspace root themselves.
-  //
-  // This check is intentionally NOT `resolveWorkspaceDeferral`: a leaf
-  // managed subpackage (local lockfile or a non-pnpm Corepack pin) is
-  // still a workspace member structurally, and GitHub still ignores its
-  // `.github/workflows/` directory. Self-managing the install does not
-  // change where GitHub reads workflow files from. Compute the
-  // subpackage-membership signal directly so both targeted and
-  // interactive modes agree.
-  const githubStepSkipForSubpackage = workspaceSubpackage;
+  // GitHub reads workflows only from the repository root, so skip every
+  // workspace member, even one that manages its own install.
   let shouldSetupGithub = targeted ? initArgs?.github === true : deploymentPlatform !== 'none';
   if (
     shouldSetupGithub &&
-    !githubStepSkipForSubpackage &&
+    !workspaceSubpackage &&
     deploymentPlatform !== 'cloudflare' &&
     deploymentPlatform !== 'none'
   ) {
@@ -3275,9 +2688,7 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
       shouldSetupGithub = false;
     }
   }
-  if (shouldSetupGithub && !githubStepSkipForSubpackage) {
-    // `setupGithubActions` writes `void-deploy.yml` (skipping with a warning if
-    // it already exists). It does not touch any pre-existing `deploy.yml`.
+  if (shouldSetupGithub && !workspaceSubpackage) {
     if (targeted) {
       // --github flag: run directly without prompting
       setupGithubActions(
@@ -3303,7 +2714,7 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
         );
       }
     }
-  } else if (githubStepSkipForSubpackage && shouldSetupGithub) {
+  } else if (workspaceSubpackage && shouldSetupGithub) {
     log.info(
       'Skipping GitHub Actions setup: workflow files must live at the repo root, not in a workspace subpackage.',
     );
@@ -3325,18 +2736,12 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
     installProjectDependencies(root, state.packageManager);
   }
   if (scaffoldedStarterMode && !workspaceSubpackageSkip) {
-    // `generateStarterMigration` injects the Yarn PnP loaders through
-    // `buildDrizzleKitSpawnEnv`, so it works under PnP like
-    // `gen.ts:runMigration`.
     generateStarterMigration(root, scaffoldedStarterMode);
   }
 
   if (!targeted && deploymentPlatform === 'void') {
     const linked = await maybeSetupDeployProject(root);
-    // Step 8 wrote `void-deploy.yml` before the project was linked, so it baked
-    // in the `${{ vars.VOID_PROJECT }}` placeholder. Now that linking resolved a
-    // slug, patch it into the workflow so the user does not also have to set a
-    // repository variable. Declining to link leaves the placeholder intact.
+    // The workflow was written before linking, with a placeholder slug.
     if (linked?.slug) {
       patchWorkflowProjectSlug(root, linked.slug);
     }
@@ -3347,11 +2752,7 @@ export async function runInitCommand(root: string, initArgs?: InitArgs): Promise
   }
 
   if (workspaceSubpackageSkip) {
-    // The workspace install + `void db generate` ordering was already
-    // surfaced via `note(..., 'Workspace subpackage')` upstream; the
-    // completion nudges the user back toward that note instead of
-    // suggesting a dev command they cannot run yet. Static starter mode
-    // has no migration step, so omit the `void db generate` half there.
+    // The dev command cannot run before the workspace install.
     if (scaffoldedStarterMode) {
       printSuccess(
         'Project initialized. Run your workspace install, then `void db generate` to finish setup.',
diff --git a/packages/void/src/cli/link.ts b/packages/void/src/cli/link.ts
index d8ca496a3..e4c9759cc 100644
--- a/packages/void/src/cli/link.ts
+++ b/packages/void/src/cli/link.ts
@@ -43,7 +43,7 @@ export async function runLink(root: string, slug?: string): Promise<void> {
       cancel(`project: No project found with slug '${slug}'.`);
       process.exit(1);
     }
-    const config = attachSelectedPlatform(root, resolved, client.apiUrl);
+    const config = attachSelectedPlatform(resolved, client.apiUrl);
     writeProjectConfig(root, config);
     printSuccess(
       `Linked to ${projectLabel(config.slug, root, projects.find((project) => project.id === config.projectId)?.url)}`,
@@ -65,7 +65,6 @@ export async function runLink(root: string, slug?: string): Promise<void> {
   writeProjectConfig(
     root,
     attachSelectedPlatform(
-      root,
       { projectId: result.project.id, slug: result.project.slug },
       client.apiUrl,
     ),
diff --git a/packages/void/src/cli/list.ts b/packages/void/src/cli/list.ts
index 26c8ebcee..5d61335e7 100644
--- a/packages/void/src/cli/list.ts
+++ b/packages/void/src/cli/list.ts
@@ -1,7 +1,14 @@
 import { outro, log } from '@voidzero-dev/vite-plus-prompts';
 import { getToken } from './auth.ts';
 import { PlatformClient, type DeploymentResponse } from './client.ts';
-import { dim, ensureUtc, formatCount, pc, sanitizeTerminalText, tablePrefix } from './output.ts';
+import {
+  dim,
+  formatCount,
+  formatRelativeTime,
+  pc,
+  sanitizeTerminalText,
+  tablePrefix,
+} from './output.ts';
 import { readDeploymentPlatform, readProjectConfig } from './project.ts';
 import { resolveProjectBySlug } from './resolve-project.ts';
 
@@ -212,31 +219,3 @@ function formatDeploymentRow(
 
   return { id: d.id, appType, statusRaw, statusColored, source, commit, isr, deployed };
 }
-
-function formatRelativeTime(iso: string): string {
-  const now = Date.now();
-  const then = new Date(ensureUtc(iso)).getTime();
-  const diffMs = now - then;
-
-  if (diffMs < 0) {
-    return 'just now';
-  }
-
-  const seconds = Math.floor(diffMs / 1000);
-  if (seconds < 60) {
-    return 'just now';
-  }
-
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60) {
-    return `${minutes}m ago`;
-  }
-
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) {
-    return `${hours}h ago`;
-  }
-
-  const days = Math.floor(hours / 24);
-  return `${days}d ago`;
-}
diff --git a/packages/void/src/cli/login.ts b/packages/void/src/cli/login.ts
index 80669d68e..55859aa8a 100644
--- a/packages/void/src/cli/login.ts
+++ b/packages/void/src/cli/login.ts
@@ -5,10 +5,8 @@ import {
   getApiUrl,
   getTokenSource,
   removeToken,
-  runLogin,
   runPlatformLogin,
   savePlatformToken,
-  saveToken,
 } from './auth.ts';
 import { isExpiredTokenError, PlatformClient } from './client.ts';
 import { printSuccess, createSpinner, pc } from './output.ts';
@@ -20,19 +18,19 @@ export type LoginPlatform = {
 };
 
 export async function selectPlatformLoginMethod(
-  platform?: LoginPlatform,
+  platform: LoginPlatform,
   requestedId?: string,
 ): Promise<{ id: string; label: string }> {
-  const providers = platform?.authenticationProviders ?? ['github', 'google'];
+  const providers = platform.authenticationProviders;
   const methods =
-    platform?.authentication?.methods ??
+    platform.authentication?.methods ??
     providers.map((id) => ({
       id,
       label: id === 'github' ? 'GitHub' : id === 'google' ? 'Google' : id,
     }));
   if (providers.length === 0) {
     throw new Error(
-      platform?.authentication?.setupPending
+      platform.authentication?.setupPending
         ? 'auth: The platform administrator must finish initial setup.'
         : 'auth: This platform has no login providers.',
     );
@@ -66,11 +64,9 @@ export async function promptForLoginToken(
   root: string = process.cwd(),
   platform?: LoginPlatform,
 ): Promise<string> {
+  const apiUrl = platform?.apiUrl ?? getApiUrl(root);
   const discovery =
-    platform ??
-    (await import('./platform-cmd.ts').then(({ discoverPlatform }) =>
-      discoverPlatform(getApiUrl(root)),
-    ));
+    platform ?? (await (await import('./platform-cmd.ts')).discoverPlatform(apiUrl));
   const { id: provider, label: providerName } = await selectPlatformLoginMethod(discovery);
   const s = createSpinner();
   s.start(`Opening browser for ${providerName} login...`);
@@ -81,14 +77,8 @@ export async function promptForLoginToken(
         `Waiting for ${providerName} login. If your browser didn't open, visit:\n${pc.blue(url)}`,
       );
     };
-    const token = platform
-      ? await runPlatformLogin(platform.apiUrl, provider, onUrl)
-      : await runLogin(root, provider, onUrl);
-    if (platform) {
-      savePlatformToken(token, platform.apiUrl);
-    } else {
-      saveToken(token, root);
-    }
+    const token = await runPlatformLogin(apiUrl, provider, onUrl);
+    savePlatformToken(token, apiUrl);
     s.stop('Logged in!');
     return token;
   } catch (err) {
diff --git a/packages/void/src/cli/migrate.ts b/packages/void/src/cli/migrate.ts
index 2300a86ab..075baf931 100644
--- a/packages/void/src/cli/migrate.ts
+++ b/packages/void/src/cli/migrate.ts
@@ -10,7 +10,7 @@ import {
 } from 'node:fs';
 import { isDeepStrictEqual } from 'node:util';
 import { log } from '@voidzero-dev/vite-plus-prompts';
-import { parse, parseTree, type Node, type ParseError } from 'jsonc-parser';
+import { parseTree, type Node } from 'jsonc-parser';
 import { join } from 'pathslash';
 import {
   seedCloudflareConfig,
@@ -18,25 +18,22 @@ import {
   VOID_LOCK_FILE,
 } from '../cloudflare-config.ts';
 import { loadTypedVoidConfigFile, TYPED_CONFIG_FILE } from '../config-loader.ts';
-import { validateConfig } from '../config.ts';
+import { GENERATED_MARKERS, renderVoidConfig } from '../config-write.ts';
+import { validateConfig, type VoidConfig } from '../config.ts';
 import {
   applyFrameworkConfigMigration,
   discoverFrameworkWranglerFiles,
   planFrameworkConfigMigration,
 } from './framework-config-migrate.ts';
+import { parseJsoncObject } from './generated-wrangler-config.ts';
 import { printSuccess } from './output.ts';
 import { LATEST_KNOWN_COMPAT_DATE } from './wrangler.ts';
 
 const LEGACY_FILE = 'void.json';
-const GENERATED_MARKER = '// Generated by void migrate.';
-const OLD_GENERATED_MARKER = '// Generated from void.json by void migrate.';
-const INIT_GENERATED_MARKER = '// Generated by void init.';
 
 function parseWranglerJsonc(path: string, raw: string): Record<string, unknown> {
-  const source = raw.replace(/^\uFEFF/, '');
-  const errors: Array<ParseError> = [];
-  const parsed: unknown = parse(source, errors, { allowTrailingComma: true });
-  if (errors.length > 0 || typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+  const parsed = parseJsoncObject(raw);
+  if (!parsed) {
     throw new Error(`migrate: Invalid JSON/JSONC in ${path}. Fix it before migrating.`);
   }
   function assertUnique(node: Node | undefined): void {
@@ -61,8 +58,8 @@ function parseWranglerJsonc(path: string, raw: string): Record<string, unknown>
       }
     }
   }
-  assertUnique(parseTree(source));
-  return parsed as Record<string, unknown>;
+  assertUnique(parseTree(raw.replace(/^\uFEFF/, '')));
+  return parsed;
 }
 
 function backup(root: string, name: string, content: string): void {
@@ -74,10 +71,6 @@ function backup(root: string, name: string, content: string): void {
   }
 }
 
-function generatedSource(config: Record<string, unknown>): string {
-  return `${GENERATED_MARKER}\nimport { defineConfig } from 'void/config';\n\nexport default defineConfig(${JSON.stringify(config, null, 2)});\n`;
-}
-
 function isOrphanedCompatibilityConfig(
   root: string,
   legacy: Record<string, unknown>,
@@ -165,11 +158,7 @@ export function migrateLegacyVoidConfig(root: string): boolean {
   let current: Record<string, unknown> | undefined;
   if (hadTyped) {
     const existing = readFileSync(typedPath, 'utf8');
-    if (
-      !existing.startsWith(GENERATED_MARKER) &&
-      !existing.startsWith(OLD_GENERATED_MARKER) &&
-      !existing.startsWith(INIT_GENERATED_MARKER)
-    ) {
+    if (!GENERATED_MARKERS.some((marker) => existing.startsWith(marker))) {
       throw new Error(
         `migrate: ${TYPED_CONFIG_FILE} already exists. Move the legacy settings into it before deleting the old files.`,
       );
@@ -207,7 +196,7 @@ export function migrateLegacyVoidConfig(root: string): boolean {
   const needsTypedWrite = !hadTyped || !isDeepStrictEqual(current, next);
   const temporaryPath = join(root, `.void.config.${randomUUID()}.ts`);
   if (needsTypedWrite) {
-    writeFileSync(temporaryPath, generatedSource(next), { flag: 'wx' });
+    writeFileSync(temporaryPath, renderVoidConfig(next as VoidConfig), { flag: 'wx' });
   }
   try {
     if (needsTypedWrite) {
diff --git a/packages/void/src/cli/operator-args.ts b/packages/void/src/cli/operator-args.ts
index df153a617..27ac19835 100644
--- a/packages/void/src/cli/operator-args.ts
+++ b/packages/void/src/cli/operator-args.ts
@@ -1,3 +1,4 @@
+import { parsePlatformLoginId } from '@void/platform';
 import { OPERATOR_MAX_TIMEOUT_MS } from './operator-client.ts';
 
 /** Public operator commands. This table also drives nested CLI help. */
@@ -9,7 +10,7 @@ export type OperatorCommand = {
   optionalPositional?: boolean;
   usage?: Array<string>;
   values?: Record<string, string>;
-  booleans?: Array<string>;
+  booleans?: Record<string, string>;
   method?: 'POST';
   path: string;
 };
@@ -21,7 +22,9 @@ export const operatorCommands: Array<OperatorCommand> = [
     description: 'Sign in as a platform administrator',
     path: '/session',
     values: { provider: 'OAuth provider' },
-    booleans: ['token-stdin'],
+    booleans: {
+      'token-stdin': 'Read a full API session from stdin for explicit operator session exchange',
+    },
   },
   {
     group: 'auth',
@@ -40,7 +43,9 @@ export const operatorCommands: Array<OperatorCommand> = [
     action: 'token',
     description: 'Print an operator token; exchange an API session with --token-stdin',
     path: '/session',
-    booleans: ['token-stdin'],
+    booleans: {
+      'token-stdin': 'Read a full API session from stdin for explicit operator session exchange',
+    },
   },
   {
     group: 'user',
@@ -132,7 +137,9 @@ export const operatorCommands: Array<OperatorCommand> = [
     action: 'status',
     description: 'Inspect saved platform Zero Trust configuration and project state counts',
     path: '/zero-trust',
-    booleans: ['check'],
+    booleans: {
+      check: 'Also check the saved settings against Cloudflare Access (several API calls)',
+    },
   },
   {
     group: 'zero-trust',
@@ -144,7 +151,11 @@ export const operatorCommands: Array<OperatorCommand> = [
       policies: 'Comma-separated reusable Access policy IDs',
       'existing-projects': 'Required when enabling: protected or public for existing projects',
     },
-    booleans: ['token-stdin', 'protect-new-projects', 'public-apps'],
+    booleans: {
+      'token-stdin': 'Read the Access management API token from stdin',
+      'protect-new-projects': 'Protect newly created projects by default',
+      'public-apps': 'Manage public app rules without identity policies',
+    },
     method: 'POST',
   },
   {
@@ -230,7 +241,7 @@ export const operatorCommands: Array<OperatorCommand> = [
     path: '/deployments/:id/logs',
     positional: ['id'],
     values: { since: 'Duration or ISO timestamp', cursor: 'Opaque continuation cursor' },
-    booleans: ['follow'],
+    booleans: { follow: 'Poll new logs until interrupted or the build ends' },
   },
   {
     group: 'build',
@@ -246,7 +257,7 @@ export const operatorCommands: Array<OperatorCommand> = [
     path: '/builds/:id/logs',
     positional: ['id'],
     values: { since: 'Last received sequence number' },
-    booleans: ['follow'],
+    booleans: { follow: 'Poll new logs until interrupted or the build ends' },
   },
   {
     group: 'signup',
@@ -370,7 +381,7 @@ export const operatorCommands: Array<OperatorCommand> = [
     description: 'Rotate project proxy tokens on tenant Workers',
     path: '/system/rotate-proxy-tokens',
     values: { project: 'Project ID' },
-    booleans: ['all'],
+    booleans: { all: 'Rotate every project' },
     method: 'POST',
   },
   {
@@ -435,7 +446,7 @@ export const operatorCommands: Array<OperatorCommand> = [
     path: '/email/attempts/:id/resolve',
     positional: ['id'],
     values: { reason: 'Audit reason without recipient or message content' },
-    booleans: ['ended'],
+    booleans: { ended: 'Attest that the original provider execution has ended' },
     method: 'POST',
   },
   {
@@ -448,7 +459,7 @@ export const operatorCommands: Array<OperatorCommand> = [
       outcome: 'Provider outcome: applied or not-applied',
       reason: 'Audit reason for the verified provider outcome',
     },
-    booleans: ['ended'],
+    booleans: { ended: 'Attest that the original provider execution has ended' },
     method: 'POST',
   },
   {
@@ -468,7 +479,7 @@ export const operatorCommands: Array<OperatorCommand> = [
       outcome: 'Provider outcome: applied or not-applied',
       reason: 'Audit reason for the verified provider outcome',
     },
-    booleans: ['ended'],
+    booleans: { ended: 'Attest that the original provider execution has ended' },
     method: 'POST',
   },
   {
@@ -485,7 +496,7 @@ export const operatorCommands: Array<OperatorCommand> = [
     path: '/email/domains',
     positional: ['domain'],
     values: { project: 'Project id or slug' },
-    booleans: ['token-stdin'],
+    booleans: { 'token-stdin': 'Read a scoped Cloudflare API token from stdin' },
     method: 'POST',
   },
   {
@@ -517,7 +528,9 @@ export const operatorCommands: Array<OperatorCommand> = [
     description: 'Remove an email domain and its Cloudflare setup',
     path: '/email/domains/:domain/remove',
     positional: ['domain'],
-    booleans: ['token-stdin'],
+    booleans: {
+      'token-stdin': 'Read a replacement Cloudflare token for blocked project cleanup from stdin',
+    },
     method: 'POST',
   },
   {
@@ -576,8 +589,7 @@ export type OperatorArgs = {
   yes: boolean;
   follow: boolean;
   tokenStdin: boolean;
-  provider: string;
-  providerExplicit?: boolean;
+  provider?: string;
   timeoutMs?: number;
   method: 'GET' | 'POST';
   path: string;
@@ -593,11 +605,9 @@ export function parseOperatorArgs(args: Array<string>): OperatorArgs {
     'json',
     'plan',
     'yes',
-    'follow',
-    'token-stdin',
+    // No command declares `--force`; parsing it as a boolean reports it as an unknown flag.
     'force',
-    'ended',
-    ...operatorCommands.flatMap((command) => command.booleans ?? []),
+    ...operatorCommands.flatMap((command) => Object.keys(command.booleans ?? {})),
   ]);
   for (let index = 0; index < args.length; index++) {
     const arg = args[index]!;
@@ -636,8 +646,7 @@ export function parseOperatorArgs(args: Array<string>): OperatorArgs {
     yes: flags.has('yes'),
     follow: flags.has('follow'),
     tokenStdin: flags.has('token-stdin'),
-    provider: values.provider ?? 'github',
-    ...(values.provider ? { providerExplicit: true } : {}),
+    provider: values.provider,
     method: 'GET',
     path: '',
     query: {},
@@ -693,9 +702,11 @@ export function parseOperatorArgs(args: Array<string>): OperatorArgs {
   }
   for (const name of flags) {
     if (
-      !['json', ...(command.method ? ['yes', 'plan'] : []), ...(command.booleans ?? [])].includes(
-        name,
-      )
+      ![
+        'json',
+        ...(command.method ? ['yes', 'plan'] : []),
+        ...Object.keys(command.booleans ?? {}),
+      ].includes(name)
     ) {
       throw new Error(`platform: Unknown flag '--${name}' for ${group} ${action}.`);
     }
@@ -708,7 +719,9 @@ export function parseOperatorArgs(args: Array<string>): OperatorArgs {
   if (identitySignupEntry) {
     const connectionId = parameters[1]!;
     const subject = parameters[2]!;
-    if (!/^[a-z][a-z0-9-]{0,63}$/.test(connectionId)) {
+    try {
+      parsePlatformLoginId(connectionId);
+    } catch {
       throw new Error('platform: Invalid login connection ID.');
     }
     if (!subject || subject.length > 255) {
@@ -774,7 +787,7 @@ export function parseOperatorArgs(args: Array<string>): OperatorArgs {
   }
   // Command-specific booleans other than the session's own `--token-stdin`
   // ride the body, where the server reads them as JSON booleans.
-  for (const name of command.booleans ?? []) {
+  for (const name of Object.keys(command.booleans ?? {})) {
     if (name !== 'token-stdin' && flags.has(name)) {
       parsed.body[name] = true;
     }
diff --git a/packages/void/src/cli/operator-client.ts b/packages/void/src/cli/operator-client.ts
index 1154e7be1..0739ec70a 100644
--- a/packages/void/src/cli/operator-client.ts
+++ b/packages/void/src/cli/operator-client.ts
@@ -1,5 +1,5 @@
 import { cfAccessHeaders } from '../shared/cf-access.ts';
-import { ensureCloudflaredToken } from './cf-access.ts';
+import { ensurePlatformAccessToken } from './cf-access.ts';
 import { normalizePlatformApiUrl } from './platform-registry.ts';
 
 export const OPERATOR_READ_TIMEOUT_MS: number = 30_000;
@@ -67,7 +67,7 @@ export class OperatorClient {
       );
     }
     const url = new URL(`${this.origin}/operator/v1${path}`);
-    ensureCloudflaredToken(this.origin);
+    ensurePlatformAccessToken(this.origin);
     for (const [name, value] of Object.entries(options.query ?? {})) {
       url.searchParams.set(name, value);
     }
diff --git a/packages/void/src/cli/operator-cmd.ts b/packages/void/src/cli/operator-cmd.ts
index 15be1cc12..05370d99b 100644
--- a/packages/void/src/cli/operator-cmd.ts
+++ b/packages/void/src/cli/operator-cmd.ts
@@ -346,7 +346,7 @@ async function runAuth(origin: string, args: OperatorArgs): Promise<void> {
           const { runPlatformLogin } = await import('./auth.ts');
           const method = await selectPlatformLoginMethod(
             await discoverPlatform(origin),
-            args.providerExplicit ? args.provider : undefined,
+            args.provider,
           );
           return runPlatformLogin(origin, method.id, (url) =>
             process.stderr.write(`Sign in at ${url}\n`),
diff --git a/packages/void/src/cli/output.ts b/packages/void/src/cli/output.ts
index 7741921ac..db5598205 100644
--- a/packages/void/src/cli/output.ts
+++ b/packages/void/src/cli/output.ts
@@ -139,7 +139,7 @@ export function helpLine(command: string, description: string): string {
  * DB timestamps lack timezone info — appends 'Z' only when no
  * existing indicator (Z, z, or numeric offset) is present.
  */
-export function ensureUtc(s: string): string {
+function ensureUtc(s: string): string {
   const last = s.at(-1);
   if (last === 'Z' || last === 'z') {
     return s;
@@ -153,6 +153,26 @@ export function ensureUtc(s: string): string {
   return s + 'Z';
 }
 
+export function formatRelativeTime(iso: string): string {
+  const diffMs = Date.now() - new Date(ensureUtc(iso)).getTime();
+  if (diffMs < 60_000) {
+    return 'just now';
+  }
+  const minutes = Math.floor(diffMs / 60_000);
+  if (minutes < 60) {
+    return `${minutes}m ago`;
+  }
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) {
+    return `${hours}h ago`;
+  }
+  return `${Math.floor(hours / 24)}d ago`;
+}
+
+export function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
 /**
  * Stack frames of an error a Worker reported, one line per frame. The log or
  * exception line already shows `Name: message`, so a leading copy of that
diff --git a/packages/void/src/cli/package.ts b/packages/void/src/cli/package.ts
index 033fd503e..e94dc2ea4 100644
--- a/packages/void/src/cli/package.ts
+++ b/packages/void/src/cli/package.ts
@@ -1,6 +1,5 @@
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { getContentType } from '@void/edge';
 import { hash as blake3hash } from 'blake3-jit';
 import ignore from 'ignore';
 import { extname, join, relative } from 'pathslash';
@@ -11,7 +10,7 @@ import { buildMigrationPlanBundle } from '../migrations/plan.ts';
 import type { MigrationFile } from '../migrations/validate.ts';
 import type { WebSocketRouteDefinition } from '../router/websocket.ts';
 import type { ResolvedSandboxConfig } from '../sandbox/config.ts';
-import { toSlash } from '../shared/utils.ts';
+import { collectFiles } from '../shared/collect-files.ts';
 import type {
   AssetConfig,
   DeployAssetManifestEntry,
@@ -36,9 +35,6 @@ const textEncoder = new TextEncoder();
 
 type ProgressCallback = (message: string) => void;
 
-const FRAMEWORK_LIVE_UNSUPPORTED_MESSAGE =
-  'deploy: void/live is currently supported in Void apps only.';
-
 /**
  * Strip dev-only / internal-only fields from each rule before shipping the
  * manifest. The resulting entries contain only `{ source, destination, status }`.
@@ -65,34 +61,12 @@ function stripDevOnlyRuleFields(
 }
 
 /**
- * Layer user-defined `routing.fallbacks` with the SPA app type's implicit
- * `/index.html` fallback. Decision: user fallbacks take precedence; if none
- * matches, the SPA default kicks in.
- *
- * The platform's `not_found_handling: 'single-page-application'` is a global
- * switch — set once per deployment — so we can't have the platform evaluate
- * user fallbacks *before* applying it. Instead, when the user has configured
- * fallbacks on a SPA app, we disable the platform-level SPA setting and
- * append a synthetic catch-all fallback rule (`/*` → `/index.html`) after
- * the user's rules. The dispatch worker evaluates routing rules with
- * first-match-wins semantics, so placing the synthetic rule last means any
- * user rule that matches a more specific pattern fires first; the synthetic
- * rule only catches paths no user rule matched.
- *
- * When the user has no fallbacks configured, the platform-level SPA switch
- * is left intact (zero worker-side overhead for the common case).
- *
- * `notFound` is the explicit `routing.notFound` from void.json. It overrides
- * the value this function would otherwise infer from `appType`, mirroring
- * `resolveAssetRoutingPolicy` on the worker-with-assets path. It is resolved
- * *before* the SPA branch, not patched onto the result afterwards: an override
- * away from `single-page-application` must also skip the synthetic
- * `/* -> /index.html` rule below, otherwise the SPA shell would still be
- * served — just through a fallback rule instead of the platform switch — and
- * the override would be a no-op. This matters because `detectPreset`
- * classifies any Vite project without backend files as `spa`, so a plain Vite
- * MPA lands on `appType: 'spa'` and `routing.notFound: '404-page'` is its only
- * escape hatch.
+ * Layer user `routing.fallbacks` over the SPA default. The platform SPA switch
+ * is global, so a SPA with user fallbacks turns it off and appends a synthetic
+ * `/* -> /index.html` rule after them (first match wins). An explicit
+ * `routing.notFound` is resolved first, so overriding away from SPA also skips
+ * the synthetic rule. `detectPreset` classes a plain Vite MPA as `spa`, so this
+ * override is its only escape hatch.
  */
 export function resolveSpaFallbackChain(
   appType: 'spa' | 'static' | undefined,
@@ -123,13 +97,8 @@ export function resolveSpaFallbackChain(
     };
   }
 
-  // User fallbacks present on a SPA app — disable the platform-level SPA
-  // switch and append a synthetic catch-all rule after user rules, so that
-  // under first-match-wins any more specific user rule fires first. If the
-  // user already has an *unscoped* `/*` → `/index.html`, skip the append so
-  // we don't ship two identical rules (which would trip the duplicate-source
-  // lint). A host-scoped catch-all only covers one hostname, so other bound
-  // hosts still need the synthetic global SPA fallback.
+  // An unscoped user `/* -> /index.html` already is the catch-all; a duplicate
+  // would trip the duplicate-source lint. A host-scoped one covers one host only.
   const alreadyHasCatchAll = userRules.some(
     (r) => r.host === undefined && r.source === '/*' && r.destination === '/index.html',
   );
@@ -188,18 +157,6 @@ export function computeAssetHash(content: Buffer, filePath: string): string {
   return Buffer.from(blake3hash(input)).toString('hex').slice(0, 32);
 }
 
-/**
- * Resolve the content-type to declare on a direct-to-R2 PUT for `path`.
- * The value is part of the signed Content-Type header on the presigned
- * URL — if the bytes are uploaded with a different content-type, R2
- * rejects the PUT (signature mismatch). Uses the same table dispatch serves
- * assets with, so R2-stored and serve-time content types agree. Defaults to
- * `application/octet-stream` for unknown extensions.
- */
-export function getAssetContentType(path: string): string {
-  return getContentType(path);
-}
-
 /**
  * Compute MD5 of raw content as a 32-char lowercase hex string.
  *
@@ -211,28 +168,10 @@ export function getAssetContentType(path: string): string {
  * and (b) project-scoped storage (`assets/${projectId}/${blake3}`) means any
  * collision attack is exploitable only against the attacker's own project.
  */
-export function computeMd5(content: Buffer): string {
+function computeMd5(content: Buffer): string {
   return createHash('md5').update(content).digest('hex');
 }
 
-/**
- * Compute both BLAKE3 (CF-compatible asset hash) and MD5 (wire-level R2
- * upload-integrity checksum) from a single in-memory buffer. Returned in
- * the v2 manifest entry shape for direct-to-R2 deploys.
- *
- * Single-pass: callers read the file once into `content`; this function
- * then derives both digests from that buffer. The file is never read twice.
- */
-export function computeAssetHashes(
-  content: Buffer,
-  filePath: string,
-): { blake3: string; md5: string } {
-  return {
-    blake3: computeAssetHash(content, filePath),
-    md5: computeMd5(content),
-  };
-}
-
 /**
  * Create a filter function that excludes .assetsignore, _headers, _redirects,
  * OS metadata files, dotenv files, deploy-internal patterns, and any patterns
@@ -322,14 +261,13 @@ export async function collectAndHashAssets(
       processed++;
       await tickProgress(processed, files.length, onProgress, 'Hashing assets');
       // `collectAssetFiles` already skipped ignored paths.
-      const relativePath = '/' + toSlash(relative(dir, filePath));
+      const relativePath = '/' + relative(dir, filePath);
       checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent);
-      // Single disk read per file; both hashes are derived from the same buffer.
       const content = readFileSync(filePath);
-      const { blake3, md5 } = computeAssetHashes(content, filePath);
+      const blake3 = computeAssetHash(content, filePath);
       assetManifest[relativePath] = {
         blake3,
-        md5,
+        md5: computeMd5(content),
         size: content.length,
         // Deprecated v1 alias of `blake3` for consumers still reading `entry.hash`.
         hash: blake3,
@@ -358,7 +296,7 @@ export type PackageOptions = {
   compatibilityDate?: string;
   /** Cloudflare compatibility_flags from framework's wrangler config. */
   compatibilityFlags?: Array<string>;
-  /** Workers CPU-time limit (ms) from void.json `worker.limits.cpu_ms`. */
+  /** Workers CPU-time limit (ms) from void.config.ts `worker.limits.cpu_ms`. */
   cpuMs?: number;
   /** Cloudflare Sandbox container metadata for platform deploys. */
   sandbox?: ResolvedSandboxConfig;
@@ -504,7 +442,6 @@ export function buildVoidManifest(opts: {
   revalidate?: number | Record<string, number>;
   pages?: Array<{ pattern: string; revalidate?: number }>;
   pathRevalidate?: Record<string, number>;
-  vars?: Record<string, string>;
   queues?: Array<QueueMeta>;
   prerender?: Array<string>;
   assetConfig?: AssetConfig;
@@ -525,7 +462,6 @@ export function buildVoidManifest(opts: {
     revalidate,
     pages,
     pathRevalidate,
-    vars,
     queues,
     prerender,
     assetConfig,
@@ -610,12 +546,6 @@ export function buildVoidManifest(opts: {
     manifest.prerender = prerender;
   }
 
-  // Layer user fallbacks with the SPA default (if applicable). When the
-  // caller signals SPA mode via `not_found_handling: 'single-page-application'`
-  // and the user has `routing.fallbacks` configured, we disable the
-  // platform-level SPA switch and append a synthetic catch-all rule so user
-  // fallbacks are evaluated first and the SPA default only fires when none
-  // matched.
   let resolvedAssetConfig = assetConfig;
   let resolvedFallbackRules = fallbackRules;
   if (assetConfig?.not_found_handling === 'single-page-application') {
@@ -628,10 +558,6 @@ export function buildVoidManifest(opts: {
     manifest.assetConfig = resolvedAssetConfig;
   }
 
-  if (vars && Object.keys(vars).length > 0) {
-    manifest.vars = vars;
-  }
-
   if (options?.workerMain) {
     manifest.workerMain = options.workerMain;
   }
@@ -688,7 +614,7 @@ export function collectWorkerFiles(workerDir: string): Map<string, Buffer> {
     throw err;
   }
   for (const filePath of workerPaths) {
-    const relativePath = toSlash(relative(workerDir, filePath));
+    const relativePath = relative(workerDir, filePath);
     if (!isWorkerModule(relativePath)) {
       continue;
     }
@@ -757,14 +683,12 @@ export function buildFrameworkManifest(opts: {
   revalidateQueryAllowlist?: Record<string, Array<string>>;
   prerender?: Array<string>;
   assetConfig?: AssetConfig;
-  vars?: Record<string, string>;
-  packageOptions?: PackageOptions;
+  packageOptions?: Omit<PackageOptions, 'workerMain'>;
   hashedAssetsPrefix?: string;
   headerRules?: Array<HeaderRule>;
   redirectRules?: Array<DevRedirectRule>;
   fallbackRules?: Array<DevRedirectRule>;
   dialect?: 'sqlite' | 'postgresql' | 'mysql';
-  webSockets?: Array<WebSocketRouteDefinition>;
 }): DeployManifest {
   const po = opts.packageOptions;
   const dialect = opts.dialect ?? 'sqlite';
@@ -777,9 +701,6 @@ export function buildFrameworkManifest(opts: {
     dialect,
     po?.bindingNames,
   );
-  if (opts.bindings.needsLive) {
-    throw new Error(FRAMEWORK_LIVE_UNSUPPORTED_MESSAGE);
-  }
 
   if (opts.migrations && opts.migrations.length > 0) {
     manifest.migrations = toMigrationsManifest(opts.migrations, dialect);
@@ -803,14 +724,11 @@ export function buildFrameworkManifest(opts: {
   if (opts.assetConfig) {
     manifest.assetConfig = opts.assetConfig;
   }
-  if (opts.vars && Object.keys(opts.vars).length > 0) {
-    manifest.vars = opts.vars;
-  }
 
   manifest.ssr = true;
   manifest.framework = opts.frameworkName;
   manifest.type = 'framework';
-  manifest.workerMain = po?.workerMain ?? opts.workerMain;
+  manifest.workerMain = opts.workerMain;
   if (po?.compatibilityDate) {
     manifest.compatibilityDate = po.compatibilityDate;
   }
@@ -837,11 +755,6 @@ export function buildFrameworkManifest(opts: {
     manifest.fallbackRules = stripDevOnlyRuleFields(opts.fallbackRules);
   }
 
-  const websocketManifest = toWebSocketManifest(opts.webSockets);
-  if (websocketManifest) {
-    manifest.websocket = websocketManifest;
-  }
-
   return manifest;
 }
 
@@ -863,23 +776,6 @@ function isWorkerModule(relativePath: string): boolean {
   return /\.(js|mjs|cjs|wasm|map|txt)$/.test(norm);
 }
 
-/**
- * Recursively collect all file paths in a directory.
- */
-function collectFiles(dir: string): Array<string> {
-  const files: Array<string> = [];
-  const entries = readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      files.push(...collectFiles(fullPath));
-    } else {
-      files.push(fullPath);
-    }
-  }
-  return files;
-}
-
 /**
  * Recursively collect static asset file paths, refusing symlinks so deploys
  * cannot publish bytes from outside the intended asset root.
@@ -893,7 +789,7 @@ function collectAssetFiles(
   const entries = readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join(dir, entry.name);
-    const relativePath = '/' + toSlash(relative(root, fullPath));
+    const relativePath = '/' + relative(root, fullPath);
     if (isIgnored(relativePath)) {
       continue;
     }
diff --git a/packages/void/src/cli/platform-access-preflight.ts b/packages/void/src/cli/platform-access-preflight.ts
index d93d47a61..5d6ac7ba0 100644
--- a/packages/void/src/cli/platform-access-preflight.ts
+++ b/packages/void/src/cli/platform-access-preflight.ts
@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import {
   parsePlatformAccessProtection,
   type PlatformAccessProtection,
@@ -8,6 +7,7 @@ import { cfAccessHeaders } from '../shared/cf-access.ts';
 import {
   inspectPlatformAccess,
   PlatformAccessClient,
+  platformAccessNonce,
   platformAccessOverlapsOrigins,
   platformAccessPublicDestinations,
   verifyPlatformAccessApplication,
@@ -52,11 +52,7 @@ export async function verifyInstalledPlatformAccessProtection(input: {
   const spec = parsePlatformAccessSetupSpec(JSON.parse(specEncoded));
   if (
     state.accountId !== (spec.accountId ?? input.manifest.account.id) ||
-    state.nonce !==
-      createHash('sha256')
-        .update(`void-access:${input.manifest.ownershipNonce}`)
-        .digest('hex')
-        .slice(0, 32)
+    state.nonce !== platformAccessNonce(input.manifest.ownershipNonce)
   ) {
     throw new Error(
       'platform: The saved Access setup does not match this installation and identity account.',
diff --git a/packages/void/src/cli/platform-access-provision.ts b/packages/void/src/cli/platform-access-provision.ts
index 52d526aee..bfdea53b7 100644
--- a/packages/void/src/cli/platform-access-provision.ts
+++ b/packages/void/src/cli/platform-access-provision.ts
@@ -1,4 +1,4 @@
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash } from 'node:crypto';
 import {
   parsePlatformAccessProtection,
   parsePlatformLoginConfiguration,
@@ -97,6 +97,9 @@ function sameSet(left: ReadonlyArray<string>, right: ReadonlyArray<string>): boo
 function fingerprint(value: unknown): string {
   return createHash('sha256').update(JSON.stringify(value)).digest('hex');
 }
+export function platformAccessNonce(ownershipNonce: string): string {
+  return createHash('sha256').update(`void-access:${ownershipNonce}`).digest('hex').slice(0, 32);
+}
 
 export class PlatformAccessClient {
   constructor(
@@ -339,15 +342,9 @@ export async function inspectPlatformAccess(
 export async function provisionPlatformAccess(
   client: PlatformAccessClient,
   input: PlatformAccessProvisionInput,
-  previous: PlatformAccessCheckpoint | undefined,
+  previous: PlatformAccessCheckpoint,
   save: (state: PlatformAccessCheckpoint) => void,
 ): Promise<PlatformAccessProvisionResult> {
-  if (!input.login && !input.protection) {
-    return { resources: [] };
-  }
-  if (client.accountId !== input.accountId) {
-    throw new Error('platform: Access account selection does not match its management client.');
-  }
   const inspected = await inspectPlatformAccess(client, input);
   const origins = [
     ...new Set(
@@ -362,15 +359,7 @@ export async function provisionPlatformAccess(
       }),
     ),
   ];
-  const state: PlatformAccessCheckpoint = previous
-    ? structuredClone(previous)
-    : {
-        version: 1,
-        accountId: input.accountId,
-        installationId: input.installationId,
-        nonce: randomBytes(16).toString('hex'),
-        resources: {},
-      };
+  const state = structuredClone(previous);
   if (
     state.version !== 1 ||
     state.accountId !== input.accountId ||
diff --git a/packages/void/src/cli/platform-access-setup.ts b/packages/void/src/cli/platform-access-setup.ts
index ce2bc75f0..9b06dba0e 100644
--- a/packages/void/src/cli/platform-access-setup.ts
+++ b/packages/void/src/cli/platform-access-setup.ts
@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { stripVTControlCharacters } from 'node:util';
 import type { PlatformInstallationManifest } from '@void/platform';
 import { confirm, log, multiselect, password, select, text } from '@voidzero-dev/vite-plus-prompts';
@@ -7,6 +6,7 @@ import { note, pc } from './output.ts';
 import {
   PlatformAccessClient,
   platformAccessIdentityProvider,
+  platformAccessNonce,
   provisionPlatformAccess,
   type PlatformAccessCheckpoint,
   type PlatformAccessProvisionResult,
@@ -570,10 +570,7 @@ export async function preparePlatformAccessSetup(input: {
         version: 1 as const,
         accountId,
         installationId: input.plan.installationId,
-        nonce: createHash('sha256')
-          .update(`void-access:${input.ownershipNonce}`)
-          .digest('hex')
-          .slice(0, 32),
+        nonce: platformAccessNonce(input.ownershipNonce),
         resources: {},
       };
   let loginClientSecret = spec.loginClientSecretEnv
diff --git a/packages/void/src/cli/platform-app-access.ts b/packages/void/src/cli/platform-app-access.ts
index 8de684b85..fc8ce378f 100644
--- a/packages/void/src/cli/platform-app-access.ts
+++ b/packages/void/src/cli/platform-app-access.ts
@@ -99,9 +99,6 @@ export async function selectInstallationAppAccess(
       'platform: Reusing the platform Access policy requires --access-protection. Choose --app-access custom to protect apps separately.',
     );
   }
-  if (!['public', 'platform', 'custom'].includes(String(selected))) {
-    throw new Error('platform: Choose who can access deployed apps.');
-  }
   return selected;
 }
 
@@ -143,9 +140,6 @@ export async function prepareInstallationAppAccess(input: {
     // Recheck an unmanaged public choice on resume: account-wide policy may have changed.
   }
   const file = input.authentication.file?.appAccess;
-  if (file?.tokenEnv && !/^[A-Z_][A-Z0-9_]*$/.test(file.tokenEnv)) {
-    throw new Error('platform: Invalid app access token environment reference.');
-  }
   let token =
     explicitToken ||
     (input.checkpoint.appAccessTokenRejected ? undefined : input.checkpoint.appAccessToken);
diff --git a/packages/void/src/cli/platform-args.ts b/packages/void/src/cli/platform-args.ts
index 8bd8f4dd2..fa940131f 100644
--- a/packages/void/src/cli/platform-args.ts
+++ b/packages/void/src/cli/platform-args.ts
@@ -279,17 +279,10 @@ export function parsePlatformArgs(args: Array<string>): PlatformArgs {
     }
     return { subcommand };
   }
-  if (subcommand === 'use') {
+  if (subcommand === 'use' || subcommand === 'status') {
     const { selector } = parseSelector(rest, subcommand);
     return { subcommand, selector };
   }
-  if (subcommand === 'status') {
-    const { selector, plan } = parseSelector(rest, subcommand);
-    if (plan) {
-      throw new Error("platform: Unknown flag '--plan'.");
-    }
-    return { subcommand, selector };
-  }
   if (subcommand === 'discover') {
     let account = '';
     let selector = '';
diff --git a/packages/void/src/cli/platform-auth-config.ts b/packages/void/src/cli/platform-auth-config.ts
index 8833ce6cf..c00a51b12 100644
--- a/packages/void/src/cli/platform-auth-config.ts
+++ b/packages/void/src/cli/platform-auth-config.ts
@@ -1,4 +1,3 @@
-import { execFile } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
 import { setTimeout as delay } from 'node:timers/promises';
 import { stripVTControlCharacters } from 'node:util';
@@ -100,7 +99,7 @@ export async function waitForPlatformLoginTest(
     throw new Error('platform: Invalid login test expiry.');
   }
   console.log(`Complete the login test in your browser: ${url.href}`);
-  openBrowser(url.href, execFile);
+  openBrowser(url.href);
   while (Date.now() < expiry) {
     signal?.throwIfAborted();
     const result = await client.request(`/config/auth/tests/${encodeURIComponent(launch.id)}`, {
diff --git a/packages/void/src/cli/platform-auth-protection.ts b/packages/void/src/cli/platform-auth-protection.ts
index 4a047c968..3a72deb97 100644
--- a/packages/void/src/cli/platform-auth-protection.ts
+++ b/packages/void/src/cli/platform-auth-protection.ts
@@ -120,6 +120,26 @@ export async function verifyProtectionWorkerOrigins(
   }
 }
 
+function stringList(value: unknown): Array<string> | undefined {
+  return Array.isArray(value) && value.every((item) => typeof item === 'string')
+    ? value
+    : undefined;
+}
+
+function protectionContext(value: Record<string, unknown>) {
+  const { installationId, userId, sessionId, revision, lifecycleVersion } = value;
+  const origins = stringList(value.origins);
+  return typeof installationId === 'string' &&
+    typeof userId === 'string' &&
+    typeof sessionId === 'string' &&
+    typeof revision === 'number' &&
+    Number.isSafeInteger(revision) &&
+    typeof lifecycleVersion === 'string' &&
+    origins
+    ? { installationId, userId, sessionId, revision, lifecycleVersion, origins }
+    : undefined;
+}
+
 export async function runPlatformProtectionConfig(args: PlatformConfigArgs): Promise<void> {
   const manifest =
     args.target === 'show' ? undefined : resolveInstallationManifest(args.installation);
@@ -143,33 +163,25 @@ export async function runPlatformProtectionConfig(args: PlatformConfigArgs): Pro
       ensurePlatformAccessToken(origin, false, true);
     }
   }
-  let context = await operator.request('/config/auth/protection');
+  const live = await operator.request('/config/auth/protection');
   if (args.target === 'show') {
-    console.log(
-      JSON.stringify({ protection: context.protection, origins: context.origins }, null, 2),
-    );
+    console.log(JSON.stringify({ protection: live.protection, origins: live.origins }, null, 2));
     return;
   }
+  let context = protectionContext(live);
   if (
     !manifest ||
     manifest.status !== 'installed' ||
     !manifest.endpoints.proxyUrl ||
     normalizePlatformApiUrl(manifest.endpoints.apiUrl ?? '') !== origin ||
-    context.installationId !== manifest.id ||
-    typeof context.userId !== 'string' ||
-    typeof context.sessionId !== 'string' ||
-    typeof context.revision !== 'number' ||
-    typeof context.lifecycleVersion !== 'string' ||
-    !Number.isSafeInteger(context.revision) ||
-    !Array.isArray(context.origins) ||
-    context.origins.some((value) => typeof value !== 'string')
+    !context ||
+    context.installationId !== manifest.id
   ) {
     throw new Error(
       'platform: Protection settings must belong to this completed installation. Repair or upgrade it first.',
     );
   }
-  let lifecycleVersion = context.lifecycleVersion;
-  let origins = context.origins as Array<string>;
+  let origins = context.origins;
   if (!origins.includes(origin) || !origins.includes(new URL(manifest.endpoints.proxyUrl).origin)) {
     throw new Error(
       'platform: The live API and proxy origins differ from installation recovery state. Repair the installation first.',
@@ -257,17 +269,13 @@ export async function runPlatformProtectionConfig(args: PlatformConfigArgs): Pro
         } else {
           writeInstallationManifest(currentManifest);
         }
-        context = await operator.request('/config/auth/protection');
-        const rawLockedOrigins: unknown = context.origins;
-        const lockedOrigins = Array.isArray(rawLockedOrigins)
-          ? rawLockedOrigins.filter((value: unknown): value is string => typeof value === 'string')
-          : [];
+        const locked = await operator.request('/config/auth/protection');
+        const lockedOrigins = stringList(locked.origins);
         if (
           normalizePlatformApiUrl(currentManifest.endpoints.apiUrl ?? '') !== origin ||
           !currentManifest.endpoints.proxyUrl ||
-          context.installationId !== currentManifest.id ||
-          lockedOrigins.length !==
-            (Array.isArray(rawLockedOrigins) ? rawLockedOrigins.length : -1) ||
+          locked.installationId !== currentManifest.id ||
+          !lockedOrigins ||
           !lockedOrigins.includes(origin) ||
           !lockedOrigins.includes(new URL(currentManifest.endpoints.proxyUrl).origin)
         ) {
@@ -330,22 +338,16 @@ export async function runPlatformProtectionConfig(args: PlatformConfigArgs): Pro
       // Resource checkpointing changes lifecycleVersion. Refresh it after releasing the
       // lifecycle lock, then verify the origins against that exact captured version. A
       // later lifecycle mutation makes this proof stale at the operator API.
-      context = await operator.request('/config/auth/protection');
+      context = protectionContext(await operator.request('/config/auth/protection'));
       if (
+        !context ||
         context.installationId !== currentManifest.id ||
-        typeof context.userId !== 'string' ||
-        typeof context.sessionId !== 'string' ||
-        typeof context.revision !== 'number' ||
-        typeof context.lifecycleVersion !== 'string' ||
-        !Array.isArray(context.origins) ||
-        context.origins.some((value: unknown) => typeof value !== 'string') ||
         JSON.stringify(context.origins) !== JSON.stringify(origins)
       ) {
         throw new Error(
           'platform: Protection settings changed while Access resources were being checkpointed. Review and retry.',
         );
       }
-      lifecycleVersion = context.lifecycleVersion;
       await verifyProtectionWorkerOrigins(cloudflare, currentManifest, origins, false);
     }
     const expiresAt = new Date(Date.now() + 300_000).toISOString();
@@ -357,7 +359,7 @@ export async function runPlatformProtectionConfig(args: PlatformConfigArgs): Pro
           userId: context.userId,
           sessionId: context.sessionId,
           revision: context.revision,
-          lifecycleVersion,
+          lifecycleVersion: context.lifecycleVersion,
           protection,
           expiresAt,
         }),
@@ -365,7 +367,7 @@ export async function runPlatformProtectionConfig(args: PlatformConfigArgs): Pro
       .digest('base64url');
     const body = {
       revision: context.revision,
-      lifecycleVersion,
+      lifecycleVersion: context.lifecycleVersion,
       protection,
       expiresAt,
       signature,
@@ -378,7 +380,7 @@ export async function runPlatformProtectionConfig(args: PlatformConfigArgs): Pro
       console.error(JSON.stringify(preview, null, 2));
     }
     const result = await operator.request('/config/auth/protection', { method: 'POST', body });
-    save({ protectionUpdateJson: JSON.stringify({ revision: result.revision, protection }) });
+    writePendingInstallationSecrets(currentManifest, checkpoint);
     promoteInstallationSecrets(currentManifest);
     console.log(
       JSON.stringify({ ...result, protection, retainedAccessApplications: true }, null, 2),
diff --git a/packages/void/src/cli/platform-auth-recovery-core.ts b/packages/void/src/cli/platform-auth-recovery-core.ts
index 136d59619..3fe2a6142 100644
--- a/packages/void/src/cli/platform-auth-recovery-core.ts
+++ b/packages/void/src/cli/platform-auth-recovery-core.ts
@@ -7,13 +7,8 @@ import {
   type PlatformAuthenticationRecovery,
   type PlatformLoginConfiguration,
 } from '@void/platform';
+import type { QueryConnection } from './platform-zero-trust-uninstall.ts';
 
-type Database = {
-  query: <T extends Record<string, unknown> = Record<string, unknown>>(
-    sql: string,
-    values?: ReadonlyArray<unknown>,
-  ) => Promise<{ rows: ReadonlyArray<T> }>;
-};
 type Credential = { ciphertext: string; iv: string; keyVersion: string };
 export type Connection = {
   id: string;
@@ -135,7 +130,7 @@ export function encryptCredential(
     ciphertext: ciphertext.toString('base64'),
   };
 }
-export async function transaction<T>(db: Database, action: () => Promise<T>): Promise<T> {
+export async function transaction<T>(db: QueryConnection, action: () => Promise<T>): Promise<T> {
   await db.query('BEGIN');
   try {
     const result = await action();
@@ -146,7 +141,7 @@ export async function transaction<T>(db: Database, action: () => Promise<T>): Pr
     throw error;
   }
 }
-export async function requireAdministrator(db: Database, id: string): Promise<void> {
+export async function requireAdministrator(db: QueryConnection, id: string): Promise<void> {
   const row = (
     await db.query(
       "SELECT id FROM users WHERE id = $1 AND role = 'admin' AND (suspended_reason IS NULL OR suspended_reason IN ('requests_exceeded', 'sandbox_runtime_exceeded')) FOR UPDATE",
@@ -157,7 +152,10 @@ export async function requireAdministrator(db: Database, id: string): Promise<vo
     throw new Error('platform: Recovery can only restore an existing active administrator.');
   }
 }
-export async function readConnection(db: Database, id: string): Promise<Connection | undefined> {
+export async function readConnection(
+  db: QueryConnection,
+  id: string,
+): Promise<Connection | undefined> {
   return (
     await db.query<Connection>(
       'SELECT c.id, c.kind, c.revision, c.generation, r.configuration, r.secret FROM platform_login_connections c JOIN platform_login_revisions r ON r.connection_id = c.id AND r.revision = c.revision WHERE c.id = $1',
@@ -167,7 +165,7 @@ export async function readConnection(db: Database, id: string): Promise<Connecti
 }
 
 async function validateRecoveryAdmission(
-  db: Database,
+  db: QueryConnection,
   connectionId: string,
   revision: number,
 ): Promise<void> {
@@ -191,7 +189,7 @@ async function validateRecoveryAdmission(
 }
 
 export async function commitAuthenticationRecovery(
-  db: Database,
+  db: QueryConnection,
   input: {
     recovery: PlatformAuthenticationRecovery;
     identity: { issuer: string; subject: string };
diff --git a/packages/void/src/cli/platform-auth-recovery.ts b/packages/void/src/cli/platform-auth-recovery.ts
index 4b005e126..05d9826e3 100644
--- a/packages/void/src/cli/platform-auth-recovery.ts
+++ b/packages/void/src/cli/platform-auth-recovery.ts
@@ -1,4 +1,3 @@
-import { execFile } from 'node:child_process';
 import { createHash, createHmac, randomBytes, randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { setTimeout as delay } from 'node:timers/promises';
@@ -246,7 +245,7 @@ export async function runPlatformAuthRecovery(args: PlatformConfigArgs): Promise
         url.searchParams.set('proof', proof);
         console.log(`Complete the recovery login in your browser: ${url.href}`);
         if (process.stdin.isTTY) {
-          openBrowser(url.href, execFile);
+          openBrowser(url.href);
         }
         let tested: { issuer: string; subject: string; login: string } | undefined;
         while (Date.now() < Date.parse(expiresAt)) {
diff --git a/packages/void/src/cli/platform-cloudflare.ts b/packages/void/src/cli/platform-cloudflare.ts
index cb7a57fa9..a32a1e859 100644
--- a/packages/void/src/cli/platform-cloudflare.ts
+++ b/packages/void/src/cli/platform-cloudflare.ts
@@ -118,10 +118,6 @@ export type PlatformManagedWorkerTraffic = Readonly<{
   customDomains: ReadonlyArray<Readonly<{ hostname: string; service: string }>>;
   routes: ReadonlyArray<Readonly<{ pattern: string; script: string }>>;
 }>;
-export type PlatformTrackedWorkerTraffic = Readonly<{
-  customDomains: ReadonlyArray<CloudflareWorkerDomain>;
-  routes: ReadonlyArray<Readonly<{ id: string; pattern: string; script: string }>>;
-}>;
 
 export type PlatformRuntimeTokenPreflightClient = Pick<
   PlatformCloudflareClient,
@@ -374,7 +370,22 @@ export class PlatformCloudflareClient {
   }
 
   async listWorkerDomains(accountId: string): Promise<ReadonlyArray<CloudflareWorkerDomain>> {
-    const result = await this.#listWorkerDomainRecords(accountId);
+    const result: Array<Record<string, unknown>> = [];
+    const perPage = 100;
+    for (let page = 1; ; page++) {
+      const query = new URLSearchParams({ page: String(page), per_page: String(perPage) });
+      const response = await this.#requestEnvelope<ReadonlyArray<Record<string, unknown>>>(
+        `/accounts/${encodeURIComponent(accountId)}/workers/domains?${query}`,
+      );
+      result.push(...response.result);
+      const totalPages = response.resultInfo?.total_pages;
+      if (
+        (typeof totalPages === 'number' && page >= totalPages) ||
+        (totalPages === undefined && response.result.length < perPage)
+      ) {
+        break;
+      }
+    }
     return result.map((entry) => ({
       hostname: requiredString(entry.hostname, 'Worker custom domain hostname'),
       id: requiredString(entry.id, 'Worker custom domain id'),
@@ -435,53 +446,19 @@ export class PlatformCloudflareClient {
       );
     }
 
-    const expected = [...origins].map((origin) => origin.hostname).sort();
     const inventory = await this.listWorkerDomains(accountId);
-    const actual = inventory
-      .filter((domain) => domain.service === workerName)
-      .map((domain) => domain.hostname)
-      .sort();
-    const everyExpectedDomainIsUniqueAndOwned = expected.every(
-      (hostname) =>
+    const everyExpectedDomainIsUniqueAndOwned = origins.every(
+      ({ hostname }) =>
         inventory.filter((domain) => domain.hostname === hostname && domain.service === workerName)
           .length === 1,
     );
-    if (
-      !everyExpectedDomainIsUniqueAndOwned ||
-      expected.some((hostname) => !actual.includes(hostname))
-    ) {
+    if (!everyExpectedDomainIsUniqueAndOwned) {
       throw new PlatformWorkerCustomDomainsChangedError(
         `platform: Worker ${JSON.stringify(workerName)} Custom Domains changed concurrently after publication; refusing to overwrite the newer traffic state.`,
       );
     }
   }
 
-  async #listWorkerDomainRecords(
-    accountId: string,
-    service?: string,
-  ): Promise<ReadonlyArray<Record<string, unknown>>> {
-    const entries: Array<Record<string, unknown>> = [];
-    const perPage = 100;
-    for (let page = 1; ; page++) {
-      const query = new URLSearchParams({ page: String(page), per_page: String(perPage) });
-      if (service) {
-        query.set('service', service);
-      }
-      const response = await this.#requestEnvelope<ReadonlyArray<Record<string, unknown>>>(
-        `/accounts/${encodeURIComponent(accountId)}/workers/domains?${query}`,
-      );
-      entries.push(...response.result);
-      const totalPages = response.resultInfo?.total_pages;
-      if (
-        (typeof totalPages === 'number' && page >= totalPages) ||
-        (totalPages === undefined && response.result.length < perPage)
-      ) {
-        break;
-      }
-    }
-    return entries;
-  }
-
   async listWorkerRoutes(zoneId: string): Promise<ReadonlyArray<CloudflareWorkerRoute>> {
     const result = await this.request<ReadonlyArray<Record<string, unknown>>>(
       `/zones/${encodeURIComponent(zoneId)}/workers/routes`,
@@ -1056,34 +1033,12 @@ export class PlatformCloudflareClient {
     if (kind === 'ai-gateway' && this.#aiGatewayClient) {
       return this.#aiGatewayClient.deleteResource(accountId, resource, zoneId);
     }
-    const account = encodeURIComponent(accountId);
     // Cloudflare addresses dispatch namespaces and Workers by name; every
     // other kind by id.
     const encoded = encodeURIComponent(
       kind === 'dispatch-namespace' || kind === 'worker' ? resource.name : resource.id,
     );
-    const path =
-      kind === 'kv-namespace'
-        ? `/accounts/${account}/storage/kv/namespaces/${encoded}`
-        : kind === 'dns-record'
-          ? zoneId
-            ? `/zones/${encodeURIComponent(zoneId)}/dns_records/${encoded}`
-            : null
-          : kind === 'ai-gateway'
-            ? `/accounts/${account}/ai-gateway/gateways/${encoded}`
-            : kind === 'r2-bucket'
-              ? `/accounts/${account}/r2/buckets/${encoded}`
-              : kind === 'queue'
-                ? `/accounts/${account}/queues/${encoded}`
-                : kind === 'dispatch-namespace'
-                  ? `/accounts/${account}/workers/dispatch/namespaces/${encoded}`
-                  : kind === 'hyperdrive'
-                    ? `/accounts/${account}/hyperdrive/configs/${encoded}`
-                    : kind === 'worker'
-                      ? `/accounts/${account}/workers/scripts/${encoded}`
-                      : kind === 'zone'
-                        ? `/zones/${encoded}`
-                        : null;
+    const path = deletionPath(kind, encodeURIComponent(accountId), encoded, zoneId);
     if (!path) {
       throw new Error(`platform: Unsupported Cloudflare deletion kind ${kind}.`);
     }
@@ -1312,18 +1267,6 @@ export class PlatformCloudflareClient {
       }),
     });
   }
-
-  async removeRoutes(
-    _accountId: string,
-    _zoneId: string | null,
-    tracked: PlatformTrackedWorkerTraffic,
-  ): Promise<void> {
-    if (tracked.routes.length > 0 || tracked.customDomains.length > 0) {
-      throw new Error(
-        'platform: Cloudflare does not support conditional Worker traffic deletion. Retaining routes and custom domains for explicit dashboard cleanup.',
-      );
-    }
-  }
 }
 
 function accessResourcePath(
@@ -1348,6 +1291,36 @@ function parseEmailRoutingTarget(rule: Record<string, unknown>): CloudflareEmail
   };
 }
 
+function deletionPath(
+  kind: string,
+  account: string,
+  encoded: string,
+  zoneId: string | undefined,
+): string | null {
+  switch (kind) {
+    case 'kv-namespace':
+      return `/accounts/${account}/storage/kv/namespaces/${encoded}`;
+    case 'dns-record':
+      return zoneId ? `/zones/${encodeURIComponent(zoneId)}/dns_records/${encoded}` : null;
+    case 'ai-gateway':
+      return `/accounts/${account}/ai-gateway/gateways/${encoded}`;
+    case 'r2-bucket':
+      return `/accounts/${account}/r2/buckets/${encoded}`;
+    case 'queue':
+      return `/accounts/${account}/queues/${encoded}`;
+    case 'dispatch-namespace':
+      return `/accounts/${account}/workers/dispatch/namespaces/${encoded}`;
+    case 'hyperdrive':
+      return `/accounts/${account}/hyperdrive/configs/${encoded}`;
+    case 'worker':
+      return `/accounts/${account}/workers/scripts/${encoded}`;
+    case 'zone':
+      return `/zones/${encoded}`;
+    default:
+      return null;
+  }
+}
+
 function cloudflareErrorDetails(envelope: CloudflareEnvelope<unknown>, status: number): string {
   return (
     envelope.errors
diff --git a/packages/void/src/cli/platform-cmd.ts b/packages/void/src/cli/platform-cmd.ts
index ae832fc54..326c516c2 100644
--- a/packages/void/src/cli/platform-cmd.ts
+++ b/packages/void/src/cli/platform-cmd.ts
@@ -1,11 +1,7 @@
 import type { PlatformDiscoveryDocument, PlatformInstallationManifest } from '@void/platform';
 import { isCancel, log, select, text } from '@voidzero-dev/vite-plus-prompts';
 import { cfAccessHeaders } from '../shared/cf-access.ts';
-import {
-  ensureCloudflaredToken,
-  ensurePlatformAccessToken,
-  isCloudflareAccessChallenge,
-} from './cf-access.ts';
+import { ensurePlatformAccessToken, isCloudflareAccessChallenge } from './cf-access.ts';
 import { printSuccess, pc } from './output.ts';
 import type { PlatformArgs } from './platform-args.ts';
 import { PlatformDisabledError, readPlatformDiscoveryResponse } from './platform-discovery.ts';
@@ -33,7 +29,7 @@ export async function discoverPlatform(
   fetcher: typeof fetch = fetch,
 ): Promise<PlatformDiscoveryDocument> {
   const apiUrl = normalizePlatformInputUrl(input);
-  ensureCloudflaredToken(apiUrl);
+  ensurePlatformAccessToken(apiUrl);
   const request = () =>
     fetcher(`${apiUrl}/.well-known/void-platform`, {
       headers: { Accept: 'application/json', ...cfAccessHeaders(process.env, apiUrl) },
diff --git a/packages/void/src/cli/platform-config-args.ts b/packages/void/src/cli/platform-config-args.ts
index 5382e2e21..58e995005 100644
--- a/packages/void/src/cli/platform-config-args.ts
+++ b/packages/void/src/cli/platform-config-args.ts
@@ -1,6 +1,6 @@
 import { PLATFORM_LOGIN_KINDS, parsePlatformLoginId } from '@void/platform';
 
-export const PLATFORM_AUTH_ACTIONS = [
+const PLATFORM_AUTH_ACTIONS = [
   'list',
   'show',
   'initialize',
@@ -14,7 +14,7 @@ export const PLATFORM_AUTH_ACTIONS = [
   'protection',
   'recover',
 ] as const;
-export type PlatformAuthAction = (typeof PLATFORM_AUTH_ACTIONS)[number];
+type PlatformAuthAction = (typeof PLATFORM_AUTH_ACTIONS)[number];
 export type PlatformConfigArgs = Readonly<{
   subcommand: 'config';
   action: PlatformAuthAction | '';
@@ -34,36 +34,14 @@ export function parsePlatformConfigArgs(args: ReadonlyArray<string>): PlatformCo
   if (args.length && args[0] !== 'auth') {
     throw new Error('platform: Usage: void platform config auth [command] [options].');
   }
-  const positional: Array<string> = [];
-  const flags = new Set<string>();
-  const values = new Map<string, string>();
-  const valueFlags = ['connection', 'installation', 'id', 'file', 'client-secret-env', 'test-id'];
-  for (let index = 1; index < args.length; index++) {
-    const arg = args[index]!;
-    if (!arg.startsWith('-')) {
-      positional.push(arg);
-      continue;
-    }
-    const name = arg.slice(2);
-    if (
-      !arg.startsWith('--') ||
-      (!['json', 'plan', 'yes'].includes(name) && !valueFlags.includes(name))
-    ) {
-      throw new Error(`platform: Unknown config auth flag ${arg}.`);
-    }
-    if (flags.has(name) || values.has(name)) {
-      throw new Error(`platform: Duplicate flag ${arg}.`);
-    }
-    if (!valueFlags.includes(name)) {
-      flags.add(name);
-      continue;
-    }
-    const value = args[++index];
-    if (!value || value.startsWith('-')) {
-      throw new Error(`platform: ${arg} requires a value.`);
-    }
-    values.set(name, value);
-  }
+  const { positional, flags, values } = parseConfigFlags(args, 'auth', [
+    'connection',
+    'installation',
+    'id',
+    'file',
+    'client-secret-env',
+    'test-id',
+  ]);
   const [action = '', target = '', ...extra] = positional;
   if (extra.length || (action && !PLATFORM_AUTH_ACTIONS.includes(action as PlatformAuthAction))) {
     throw new Error(
@@ -139,3 +117,41 @@ export function parsePlatformConfigArgs(args: ReadonlyArray<string>): PlatformCo
     yes: flags.has('yes'),
   };
 }
+
+/** Parses `config <group>` flags: --json, --plan, --yes, and the given value flags. */
+export function parseConfigFlags(
+  args: ReadonlyArray<string>,
+  group: 'auth' | 'plans',
+  valueFlags: ReadonlyArray<string>,
+): { positional: Array<string>; flags: Set<string>; values: Map<string, string> } {
+  const positional: Array<string> = [];
+  const flags = new Set<string>();
+  const values = new Map<string, string>();
+  for (let index = 1; index < args.length; index++) {
+    const arg = args[index]!;
+    if (!arg.startsWith('-')) {
+      positional.push(arg);
+      continue;
+    }
+    const name = arg.slice(2);
+    if (
+      !arg.startsWith('--') ||
+      (!['json', 'plan', 'yes'].includes(name) && !valueFlags.includes(name))
+    ) {
+      throw new Error(`platform: Unknown config ${group} flag ${arg}.`);
+    }
+    if (flags.has(name) || values.has(name)) {
+      throw new Error(`platform: Duplicate flag ${arg}.`);
+    }
+    if (!valueFlags.includes(name)) {
+      flags.add(name);
+      continue;
+    }
+    const value = args[++index];
+    if (!value || value.startsWith('-')) {
+      throw new Error(`platform: ${arg} requires a value.`);
+    }
+    values.set(name, value);
+  }
+  return { positional, flags, values };
+}
diff --git a/packages/void/src/cli/platform-install-activation.ts b/packages/void/src/cli/platform-install-activation.ts
index 70a15bb4d..3576538a1 100644
--- a/packages/void/src/cli/platform-install-activation.ts
+++ b/packages/void/src/cli/platform-install-activation.ts
@@ -1,17 +1,17 @@
 import {
   createPlatformWorkerConfigs,
   PLATFORM_DISABLED_KEY,
-  PLATFORM_DISABLED_VALUE,
   transitionInstallation,
   type PlatformInstallationManifest,
   type PlatformLifecycleOperation,
 } from '@void/platform';
+import type { PlatformRuntimeManifest } from '@void/platform/installer';
+import { platformWorkerAction, platformWorkerDeployCallbacks } from './platform-install-workers.ts';
 import { verifyPlatformHealth, bootstrapPlatformSharedEmail } from './platform-installer-health.ts';
 import {
   requireId,
   inventoryUnmanagedPlatformWorkerTraffic,
   mergePlatformWorkerTrafficConfig,
-  publishPlatformWorkerCustomDomains,
 } from './platform-installer-resources.ts';
 import {
   secretCheckpoint,
@@ -19,12 +19,12 @@ import {
   platformWorkerSecretPayload,
 } from './platform-installer-secrets.ts';
 import {
+  type InstallationCheckpointWriter,
+  type PlatformDatabaseLifecycleLock,
   type PlatformInstallerDependencies,
-  type PlatformWorkerRollback,
   type PlatformInstallationSecrets,
+  type PlatformInstallRunState,
   type PlatformWorkerKey,
-  type PlatformWorkerSecretUpdateIntent,
-  type InstallerClient,
   type PlatformHealthCheckContext,
 } from './platform-installer-types.ts';
 import {
@@ -34,36 +34,20 @@ import {
   nextWorkerCutoverGeneration,
   recordWorkerSecretUpdateState,
   deployPlatformWorker,
-  recordWorkerCutoverStage,
-  recordWorkerUnsafeTraffic,
-  inspectNewPlatformWorker,
   verifyPlatformWorkerCutoverVersions,
 } from './platform-installer-workers.ts';
-import { type PlatformInstallPlan, type PlatformInstallPlanAction } from './platform-plan.ts';
+import { platformWorkersDevUrl, type PlatformInstallPlanAction } from './platform-plan.ts';
 import { writeInstallationManifest, writePendingInstallationSecrets } from './platform-registry.ts';
-import {
-  platformManagedWorkerTraffic,
-  recordPlatformWorkerTraffic,
-  trackedPlatformWorkerTraffic,
-} from './platform-traffic.ts';
+import { platformManagedWorkerTraffic } from './platform-traffic.ts';
 
 export async function enableInstallationServices(input: {
+  readonly state: PlatformInstallRunState;
   readonly checkpointOperation: (phase: PlatformLifecycleOperation['phase']) => Promise<void>;
   readonly requiresStagedCommit: boolean;
   readonly authenticationCutoverCommitted: boolean;
-  manifest: PlatformInstallationManifest;
-  workerCutoverGeneration: number;
   readonly now: () => string;
-  readonly writeRemoteInstallationCheckpoint: (
-    client: InstallerClient,
-    checkpointPlan: PlatformInstallPlan,
-    checkpointManifest: PlatformInstallationManifest,
-  ) => Promise<void>;
+  readonly writeRemoteInstallationCheckpoint: InstallationCheckpointWriter;
   readonly dependencies: PlatformInstallerDependencies;
-  readonly plan: PlatformInstallPlan;
-  workerRollbacks: Array<PlatformWorkerRollback>;
-  workerSecretUpdateIntent: PlatformWorkerSecretUpdateIntent | null;
-  readonly secrets: PlatformInstallationSecrets;
   readonly workerKeys: ReadonlyArray<PlatformWorkerKey>;
   readonly workerActions: ReadonlyArray<PlatformInstallPlanAction>;
   readonly workerDeploymentSecrets: PlatformInstallationSecrets;
@@ -75,25 +59,21 @@ export async function enableInstallationServices(input: {
   readonly ids: { [k: string]: string };
   readonly runPinnedPlatformWrangler: typeof runPlatformWrangler;
   readonly shouldBootstrapSharedEmail: boolean;
-  workerDeploymentCommitted: boolean;
-  readonly releaseDatabaseLock: import('./platform-installer-types.ts').PlatformDatabaseLifecycleLock;
-  readonly wasDisabled: boolean;
-  readonly previousPublicEndpoints: boolean;
+  readonly releaseDatabaseLock: PlatformDatabaseLifecycleLock;
   readonly version: string;
   readonly targetUsageProtocolVersion: 0 | 1 | 2;
   readonly healthCheckContext: PlatformHealthCheckContext;
-  readonly runtime: import('@void/platform/installer').PlatformRuntimeManifest;
+  readonly runtime: PlatformRuntimeManifest;
   readonly runtimeProvenance: NonNullable<PlatformInstallationManifest['runtime']>;
 }): Promise<{ emailOperationId: string | undefined }> {
   const {
+    state,
     checkpointOperation,
     requiresStagedCommit,
     authenticationCutoverCommitted,
     now,
     writeRemoteInstallationCheckpoint,
     dependencies,
-    plan,
-    secrets,
     workerKeys,
     workerActions,
     workerDeploymentSecrets,
@@ -106,61 +86,62 @@ export async function enableInstallationServices(input: {
     runPinnedPlatformWrangler,
     shouldBootstrapSharedEmail,
     releaseDatabaseLock,
-    wasDisabled,
-    previousPublicEndpoints,
     version,
     targetUsageProtocolVersion,
     healthCheckContext,
     runtime,
     runtimeProvenance,
   } = input;
+  const { plan, secrets } = state;
 
   await checkpointOperation('enabling');
   if (requiresStagedCommit) {
     if (!authenticationCutoverCommitted) {
-      input.manifest = recordWorkerCutoverResolution(
-        input.manifest,
-        input.workerCutoverGeneration,
+      state.manifest = recordWorkerCutoverResolution(
+        state.manifest,
+        state.workerCutoverGeneration,
         'committed',
         now(),
       );
-      input.manifest = recordWorkerTrafficState(
-        input.manifest,
-        input.workerCutoverGeneration,
+      state.manifest = recordWorkerTrafficState(
+        state.manifest,
+        state.workerCutoverGeneration,
         false,
         now(),
       );
-      writeInstallationManifest(input.manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-      input.workerRollbacks = [];
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
+      state.workerRollbacks = [];
     }
 
-    input.workerCutoverGeneration = nextWorkerCutoverGeneration(input.manifest);
-    if (input.workerSecretUpdateIntent) {
-      input.manifest = recordWorkerSecretUpdateState(
-        input.manifest,
-        input.workerCutoverGeneration,
+    state.workerCutoverGeneration = nextWorkerCutoverGeneration(state.manifest);
+    if (state.workerSecretUpdateIntent) {
+      state.manifest = recordWorkerSecretUpdateState(
+        state.manifest,
+        state.workerCutoverGeneration,
         'pending',
-        input.workerSecretUpdateIntent.id,
+        state.workerSecretUpdateIntent.id,
         now(),
       );
-      writeInstallationManifest(input.manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-      input.workerSecretUpdateIntent = {
-        ...input.workerSecretUpdateIntent,
-        generation: input.workerCutoverGeneration,
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
+      state.workerSecretUpdateIntent = {
+        ...state.workerSecretUpdateIntent,
+        generation: state.workerCutoverGeneration,
       };
       writePendingInstallationSecrets(
-        input.manifest,
-        secretCheckpoint(secrets, input.workerSecretUpdateIntent),
+        state.manifest,
+        secretCheckpoint(secrets, state.workerSecretUpdateIntent),
       );
     }
+    const writeManifest = async (next: PlatformInstallationManifest): Promise<void> => {
+      state.manifest = next;
+      writeInstallationManifest(next);
+      await writeRemoteInstallationCheckpoint(dependencies.client, plan, next);
+    };
     for (const key of workerKeys) {
       dependencies.onProgress?.(`Enabling the ${key} service`);
-      const action = workerActions.find(
-        (entry) =>
-          entry.key === (key === 'emailGateway' ? 'email-gateway-worker' : `${key}-worker`),
-      )!;
+      const action = platformWorkerAction(workerActions, key);
       const workerSecrets = platformWorkerSecretPayload(
         key,
         workerDeploymentSecrets,
@@ -176,106 +157,26 @@ export async function enableInstallationServices(input: {
       const rollback = dependencies.deployWorker
         ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig)
         : await deployPlatformWorker(workerConfig, workerSecrets, {
+            ...platformWorkerDeployCallbacks({
+              client: dependencies.client,
+              plan,
+              zoneId,
+              ids,
+              key,
+              action,
+              generation: state.workerCutoverGeneration,
+              now,
+              readManifest: () => state.manifest,
+              writeManifest,
+              checkpoint: (update) => update(),
+            }),
             apiBaseUrl: cloudflareApiBaseUrl,
-            ...(dependencies.client.request
-              ? { readCloudflare: (path) => dependencies.client.request!(path) }
-              : {}),
-            onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
-              input.manifest = recordWorkerCutoverStage(
-                input.manifest!,
-                input.workerCutoverGeneration,
-                key,
-                previousVersionId,
-                stagedVersionId,
-                action.name,
-                previousTriggers,
-                now(),
-              );
-              writeInstallationManifest(input.manifest);
-              await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-            },
-            onTrafficPublished: async () => {
-              if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) {
-                throw new Error('platform: Cloudflare traffic inventory is unavailable.');
-              }
-              const [customDomains, routes] = await Promise.all([
-                dependencies.client.listWorkerDomains(plan.account.id),
-                zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([]),
-              ]);
-              const next = recordPlatformWorkerTraffic(
-                input.manifest!,
-                action.name,
-                { customDomains, routes },
-                now(),
-              );
-              if (JSON.stringify(next.resources) !== JSON.stringify(input.manifest!.resources)) {
-                input.manifest = next;
-                writeInstallationManifest(input.manifest);
-                await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-              }
-            },
-            onUnsafeTraffic: async () => {
-              input.manifest = recordWorkerUnsafeTraffic(
-                input.manifest!,
-                input.workerCutoverGeneration,
-                key,
-                action.name,
-                now(),
-              );
-              writeInstallationManifest(input.manifest);
-              await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-            },
             managedRoutes: managedRoutes
               .filter((route) => route.script === action.name)
               .map((route) => route.pattern),
             preservedRoutes,
-            publishCustomDomains: (workerName, origins) =>
-              publishPlatformWorkerCustomDomains(
-                dependencies.client,
-                plan.account.id,
-                workerName,
-                origins,
-              ),
-            publishRoutes: async (workerName, patterns) => {
-              if (!dependencies.client.publishWorkerRoutesSafely) {
-                throw new Error(
-                  'platform: Safe Cloudflare Worker route publication is unavailable.',
-                );
-              }
-              if (zoneId) {
-                await dependencies.client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
-              } else if (patterns.length > 0) {
-                throw new Error('platform: Cannot publish zone routes in workers.dev mode.');
-              }
-            },
             previousConfig: previousWorkerConfig,
             previousPublicEndpoints: true,
-            inspectNewWorker: () =>
-              inspectNewPlatformWorker(
-                dependencies.client,
-                plan.account.id,
-                input.manifest!,
-                action.key,
-                action.name,
-              ),
-            removeCustomDomains: async () => {
-              if (!dependencies.client.removeRoutes) {
-                throw new Error('platform: Cloudflare route removal is unavailable.');
-              }
-              await dependencies.client.removeRoutes(
-                plan.account.id,
-                zoneId,
-                trackedPlatformWorkerTraffic(input.manifest!, new Set([action.name])),
-              );
-            },
-            retainNewWorker: async () => {
-              await dependencies.client.putKvValue(
-                plan.account.id,
-                requireId(ids, 'routing-kv'),
-                PLATFORM_DISABLED_KEY,
-                PLATFORM_DISABLED_VALUE,
-              );
-            },
             // Traffic opens only after every Worker in this generation is
             // verified against its own staged checkpoint, so none may be reused.
             reuseMatchingVersion: false,
@@ -283,7 +184,7 @@ export async function enableInstallationServices(input: {
             workerExisted: true,
           });
       if (rollback) {
-        input.workerRollbacks.push(rollback);
+        state.workerRollbacks.push(rollback);
       }
     }
   }
@@ -292,11 +193,11 @@ export async function enableInstallationServices(input: {
       return;
     }
     if (dependencies.verifyWorkerCutover) {
-      await dependencies.verifyWorkerCutover(input.manifest!, input.workerCutoverGeneration);
+      await dependencies.verifyWorkerCutover(state.manifest, state.workerCutoverGeneration);
     } else if (!dependencies.deployWorker) {
       await verifyPlatformWorkerCutoverVersions(
-        input.manifest!,
-        input.workerCutoverGeneration,
+        state.manifest,
+        state.workerCutoverGeneration,
         enabledConfigs,
         plan.account.id,
         runPinnedPlatformWrangler,
@@ -310,93 +211,89 @@ export async function enableInstallationServices(input: {
     // Shared-zone setup mutates provider routing. Once it begins, retain the
     // verified Worker set and keep the installation's routing gate closed on
     // failure so a retry can resume the durable email operation safely.
-    input.workerDeploymentCommitted = true;
-    input.manifest = recordWorkerCutoverResolution(
-      input.manifest,
-      input.workerCutoverGeneration,
+    state.workerDeploymentCommitted = true;
+    state.manifest = recordWorkerCutoverResolution(
+      state.manifest,
+      state.workerCutoverGeneration,
       'committed',
       now(),
     );
-    if (input.workerSecretUpdateIntent) {
-      input.manifest = recordWorkerSecretUpdateState(
-        input.manifest,
-        input.workerCutoverGeneration,
+    if (state.workerSecretUpdateIntent) {
+      state.manifest = recordWorkerSecretUpdateState(
+        state.manifest,
+        state.workerCutoverGeneration,
         'committed',
-        input.workerSecretUpdateIntent.id,
+        state.workerSecretUpdateIntent.id,
         now(),
       );
     }
-    writeInstallationManifest(input.manifest);
-    await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-    input.workerRollbacks = [];
+    writeInstallationManifest(state.manifest);
+    await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
+    state.workerRollbacks = [];
     dependencies.onProgress?.('Preparing shared email routing');
     emailOperationId = await (dependencies.bootstrapEmail ?? bootstrapPlatformSharedEmail)(
       plan.apiUrl,
-      createPlatformHealthProbeToken(input.manifest.ownershipNonce),
+      createPlatformHealthProbeToken(state.manifest.ownershipNonce),
     );
   }
   // A failed uninstall, or one whose database is reused, leaves its record
   // behind. Remove it before traffic opens so Zero Trust writers run again.
   await releaseDatabaseLock.liftProjectZeroTrustFence?.();
-  if (dependencies.client.deleteKvValue) {
-    await dependencies.client.deleteKvValue(
-      plan.account.id,
-      requireId(ids, 'routing-kv'),
-      PLATFORM_DISABLED_KEY,
-    );
-  } else if (wasDisabled || !previousPublicEndpoints) {
-    throw new Error('platform: Routing disablement removal is unavailable.');
-  }
+  await dependencies.client.deleteKvValue(
+    plan.account.id,
+    requireId(ids, 'routing-kv'),
+    PLATFORM_DISABLED_KEY,
+  );
   if (requiresStagedCommit) {
     dependencies.onProgress?.('Verifying the enabled platform');
     await (dependencies.verifyHealth ?? verifyPlatformHealth)(
       plan.apiUrl,
-      input.manifest.id,
+      state.manifest.id,
       plan.proxyUrl,
       plan.deployment.application.baseDomain,
       version,
       targetUsageProtocolVersion,
-      createPlatformHealthProbeToken(input.manifest.ownershipNonce),
+      createPlatformHealthProbeToken(state.manifest.ownershipNonce),
       undefined,
       !plan.deployment.application.zoneName
-        ? `https://${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`
+        ? platformWorkersDevUrl(plan, plan.deployment.resources.dispatchWorker)
         : undefined,
       healthCheckContext,
     );
     await verifyCurrentWorkerCutover();
   }
-  input.workerDeploymentCommitted = true;
-  input.manifest = recordWorkerCutoverResolution(
-    input.manifest,
-    input.workerCutoverGeneration,
+  state.workerDeploymentCommitted = true;
+  state.manifest = recordWorkerCutoverResolution(
+    state.manifest,
+    state.workerCutoverGeneration,
     'committed',
     now(),
   );
-  input.manifest = recordWorkerTrafficState(
-    input.manifest,
-    input.workerCutoverGeneration,
+  state.manifest = recordWorkerTrafficState(
+    state.manifest,
+    state.workerCutoverGeneration,
     true,
     now(),
   );
-  if (input.workerSecretUpdateIntent) {
-    input.manifest = recordWorkerSecretUpdateState(
-      input.manifest,
-      input.workerCutoverGeneration,
+  if (state.workerSecretUpdateIntent) {
+    state.manifest = recordWorkerSecretUpdateState(
+      state.manifest,
+      state.workerCutoverGeneration,
       'committed',
-      input.workerSecretUpdateIntent.id,
+      state.workerSecretUpdateIntent.id,
       now(),
     );
   }
-  input.manifest = {
-    ...input.manifest,
+  state.manifest = {
+    ...state.manifest,
     deployment: plan.deployment,
     deploymentExecution: runtime.deploymentExecution,
     platformVersion: version,
     runtime: runtimeProvenance,
-    safetyProtocols: runtime.safetyProtocols ?? { sandboxDrain: 0 },
+    safetyProtocols: runtime.safetyProtocols,
     updatedAt: now(),
     usageProtocolVersion: targetUsageProtocolVersion,
   };
-  input.manifest = transitionInstallation(input.manifest, 'installed', now());
+  state.manifest = transitionInstallation(state.manifest, 'installed', now());
   return { emailOperationId };
 }
diff --git a/packages/void/src/cli/platform-install-auth.ts b/packages/void/src/cli/platform-install-auth.ts
index 19b97b0c2..252614ffb 100644
--- a/packages/void/src/cli/platform-install-auth.ts
+++ b/packages/void/src/cli/platform-install-auth.ts
@@ -7,6 +7,7 @@ import {
   parsePlatformAuthenticationSetup,
   parsePlatformLoginConfiguration,
   platformDashboardUrl,
+  type PlatformAppAccess,
   type PlatformDeploymentManifest,
   type PlatformLoginKind,
 } from '@void/platform';
@@ -22,8 +23,8 @@ import type { PlatformCloudflareClient } from './platform-cloudflare.ts';
 import type { PlatformInstallPlan } from './platform-plan.ts';
 import { platformPromptAnswer } from './platform-setup.ts';
 
-export type AppAccessFile = {
-  mode: import('@void/platform').PlatformAppAccess;
+type AppAccessFile = {
+  mode: PlatformAppAccess;
   tokenEnv?: string;
   identityProviderIds?: Array<string>;
   policyIds?: Array<string>;
@@ -37,6 +38,11 @@ type AuthFile = {
   protection?: unknown;
   cloudflareAccess?: PlatformAccessSetupSpec;
 };
+
+function defaultConnectionId(kind: PlatformLoginKind): string {
+  return kind === 'oidc' ? 'company' : kind === 'cloudflare-access' ? 'access' : kind;
+}
+
 export type PlatformAuthSelection = {
   authentication: PlatformDeploymentManifest['authentication'];
   file?: AuthFile;
@@ -135,9 +141,6 @@ export async function selectInstallationAuthentication(
     }
     return { authentication: recorded };
   }
-  if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === undefined) {
-    return { authentication: { providers: ['github'] } };
-  }
   const providers =
     choices.loginMethods ??
     (!process.stdin.isTTY
@@ -211,7 +214,7 @@ export async function collectInstallationAuthentication(
     selection.authentication.providers.map((kind) => ({
       configuration: {
         kind,
-        id: kind === 'oidc' ? 'company' : kind === 'cloudflare-access' ? 'access' : kind,
+        id: defaultConnectionId(kind),
         label:
           kind === 'github'
             ? 'GitHub'
@@ -259,7 +262,7 @@ export async function collectInstallationAuthentication(
     const config = { ...entry.configuration };
     const kind = config.kind as PlatformLoginKind;
     if (!config.id) {
-      config.id = kind === 'oidc' ? 'company' : kind === 'cloudflare-access' ? 'access' : kind;
+      config.id = defaultConnectionId(kind);
     }
     if (prepared?.login && prepared.login.configuration.id === config.id) {
       const connection = prepared.login;
diff --git a/packages/void/src/cli/platform-install-preparation.ts b/packages/void/src/cli/platform-install-preparation.ts
index 027d00134..ea4e2ee64 100644
--- a/packages/void/src/cli/platform-install-preparation.ts
+++ b/packages/void/src/cli/platform-install-preparation.ts
@@ -3,9 +3,10 @@ import {
   createPlatformDeploymentManifest,
   platformDashboardUrl,
   transitionInstallation,
-  type PlatformInstallationManifest,
+  type PlatformDeploymentManifest,
   parsePlatformAuthenticationSetup,
 } from '@void/platform';
+import type { PlatformRuntimeManifest } from '@void/platform/installer';
 import { ensurePlatformAccessHealthChecks } from './platform-access-health.ts';
 import { verifyInstalledPlatformAccessProtection } from './platform-access-preflight.ts';
 import {
@@ -22,100 +23,100 @@ import {
   createPlatformHealthProbeToken,
 } from './platform-installer-secrets.ts';
 import {
+  type PlatformDatabaseLifecycleLock,
   type PlatformInstallerDependencies,
-  type PlatformInstallationSecrets,
-  type PlatformWorkerSecretUpdateIntent,
+  type PlatformInstallRunState,
   mergePlatformLiveAuthenticationDeployment,
 } from './platform-installer-types.ts';
-import { type PlatformInstallPlan } from './platform-plan.ts';
 import {
   readPendingInstallationSecrets,
   writeInstallationManifest,
   writePendingInstallationSecrets,
 } from './platform-registry.ts';
 
+function withAuthentication(
+  deployment: PlatformDeploymentManifest,
+  authentication: PlatformDeploymentManifest['authentication'],
+): PlatformDeploymentManifest {
+  return createPlatformDeploymentManifest({
+    ...deployment,
+    authentication,
+    capabilities: {
+      ...deployment.capabilities,
+      githubOAuth: authentication.providers.includes('github'),
+      googleOAuth: authentication.providers.includes('google'),
+    },
+  });
+}
+
 export async function prepareInstallationAuthentication(input: {
-  readonly releaseDatabaseLock: import('./platform-installer-types.ts').PlatformDatabaseLifecycleLock;
-  authenticationEnforcementActive: boolean;
-  readonly runtime: import('@void/platform/installer').PlatformRuntimeManifest;
-  plan: PlatformInstallPlan;
+  readonly state: PlatformInstallRunState;
+  readonly releaseDatabaseLock: PlatformDatabaseLifecycleLock;
+  readonly runtime: PlatformRuntimeManifest;
   readonly authenticationProtocolTransition: boolean;
-  manifest: PlatformInstallationManifest;
-  secrets: PlatformInstallationSecrets;
   readonly now: () => string;
   readonly dependencies: PlatformInstallerDependencies;
-  readonly workerSecretUpdateIntent: PlatformWorkerSecretUpdateIntent | null;
 }): Promise<void> {
   const {
+    state,
     releaseDatabaseLock,
     runtime,
     authenticationProtocolTransition,
     now,
     dependencies,
-    workerSecretUpdateIntent,
   } = input;
+  const { workerSecretUpdateIntent } = state;
 
   const liveAuthentication = await releaseDatabaseLock.readAuthenticationState?.();
   if (liveAuthentication) {
-    input.authenticationEnforcementActive = liveAuthentication.sessionsRequired;
+    state.authenticationEnforcementActive = liveAuthentication.sessionsRequired;
     if (liveAuthentication.sessionsRequired && runtime.authenticationProtocolVersion !== 1) {
       throw new Error(
         'platform: This runtime cannot enforce the active authentication configuration. Use an authentication-compatible runtime.',
       );
     }
     const deployment = mergePlatformLiveAuthenticationDeployment(
-      input.plan.deployment,
+      state.plan.deployment,
       liveAuthentication,
     );
-    input.plan = { ...input.plan, deployment };
+    state.plan = { ...state.plan, deployment };
     if (!authenticationProtocolTransition) {
-      input.manifest = { ...input.manifest, deployment };
+      state.manifest = { ...state.manifest, deployment };
     }
   }
   if (
     !liveAuthentication &&
-    input.manifest.deployment.authentication.configurable &&
-    !input.plan.deployment.authentication.configurable
+    state.manifest.deployment.authentication.configurable &&
+    !state.plan.deployment.authentication.configurable
   ) {
-    const authentication = input.manifest.deployment.authentication;
-    const providers = authentication.providers;
-    input.plan = {
-      ...input.plan,
-      deployment: createPlatformDeploymentManifest({
-        ...input.plan.deployment,
-        authentication,
-        capabilities: {
-          ...input.plan.deployment.capabilities,
-          githubOAuth: providers.includes('github'),
-          googleOAuth: providers.includes('google'),
-        },
-      }),
+    state.plan = {
+      ...state.plan,
+      deployment: withAuthentication(
+        state.plan.deployment,
+        state.manifest.deployment.authentication,
+      ),
     };
   }
-  if (authenticationProtocolTransition && !input.plan.deployment.authentication.configurable) {
-    const providers = input.plan.deployment.authentication.providers;
-    const deployment = createPlatformDeploymentManifest({
-      ...input.plan.deployment,
-      authentication: { providers, configurable: true },
-      capabilities: {
-        ...input.plan.deployment.capabilities,
-        githubOAuth: providers.includes('github'),
-        googleOAuth: providers.includes('google'),
-      },
-    });
-    input.plan = { ...input.plan, deployment };
+  if (authenticationProtocolTransition && !state.plan.deployment.authentication.configurable) {
+    state.plan = {
+      ...state.plan,
+      deployment: withAuthentication(state.plan.deployment, {
+        providers: state.plan.deployment.authentication.providers,
+        configurable: true,
+      }),
+    };
   }
   const activateAccessCredentials = () => {
-    if (!input.secrets.accessCredentialsJson) {
+    if (!state.secrets.accessCredentialsJson) {
       return;
     }
-    const credentials: unknown = JSON.parse(input.secrets.accessCredentialsJson);
+    const credentials: unknown = JSON.parse(state.secrets.accessCredentialsJson);
     if (!credentials || typeof credentials !== 'object' || Array.isArray(credentials)) {
       throw new Error('platform: Invalid saved Access credentials.');
     }
     // Lifecycle HTTP calls use API/proxy origins. Retain optional dashboard credentials
     // in recovery storage without activating them, including after protection removal.
-    const origins = [input.plan.apiUrl, input.plan.proxyUrl];
+    const origins = [state.plan.apiUrl, state.plan.proxyUrl];
     activatePlatformAccessCredentials(
       JSON.stringify(
         Object.fromEntries(
@@ -126,30 +127,29 @@ export async function prepareInstallationAuthentication(input: {
     );
   };
   activateAccessCredentials();
-  input.manifest = checkpointAuthenticationResources(input.manifest, input.secrets, now());
-  writeInstallationManifest(input.manifest);
-  await releaseDatabaseLock.checkpoint?.(input.manifest);
+  state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+  writeInstallationManifest(state.manifest);
+  await releaseDatabaseLock.checkpoint?.(state.manifest);
   dependencies.onProgress?.('Checking and creating Cloudflare resources');
   if (
     !authenticationProtocolTransition &&
-    JSON.stringify(input.manifest.deployment) !== JSON.stringify(input.plan.deployment)
+    JSON.stringify(state.manifest.deployment) !== JSON.stringify(state.plan.deployment)
   ) {
-    input.manifest = {
-      ...input.manifest,
-      deployment: input.plan.deployment,
+    state.manifest = {
+      ...state.manifest,
+      deployment: state.plan.deployment,
       updatedAt: now(),
     };
-    writeInstallationManifest(input.manifest);
-    await releaseDatabaseLock.checkpoint?.(input.manifest);
+    writeInstallationManifest(state.manifest);
+    await releaseDatabaseLock.checkpoint?.(state.manifest);
   }
-  await releaseDatabaseLock.checkpoint?.(input.manifest);
-  if (input.manifest.status !== 'provisioning') {
-    input.manifest = transitionInstallation(input.manifest, 'provisioning', now());
-    writeInstallationManifest(input.manifest);
+  if (state.manifest.status !== 'provisioning') {
+    state.manifest = transitionInstallation(state.manifest, 'provisioning', now());
+    writeInstallationManifest(state.manifest);
   }
   if (
     runtime.deploymentExecution !== 1 &&
-    (input.manifest.deploymentExecution === 1 ||
+    (state.manifest.deploymentExecution === 1 ||
       dependencies.databaseRollbackSource?.manifest.deploymentExecution === 1)
   ) {
     // Admission takes a shared row lock on this authoritative checkpoint in the
@@ -158,101 +158,101 @@ export async function prepareInstallationAuthentication(input: {
     if (!releaseDatabaseLock.checkpoint) {
       throw new Error('platform: The database lifecycle lock cannot fence deployment admission.');
     }
-    await releaseDatabaseLock.checkpoint(input.manifest);
+    await releaseDatabaseLock.checkpoint(state.manifest);
     dependencies.onProgress?.('Verifying durable deployment operations have drained');
     await (dependencies.verifyDeploymentExecutionDrain ?? verifyPlatformDeploymentExecutionDrain)(
-      input.plan.apiUrl,
-      createPlatformHealthProbeToken(input.manifest.ownershipNonce),
-      input.manifest.id,
+      state.plan.apiUrl,
+      createPlatformHealthProbeToken(state.manifest.ownershipNonce),
+      state.manifest.id,
     );
   }
 
   if (dependencies.prepareAuthentication) {
     dependencies.onProgress?.('Preparing platform authentication');
     try {
-      input.secrets = {
-        ...input.secrets,
-        ...(await dependencies.prepareAuthentication(input.manifest, input.secrets)),
+      state.secrets = {
+        ...state.secrets,
+        ...(await dependencies.prepareAuthentication(state.manifest, state.secrets)),
       };
     } catch (error) {
       // Preserve provider secrets/ambiguous-create intents written while the preparation
       // hook was running; the outer failure checkpoint must not erase that recovery data.
-      const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-      input.secrets = {
-        ...input.secrets,
+      const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+      state.secrets = {
+        ...state.secrets,
         authenticationPreparation: Object.fromEntries(
           Object.entries(latest).filter(([name]) => isPlatformAuthenticationPreparationKey(name)),
         ),
         authenticationSetupJson:
-          latest.authenticationSetupJson || input.secrets.authenticationSetupJson,
-        authSetupToken: latest.authSetupToken || input.secrets.authSetupToken,
-        authBootstrapCode: latest.authBootstrapCode || input.secrets.authBootstrapCode,
+          latest.authenticationSetupJson || state.secrets.authenticationSetupJson,
+        authSetupToken: latest.authSetupToken || state.secrets.authSetupToken,
+        authBootstrapCode: latest.authBootstrapCode || state.secrets.authBootstrapCode,
         accessProvisioningJson:
-          latest.accessProvisioningJson || input.secrets.accessProvisioningJson,
-        accessCredentialsJson: latest.accessCredentialsJson || input.secrets.accessCredentialsJson,
+          latest.accessProvisioningJson || state.secrets.accessProvisioningJson,
+        accessCredentialsJson: latest.accessCredentialsJson || state.secrets.accessCredentialsJson,
       };
-      input.manifest = checkpointAuthenticationResources(input.manifest, input.secrets, now());
-      writeInstallationManifest(input.manifest);
-      await releaseDatabaseLock.checkpoint?.(input.manifest);
+      state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+      writeInstallationManifest(state.manifest);
+      await releaseDatabaseLock.checkpoint?.(state.manifest);
       throw error;
     }
-    const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-    input.secrets = {
-      ...input.secrets,
+    const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+    state.secrets = {
+      ...state.secrets,
       authenticationPreparation: Object.fromEntries(
         Object.entries(latest).filter(([name]) => isPlatformAuthenticationPreparationKey(name)),
       ),
     };
-    input.manifest = checkpointAuthenticationResources(input.manifest, input.secrets, now());
-    writeInstallationManifest(input.manifest);
-    await releaseDatabaseLock.checkpoint?.(input.manifest);
+    state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+    writeInstallationManifest(state.manifest);
+    await releaseDatabaseLock.checkpoint?.(state.manifest);
     activateAccessCredentials();
-    assertRequiredPlatformSecrets(input.plan, input.manifest, input.secrets);
+    assertRequiredPlatformSecrets(state.plan, state.manifest, state.secrets);
     if (
-      input.secrets.authenticationSetupJson &&
+      state.secrets.authenticationSetupJson &&
       createHash('sha256')
-        .update(input.secrets.authBootstrapCode ?? '')
+        .update(state.secrets.authBootstrapCode ?? '')
         .digest('hex') !==
-        parsePlatformAuthenticationSetup(JSON.parse(input.secrets.authenticationSetupJson))
+        parsePlatformAuthenticationSetup(JSON.parse(state.secrets.authenticationSetupJson))
           .bootstrapCredentialHash
     ) {
       throw new Error(
         'platform: Prepared authentication does not match its administrator setup code.',
       );
     }
-    writePendingInstallationSecrets(input.manifest, {
-      ...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+    writePendingInstallationSecrets(state.manifest, {
+      ...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
       databaseClaimState: 'claimed',
     });
   }
 
   const appAccessSetupRequired =
-    !!input.plan.deployment.appAccess &&
-    !input.manifest.steps.some((step) => step.key === 'app-access-initialized:v1');
+    !!state.plan.deployment.appAccess &&
+    !state.manifest.steps.some((step) => step.key === 'app-access-initialized:v1');
   if (appAccessSetupRequired) {
     if (dependencies.prepareAppAccess) {
       try {
         const appAccessSetupJson = await dependencies.prepareAppAccess(
-          input.manifest,
-          input.secrets,
+          state.manifest,
+          state.secrets,
         );
-        const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-        input.secrets = {
-          ...input.secrets,
+        const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+        state.secrets = {
+          ...state.secrets,
           appAccessSetupJson,
           authenticationPreparation: Object.fromEntries(
             Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)),
           ),
         };
-        writePendingInstallationSecrets(input.manifest, {
-          ...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+        writePendingInstallationSecrets(state.manifest, {
+          ...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
           databaseClaimState: 'claimed',
         });
       } catch (error) {
-        const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-        input.secrets = {
-          ...input.secrets,
-          appAccessSetupJson: latest.appAccessSetupJson || input.secrets.appAccessSetupJson,
+        const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+        state.secrets = {
+          ...state.secrets,
+          appAccessSetupJson: latest.appAccessSetupJson || state.secrets.appAccessSetupJson,
           authenticationPreparation: Object.fromEntries(
             Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)),
           ),
@@ -260,14 +260,14 @@ export async function prepareInstallationAuthentication(input: {
         throw error;
       }
     }
-    if (!input.secrets.appAccessSetupJson) {
+    if (!state.secrets.appAccessSetupJson) {
       throw new Error(
         'platform: Restore the encrypted app access setup checkpoint before resuming.',
       );
     }
-    if (!input.secrets.appAccessSetupToken) {
+    if (!state.secrets.appAccessSetupToken) {
       if (
-        input.manifest.resources.some(
+        state.manifest.resources.some(
           (resource) => resource.key === 'api-worker' && resource.state === 'ready',
         )
       ) {
@@ -275,18 +275,18 @@ export async function prepareInstallationAuthentication(input: {
           'platform: Restore the encrypted app access setup authority before resuming.',
         );
       }
-      input.secrets = { ...input.secrets, appAccessSetupToken: randomBytes(32).toString('hex') };
-      writePendingInstallationSecrets(input.manifest, {
-        ...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+      state.secrets = { ...state.secrets, appAccessSetupToken: randomBytes(32).toString('hex') };
+      writePendingInstallationSecrets(state.manifest, {
+        ...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
         databaseClaimState: 'claimed',
       });
     }
   }
-  if (input.plan.deployment.authentication.accessProtection) {
+  if (state.plan.deployment.authentication.accessProtection) {
     const protection = liveAuthentication
       ? liveAuthentication.protection
-      : input.secrets.authenticationSetupJson
-        ? parsePlatformAuthenticationSetup(JSON.parse(input.secrets.authenticationSetupJson))
+      : state.secrets.authenticationSetupJson
+        ? parsePlatformAuthenticationSetup(JSON.parse(state.secrets.authenticationSetupJson))
             .protection
         : null;
     if (!protection) {
@@ -297,54 +297,54 @@ export async function prepareInstallationAuthentication(input: {
     dependencies.onProgress?.('Verifying current Access policies and protected origins');
     await (dependencies.verifyAccessProtection ?? verifyInstalledPlatformAccessProtection)({
       client: dependencies.client,
-      manifest: input.manifest,
-      plan: input.plan,
-      dashboardUrl: platformDashboardUrl(input.plan.deployment),
+      manifest: state.manifest,
+      plan: state.plan,
+      dashboardUrl: platformDashboardUrl(state.plan.deployment),
       protection,
-      checkpoint: secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+      checkpoint: secretCheckpoint(state.secrets, workerSecretUpdateIntent),
     });
   }
   if (
-    input.plan.deployment.authentication.accessProtection ||
+    state.plan.deployment.authentication.accessProtection ||
     (appAccessSetupRequired &&
-      input.secrets.appAccessSetupJson &&
-      JSON.parse(input.secrets.appAccessSetupJson).managed === true)
+      state.secrets.appAccessSetupJson &&
+      JSON.parse(state.secrets.appAccessSetupJson).managed === true)
   ) {
     dependencies.onProgress?.('Preparing Access for authenticated platform health checks');
     try {
       await (dependencies.prepareHealthAccess ?? ensurePlatformAccessHealthChecks)({
         client: dependencies.client,
-        manifest: input.manifest,
-        plan: input.plan,
-        checkpoint: secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+        manifest: state.manifest,
+        plan: state.plan,
+        checkpoint: secretCheckpoint(state.secrets, workerSecretUpdateIntent),
         save: (accessHealthProvisioningJson) => {
-          input.secrets = { ...input.secrets, accessHealthProvisioningJson };
-          input.manifest = checkpointAuthenticationResources(input.manifest!, input.secrets, now());
-          writePendingInstallationSecrets(input.manifest, {
-            ...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+          state.secrets = { ...state.secrets, accessHealthProvisioningJson };
+          state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+          writePendingInstallationSecrets(state.manifest, {
+            ...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
             databaseClaimState: 'claimed',
           });
-          writeInstallationManifest(input.manifest);
+          writeInstallationManifest(state.manifest);
         },
       });
     } catch (error) {
       if (
         appAccessSetupRequired &&
-        input.secrets.appAccessSetupJson &&
-        JSON.parse(input.secrets.appAccessSetupJson).managed &&
+        state.secrets.appAccessSetupJson &&
+        JSON.parse(state.secrets.appAccessSetupJson).managed &&
         error instanceof PlatformCloudflareApiError &&
         [401, 403].includes(error.status)
       ) {
-        input.secrets = {
-          ...input.secrets,
+        state.secrets = {
+          ...state.secrets,
           authenticationPreparation: {
-            ...input.secrets.authenticationPreparation,
+            ...state.secrets.authenticationPreparation,
             appAccessTokenRejected: 'true',
           },
         };
         writePendingInstallationSecrets(
-          input.manifest,
-          secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+          state.manifest,
+          secretCheckpoint(state.secrets, workerSecretUpdateIntent),
         );
         throw new PlatformAppAccessCredentialError(
           'platform: App access token rejected while preparing health checks. Resume installation to provide a replacement.',
@@ -352,7 +352,7 @@ export async function prepareInstallationAuthentication(input: {
       }
       throw error;
     } finally {
-      await releaseDatabaseLock.checkpoint?.(input.manifest);
+      await releaseDatabaseLock.checkpoint?.(state.manifest);
     }
   }
 }
diff --git a/packages/void/src/cli/platform-install-provisioning.ts b/packages/void/src/cli/platform-install-provisioning.ts
index 6883ef060..95e3e8439 100644
--- a/packages/void/src/cli/platform-install-provisioning.ts
+++ b/packages/void/src/cli/platform-install-provisioning.ts
@@ -1,9 +1,9 @@
 import {
   recordInstallationStep,
   transitionInstallation,
-  type PlatformInstallationManifest,
   type PlatformLifecycleOperation,
 } from '@void/platform';
+import type { PlatformRuntimeManifest } from '@void/platform/installer';
 import { join } from 'pathslash';
 import { verifyPlatformAuthenticationDatabase } from './platform-auth-database.ts';
 import { preparePlatformDatabaseSchema } from './platform-installer-database.ts';
@@ -18,29 +18,24 @@ import {
   hash,
 } from './platform-installer-resources.ts';
 import {
+  type InstallationCheckpointWriter,
+  type PlatformDatabaseLifecycleLock,
   type PlatformInstallerDependencies,
-  type PlatformInstallationSecrets,
   type PlatformInstallationResult,
-  type InstallerClient,
+  type PlatformInstallRunState,
 } from './platform-installer-types.ts';
 import { type PlatformInstallPlan } from './platform-plan.ts';
 import { writeInstallationManifest } from './platform-registry.ts';
 
 export async function provisionInstallationServices(input: {
-  readonly plan: PlatformInstallPlan;
-  manifest: PlatformInstallationManifest;
+  readonly state: PlatformInstallRunState;
   readonly now: () => string;
-  readonly releaseDatabaseLock: import('./platform-installer-types.ts').PlatformDatabaseLifecycleLock;
+  readonly releaseDatabaseLock: PlatformDatabaseLifecycleLock;
   readonly dependencies: PlatformInstallerDependencies;
-  readonly secrets: PlatformInstallationSecrets;
-  readonly writeRemoteInstallationCheckpoint: (
-    client: InstallerClient,
-    checkpointPlan: PlatformInstallPlan,
-    checkpointManifest: PlatformInstallationManifest,
-  ) => Promise<void>;
+  readonly writeRemoteInstallationCheckpoint: InstallationCheckpointWriter;
   readonly checkpointOperation: (phase: PlatformLifecycleOperation['phase']) => Promise<void>;
   readonly externalHyperdriveOriginHash: string | undefined;
-  readonly runtime: import('@void/platform/installer').PlatformRuntimeManifest;
+  readonly runtime: PlatformRuntimeManifest;
   readonly runtimeDirectory: string;
   readonly sourcePlatformVersion: string | null;
   readonly hadPriorWorkers: boolean;
@@ -58,11 +53,10 @@ export async function provisionInstallationServices(input: {
     }
 > {
   const {
-    plan,
+    state,
     now,
     releaseDatabaseLock,
     dependencies,
-    secrets,
     writeRemoteInstallationCheckpoint,
     checkpointOperation,
     externalHyperdriveOriginHash,
@@ -71,6 +65,7 @@ export async function provisionInstallationServices(input: {
     sourcePlatformVersion,
     hadPriorWorkers,
   } = input;
+  const { plan, secrets } = state;
 
   const routingAction = plan.actions.find((action) => action.key === 'routing-kv')!;
   if (routingAction.action === 'adopt') {
@@ -78,22 +73,22 @@ export async function provisionInstallationServices(input: {
   }
   if (routingAction.action === 'reuse') {
     if (
-      !input.manifest.resources.some((resource) => resource.key === routingAction.key) &&
+      !state.manifest.resources.some((resource) => resource.key === routingAction.key) &&
       routingAction.id
     ) {
-      input.manifest = recordResource(
-        input.manifest,
+      state.manifest = recordResource(
+        state.manifest,
         routingAction,
         routingAction.id,
         'created',
         now(),
       );
-      writeInstallationManifest(input.manifest);
+      writeInstallationManifest(state.manifest);
     }
   } else {
-    input.manifest = recordProvisionIntent(input.manifest, routingAction, now());
-    writeInstallationManifest(input.manifest);
-    await releaseDatabaseLock.checkpoint?.(input.manifest);
+    state.manifest = recordProvisionIntent(state.manifest, routingAction, now());
+    writeInstallationManifest(state.manifest);
+    await releaseDatabaseLock.checkpoint?.(state.manifest);
     const routing = await createResource(
       dependencies.client,
       plan,
@@ -101,48 +96,48 @@ export async function provisionInstallationServices(input: {
       secrets.databaseUrl,
       '',
     );
-    input.manifest = recordResource(input.manifest, routingAction, routing.id, 'created', now());
-    writeInstallationManifest(input.manifest);
+    state.manifest = recordResource(state.manifest, routingAction, routing.id, 'created', now());
+    writeInstallationManifest(state.manifest);
   }
-  await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+  await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
 
   const zoneAction = plan.actions.find((action) => action.key === 'zone');
   let zone = plan.zone;
   if (zoneAction) {
     if (zoneAction.action === 'create') {
-      input.manifest = recordProvisionIntent(input.manifest, zoneAction, now());
-      writeInstallationManifest(input.manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+      state.manifest = recordProvisionIntent(state.manifest, zoneAction, now());
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
       zone = await dependencies.client.createZone(plan.account.id, zoneAction.name);
     }
     if (!zone) {
       throw new Error('platform: Cloudflare did not return the platform zone.');
     }
     if (zoneAction.action === 'adopt') {
-      input.manifest = recordAdoptionIntent(input.manifest, zoneAction, zone.id, now());
-      writeInstallationManifest(input.manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+      state.manifest = recordAdoptionIntent(state.manifest, zoneAction, zone.id, now());
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
     }
-    input.manifest = recordResource(
-      input.manifest,
+    state.manifest = recordResource(
+      state.manifest,
       zoneAction,
       zone.id,
       zoneAction.action === 'adopt'
         ? 'adopted'
-        : zoneAction.action === 'create' || hasProvisionIntent(input.manifest, zoneAction)
+        : zoneAction.action === 'create' || hasProvisionIntent(state.manifest, zoneAction)
           ? 'created'
           : undefined,
       now(),
     );
-    writeInstallationManifest(input.manifest);
-    await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+    writeInstallationManifest(state.manifest);
+    await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
     if (zone.status !== 'active') {
-      input.manifest = transitionInstallation(input.manifest, 'waiting-for-dns', now());
+      state.manifest = transitionInstallation(state.manifest, 'waiting-for-dns', now());
       await checkpointOperation('waiting-for-dns');
-      writeInstallationManifest(input.manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
       return {
-        manifest: input.manifest,
+        manifest: state.manifest,
         waitingForDns: true,
         waitingForSandboxDrain: false,
         zoneNameServers: zone.nameServers,
@@ -150,8 +145,8 @@ export async function provisionInstallationServices(input: {
     }
   }
   const zoneId = zone?.id ?? '';
-  input.manifest = await reconcilePlatformInstallationResources(
-    input.manifest,
+  state.manifest = await reconcilePlatformInstallationResources(
+    state.manifest,
     plan,
     secrets,
     zoneId,
@@ -160,12 +155,12 @@ export async function provisionInstallationServices(input: {
     now,
     writeRemoteInstallationCheckpoint,
     (next) => {
-      input.manifest = next;
+      state.manifest = next;
     },
   );
 
   dependencies.onProgress?.('Verifying uncached authentication database reads');
-  const authenticationDatabase = input.manifest.resources.find(
+  const authenticationDatabase = state.manifest.resources.find(
     (resource) => resource.key === 'hyperdrive',
   );
   if (!authenticationDatabase) {
@@ -178,25 +173,24 @@ export async function provisionInstallationServices(input: {
     secrets.databaseUrl,
   );
 
-  input.manifest = await preparePlatformDatabaseSchema(
-    input.manifest,
+  state.manifest = await preparePlatformDatabaseSchema(
+    state.manifest,
     runtime,
     runtimeDirectory,
     sourcePlatformVersion,
     hadPriorWorkers,
     plan,
-    secrets,
     dependencies,
     releaseDatabaseLock,
     now,
     writeRemoteInstallationCheckpoint,
     (next) => {
-      input.manifest = next;
+      state.manifest = next;
     },
   );
 
   dependencies.onProgress?.('Checking platform safety');
-  const targetSandboxDrainProtocol = runtime.safetyProtocols?.sandboxDrain ?? 0;
+  const targetSandboxDrainProtocol = runtime.safetyProtocols.sandboxDrain;
   const prepareSandboxDrain =
     dependencies.prepareSandboxDrain ?? releaseDatabaseLock.prepareSandboxDrain;
   if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) {
@@ -221,25 +215,25 @@ export async function provisionInstallationServices(input: {
   const sandboxDrainState = sandboxDrainPreparation?.state ?? 'complete';
   if (
     targetSandboxDrainProtocol >= 1 &&
-    (input.manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol
+    (state.manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol
   ) {
-    input.manifest = {
-      ...input.manifest,
+    state.manifest = {
+      ...state.manifest,
       safetyProtocols: { sandboxDrain: targetSandboxDrainProtocol },
       updatedAt: now(),
     };
-    writeInstallationManifest(input.manifest);
-    await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+    writeInstallationManifest(state.manifest);
+    await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
   }
 
-  input.manifest = transitionInstallation(input.manifest, 'deploying', now());
+  state.manifest = transitionInstallation(state.manifest, 'deploying', now());
   await checkpointOperation('deploying');
-  writeInstallationManifest(input.manifest);
+  writeInstallationManifest(state.manifest);
   const ids = Object.fromEntries(
-    input.manifest.resources.map((resource) => [resource.key, resource.id]),
+    state.manifest.resources.map((resource) => [resource.key, resource.id]),
   );
   const bootstrapStep = 'bootstrap-access:v1';
-  if (!input.manifest.steps.some((step) => step.key === bootstrapStep)) {
+  if (!state.manifest.steps.some((step) => step.key === bootstrapStep)) {
     const routingKv = requireId(ids, 'routing-kv');
     await dependencies.client.putKvValue(plan.account.id, routingKv, 'signup:enabled', 'true');
     await dependencies.client.putKvValue(
@@ -248,8 +242,8 @@ export async function provisionInstallationServices(input: {
       'signup:allowlist',
       JSON.stringify([]),
     );
-    input.manifest = recordInstallationStep(
-      input.manifest,
+    state.manifest = recordInstallationStep(
+      state.manifest,
       {
         completedAt: now(),
         key: bootstrapStep,
@@ -257,7 +251,7 @@ export async function provisionInstallationServices(input: {
       },
       now(),
     );
-    writeInstallationManifest(input.manifest);
+    writeInstallationManifest(state.manifest);
   }
   const entrypoints = Object.fromEntries(
     Object.entries(runtime.artifacts).map(([key, artifact]) => [
diff --git a/packages/void/src/cli/platform-install-workers.ts b/packages/void/src/cli/platform-install-workers.ts
index 6cdf9d358..cccea4146 100644
--- a/packages/void/src/cli/platform-install-workers.ts
+++ b/packages/void/src/cli/platform-install-workers.ts
@@ -1,94 +1,181 @@
+import { createPlatformWorkerConfigs, type PlatformInstallationManifest } from '@void/platform';
+import { writePlatformTiming } from './platform-installer-process.ts';
 import {
-  createPlatformWorkerConfigs,
-  PLATFORM_DISABLED_KEY,
-  PLATFORM_DISABLED_VALUE,
-  type PlatformInstallationManifest,
-} from '@void/platform';
-import {
-  requireId,
   recordResource,
   recordProvisionIntent,
   inventoryUnmanagedPlatformWorkerTraffic,
   mergePlatformWorkerTrafficConfig,
-  publishPlatformWorkerCustomDomains,
 } from './platform-installer-resources.ts';
 import { platformWorkerSecretPayload } from './platform-installer-secrets.ts';
 import {
+  type InstallationCheckpointWriter,
+  type InstallerClient,
   type PlatformInstallerDependencies,
-  type PlatformWorkerRollback,
+  type PlatformWorkerDeploymentOptions,
   type PlatformInstallationSecrets,
+  type PlatformInstallRunState,
   type PlatformWorkerKey,
-  type PlatformWorkerSecretUpdateIntent,
-  type InstallerClient,
 } from './platform-installer-types.ts';
 import {
   runPlatformWrangler,
   deployPlatformWorker,
+  platformWorkerResourceKey,
+  platformWorkerTrafficCallbacks,
   recordWorkerCutoverStage,
   recordWorkerUnsafeTraffic,
-  inspectNewPlatformWorker,
 } from './platform-installer-workers.ts';
 import { type PlatformInstallPlan, type PlatformInstallPlanAction } from './platform-plan.ts';
 import { writeInstallationManifest } from './platform-registry.ts';
-import {
-  platformManagedWorkerTraffic,
-  recordPlatformWorkerTraffic,
-  trackedPlatformWorkerTraffic,
-} from './platform-traffic.ts';
+import { platformManagedWorkerTraffic, recordPlatformWorkerTraffic } from './platform-traffic.ts';
+
+export function platformWorkerAction(
+  workerActions: ReadonlyArray<PlatformInstallPlanAction>,
+  key: PlatformWorkerKey,
+): PlatformInstallPlanAction {
+  return workerActions.find((entry) => entry.key === platformWorkerResourceKey(key))!;
+}
+
+/** Deploy callbacks shared by the upload and enable phases for one platform Worker. */
+export function platformWorkerDeployCallbacks(input: {
+  readonly client: InstallerClient;
+  readonly plan: PlatformInstallPlan;
+  readonly zoneId: string;
+  readonly ids: { [k: string]: string };
+  readonly key: PlatformWorkerKey;
+  readonly action: PlatformInstallPlanAction;
+  readonly generation: number;
+  readonly now: () => string;
+  readonly readManifest: () => PlatformInstallationManifest;
+  readonly writeManifest: (manifest: PlatformInstallationManifest) => Promise<void>;
+  readonly checkpoint: (update: () => Promise<void>, safetyRecovery?: boolean) => Promise<void>;
+}): Pick<
+  PlatformWorkerDeploymentOptions,
+  | 'readCloudflare'
+  | 'onStaged'
+  | 'onTrafficPublished'
+  | 'onUnsafeTraffic'
+  | 'publishCustomDomains'
+  | 'publishRoutes'
+  | 'inspectNewWorker'
+  | 'retainNewWorker'
+> {
+  const {
+    client,
+    plan,
+    zoneId,
+    ids,
+    key,
+    action,
+    generation,
+    now,
+    readManifest,
+    writeManifest,
+    checkpoint,
+  } = input;
+  return {
+    readCloudflare: (path) => client.request(path),
+    onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
+      await checkpoint(async () => {
+        await writeManifest(
+          recordWorkerCutoverStage(
+            readManifest(),
+            generation,
+            key,
+            previousVersionId,
+            stagedVersionId,
+            action.name,
+            previousTriggers,
+            now(),
+          ),
+        );
+      });
+    },
+    onTrafficPublished: async () => {
+      const [customDomains, routes] = await Promise.all([
+        client.listWorkerDomains(plan.account.id),
+        zoneId ? client.listWorkerRoutes(zoneId) : Promise.resolve([]),
+      ]);
+      await checkpoint(async () => {
+        const manifest = readManifest();
+        const next = recordPlatformWorkerTraffic(
+          manifest,
+          action.name,
+          { customDomains, routes },
+          now(),
+        );
+        if (JSON.stringify(next.resources) !== JSON.stringify(manifest.resources)) {
+          await writeManifest(next);
+        }
+      });
+    },
+    onUnsafeTraffic: async () => {
+      await checkpoint(async () => {
+        await writeManifest(
+          recordWorkerUnsafeTraffic(readManifest(), generation, key, action.name, now()),
+        );
+      }, true);
+    },
+    ...platformWorkerTrafficCallbacks({
+      client,
+      accountId: plan.account.id,
+      ids,
+      key,
+      workerName: action.name,
+      readManifest,
+    }),
+    publishRoutes: async (workerName, patterns) => {
+      if (zoneId) {
+        await client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
+      } else if (patterns.length > 0) {
+        throw new Error('platform: Cannot publish zone routes in workers.dev mode.');
+      }
+    },
+  };
+}
 
 export async function uploadInstallationWorkers(input: {
+  readonly state: PlatformInstallRunState;
   readonly dependencies: PlatformInstallerDependencies;
   readonly requiresStagedCommit: boolean;
-  readonly workerSecretUpdateIntent: PlatformWorkerSecretUpdateIntent | null;
   readonly recoveringUnsafeTraffic: boolean;
   readonly workerActions: ReadonlyArray<PlatformInstallPlanAction>;
   readonly workerKeys: ReadonlyArray<PlatformWorkerKey>;
   readonly workerDeploymentSecrets: PlatformInstallationSecrets;
-  readonly plan: PlatformInstallPlan;
   readonly zoneId: string;
-  manifest: PlatformInstallationManifest;
   readonly now: () => string;
-  readonly writeRemoteInstallationCheckpoint: (
-    client: InstallerClient,
-    checkpointPlan: PlatformInstallPlan,
-    checkpointManifest: PlatformInstallationManifest,
-  ) => Promise<void>;
+  readonly writeRemoteInstallationCheckpoint: InstallationCheckpointWriter;
   readonly configs: ReturnType<typeof createPlatformWorkerConfigs>;
   readonly previousConfigs: ReturnType<typeof createPlatformWorkerConfigs>;
   readonly cloudflareApiBaseUrl: string;
-  readonly workerCutoverGeneration: number;
   readonly preserveDisabled: boolean;
   readonly managedRoutes: ReturnType<typeof platformManagedWorkerTraffic>['routes'];
   readonly previousPublicEndpoints: boolean;
   readonly ids: { [k: string]: string };
   readonly runParallelPinnedPlatformWrangler: typeof runPlatformWrangler;
   readonly runPinnedPlatformWrangler: typeof runPlatformWrangler;
-  readonly workerRollbacks: Array<PlatformWorkerRollback>;
 }): Promise<void> {
   const {
+    state,
     dependencies,
     requiresStagedCommit,
-    workerSecretUpdateIntent,
     recoveringUnsafeTraffic,
     workerActions,
     workerKeys,
     workerDeploymentSecrets,
-    plan,
     zoneId,
     now,
     writeRemoteInstallationCheckpoint,
     configs,
     previousConfigs,
     cloudflareApiBaseUrl,
-    workerCutoverGeneration,
     preserveDisabled,
     managedRoutes,
     previousPublicEndpoints,
     ids,
     runParallelPinnedPlatformWrangler,
     runPinnedPlatformWrangler,
-    workerRollbacks,
   } = input;
+  const { plan, workerSecretUpdateIntent, workerCutoverGeneration, workerRollbacks } = state;
 
   const parallelWorkerUploads =
     !dependencies.deployWorker &&
@@ -125,6 +212,11 @@ export async function uploadInstallationWorkers(input: {
     );
     return result;
   };
+  const writeManifest = async (next: PlatformInstallationManifest): Promise<void> => {
+    state.manifest = next;
+    writeInstallationManifest(next);
+    await writeRemoteInstallationCheckpoint(dependencies.client, plan, next);
+  };
   let availableUploadSlots = 2;
   let uploadFailure: unknown;
   const uploadWaiters: Array<{
@@ -176,16 +268,10 @@ export async function uploadInstallationWorkers(input: {
     dependencies.onProgress?.(`Deploying the ${key} service`);
     let workerStepStarted = performance.now();
     const markWorkerStep = (step: string) => {
-      if (process.env.VOID_PLATFORM_TIMINGS === '1') {
-        process.stderr.write(
-          `[platform timing] worker ${key} ${step} ${(performance.now() - workerStepStarted).toFixed(0)} ms\n`,
-        );
-      }
+      writePlatformTiming(`worker ${key} ${step}`, workerStepStarted);
       workerStepStarted = performance.now();
     };
-    const action = workerActions.find(
-      (entry) => entry.key === (key === 'emailGateway' ? 'email-gateway-worker' : `${key}-worker`),
-    )!;
+    const action = platformWorkerAction(workerActions, key);
     const workerSecrets = platformWorkerSecretPayload(
       key,
       workerDeploymentSecrets,
@@ -194,14 +280,12 @@ export async function uploadInstallationWorkers(input: {
       action.action !== 'create',
     );
     await checkpointWorkerManifest(async () => {
-      const intended = recordProvisionIntent(input.manifest!, action, now());
-      if (intended !== input.manifest) {
-        input.manifest = intended;
-        writeInstallationManifest(input.manifest);
-        await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+      const intended = recordProvisionIntent(state.manifest, action, now());
+      if (intended !== state.manifest) {
+        await writeManifest(intended);
       }
     });
-    await dependencies.revalidateBeforeWorkerDeploy(input.manifest!, action);
+    await dependencies.revalidateBeforeWorkerDeploy(state.manifest, action);
     markWorkerStep('revalidate');
     const preservedRoutes = dependencies.deployWorker
       ? []
@@ -217,116 +301,32 @@ export async function uploadInstallationWorkers(input: {
     const rollback = dependencies.deployWorker
       ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig)
       : await deployPlatformWorker(workerConfig, workerSecrets, {
+          ...platformWorkerDeployCallbacks({
+            client: dependencies.client,
+            plan,
+            zoneId,
+            ids,
+            key,
+            action,
+            generation: workerCutoverGeneration,
+            now,
+            readManifest: () => state.manifest,
+            writeManifest,
+            checkpoint: checkpointWorkerManifest,
+          }),
           apiBaseUrl: cloudflareApiBaseUrl,
           operatorApiToken: dependencies.operatorApiToken,
           ...(parallelWorkerUploads
             ? { acquireUploadSlot, onReadyForActivation, waitForPriorWorker }
             : {}),
-          ...(dependencies.client.request
-            ? { readCloudflare: (path) => dependencies.client.request!(path) }
-            : {}),
-          onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
-            await checkpointWorkerManifest(async () => {
-              input.manifest = recordWorkerCutoverStage(
-                input.manifest!,
-                workerCutoverGeneration,
-                key,
-                previousVersionId,
-                stagedVersionId,
-                action.name,
-                previousTriggers,
-                now(),
-              );
-              writeInstallationManifest(input.manifest);
-              await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-            });
-          },
-          onTrafficPublished: async () => {
-            if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) {
-              throw new Error('platform: Cloudflare traffic inventory is unavailable.');
-            }
-            const [customDomains, routes] = await Promise.all([
-              dependencies.client.listWorkerDomains(plan.account.id),
-              zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([]),
-            ]);
-            await checkpointWorkerManifest(async () => {
-              const next = recordPlatformWorkerTraffic(
-                input.manifest!,
-                action.name,
-                { customDomains, routes },
-                now(),
-              );
-              if (JSON.stringify(next.resources) !== JSON.stringify(input.manifest!.resources)) {
-                input.manifest = next;
-                writeInstallationManifest(input.manifest);
-                await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-              }
-            });
-          },
-          onUnsafeTraffic: async () => {
-            await checkpointWorkerManifest(async () => {
-              input.manifest = recordWorkerUnsafeTraffic(
-                input.manifest!,
-                workerCutoverGeneration,
-                key,
-                action.name,
-                now(),
-              );
-              writeInstallationManifest(input.manifest);
-              await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-            }, true);
-          },
           managedRoutes: preserveDisabled
             ? []
             : managedRoutes
                 .filter((route) => route.script === action.name)
                 .map((route) => route.pattern),
           preservedRoutes,
-          publishCustomDomains: (workerName, origins) =>
-            publishPlatformWorkerCustomDomains(
-              dependencies.client,
-              plan.account.id,
-              workerName,
-              origins,
-            ),
-          publishRoutes: async (workerName, patterns) => {
-            if (!dependencies.client.publishWorkerRoutesSafely) {
-              throw new Error('platform: Safe Cloudflare Worker route publication is unavailable.');
-            }
-            if (zoneId) {
-              await dependencies.client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
-            } else if (patterns.length > 0) {
-              throw new Error('platform: Cannot publish zone routes in workers.dev mode.');
-            }
-          },
           previousConfig: previousWorkerConfig,
           previousPublicEndpoints: previousPublicEndpoints,
-          inspectNewWorker: () =>
-            inspectNewPlatformWorker(
-              dependencies.client,
-              plan.account.id,
-              input.manifest!,
-              action.key,
-              action.name,
-            ),
-          removeCustomDomains: async () => {
-            if (!dependencies.client.removeRoutes) {
-              throw new Error('platform: Cloudflare route removal is unavailable.');
-            }
-            await dependencies.client.removeRoutes(
-              plan.account.id,
-              zoneId,
-              trackedPlatformWorkerTraffic(input.manifest!, new Set([action.name])),
-            );
-          },
-          retainNewWorker: async () => {
-            await dependencies.client.putKvValue(
-              plan.account.id,
-              requireId(ids, 'routing-kv'),
-              PLATFORM_DISABLED_KEY,
-              PLATFORM_DISABLED_VALUE,
-            );
-          },
           runner: parallelWorkerUploads
             ? runParallelPinnedPlatformWrangler
             : runPinnedPlatformWrangler,
@@ -337,15 +337,13 @@ export async function uploadInstallationWorkers(input: {
       workerRollbacks.push(rollback);
     }
     await checkpointWorkerManifest(async () => {
-      const recorded = recordResource(input.manifest!, action, action.name, 'created', now());
+      const recorded = recordResource(state.manifest, action, action.name, 'created', now());
       if (
         rollback ||
         dependencies.deployWorker ||
-        JSON.stringify(recorded.resources) !== JSON.stringify(input.manifest!.resources)
+        JSON.stringify(recorded.resources) !== JSON.stringify(state.manifest.resources)
       ) {
-        input.manifest = recorded;
-        writeInstallationManifest(input.manifest);
-        await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+        await writeManifest(recorded);
       }
     });
     markWorkerStep('record');
diff --git a/packages/void/src/cli/platform-installer-database.ts b/packages/void/src/cli/platform-installer-database.ts
index bbd879b55..a1a6393c4 100644
--- a/packages/void/src/cli/platform-installer-database.ts
+++ b/packages/void/src/cli/platform-installer-database.ts
@@ -13,9 +13,9 @@ import type {
 } from '@void/platform/installer';
 import { platformDatabaseSchemaDigest } from '@void/platform/installer';
 import { join } from 'pathslash';
+import type { Pool } from 'pg';
 import { verifyPlatformDatabaseArtifacts } from './platform-installer-runtime.ts';
 import {
-  type PlatformInstallationSecrets,
   type PlatformInstallerDependencies,
   type PlatformDatabaseLifecycleLock,
   type InstallationCheckpointWriter,
@@ -25,13 +25,13 @@ import {
 } from './platform-installer-types.ts';
 import { type PlatformInstallPlan } from './platform-plan.ts';
 import { writeInstallationManifest } from './platform-registry.ts';
-import { readPlatformProjectSlugsConnection } from './platform-teardown.ts';
 import {
   fencePlatformProjectZeroTrustConnection,
   liftPlatformProjectZeroTrustFenceConnection,
   lockPlatformProjectZeroTrustConnection,
   readPlatformProjectZeroTrustStateConnection,
   type PlatformProjectZeroTrustState,
+  type QueryConnection,
 } from './platform-zero-trust-uninstall.ts';
 
 // onManifestChange keeps migration checkpoints visible to the outer failure handler.
@@ -42,7 +42,6 @@ export async function preparePlatformDatabaseSchema(
   sourcePlatformVersion: string | null,
   hadPriorWorkers: boolean,
   plan: PlatformInstallPlan,
-  secrets: PlatformInstallationSecrets,
   dependencies: PlatformInstallerDependencies,
   releaseDatabaseLock: PlatformDatabaseLifecycleLock,
   now: () => string,
@@ -70,25 +69,18 @@ export async function preparePlatformDatabaseSchema(
     await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
   } else if (!manifest.steps.some((step) => step.key === migrationStep)) {
     dependencies.onProgress?.('Applying platform database migrations');
-    const legacyMigrationStep = `database-migrations:${runtime.database.journalSha256}`;
-    if (dependencies.migrateDatabase) {
-      if (!manifest.steps.some((step) => step.key === legacyMigrationStep)) {
-        await dependencies.migrateDatabase(secrets.databaseUrl, join(runtimeDirectory, 'drizzle'));
-      }
-    } else {
-      const prepareDatabase = dependencies.prepareDatabase ?? releaseDatabaseLock.prepareDatabase;
-      if (!prepareDatabase) {
-        throw new Error(
-          'platform: The PostgreSQL lifecycle lock cannot verify or migrate this database.',
-        );
-      }
-      await prepareDatabase(
-        runtimeDirectory,
-        runtime.database,
-        sourcePlatformVersion,
-        hadPriorWorkers,
+    const prepareDatabase = dependencies.prepareDatabase ?? releaseDatabaseLock.prepareDatabase;
+    if (!prepareDatabase) {
+      throw new Error(
+        'platform: The PostgreSQL lifecycle lock cannot verify or migrate this database.',
       );
     }
+    await prepareDatabase(
+      runtimeDirectory,
+      runtime.database,
+      sourcePlatformVersion,
+      hadPriorWorkers,
+    );
     manifest = recordInstallationStep(
       manifest,
       {
@@ -182,22 +174,34 @@ export function platformDatabaseClientUrl(databaseUrl: string): string {
   return url.toString();
 }
 
-export async function claimPlatformDatabase(
+async function withPlatformDatabasePool<T>(
   databaseUrl: string,
-  installationId: string,
-  ownershipNonce: string,
-): Promise<void> {
+  use: (pool: Pool) => Promise<T>,
+): Promise<T> {
   const { Pool } = await import('pg');
   const pool = new Pool({ connectionString: platformDatabaseClientUrl(databaseUrl), max: 1 });
-  const client = await pool.connect();
   try {
-    await claimPlatformDatabaseConnection(client, installationId, ownershipNonce);
+    return await use(pool);
   } finally {
-    client.release();
     await pool.end();
   }
 }
 
+export function claimPlatformDatabase(
+  databaseUrl: string,
+  installationId: string,
+  ownershipNonce: string,
+): Promise<void> {
+  return withPlatformDatabasePool(databaseUrl, async (pool) => {
+    const client = await pool.connect();
+    try {
+      await claimPlatformDatabaseConnection(client, installationId, ownershipNonce);
+    } finally {
+      client.release();
+    }
+  });
+}
+
 export async function acquirePlatformDatabaseLifecycleLock(
   databaseUrl: string,
   installationId: string,
@@ -235,72 +239,83 @@ export async function readPlatformDatabaseLifecycleManifest(
   installationId: string,
   ownershipNonce: string,
 ): Promise<PlatformInstallationManifest | null> {
-  const { Pool } = await import('pg');
-  const pool = new Pool({ connectionString: platformDatabaseClientUrl(databaseUrl), max: 1 });
-  try {
-    return await readPlatformDatabaseLifecycleManifestConnection(
-      pool,
-      installationId,
-      ownershipNonce,
-    );
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith('platform:')) {
-      throw error;
+  return withPlatformDatabasePool(databaseUrl, async (pool) => {
+    try {
+      return await readPlatformDatabaseLifecycleManifestConnection(
+        pool,
+        installationId,
+        ownershipNonce,
+      );
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith('platform:')) {
+        throw error;
+      }
+      throw new Error(
+        `platform: Could not read the PostgreSQL lifecycle checkpoint: ${error instanceof Error ? error.message : String(error)}`,
+      );
     }
-    throw new Error(
-      `platform: Could not read the PostgreSQL lifecycle checkpoint: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  } finally {
-    await pool.end();
-  }
+  });
 }
 
-/** Read project Zero Trust state for a plan, which holds no lifecycle lock. */
-export async function readPlatformProjectZeroTrustState(
+/** Plans hold no lifecycle lock, so verify the installation claim before reading. */
+async function readClaimedPlatformDatabase<T>(
   databaseUrl: string,
   installationId: string,
   ownershipNonce: string,
-): Promise<PlatformProjectZeroTrustState> {
+  read: (pool: Pool) => Promise<T>,
+): Promise<T> {
   if (!databaseUrl) {
     throw new Error('the installation database URL is not recorded on this machine');
   }
-  const { Pool } = await import('pg');
-  const pool = new Pool({ connectionString: platformDatabaseClientUrl(databaseUrl), max: 1 });
-  try {
-    // Throws unless the database is claimed by this installation.
+  return withPlatformDatabasePool(databaseUrl, async (pool) => {
     await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
-    return await readPlatformProjectZeroTrustStateConnection(pool);
-  } finally {
-    await pool.end();
-  }
+    return read(pool);
+  });
 }
 
-/** Read project slugs for a --purge-resources plan, which holds no lifecycle lock. */
-export async function readPlatformProjectSlugs(
+/** Read project Zero Trust state for a plan. */
+export function readPlatformProjectZeroTrustState(
+  databaseUrl: string,
+  installationId: string,
+  ownershipNonce: string,
+): Promise<PlatformProjectZeroTrustState> {
+  return readClaimedPlatformDatabase(
+    databaseUrl,
+    installationId,
+    ownershipNonce,
+    readPlatformProjectZeroTrustStateConnection,
+  );
+}
+
+/** Read project slugs for a --purge-resources plan. */
+export function readPlatformProjectSlugs(
   databaseUrl: string,
   installationId: string,
   ownershipNonce: string,
 ): Promise<ReadonlyArray<string>> {
-  if (!databaseUrl) {
-    throw new Error('the installation database URL is not recorded on this machine');
-  }
-  const { Pool } = await import('pg');
-  const pool = new Pool({ connectionString: platformDatabaseClientUrl(databaseUrl), max: 1 });
-  try {
-    // Throws unless the database is claimed by this installation.
-    await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
-    return await readPlatformProjectSlugsConnection(pool);
-  } finally {
-    await pool.end();
-  }
+  return readClaimedPlatformDatabase(
+    databaseUrl,
+    installationId,
+    ownershipNonce,
+    readPlatformProjectSlugsConnection,
+  );
 }
 
-type DatabaseClaimConnection = Readonly<{
-  query: <Row extends Record<string, unknown> = Record<string, unknown>>(
-    sql: string,
-    values?: ReadonlyArray<unknown>,
-  ) => Promise<{ rows: ReadonlyArray<Row> }>;
-}>;
+/** Slugs of every project row, including projects whose deletion stopped partway. */
+export async function readPlatformProjectSlugsConnection(
+  client: QueryConnection,
+): Promise<ReadonlyArray<string>> {
+  const table = await client.query<{ present: boolean }>(
+    `SELECT to_regclass('public.projects') IS NOT NULL AS "present"`,
+  );
+  if (table.rows[0]?.present !== true) {
+    return [];
+  }
+  const rows = await client.query<{ slug: string }>(
+    'SELECT "slug" FROM "projects" ORDER BY "slug"',
+  );
+  return rows.rows.map((row) => row.slug);
+}
 
 type PlatformDatabaseMigrationRow = Readonly<{
   created_at: unknown;
@@ -309,7 +324,7 @@ type PlatformDatabaseMigrationRow = Readonly<{
 }>;
 
 export async function inspectPlatformDatabaseStateConnection(
-  client: DatabaseClaimConnection,
+  client: QueryConnection,
   database: PlatformRuntimeDatabaseManifest,
 ): Promise<PlatformDatabaseState> {
   const relation = await client.query<{ relation: string | null }>(
@@ -332,14 +347,9 @@ export async function inspectPlatformDatabaseStateConnection(
     );
   }
   let previousTimestamp = -1;
-  const seenTimestamps = new Set<number>();
   for (const [position, row] of result.rows.entries()) {
     const timestampMillis = databaseInteger(row.created_at);
-    if (
-      timestampMillis === null ||
-      timestampMillis <= previousTimestamp ||
-      seenTimestamps.has(timestampMillis)
-    ) {
+    if (timestampMillis === null || timestampMillis <= previousTimestamp) {
       throw new Error(
         'platform: PostgreSQL migration history is duplicated or not strictly ordered.',
       );
@@ -351,7 +361,6 @@ export async function inspectPlatformDatabaseStateConnection(
       );
     }
     previousTimestamp = timestampMillis;
-    seenTimestamps.add(timestampMillis);
   }
   const applied = database.migrations.slice(0, result.rows.length);
   return {
@@ -361,7 +370,7 @@ export async function inspectPlatformDatabaseStateConnection(
 }
 
 export async function preparePlatformDatabaseConnection(
-  client: DatabaseClaimConnection,
+  client: QueryConnection,
   runtimeDirectory: string,
   database: PlatformRuntimeDatabaseManifest,
   sourcePlatformVersion: string | null,
@@ -441,7 +450,7 @@ export async function preparePlatformDatabaseConnection(
 }
 
 export async function readPlatformDatabaseLifecycleManifestConnection(
-  client: DatabaseClaimConnection,
+  client: QueryConnection,
   installationId: string,
   ownershipNonce: string,
 ): Promise<PlatformInstallationManifest | null> {
@@ -483,7 +492,7 @@ export async function readPlatformDatabaseLifecycleManifestConnection(
 }
 
 export async function acquirePlatformDatabaseLifecycleLockConnection(
-  client: DatabaseClaimConnection,
+  client: QueryConnection,
   installationId: string,
   ownershipNonce: string,
 ): Promise<PlatformDatabaseLifecycleLock> {
@@ -626,17 +635,26 @@ export async function acquirePlatformDatabaseLifecycleLockConnection(
   return release;
 }
 
-export async function preparePlatformSandboxDrainConnection(
-  client: DatabaseClaimConnection,
-  requiredAdmissionProtocol: 0 | 2 | 3 = 0,
-): Promise<PlatformSandboxDrainPreparation> {
+type SandboxDrainCheckpointRow = {
+  admission_protocol: number;
+  completed_at: string | null;
+  cursor: unknown;
+  generation: string;
+  phase: string;
+  started_at: string;
+  state: string;
+  updated_at: string;
+};
+
+/** Null when the sandbox-drain checkpoint table does not exist. */
+async function readSandboxDrainTable(
+  client: QueryConnection,
+): Promise<{ hasAdmissionColumn: boolean } | null> {
   const relation = await client.query<{ relation: string | null }>(
     `SELECT to_regclass('"sandbox_drain_checkpoints"')::text AS "relation"`,
   );
   if (!relation.rows[0]?.relation) {
-    throw new Error(
-      'platform: Runtime declares sandbox-drain safety but its database checkpoint table is missing.',
-    );
+    return null;
   }
   const admissionColumn = await client.query<{ present: boolean }>(
     `SELECT EXISTS(
@@ -647,40 +665,33 @@ export async function preparePlatformSandboxDrainConnection(
          AND column_name = 'admission_protocol'
      ) AS "present"`,
   );
-  const hasAdmissionColumn = admissionColumn.rows[0]?.present === true;
+  return { hasAdmissionColumn: admissionColumn.rows[0]?.present === true };
+}
+
+export async function preparePlatformSandboxDrainConnection(
+  client: QueryConnection,
+  requiredAdmissionProtocol: 0 | 2 | 3 = 0,
+): Promise<PlatformSandboxDrainPreparation> {
+  const table = await readSandboxDrainTable(client);
+  if (!table) {
+    throw new Error(
+      'platform: Runtime declares sandbox-drain safety but its database checkpoint table is missing.',
+    );
+  }
+  const { hasAdmissionColumn } = table;
   if (requiredAdmissionProtocol >= 2 && !hasAdmissionColumn) {
     throw new Error(
       'platform: The runtime database does not include the sandbox deployment admission barrier.',
     );
   }
   const readCheckpoint = () =>
-    client.query<{
-      admission_protocol: number;
-      completed_at: string | null;
-      cursor: unknown;
-      generation: string;
-      phase: string;
-      started_at: string;
-      state: string;
-      updated_at: string;
-    }>(
+    client.query<SandboxDrainCheckpointRow>(
       `SELECT ${hasAdmissionColumn ? '"admission_protocol"' : '0 AS "admission_protocol"'}, "generation", "state", "phase", "cursor", "started_at", "updated_at", "completed_at"
        FROM "sandbox_drain_checkpoints"
        WHERE "singleton" = true`,
     );
   const classify = (
-    row:
-      | {
-          admission_protocol: number;
-          completed_at: string | null;
-          cursor: unknown;
-          generation: string;
-          phase: string;
-          started_at: string;
-          state: string;
-          updated_at: string;
-        }
-      | undefined,
+    row: SandboxDrainCheckpointRow | undefined,
   ): PlatformSandboxDrainPreparation | null => {
     if (!row) {
       return null;
@@ -831,8 +842,8 @@ export async function preparePlatformSandboxDrainConnection(
   return preparedState;
 }
 
-export async function verifyPlatformDatabaseConnection(
-  client: DatabaseClaimConnection,
+async function verifyPlatformDatabaseConnection(
+  client: QueryConnection,
   runtimeDirectory: string,
   database: PlatformRuntimeDatabaseManifest,
 ): Promise<void> {
@@ -846,24 +857,13 @@ export async function verifyPlatformDatabaseConnection(
 }
 
 async function readRequiredPlatformSafetyProtocols(
-  client: DatabaseClaimConnection,
+  client: QueryConnection,
 ): Promise<Readonly<{ sandboxDrain: 0 | 1 | 2 | 3 }>> {
-  const relation = await client.query<{ relation: string | null }>(
-    `SELECT to_regclass('"sandbox_drain_checkpoints"')::text AS "relation"`,
-  );
-  if (!relation.rows[0]?.relation) {
+  const table = await readSandboxDrainTable(client);
+  if (!table) {
     return { sandboxDrain: 0 };
   }
-  const admissionColumn = await client.query<{ present: boolean }>(
-    `SELECT EXISTS(
-       SELECT 1
-       FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = 'sandbox_drain_checkpoints'
-         AND column_name = 'admission_protocol'
-     ) AS "present"`,
-  );
-  if (admissionColumn.rows[0]?.present === true) {
+  if (table.hasAdmissionColumn) {
     const admission = await client.query<{ required: boolean; protocol: number | null }>(
       `SELECT EXISTS(
          SELECT 1
@@ -895,10 +895,7 @@ export function assertPlatformRuntimeSafety(
   installed: Readonly<{ sandboxDrain: 0 | 1 | 2 | 3 }>,
   database: Readonly<{ sandboxDrain: 0 | 1 | 2 | 3 }> = { sandboxDrain: 0 },
 ): void {
-  const requiredSandboxDrain = Math.max(
-    installed?.sandboxDrain ?? 0,
-    database?.sandboxDrain ?? 0,
-  ) as 0 | 1 | 2;
+  const requiredSandboxDrain = Math.max(installed.sandboxDrain, database.sandboxDrain);
   if ((runtime.safetyProtocols?.sandboxDrain ?? 0) < requiredSandboxDrain) {
     throw new Error(
       `platform: Void Platform ${runtime.platformVersion} predates the required sandbox-drain safety protocol. Refusing to upload or activate a runtime that could reopen sandbox creation after drain.`,
@@ -906,8 +903,8 @@ export function assertPlatformRuntimeSafety(
   }
 }
 
-export async function claimPlatformDatabaseConnection(
-  client: DatabaseClaimConnection,
+async function claimPlatformDatabaseConnection(
+  client: QueryConnection,
   installationId: string,
   ownershipNonce: string,
 ): Promise<void> {
diff --git a/packages/void/src/cli/platform-installer-errors.ts b/packages/void/src/cli/platform-installer-errors.ts
index c2e174bdb..8b8a52e57 100644
--- a/packages/void/src/cli/platform-installer-errors.ts
+++ b/packages/void/src/cli/platform-installer-errors.ts
@@ -19,10 +19,6 @@ export function assertCleanPlatformWrangler(
   }
 }
 
-export function cleanPlatformCommandResult(): CloudflareCommandResult {
-  return { status: 0, stderr: '', stdout: '' };
-}
-
 export function assertPlatformTriggerStabilization(
   result: Awaited<ReturnType<typeof stabilizeCloudflareVersionTriggers>>,
   workerName: string,
@@ -40,7 +36,3 @@ export function assertPlatformTriggerStabilization(
     );
   }
 }
-
-export function errorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
diff --git a/packages/void/src/cli/platform-installer-inspection.ts b/packages/void/src/cli/platform-installer-inspection.ts
index 3051ac920..a25284e0f 100644
--- a/packages/void/src/cli/platform-installer-inspection.ts
+++ b/packages/void/src/cli/platform-installer-inspection.ts
@@ -15,6 +15,8 @@ import {
   type WorkerInspectionClient,
 } from './platform-installer-types.ts';
 
+export class PlatformWorkerOwnershipError extends Error {}
+
 export async function readActivePlatformWorkerVersion(
   configPath: string,
   accountId: string,
@@ -164,9 +166,6 @@ export async function inspectNewPlatformWorker(
   resourceKey: string,
   workerName: string,
 ): Promise<'missing' | 'owned'> {
-  if (!client.listWorkerNames || !client.getWorkerPlainTextBindings) {
-    throw new Error('platform: Cloudflare Worker ownership inspection is unavailable.');
-  }
   const workerNames = await client.listWorkerNames(accountId);
   if (!workerNames.includes(workerName)) {
     return 'missing';
@@ -296,7 +295,7 @@ export async function readPlatformWorkerVersionSnapshot(
     ownershipBindings.length !== 1 ||
     (ownershipBindings[0] as { text: string }).text !== expectedOwnershipMarker
   ) {
-    throw new Error(
+    throw new PlatformWorkerOwnershipError(
       `platform: Active Worker version ${versionId} for ${workerName} does not belong to this installation.`,
     );
   }
diff --git a/packages/void/src/cli/platform-installer-process.ts b/packages/void/src/cli/platform-installer-process.ts
index c3baba9c6..4c7cf9a0b 100644
--- a/packages/void/src/cli/platform-installer-process.ts
+++ b/packages/void/src/cli/platform-installer-process.ts
@@ -37,6 +37,15 @@ export async function runPlatformWrangler(
 
 const PLATFORM_WRANGLER_TIMEOUT_MS = 10 * 60 * 1000;
 
+/** Opt-in maintainer diagnostics, enabled with VOID_PLATFORM_TIMINGS=1. */
+export function writePlatformTiming(label: string, startedAt: number): void {
+  if (process.env.VOID_PLATFORM_TIMINGS === '1') {
+    process.stderr.write(
+      `[platform timing] ${label} ${(performance.now() - startedAt).toFixed(0)} ms\n`,
+    );
+  }
+}
+
 export async function runPlatformWranglerAtApiBase(
   operation: CloudflareOperation,
   accountId: string,
@@ -48,7 +57,7 @@ export async function runPlatformWranglerAtApiBase(
 ): Promise<CloudflareCommandResult> {
   const startedAt = performance.now();
   const runner = createDefaultRunWrangler(process.cwd(), {
-    launcher: resolveCloudflareOperationArgv(process.cwd()),
+    launcher: resolveCloudflareOperationArgv(),
     parallelWorkerUpload,
     timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS,
   });
@@ -58,11 +67,7 @@ export async function runPlatformWranglerAtApiBase(
     apiToken,
     cwd,
   });
-  if (process.env.VOID_PLATFORM_TIMINGS === '1') {
-    process.stderr.write(
-      `[platform timing] Cloudflare ${operation.type} ${(performance.now() - startedAt).toFixed(0)} ms\n`,
-    );
-  }
+  writePlatformTiming(`Cloudflare ${operation.type}`, startedAt);
   const stdout = result.stdout || '';
   const stderr = result.stderr || '';
   // Void owns progress output. Successful commands may still emit banners and
diff --git a/packages/void/src/cli/platform-installer-resources.ts b/packages/void/src/cli/platform-installer-resources.ts
index 4fe3e69ea..3d6e5b6a5 100644
--- a/packages/void/src/cli/platform-installer-resources.ts
+++ b/packages/void/src/cli/platform-installer-resources.ts
@@ -15,6 +15,7 @@ import {
   type CloudflareNamedResource,
   type CloudflareWorkerCustomDomainOrigin,
 } from './platform-cloudflare.ts';
+import { writePlatformTiming } from './platform-installer-process.ts';
 import {
   type PlatformInstallationSecrets,
   type PlatformInstallerDependencies,
@@ -23,8 +24,12 @@ import {
   type PlatformDatabaseLifecycleLock,
 } from './platform-installer-types.ts';
 import {
+  dnsRecordConfigHash,
+  hasProvisionIntentStep,
+  legacyResourceConfigHash,
   platformAdoptionIntentHash,
   platformProvisionIntentHash,
+  r2BucketConfigHash,
   type PlatformInstallPlan,
   type PlatformInstallPlanAction,
 } from './platform-plan.ts';
@@ -183,11 +188,7 @@ export async function writeRemoteInstallationCheckpointWithoutDatabase(
 ): Promise<void> {
   const startedAt = performance.now();
   await databaseLock?.checkpoint?.(manifest);
-  if (process.env.VOID_PLATFORM_TIMINGS === '1') {
-    process.stderr.write(
-      `[platform timing] database checkpoint ${(performance.now() - startedAt).toFixed(0)} ms\n`,
-    );
-  }
+  writePlatformTiming('database checkpoint', startedAt);
   const routing = manifest.resources.find(
     (resource) =>
       resource.key === 'routing-kv' &&
@@ -205,11 +206,7 @@ export async function writeRemoteInstallationCheckpointWithoutDatabase(
     REMOTE_INSTALLATION_MANIFEST_KEY,
     JSON.stringify(manifest),
   );
-  if (process.env.VOID_PLATFORM_TIMINGS === '1') {
-    process.stderr.write(
-      `[platform timing] remote checkpoint ${(performance.now() - kvStartedAt).toFixed(0)} ms\n`,
-    );
-  }
+  writePlatformTiming('remote checkpoint', kvStartedAt);
 }
 
 export function recordProvisionIntent(
@@ -219,6 +216,9 @@ export function recordProvisionIntent(
 ): PlatformInstallationManifest {
   const previousResourceId =
     manifest.resources.find((resource) => resource.key === action.key)?.id ?? null;
+  if (hasProvisionIntentStep(manifest, action.key, action.kind, action.name, previousResourceId)) {
+    return manifest;
+  }
   const resultHash = platformProvisionIntentHash(
     manifest,
     action.key,
@@ -226,15 +226,6 @@ export function recordProvisionIntent(
     action.name,
     previousResourceId,
   );
-  const existing = manifest.steps.find(
-    (step) =>
-      (step.key === `provision-intent:${action.key}` ||
-        step.key.startsWith(`provision-intent:${action.key}:`)) &&
-      step.resultHash === resultHash,
-  );
-  if (existing) {
-    return manifest;
-  }
   return recordInstallationStep(
     manifest,
     {
@@ -269,19 +260,7 @@ export function hasProvisionIntent(
 ): boolean {
   const previousResourceId =
     manifest.resources.find((resource) => resource.key === action.key)?.id ?? null;
-  return manifest.steps.some(
-    (step) =>
-      (step.key === `provision-intent:${action.key}` ||
-        step.key.startsWith(`provision-intent:${action.key}:`)) &&
-      step.resultHash ===
-        platformProvisionIntentHash(
-          manifest,
-          action.key,
-          action.kind,
-          action.name,
-          previousResourceId,
-        ),
-  );
+  return hasProvisionIntentStep(manifest, action.key, action.kind, action.name, previousResourceId);
 }
 
 export async function createResource(
@@ -333,7 +312,7 @@ export function recordResource(
               ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl))
               : action.kind === 'r2-bucket' && resourceFingerprint
                 ? r2BucketConfigHash(action.name, resourceFingerprint)
-                : hash(JSON.stringify({ kind: action.kind, name: action.name })),
+                : legacyResourceConfigHash(action.kind, action.name),
       id,
       key: action.key,
       kind: action.kind,
@@ -345,10 +324,6 @@ export function recordResource(
   );
 }
 
-export function r2BucketConfigHash(name: string, fingerprint: string): string {
-  return hash(JSON.stringify({ fingerprint, kind: 'r2-bucket', name }));
-}
-
 export function retainReplacedInstallationResource(
   manifest: PlatformInstallationManifest,
   action: PlatformInstallPlanAction,
@@ -408,11 +383,6 @@ export async function inventoryUnmanagedPlatformWorkerTraffic(
   plan: PlatformInstallPlan,
   workerName: string,
 ): Promise<ReadonlyArray<unknown>> {
-  if (!client.listWorkerDomains || !client.listWorkerServiceRoutes) {
-    throw new Error(
-      `platform: Cloudflare traffic inventory is required before updating Worker ${JSON.stringify(workerName)}.`,
-    );
-  }
   const [routes, domains] = await Promise.all([
     client.listWorkerServiceRoutes(plan.account.id, workerName),
     client.listWorkerDomains(plan.account.id),
@@ -546,18 +516,6 @@ function requiredBoolean(value: unknown, field: string): boolean {
   return value;
 }
 
-export async function publishPlatformWorkerCustomDomains(
-  client: InstallerClient,
-  accountId: string,
-  workerName: string,
-  origins: ReadonlyArray<CloudflareWorkerCustomDomainOrigin>,
-): Promise<void> {
-  if (!client.publishWorkerCustomDomainsSafely) {
-    throw new Error('platform: Safe Cloudflare Custom Domain publication is unavailable.');
-  }
-  await client.publishWorkerCustomDomainsSafely(accountId, workerName, origins);
-}
-
 function uniqueTriggerRoutes(routes: ReadonlyArray<unknown>): ReadonlyArray<unknown> {
   const seen = new Set<string>();
   return routes.filter((route) => {
@@ -570,15 +528,6 @@ function uniqueTriggerRoutes(routes: ReadonlyArray<unknown>): ReadonlyArray<unkn
   });
 }
 
-function dnsRecordConfigHash(
-  name: string,
-  type: string,
-  content: string,
-  proxied: boolean,
-): string {
-  return hash(JSON.stringify({ content, kind: 'dns-record', name, proxied, type }));
-}
-
 export function hash(value: string | Buffer): string {
   return createHash('sha256').update(value).digest('hex');
 }
diff --git a/packages/void/src/cli/platform-installer-runtime.ts b/packages/void/src/cli/platform-installer-runtime.ts
index 934b7bee1..aee3951ba 100644
--- a/packages/void/src/cli/platform-installer-runtime.ts
+++ b/packages/void/src/cli/platform-installer-runtime.ts
@@ -6,8 +6,8 @@ import type {
 } from '@void/platform/installer';
 import { resolvePlatformRuntime } from '@void/platform/installer';
 import { join } from 'pathslash';
+import { getErrorMessage } from './output.ts';
 import { hash } from './platform-installer-resources.ts';
-import { errorMessage } from './platform-installer-workers.ts';
 
 export function loadPlatformRuntime(customRuntimeDirectory: string): PlatformRuntime {
   const runtime = resolvePlatformRuntime(customRuntimeDirectory || undefined);
@@ -33,7 +33,7 @@ export function verifyRuntimeArtifacts(
     try {
       contents = readFileSync(path);
     } catch (error) {
-      throw new Error(`platform: Runtime artifact is missing: ${errorMessage(error)}`);
+      throw new Error(`platform: Runtime artifact is missing: ${getErrorMessage(error)}`);
     }
     if (contents.byteLength !== artifact.size || hash(contents) !== artifact.sha256) {
       throw new Error(`platform: Runtime artifact failed integrity verification: ${path}.`);
@@ -52,7 +52,7 @@ export function verifyPlatformDatabaseArtifacts(
     journal = readFileSync(journalPath);
   } catch (error) {
     throw new Error(
-      `platform: Runtime database migration journal is missing: ${errorMessage(error)}`,
+      `platform: Runtime database migration journal is missing: ${getErrorMessage(error)}`,
     );
   }
   if (hash(journal) !== database.journalSha256) {
@@ -66,7 +66,7 @@ export function verifyPlatformDatabaseArtifacts(
     try {
       contents = readFileSync(path);
     } catch (error) {
-      throw new Error(`platform: Runtime database migration is missing: ${errorMessage(error)}`);
+      throw new Error(`platform: Runtime database migration is missing: ${getErrorMessage(error)}`);
     }
     if (hash(contents) !== migration.sha256) {
       throw new Error(
diff --git a/packages/void/src/cli/platform-installer-secrets.ts b/packages/void/src/cli/platform-installer-secrets.ts
index c3557b4c4..2635944ce 100644
--- a/packages/void/src/cli/platform-installer-secrets.ts
+++ b/packages/void/src/cli/platform-installer-secrets.ts
@@ -9,6 +9,7 @@ import {
 } from './platform-access-setup.ts';
 import {
   type PlatformInstallationSecrets,
+  type PlatformWorkerKey,
   type PlatformWorkerSecretUpdateIntent,
   type PlatformWorkerSecretUpdateName,
   PLATFORM_WORKER_SECRET_UPDATE_NAMES,
@@ -77,10 +78,7 @@ export function createPlatformInstallationSecrets(input: {
     const setup = parsePlatformAuthenticationSetup(JSON.parse(authenticationSetupJson));
     if (
       !existingInstallation &&
-      (authSetupToken.length < 32 ||
-        !/^[a-f0-9]{64}$/.test(authBootstrapCode) ||
-        createHash('sha256').update(authBootstrapCode).digest('hex') !==
-          setup.bootstrapCredentialHash)
+      createHash('sha256').update(authBootstrapCode).digest('hex') !== setup.bootstrapCredentialHash
     ) {
       throw new Error(
         'platform: Valid installation setup authority and a matching administrator setup code are required.',
@@ -140,6 +138,22 @@ export function createPlatformInstallationSecrets(input: {
     !!emailSigningSecret &&
     ((emailEnabled && (!existingEmailEnabled || !checkpoint.emailSigningSecret)) ||
       !!input.emailSigningSecret);
+  const githubOptional = existingInstallation || modernAuthentication;
+  const resolve = (
+    key:
+      | 'bootstrapGitHubId'
+      | 'bootstrapGitHubLogin'
+      | 'cloudflareApiToken'
+      | 'githubClientId'
+      | 'githubClientSecret'
+      | 'r2AccessKeyId'
+      | 'r2SecretAccessKey',
+    requiredName: string,
+    optional: boolean,
+  ): string => {
+    const value = configured(input[key], key);
+    return optional ? value : required(value, requiredName);
+  };
   const explicitWorkerSecretUpdates = withoutEmptySecrets({
     CF_API_TOKEN: input.cloudflareApiToken,
     ...(emailSigningSecretUpdateAuthorized ? { EMAIL_SIGNING_SECRET: emailSigningSecret } : {}),
@@ -174,59 +188,40 @@ export function createPlatformInstallationSecrets(input: {
     pendingWorkerSecretUpdateIntent: input.updateExistingWorkers
       ? pendingWorkerSecretUpdateIntent
       : undefined,
-    bootstrapGitHubId:
-      existingInstallation || modernAuthentication
-        ? configured(input.bootstrapGitHubId, 'bootstrapGitHubId')
-        : required(
-            configured(input.bootstrapGitHubId, 'bootstrapGitHubId'),
-            'resolved administrator GitHub account id',
-          ),
-    bootstrapGitHubLogin:
-      existingInstallation || modernAuthentication
-        ? configured(input.bootstrapGitHubLogin, 'bootstrapGitHubLogin')
-        : required(
-            configured(input.bootstrapGitHubLogin, 'bootstrapGitHubLogin'),
-            'VOID_PLATFORM_ADMIN_GITHUB_LOGIN',
-          ),
-    cloudflareApiToken: existingInstallation
-      ? configured(input.cloudflareApiToken, 'cloudflareApiToken')
-      : required(
-          configured(input.cloudflareApiToken, 'cloudflareApiToken'),
-          'VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN',
-        ),
+    bootstrapGitHubId: resolve(
+      'bootstrapGitHubId',
+      'resolved administrator GitHub account id',
+      githubOptional,
+    ),
+    bootstrapGitHubLogin: resolve(
+      'bootstrapGitHubLogin',
+      'VOID_PLATFORM_ADMIN_GITHUB_LOGIN',
+      githubOptional,
+    ),
+    cloudflareApiToken: resolve(
+      'cloudflareApiToken',
+      'VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN',
+      existingInstallation,
+    ),
     databaseUrl: required(input.databaseUrl || checkpoint.databaseUrl || '', 'DATABASE_URL'),
     emailEnabled,
     emailSigningSecret,
-    githubClientId:
-      existingInstallation || modernAuthentication
-        ? configured(input.githubClientId, 'githubClientId')
-        : required(
-            configured(input.githubClientId, 'githubClientId'),
-            'VOID_PLATFORM_GITHUB_CLIENT_ID',
-          ),
-    githubClientSecret:
-      existingInstallation || modernAuthentication
-        ? configured(input.githubClientSecret, 'githubClientSecret')
-        : required(
-            configured(input.githubClientSecret, 'githubClientSecret'),
-            'VOID_PLATFORM_GITHUB_CLIENT_SECRET',
-          ),
+    githubClientId: resolve('githubClientId', 'VOID_PLATFORM_GITHUB_CLIENT_ID', githubOptional),
+    githubClientSecret: resolve(
+      'githubClientSecret',
+      'VOID_PLATFORM_GITHUB_CLIENT_SECRET',
+      githubOptional,
+    ),
     jwtSecret: resolvedJwtSecret,
     projectSecretActiveKeyVersion: projectSecretKeyring.activeVersion,
     projectSecretKey: projectSecretKeyring.v1Key,
     projectSecretKeysJson: projectSecretKeyring.keysJson,
-    r2AccessKeyId: existingInstallation
-      ? configured(input.r2AccessKeyId, 'r2AccessKeyId')
-      : required(
-          configured(input.r2AccessKeyId, 'r2AccessKeyId'),
-          'VOID_PLATFORM_R2_ACCESS_KEY_ID',
-        ),
-    r2SecretAccessKey: existingInstallation
-      ? configured(input.r2SecretAccessKey, 'r2SecretAccessKey')
-      : required(
-          configured(input.r2SecretAccessKey, 'r2SecretAccessKey'),
-          'VOID_PLATFORM_R2_SECRET_ACCESS_KEY',
-        ),
+    r2AccessKeyId: resolve('r2AccessKeyId', 'VOID_PLATFORM_R2_ACCESS_KEY_ID', existingInstallation),
+    r2SecretAccessKey: resolve(
+      'r2SecretAccessKey',
+      'VOID_PLATFORM_R2_SECRET_ACCESS_KEY',
+      existingInstallation,
+    ),
   };
 }
 
@@ -513,7 +508,7 @@ export function apiWorkerSecrets(
 
 /** Existing Workers inherit live secrets, including complete encryption keyrings. */
 export function platformWorkerSecretPayload(
-  worker: 'api' | 'proxy' | 'emailGateway' | 'tail' | 'dispatch',
+  worker: PlatformWorkerKey,
   secrets: PlatformInstallationSecrets,
   accountId: string,
   zoneId: string,
@@ -534,16 +529,9 @@ export function platformWorkerSecretPayload(
     }
     return proxyWorkerSecrets(secrets, accountId);
   }
-  const allowed =
+  const allowed: ReadonlyArray<string> =
     worker === 'api'
-      ? [
-          'CF_API_TOKEN',
-          'EMAIL_SIGNING_SECRET',
-          'GITHUB_CLIENT_ID',
-          'GITHUB_CLIENT_SECRET',
-          'R2_ACCESS_KEY_ID',
-          'R2_SECRET_ACCESS_KEY',
-        ]
+      ? PLATFORM_WORKER_SECRET_UPDATE_NAMES
       : worker === 'proxy'
         ? ['CF_API_TOKEN', 'EMAIL_SIGNING_SECRET']
         : ['EMAIL_SIGNING_SECRET'];
diff --git a/packages/void/src/cli/platform-installer-types.ts b/packages/void/src/cli/platform-installer-types.ts
index 212233b5a..6335121dc 100644
--- a/packages/void/src/cli/platform-installer-types.ts
+++ b/packages/void/src/cli/platform-installer-types.ts
@@ -175,6 +175,7 @@ export type PlatformDatabaseMigrationResult = Readonly<{
 
 export type InstallerClient = Pick<
   PlatformCloudflareClient,
+  | 'apiBaseUrl'
   | 'createDispatchNamespace'
   | 'createDnsRecord'
   | 'createAiGateway'
@@ -185,28 +186,22 @@ export type InstallerClient = Pick<
   | 'createQueue'
   | 'createR2Bucket'
   | 'createZone'
+  | 'deleteKvValue'
+  | 'getWorkerPlainTextBindings'
+  | 'listWorkerDomains'
+  | 'listWorkerNames'
+  | 'listWorkerRoutes'
+  | 'listWorkerServiceRoutes'
+  | 'publishWorkerCustomDomainsSafely'
+  | 'publishWorkerRoutesSafely'
   | 'putKvValue'
   | 'putR2Object'
-> &
-  Partial<
-    Pick<
-      PlatformCloudflareClient,
-      | 'request'
-      | 'apiBaseUrl'
-      | 'deleteKvValue'
-      | 'getWorkerPlainTextBindings'
-      | 'listWorkerDomains'
-      | 'listWorkerNames'
-      | 'listWorkerServiceRoutes'
-      | 'listWorkerRoutes'
-      | 'publishWorkerCustomDomainsSafely'
-      | 'publishWorkerRoutesSafely'
-      | 'removeRoutes'
-    >
-  > & { readonly apiBaseUrl?: string };
+  | 'request'
+>;
 
-export type WorkerInspectionClient = Partial<
-  Pick<PlatformCloudflareClient, 'getWorkerPlainTextBindings' | 'listWorkerNames'>
+export type WorkerInspectionClient = Pick<
+  PlatformCloudflareClient,
+  'getWorkerPlainTextBindings' | 'listWorkerNames'
 >;
 
 export type PlatformWorkerRollback = () => Promise<void>;
@@ -261,7 +256,6 @@ export type PlatformInstallerDependencies = Readonly<{
     secrets: Record<string, string> | null,
     previousConfig: Record<string, unknown>,
   ) => Promise<PlatformWorkerRollback | void>;
-  migrateDatabase?: (databaseUrl: string, migrationsFolder: string) => Promise<void>;
   now?: () => string;
   onProgress?: (message: string) => void;
   operation?: PlatformLifecycleOperation['action'];
@@ -304,6 +298,18 @@ export type PlatformInstallerDependencies = Readonly<{
   ) => Promise<void>;
 }>;
 
+/** What installPlatform and its phases update while an installation runs. */
+export type PlatformInstallRunState = {
+  manifest: PlatformInstallationManifest;
+  plan: PlatformInstallPlan;
+  secrets: PlatformInstallationSecrets;
+  workerSecretUpdateIntent: PlatformWorkerSecretUpdateIntent | null;
+  workerCutoverGeneration: number;
+  workerRollbacks: Array<PlatformWorkerRollback>;
+  workerDeploymentCommitted: boolean;
+  authenticationEnforcementActive: boolean;
+};
+
 export type PlatformInstallationResult = Readonly<{
   emailOperationId?: string;
   manifest: PlatformInstallationManifest;
@@ -343,7 +349,6 @@ export type PlatformWorkerDeploymentOptions = Readonly<{
     origins: ReadonlyArray<CloudflareWorkerCustomDomainOrigin>,
   ) => Promise<void>;
   publishRoutes: (workerName: string, patterns: ReadonlyArray<string>) => Promise<void>;
-  removeCustomDomains: () => Promise<void>;
   retainNewWorker: () => Promise<void>;
   /** False uploads a new version even when the active one has identical input. */
   reuseMatchingVersion?: boolean;
diff --git a/packages/void/src/cli/platform-installer-workers.ts b/packages/void/src/cli/platform-installer-workers.ts
index c23a323f1..0f2b9187b 100644
--- a/packages/void/src/cli/platform-installer-workers.ts
+++ b/packages/void/src/cli/platform-installer-workers.ts
@@ -27,13 +27,13 @@ import {
   type PlatformInstallationManifest,
 } from '@void/platform';
 import { dirname, join, resolve } from 'pathslash';
+import { getErrorMessage } from './output.ts';
 import {
   PlatformWorkerCustomDomainsChangedError,
   PlatformWorkerRoutesChangedError,
   type CloudflareWorkerCustomDomainOrigin,
 } from './platform-cloudflare.ts';
 import {
-  interruptedWorkerCutover,
   readTriggerConfigFromObject,
   recordWorkerCutoverResolution,
   recordWorkerTrafficState,
@@ -41,9 +41,7 @@ import {
   resolvePlatformPreviousTriggerConfig,
 } from './platform-installer-cutover.ts';
 import {
-  cleanPlatformCommandResult,
   assertPlatformTriggerStabilization,
-  errorMessage,
   assertCleanPlatformWrangler,
 } from './platform-installer-errors.ts';
 import {
@@ -55,6 +53,7 @@ import {
   readPlatformWorkerVersionSnapshot,
   readPlatformWorkerOwnershipMarker,
   classifyPlatformWorkerDeploymentLineage,
+  PlatformWorkerOwnershipError,
   samePlatformWorkerTraffic,
 } from './platform-installer-inspection.ts';
 import {
@@ -68,14 +67,15 @@ import {
   isolatePlatformWorkerCustomDomains,
   mergePreservedTriggerRoutes,
   withoutPlatformCustomDomainTriggers,
-  publishPlatformWorkerCustomDomains,
   requireId,
   validateReplannedWorkerActions,
   withoutPlatformWorkerTrafficAttachments,
 } from './platform-installer-resources.ts';
 import {
+  type InstallerClient,
   type PlatformInstallerDependencies,
   type InstallationCheckpointWriter,
+  type InterruptedWorkerCutover,
   type PlatformWorkerKey,
   type PlatformWorkerDeploymentOptions,
   type PlatformWorkerRollback,
@@ -84,32 +84,86 @@ import {
 } from './platform-installer-types.ts';
 import { type PlatformInstallPlan, type PlatformInstallPlanAction } from './platform-plan.ts';
 import { writeInstallationManifest } from './platform-registry.ts';
-import { trackedPlatformWorkerTraffic } from './platform-traffic.ts';
 import { platformWorkerLiveTriggersMatch } from './platform-trigger-proof.ts';
 import { resolveCloudflareOperationArgv } from './preset.ts';
 
+export function platformWorkerResourceKey(key: PlatformWorkerKey): string {
+  return key === 'emailGateway' ? 'email-gateway-worker' : `${key}-worker`;
+}
+
+/** Callbacks shared by a platform Worker deploy and its interrupted-cutover rollback. */
+export function platformWorkerTrafficCallbacks(input: {
+  readonly client: InstallerClient;
+  readonly accountId: string;
+  readonly ids: Readonly<Record<string, string>>;
+  readonly key: PlatformWorkerKey;
+  readonly workerName: string;
+  readonly readManifest: () => PlatformInstallationManifest;
+}): Pick<
+  PlatformWorkerDeploymentOptions,
+  'inspectNewWorker' | 'publishCustomDomains' | 'retainNewWorker'
+> {
+  const { client, accountId, ids, key, workerName, readManifest } = input;
+  return {
+    inspectNewWorker: () =>
+      inspectNewPlatformWorker(
+        client,
+        accountId,
+        readManifest(),
+        platformWorkerResourceKey(key),
+        workerName,
+      ),
+    publishCustomDomains: (name, origins) =>
+      client.publishWorkerCustomDomainsSafely(accountId, name, origins),
+    retainNewWorker: async () => {
+      await client.putKvValue(
+        accountId,
+        requireId(ids, 'routing-kv'),
+        PLATFORM_DISABLED_KEY,
+        PLATFORM_DISABLED_VALUE,
+      );
+    },
+  };
+}
+
 // Restore staged Workers before starting a new generation, then replan any
 // newly created Worker that recovery had to retain.
 export async function recoverInterruptedPlatformWorkerCutover(
-  manifest: PlatformInstallationManifest,
-  interruptedCutover: NonNullable<ReturnType<typeof interruptedWorkerCutover>> | null,
-  workerActions: ReadonlyArray<PlatformInstallPlanAction>,
-  configs: ReturnType<typeof createPlatformWorkerConfigs>,
-  previousConfigs: ReturnType<typeof createPlatformWorkerConfigs>,
-  plan: PlatformInstallPlan,
-  dependencies: PlatformInstallerDependencies,
-  ids: Record<string, string>,
-  zoneId: string,
-  previousPublicEndpoints: boolean,
-  hasEmailGatewayArtifact: boolean,
-  runPinnedPlatformWrangler: typeof runPlatformWrangler,
-  now: () => string,
-  writeRemoteInstallationCheckpoint: InstallationCheckpointWriter,
-  onManifestChange: (manifest: PlatformInstallationManifest) => void,
+  input: Readonly<{
+    manifest: PlatformInstallationManifest;
+    interruptedCutover: InterruptedWorkerCutover | null;
+    workerActions: ReadonlyArray<PlatformInstallPlanAction>;
+    configs: ReturnType<typeof createPlatformWorkerConfigs>;
+    previousConfigs: ReturnType<typeof createPlatformWorkerConfigs>;
+    plan: PlatformInstallPlan;
+    dependencies: PlatformInstallerDependencies;
+    ids: Record<string, string>;
+    previousPublicEndpoints: boolean;
+    hasEmailGatewayArtifact: boolean;
+    runPinnedPlatformWrangler: typeof runPlatformWrangler;
+    now: () => string;
+    writeRemoteInstallationCheckpoint: InstallationCheckpointWriter;
+    onManifestChange: (manifest: PlatformInstallationManifest) => void;
+  }>,
 ): Promise<{
   manifest: PlatformInstallationManifest;
   workerActions: ReadonlyArray<PlatformInstallPlanAction>;
 }> {
+  const {
+    interruptedCutover,
+    configs,
+    previousConfigs,
+    plan,
+    dependencies,
+    ids,
+    previousPublicEndpoints,
+    hasEmailGatewayArtifact,
+    runPinnedPlatformWrangler,
+    now,
+    writeRemoteInstallationCheckpoint,
+    onManifestChange,
+  } = input;
+  let { manifest, workerActions } = input;
   if (interruptedCutover) {
     const recoveryOrder: ReadonlyArray<PlatformWorkerKey> = [
       'dispatch',
@@ -161,39 +215,14 @@ export async function recoverInterruptedPlatformWorkerCutover(
           ),
           previousVersionId: snapshot.previousVersionId,
           preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
-          inspectNewWorker: () =>
-            inspectNewPlatformWorker(
-              dependencies.client,
-              plan.account.id,
-              manifest!,
-              key === 'emailGateway' ? 'email-gateway-worker' : `${key}-worker`,
-              snapshot.workerName,
-            ),
-          removeCustomDomains: async () => {
-            if (!dependencies.client.removeRoutes) {
-              throw new Error('platform: Cloudflare route removal is unavailable.');
-            }
-            await dependencies.client.removeRoutes(
-              plan.account.id,
-              zoneId,
-              trackedPlatformWorkerTraffic(manifest!, new Set([snapshot.workerName])),
-            );
-          },
-          publishCustomDomains: (workerName, origins) =>
-            publishPlatformWorkerCustomDomains(
-              dependencies.client,
-              plan.account.id,
-              workerName,
-              origins,
-            ),
-          retainNewWorker: async () => {
-            await dependencies.client.putKvValue(
-              plan.account.id,
-              requireId(ids, 'routing-kv'),
-              PLATFORM_DISABLED_KEY,
-              PLATFORM_DISABLED_VALUE,
-            );
-          },
+          ...platformWorkerTrafficCallbacks({
+            client: dependencies.client,
+            accountId: plan.account.id,
+            ids,
+            key,
+            workerName: snapshot.workerName,
+            readManifest: () => manifest,
+          }),
           runner: runPinnedPlatformWrangler,
           workerExisted: snapshot.previousVersionId !== null,
           workerName: snapshot.workerName,
@@ -212,17 +241,14 @@ export async function recoverInterruptedPlatformWorkerCutover(
       previousPublicEndpoints && interruptedCutover.unsafeTraffic.size === 0,
       now(),
     );
-    let retainedNewWorker = false;
-    for (const [, snapshot] of interruptedCutover.staged) {
-      if (snapshot.previousVersionId !== null) {
-        continue;
-      }
-      retainedNewWorker = true;
-    }
     onManifestChange(manifest);
     writeInstallationManifest(manifest);
     await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-    if (retainedNewWorker) {
+    if (
+      [...interruptedCutover.staged.values()].some(
+        (snapshot) => snapshot.previousVersionId === null,
+      )
+    ) {
       if (!dependencies.replanWorkers) {
         throw new Error(
           'platform: Recovering retained Workers requires a fresh Cloudflare installation plan.',
@@ -245,7 +271,7 @@ function platformWorkerUploaderHash(): string | null {
     return cachedPlatformUploaderHash;
   }
   try {
-    const launcher = resolveCloudflareOperationArgv(process.cwd())[1];
+    const launcher = resolveCloudflareOperationArgv()[1];
     if (!launcher) {
       return (cachedPlatformUploaderHash = null);
     }
@@ -508,10 +534,6 @@ export async function deployPlatformWorker(
             knownTriggerConfigs: { [versionId]: nextTriggers },
             manageRoutes: false,
             previousTriggerConfig: triggerConfig,
-            publishEmptyCustomDomains: async () => {
-              await options.removeCustomDomains();
-              return cleanPlatformCommandResult();
-            },
             runWrangler: platformWorkerCommandRunner(accountId, directory, runner),
             targetTriggerConfig: nextTriggers,
             targetVersionId: versionId,
@@ -555,7 +577,7 @@ export async function deployPlatformWorker(
           unsafeTraffic: true,
         });
         throw new PlatformWorkerRecoveryIncompleteError(
-          `platform: Worker ${workerName} traffic reconciliation failed: ${errorMessage(error)}${
+          `platform: Worker ${workerName} traffic reconciliation failed: ${getErrorMessage(error)}${
             failures.length > 0 ? ` Safety recovery also failed: ${failures.join('; ')}` : ''
           }`,
           { cause: error },
@@ -607,11 +629,7 @@ export async function deployPlatformWorker(
           candidate = { deploymentId: after[0]!.id, snapshot };
         }
       } catch (error) {
-        if (
-          error instanceof Error &&
-          (error.message.includes('changed concurrently') ||
-            error.message.includes('does not belong to this installation'))
-        ) {
+        if (error instanceof PlatformWorkerOwnershipError) {
           throw error;
         }
         // A read error is not evidence of equality; use the established upload path.
@@ -821,7 +839,7 @@ export async function deployPlatformWorker(
           unsafeTraffic: true,
         });
         throw new PlatformWorkerRecoveryIncompleteError(
-          `platform: Worker ${workerName} changed concurrently during activation, and restoring intervening deployment ${interveningDeployment.id} failed: ${errorMessage(recoveryError)}${
+          `platform: Worker ${workerName} changed concurrently during activation, and restoring intervening deployment ${interveningDeployment.id} failed: ${getErrorMessage(recoveryError)}${
             recoveryFailures.length > 0
               ? ` Safety recovery also failed: ${recoveryFailures.join('; ')}`
               : ''
@@ -841,10 +859,6 @@ export async function deployPlatformWorker(
       },
       manageRoutes: false,
       previousTriggerConfig: previousTriggers,
-      publishEmptyCustomDomains: async () => {
-        await options.removeCustomDomains();
-        return cleanPlatformCommandResult();
-      },
       runWrangler: platformWorkerCommandRunner(accountId, directory, readRunner),
       targetTriggerConfig: nextTriggers,
       targetVersionId: uploadedVersionId,
@@ -872,7 +886,6 @@ export async function deployPlatformWorker(
         previousVersionId,
         preserveCustomDomains: false,
         inspectNewWorker: options.inspectNewWorker,
-        removeCustomDomains: options.removeCustomDomains,
         publishCustomDomains: options.publishCustomDomains,
         retainNewWorker: options.retainNewWorker,
         runner: readRunner,
@@ -895,7 +908,7 @@ export async function deployPlatformWorker(
               activatedDeploymentId,
               activatedVersionId: rollbackVersionId,
               config,
-              nextTriggers: readTriggerConfigFromObject(nextTraffic.wranglerConfig),
+              nextTriggers,
               previousConfig: options.previousConfig,
               previousCustomDomains: previousTraffic.customDomains,
               previousDeployment,
@@ -903,7 +916,6 @@ export async function deployPlatformWorker(
               previousVersionId,
               preserveCustomDomains: unsafeTraffic,
               inspectNewWorker: options.inspectNewWorker,
-              removeCustomDomains: options.removeCustomDomains,
               publishCustomDomains: options.publishCustomDomains,
               retainNewWorker: options.retainNewWorker,
               runner: readRunner,
@@ -915,13 +927,13 @@ export async function deployPlatformWorker(
     });
     if (recoveryFailures.length > 0) {
       throw new PlatformWorkerRecoveryIncompleteError(
-        `platform: ${errorMessage(error)} Automatic recovery for ${workerName} was incomplete: ${recoveryFailures.join('; ')}`,
+        `platform: ${getErrorMessage(error)} Automatic recovery for ${workerName} was incomplete: ${recoveryFailures.join('; ')}`,
         { cause: error },
       );
     }
     if (unsafeTraffic) {
       throw new PlatformWorkerRecoveryIncompleteError(
-        `platform: ${errorMessage(error)} The routing gate remains closed and live Custom Domains were retained for safe reconciliation on retry.`,
+        `platform: ${getErrorMessage(error)} The routing gate remains closed and live Custom Domains were retained for safe reconciliation on retry.`,
         { cause: error },
       );
     }
@@ -942,7 +954,7 @@ export async function recoverFailedPlatformWorkerDeployment(input: {
     try {
       await operation();
     } catch (error) {
-      failures.push(`${label}: ${errorMessage(error)}`);
+      failures.push(`${label}: ${getErrorMessage(error)}`);
     }
   };
   if (input.unsafeTraffic) {
@@ -968,7 +980,6 @@ async function rollbackPlatformWorker(input: {
   previousVersionId: string | null;
   preserveCustomDomains: boolean;
   inspectNewWorker: () => Promise<'missing' | 'owned'>;
-  removeCustomDomains: () => Promise<void>;
   publishCustomDomains: (
     workerName: string,
     origins: ReadonlyArray<CloudflareWorkerCustomDomainOrigin>,
@@ -1004,9 +1015,6 @@ async function rollbackPlatformWorker(input: {
         return;
       }
       await input.retainNewWorker();
-      if (!input.preserveCustomDomains) {
-        await input.removeCustomDomains();
-      }
       return;
     }
     const currentVersionId = await readActivePlatformWorkerVersion(
@@ -1081,10 +1089,6 @@ async function rollbackPlatformWorker(input: {
       },
       manageRoutes: false,
       previousTriggerConfig: input.nextTriggers,
-      publishEmptyCustomDomains: async () => {
-        await input.removeCustomDomains();
-        return cleanPlatformCommandResult();
-      },
       runWrangler: platformWorkerCommandRunner(input.accountId, directory, input.runner),
       targetTriggerConfig: input.previousTriggers,
       targetVersionId: input.previousVersionId,
@@ -1182,14 +1186,9 @@ export async function restorePlatformWorkerDeployment(input: {
   }
 }
 
-export {
-  runPlatformWrangler,
-  runPlatformWranglerAtApiBase,
-  withConditionalPlatformWorkerCreate,
-} from './platform-installer-process.ts';
+export { runPlatformWrangler, runPlatformWranglerAtApiBase } from './platform-installer-process.ts';
 
 export {
-  withoutCompletedPlatformWorkerMigrations,
   nextTrafficGeneration,
   nextWorkerCutoverGeneration,
   recordWorkerSecretUpdateState,
@@ -1200,14 +1199,6 @@ export {
   verifyPlatformWorkerCutoverVersions,
   recordWorkerTrafficState,
   stablePublicEndpointState,
-  resolvePlatformPreviousTriggerConfig,
 } from './platform-installer-cutover.ts';
 
-export {
-  readPlatformWorkerDeployments,
-  classifyPlatformWorkerDeploymentLineage,
-  inspectNewPlatformWorker,
-  readActivePlatformWorkerSnapshot,
-} from './platform-installer-inspection.ts';
-
-export { errorMessage } from './platform-installer-errors.ts';
+export { inspectNewPlatformWorker } from './platform-installer-inspection.ts';
diff --git a/packages/void/src/cli/platform-installer.ts b/packages/void/src/cli/platform-installer.ts
index d39e6e0b4..0df7e582b 100644
--- a/packages/void/src/cli/platform-installer.ts
+++ b/packages/void/src/cli/platform-installer.ts
@@ -5,7 +5,6 @@ import {
   PLATFORM_DISABLED_KEY,
   PLATFORM_DISABLED_VALUE,
   recordInstallationStep,
-  setInstallationDesiredState,
   setInstallationEndpoints,
   platformDashboardUrl,
   transitionInstallation,
@@ -15,6 +14,7 @@ import {
 import { PLATFORM_ADMIN_ASSETS_DIRECTORY, resolvePlatformRuntime } from '@void/platform/installer';
 import { join } from 'pathslash';
 import { ensurePlatformAccessToken } from './cf-access.ts';
+import { getErrorMessage } from './output.ts';
 import {
   initializeInstalledAppAccess,
   PlatformAppAccessCredentialError,
@@ -55,13 +55,13 @@ import {
   PlatformWorkerRecoveryIncompleteError,
   type PlatformInstallationSecrets,
   type PlatformInstallationResult,
+  type PlatformInstallRunState,
   type PlatformWorkerKey,
   type PlatformWorkerSecretUpdateIntent,
   type InstallerClient,
   type PlatformHealthCheckContext,
 } from './platform-installer-types.ts';
 import {
-  errorMessage,
   recordWorkerCutoverResolution,
   recordWorkerTrafficState,
   runPlatformWrangler,
@@ -73,7 +73,11 @@ import {
   nextWorkerCutoverGeneration,
   recordWorkerSecretUpdateState,
 } from './platform-installer-workers.ts';
-import { type PlatformInstallPlan, type PlatformInstallPlanAction } from './platform-plan.ts';
+import {
+  platformWorkersDevUrl,
+  type PlatformInstallPlan,
+  type PlatformInstallPlanAction,
+} from './platform-plan.ts';
 import {
   latestPlatformWorkerCutoverGeneration,
   platformWorkerSecretUpdateIntentState,
@@ -83,7 +87,6 @@ import {
 } from './platform-registry.ts';
 import { assertPlatformWorkerSecretUpdateAuthority } from './platform-secret-update-authority.ts';
 import { platformManagedWorkerTraffic } from './platform-traffic.ts';
-import { resolvePinnedApiBaseUrl } from './provision.ts';
 
 export { PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY as REMOTE_INSTALLATION_MANIFEST_KEY } from '@void/platform';
 
@@ -91,20 +94,37 @@ export { PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY as REMOTE_INSTALLATION_MANIFE
 // follow while the database lifecycle lock is still held by the caller.
 async function recoverFailedPlatformInstallation(
   error: unknown,
-  manifest: PlatformInstallationManifest,
-  plan: PlatformInstallPlan,
-  dependencies: PlatformInstallerDependencies,
-  workerTrafficGuarded: boolean,
-  workerDeploymentCommitted: boolean,
-  workerRollbacks: Array<PlatformWorkerRollback>,
-  authenticationEnforcementActive: boolean,
-  authenticationProtocolTransition: boolean,
-  workerCutoverGeneration: number,
-  previousPublicEndpoints: boolean,
-  operationStarted: boolean,
-  now: () => string,
-  writeRemoteInstallationCheckpoint: InstallationCheckpointWriter,
+  state: Readonly<{
+    manifest: PlatformInstallationManifest;
+    plan: PlatformInstallPlan;
+    dependencies: PlatformInstallerDependencies;
+    workerTrafficGuarded: boolean;
+    workerDeploymentCommitted: boolean;
+    workerRollbacks: Array<PlatformWorkerRollback>;
+    authenticationEnforcementActive: boolean;
+    authenticationProtocolTransition: boolean;
+    workerCutoverGeneration: number;
+    previousPublicEndpoints: boolean;
+    operationStarted: boolean;
+    now: () => string;
+    writeRemoteInstallationCheckpoint: InstallationCheckpointWriter;
+  }>,
 ): Promise<unknown> {
+  const {
+    plan,
+    dependencies,
+    workerTrafficGuarded,
+    workerDeploymentCommitted,
+    workerRollbacks,
+    authenticationEnforcementActive,
+    authenticationProtocolTransition,
+    workerCutoverGeneration,
+    previousPublicEndpoints,
+    operationStarted,
+    now,
+    writeRemoteInstallationCheckpoint,
+  } = state;
+  let { manifest } = state;
   let failure: unknown = error;
   const currentWorkerRecoveryIncomplete = error instanceof PlatformWorkerRecoveryIncompleteError;
   if (workerTrafficGuarded) {
@@ -120,11 +140,13 @@ async function recoverFailedPlatformInstallation(
       );
     } catch (guardError) {
       failure = new Error(
-        `platform: ${errorMessage(error)} The installation also failed to retain its routing safety gate: ${errorMessage(guardError)}`,
+        `platform: ${getErrorMessage(error)} The installation also failed to retain its routing safety gate: ${getErrorMessage(guardError)}`,
         { cause: error },
       );
     }
   }
+  // With authentication enforced mid-transition, traffic stays closed and a
+  // retry resumes toward a fully compatible Worker set instead of rolling back.
   if (
     !workerDeploymentCommitted &&
     workerRollbacks.length > 0 &&
@@ -135,15 +157,14 @@ async function recoverFailedPlatformInstallation(
       try {
         await rollback();
       } catch (rollbackError) {
-        rollbackFailures.push(errorMessage(rollbackError));
+        rollbackFailures.push(getErrorMessage(rollbackError));
       }
     }
-    workerRollbacks = [];
     if (rollbackFailures.length > 0 || currentWorkerRecoveryIncomplete) {
       failure = new Error(
         rollbackFailures.length > 0
-          ? `platform: ${errorMessage(error)} Automatic Worker rollback was incomplete: ${rollbackFailures.join('; ')} Inspect the installation before retrying.`
-          : `platform: ${errorMessage(error)} The current Worker rollback was incomplete. The cutover remains unresolved and will be recovered on retry.`,
+          ? `platform: ${getErrorMessage(error)} Automatic Worker rollback was incomplete: ${rollbackFailures.join('; ')} Inspect the installation before retrying.`
+          : `platform: ${getErrorMessage(error)} The current Worker rollback was incomplete. The cutover remains unresolved and will be recovered on retry.`,
         { cause: error },
       );
     } else if (workerCutoverGeneration > 0) {
@@ -161,9 +182,6 @@ async function recoverFailedPlatformInstallation(
       );
       writeInstallationManifest(manifest);
     }
-  } else if (authenticationEnforcementActive && authenticationProtocolTransition) {
-    // Traffic remains closed and retry resumes toward a fully compatible Worker set.
-    workerRollbacks = [];
   }
   if (manifest.status !== 'uninstalled' && (manifest.status !== 'failed' || operationStarted)) {
     try {
@@ -196,37 +214,21 @@ export async function installPlatform(
     );
   }
   const now = dependencies.now ?? (() => new Date().toISOString());
-  const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
-  const runPinnedPlatformWrangler: typeof runPlatformWrangler = (
-    operation,
-    accountId,
-    cwd,
-    capture,
-  ) =>
-    runPlatformWranglerAtApiBase(
-      operation,
-      accountId,
-      cwd,
-      capture,
-      cloudflareApiBaseUrl,
-      false,
-      dependencies.operatorApiToken,
-    );
-  const runParallelPinnedPlatformWrangler: typeof runPlatformWrangler = (
-    operation,
-    accountId,
-    cwd,
-    capture,
-  ) =>
-    runPlatformWranglerAtApiBase(
-      operation,
-      accountId,
-      cwd,
-      capture,
-      cloudflareApiBaseUrl,
-      true,
-      dependencies.operatorApiToken,
-    );
+  const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl;
+  const pinnedPlatformWrangler =
+    (parallelWorkerUpload: boolean): typeof runPlatformWrangler =>
+    (operation, accountId, cwd, capture) =>
+      runPlatformWranglerAtApiBase(
+        operation,
+        accountId,
+        cwd,
+        capture,
+        cloudflareApiBaseUrl,
+        parallelWorkerUpload,
+        dependencies.operatorApiToken,
+      );
+  const runPinnedPlatformWrangler = pinnedPlatformWrangler(false);
+  const runParallelPinnedPlatformWrangler = pinnedPlatformWrangler(true);
   const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
   const runtimeDirectory = resolvedRuntime.directory;
   const runtime = resolvedRuntime.manifest;
@@ -306,7 +308,6 @@ export async function installPlatform(
       (resource) => resource.kind === 'worker' && resource.state === 'ready',
     ) ||
       plan.actions.some((action) => action.kind === 'worker' && action.action !== 'create'));
-  const wasDisabled = existing?.status === 'disabled';
   const preserveDisabled = existing?.desiredState === 'disabled';
   const shouldBootstrapSharedEmail =
     !preserveDisabled &&
@@ -318,13 +319,9 @@ export async function installPlatform(
     hadPriorWorkers &&
     existing?.deployment.authentication.configurable !== true &&
     runtime.authenticationProtocolVersion === 1;
-  let workerCutoverGeneration = 0;
-  let workerRollbacks: Array<PlatformWorkerRollback> = [];
-  let workerDeploymentCommitted = false;
   let workerTrafficGuarded = false;
-  let authenticationEnforcementActive = false;
-  let manifest = existing;
-  if (!manifest) {
+  let manifest: PlatformInstallationManifest;
+  if (!existing) {
     const createdAt = now();
     manifest = createPlatformInstallationManifest({
       account: plan.account,
@@ -336,8 +333,10 @@ export async function installPlatform(
     });
     manifest = transitionInstallation(manifest, 'planned', now());
     writeInstallationManifest(manifest);
-  } else if (manifest.status === 'uninstalled') {
-    throw new Error(`platform: Installation ${manifest.id} has already been uninstalled.`);
+  } else if (existing.status === 'uninstalled') {
+    throw new Error(`platform: Installation ${existing.id} has already been uninstalled.`);
+  } else {
+    manifest = existing;
   }
   const explicitWorkerSecretUpdates = sanitizeWorkerSecretUpdates(secrets.workerSecretUpdates);
   const hasExplicitWorkerSecretUpdates = Object.keys(explicitWorkerSecretUpdates).length > 0;
@@ -347,7 +346,7 @@ export async function installPlatform(
       'active'
       ? secrets.pendingWorkerSecretUpdateIntent
       : null;
-  let workerSecretUpdateIntent: PlatformWorkerSecretUpdateIntent | null =
+  const workerSecretUpdateIntent: PlatformWorkerSecretUpdateIntent | null =
     hasExplicitWorkerSecretUpdates
       ? {
           baselineGeneration: latestPlatformWorkerCutoverGeneration(manifest),
@@ -360,10 +359,6 @@ export async function installPlatform(
           },
         }
       : resumedWorkerSecretUpdateIntent;
-  if (preserveDisabled && manifest.desiredState !== 'disabled') {
-    manifest = setInstallationDesiredState(manifest, 'disabled', now());
-    writeInstallationManifest(manifest);
-  }
   assertRequiredPlatformSecrets(plan, manifest, secrets, !!dependencies.prepareAuthentication);
   if (hyperdriveAction?.action === 'create') {
     // Reject a URL Hyperdrive can never accept before the claim binds it to this installation.
@@ -373,8 +368,19 @@ export async function installPlatform(
   if (plan.externalHyperdrive) {
     secrets = { ...secrets, externalHyperdriveJson: JSON.stringify(plan.externalHyperdrive) };
   }
-  const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
-  writePendingInstallationSecrets(manifest, {
+  // The phases update this state in place, and failure recovery reads its latest values.
+  const state: PlatformInstallRunState = {
+    manifest,
+    plan,
+    secrets,
+    workerSecretUpdateIntent,
+    workerCutoverGeneration: 0,
+    workerRollbacks: [],
+    workerDeploymentCommitted: false,
+    authenticationEnforcementActive: false,
+  };
+  const pendingSecrets = secretCheckpoint(state.secrets, state.workerSecretUpdateIntent);
+  writePendingInstallationSecrets(state.manifest, {
     ...pendingSecrets,
     databaseClaimState: 'claiming',
   });
@@ -382,26 +388,26 @@ export async function installPlatform(
   dependencies.onProgress?.('Preparing the platform database');
   try {
     await (dependencies.claimDatabase ?? claimPlatformDatabase)(
-      secrets.databaseUrl,
-      manifest.id,
-      manifest.ownershipNonce,
+      state.secrets.databaseUrl,
+      state.manifest.id,
+      state.manifest.ownershipNonce,
     );
   } catch (error) {
-    writePendingInstallationSecrets(manifest, {
+    writePendingInstallationSecrets(state.manifest, {
       ...pendingSecrets,
       databaseClaimState: 'failed',
     });
     throw error;
   }
-  writePendingInstallationSecrets(manifest, {
+  writePendingInstallationSecrets(state.manifest, {
     ...pendingSecrets,
     databaseClaimState: 'claimed',
   });
   dependencies.onProgress?.('Acquiring the database lock');
   const releaseDatabaseLock = await dependencies.acquireDatabaseLifecycleLock(
-    secrets.databaseUrl,
-    manifest.id,
-    manifest.ownershipNonce,
+    state.secrets.databaseUrl,
+    state.manifest.id,
+    state.manifest.ownershipNonce,
   );
   const writeRemoteInstallationCheckpoint = (
     client: InstallerClient,
@@ -415,7 +421,7 @@ export async function installPlatform(
       releaseDatabaseLock,
     );
   const authoritative = releaseDatabaseLock.authoritativeManifest;
-  if (authoritative && JSON.stringify(authoritative) !== JSON.stringify(manifest)) {
+  if (authoritative && JSON.stringify(authoritative) !== JSON.stringify(state.manifest)) {
     writeInstallationManifest(authoritative);
     await releaseDatabaseLock();
     throw new Error(
@@ -425,48 +431,45 @@ export async function installPlatform(
   try {
     assertPlatformWorkerSecretUpdateAuthority({
       explicitUpdates: explicitWorkerSecretUpdates,
-      localIntent: secrets.pendingWorkerSecretUpdateIntent,
-      manifest,
+      localIntent: state.secrets.pendingWorkerSecretUpdateIntent,
+      manifest: state.manifest,
       requiresEmailSigningSecret:
-        manifest.deployment.capabilities.email || plan.deployment.capabilities.email,
+        state.manifest.deployment.capabilities.email || state.plan.deployment.capabilities.email,
     });
   } catch (error) {
     await releaseDatabaseLock();
     throw error;
   }
-  if (
-    workerSecretUpdateIntent &&
-    !hasExplicitWorkerSecretUpdates &&
-    platformWorkerSecretUpdateIntentState(manifest, workerSecretUpdateIntent) !== 'active'
-  ) {
-    workerSecretUpdateIntent = null;
-  }
   // Progress is checkpointed under the same lifecycle lock as mutations. Do not
   // update it from parallel Worker upload callbacks.
   const checkpointOperation = async (phase: PlatformLifecycleOperation['phase']) => {
-    if (!manifest?.operation) {
+    if (!state.manifest.operation) {
       return;
     }
     const updatedAt = now();
-    manifest = { ...manifest, operation: { ...manifest.operation, phase, updatedAt }, updatedAt };
-    writeInstallationManifest(manifest);
-    await releaseDatabaseLock.checkpoint?.(manifest);
+    state.manifest = {
+      ...state.manifest,
+      operation: { ...state.manifest.operation, phase, updatedAt },
+      updatedAt,
+    };
+    writeInstallationManifest(state.manifest);
+    await releaseDatabaseLock.checkpoint?.(state.manifest);
   };
   let operationStarted = false;
   try {
     assertPlatformRuntimeSafety(
       runtime,
-      manifest.safetyProtocols,
+      state.manifest.safetyProtocols,
       releaseDatabaseLock.requiredSafetyProtocols,
     );
     if (existing) {
       await dependencies.verifyExistingOwnership?.(
-        manifest,
+        state.manifest,
         authoritative !== null && authoritative !== undefined,
       );
     }
     const action = dependencies.operation ?? (existing ? 'upgrade' : 'install');
-    const previousOperation = manifest.operation;
+    const previousOperation = state.manifest.operation;
     const resuming =
       previousOperation?.action === action &&
       previousOperation.toVersion === version &&
@@ -474,8 +477,8 @@ export async function installPlatform(
       previousOperation.phase !== 'complete';
     const startedAt = now();
     operationStarted = true;
-    manifest = {
-      ...manifest,
+    state.manifest = {
+      ...state.manifest,
       operation: {
         id: resuming ? previousOperation.id : randomUUID(),
         action,
@@ -490,52 +493,21 @@ export async function installPlatform(
     };
     await checkpointOperation('preparing');
     await prepareInstallationAuthentication({
+      state,
       releaseDatabaseLock,
-      get authenticationEnforcementActive() {
-        return authenticationEnforcementActive!;
-      },
-      set authenticationEnforcementActive(value: boolean) {
-        authenticationEnforcementActive = value;
-      },
       runtime,
-      get plan() {
-        return plan!;
-      },
-      set plan(value: PlatformInstallPlan) {
-        plan = value;
-      },
       authenticationProtocolTransition,
-      get manifest() {
-        return manifest!;
-      },
-      set manifest(value: PlatformInstallationManifest) {
-        manifest = value;
-      },
-      get secrets() {
-        return secrets!;
-      },
-      set secrets(value: PlatformInstallationSecrets) {
-        secrets = value;
-      },
       now,
       dependencies,
-      workerSecretUpdateIntent,
     });
 
     // Establish the durable installation checkpoint before creating any
     // resource that may need to be reconciled or removed after interruption.
-    const provisionInstallationServicesResult = await provisionInstallationServices({
-      plan,
-      get manifest() {
-        return manifest!;
-      },
-      set manifest(value: PlatformInstallationManifest) {
-        manifest = value;
-      },
+    const provisioned = await provisionInstallationServices({
+      state,
       now,
       releaseDatabaseLock,
       dependencies,
-      secrets,
       writeRemoteInstallationCheckpoint,
       checkpointOperation,
       externalHyperdriveOriginHash,
@@ -544,32 +516,42 @@ export async function installPlatform(
       sourcePlatformVersion,
       hadPriorWorkers,
     });
-    if ('waitingForDns' in provisionInstallationServicesResult) {
-      return provisionInstallationServicesResult;
+    if ('waitingForDns' in provisioned) {
+      return provisioned;
     }
-    const zone = provisionInstallationServicesResult.zone;
-    const zoneId = provisionInstallationServicesResult.zoneId;
-    const targetSandboxDrainProtocol =
-      provisionInstallationServicesResult.targetSandboxDrainProtocol;
-    const prepareSandboxDrain = provisionInstallationServicesResult.prepareSandboxDrain;
-    const sandboxDrainState = provisionInstallationServicesResult.sandboxDrainState;
-    const ids = provisionInstallationServicesResult.ids;
-    const entrypoints = provisionInstallationServicesResult.entrypoints;
-    let interruptedCutover = interruptedWorkerCutover(manifest);
-    if (interruptedCutover && authenticationProtocolTransition && authenticationEnforcementActive) {
-      manifest = recordWorkerCutoverResolution(
-        manifest,
+    const {
+      zone,
+      zoneId,
+      targetSandboxDrainProtocol,
+      prepareSandboxDrain,
+      sandboxDrainState,
+      ids,
+      entrypoints,
+    } = provisioned;
+    let interruptedCutover = interruptedWorkerCutover(state.manifest);
+    if (
+      interruptedCutover &&
+      authenticationProtocolTransition &&
+      state.authenticationEnforcementActive
+    ) {
+      state.manifest = recordWorkerCutoverResolution(
+        state.manifest,
         interruptedCutover.generation,
         'committed',
         now(),
       );
-      manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, false, now());
-      writeInstallationManifest(manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+      state.manifest = recordWorkerTrafficState(
+        state.manifest,
+        interruptedCutover.generation,
+        false,
+        now(),
+      );
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
       interruptedCutover = null;
     }
     const recoveringUnsafeTraffic = (interruptedCutover?.unsafeTraffic.size ?? 0) > 0;
-    const createsWorker = plan.actions.some(
+    const createsWorker = state.plan.actions.some(
       (action) =>
         action.kind === 'worker' &&
         action.action === 'create' &&
@@ -587,15 +569,15 @@ export async function installPlatform(
       recoveringUnsafeTraffic ||
       createsWorker ||
       recoveringCreatedWorker ||
-      manifest.usageProtocolVersion !== targetUsageProtocolVersion ||
+      state.manifest.usageProtocolVersion !== targetUsageProtocolVersion ||
       authenticationProtocolTransition ||
       shouldBootstrapSharedEmail ||
       requiresSandboxDrain ||
-      (!!plan.deployment.appAccess &&
-        !manifest.steps.some((step) => step.key === 'app-access-initialized:v1'));
+      (!!state.plan.deployment.appAccess &&
+        !state.manifest.steps.some((step) => step.key === 'app-access-initialized:v1'));
     if (requiresTrafficGuard) {
       await dependencies.client.putKvValue(
-        plan.account.id,
+        state.plan.account.id,
         requireId(ids, 'routing-kv'),
         PLATFORM_DISABLED_KEY,
         PLATFORM_DISABLED_VALUE,
@@ -604,9 +586,9 @@ export async function installPlatform(
       dependencies.onProgress?.('Application traffic paused for a safe platform cutover');
     }
     if (!preserveDisabled) {
-      const trafficGeneration = nextTrafficGeneration(manifest);
-      manifest = recordInstallationStep(
-        manifest,
+      const trafficGeneration = nextTrafficGeneration(state.manifest);
+      state.manifest = recordInstallationStep(
+        state.manifest,
         {
           completedAt: now(),
           key: `traffic-enabled:${trafficGeneration}`,
@@ -614,22 +596,25 @@ export async function installPlatform(
         },
         now(),
       );
-      writeInstallationManifest(manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
     }
     const configInput = {
       authenticationDatabaseUncached: true,
       proxyHealthBinding: true,
-      accountId: plan.account.id,
-      apiUrl: plan.apiUrl,
-      deployment: plan.deployment,
+      accountId: state.plan.account.id,
+      apiUrl: state.plan.apiUrl,
+      deployment: state.plan.deployment,
       deploymentExecution: runtime.deploymentExecution,
-      healthProbeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
-      installationId: manifest.id,
-      ownershipNonce: manifest.ownershipNonce,
+      healthProbeToken: createPlatformHealthProbeToken(state.manifest.ownershipNonce),
+      installationId: state.manifest.id,
+      ownershipNonce: state.manifest.ownershipNonce,
       platformVersion: version,
-      proxyUrl: plan.proxyUrl,
-      emailGatewayUrl: `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev`,
+      proxyUrl: state.plan.proxyUrl,
+      emailGatewayUrl: platformWorkersDevUrl(
+        state.plan,
+        state.plan.deployment.resources.emailGatewayWorker,
+      ),
       resources: {
         hyperdrive: requireId(ids, 'hyperdrive'),
         isrCacheKv: requireId(ids, 'isr-cache-kv'),
@@ -647,8 +632,8 @@ export async function installPlatform(
     // Preparation can generate new setup credentials. Snapshot only after all
     // preparation has completed so the deployed API can verify the handoff.
     const workerDeploymentSecrets: PlatformInstallationSecrets = {
-      ...secrets,
-      workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {},
+      ...state.secrets,
+      workerSecretUpdates: state.workerSecretUpdateIntent?.updates ?? {},
     };
     const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
     const enabledConfigs = createPlatformWorkerConfigs({
@@ -668,127 +653,122 @@ export async function installPlatform(
       publicEndpoints: previousPublicEndpoints,
       trafficState: previousPublicEndpoints ? 'enabled' : 'staging',
     });
-    const managedRoutes = platformManagedWorkerTraffic(plan.deployment).routes;
-    let workerActions: ReadonlyArray<PlatformInstallPlanAction> = plan.actions.filter(
+    const managedRoutes = platformManagedWorkerTraffic(state.plan.deployment).routes;
+    let workerActions: ReadonlyArray<PlatformInstallPlanAction> = state.plan.actions.filter(
       (action) =>
         action.kind === 'worker' &&
         (hasEmailGatewayArtifact || action.key !== 'email-gateway-worker'),
     );
-    ({ manifest, workerActions } = await recoverInterruptedPlatformWorkerCutover(
-      manifest,
+    ({ manifest: state.manifest, workerActions } = await recoverInterruptedPlatformWorkerCutover({
+      manifest: state.manifest,
       interruptedCutover,
       workerActions,
       configs,
       previousConfigs,
-      plan,
+      plan: state.plan,
       dependencies,
       ids,
-      zoneId,
       previousPublicEndpoints,
       hasEmailGatewayArtifact,
       runPinnedPlatformWrangler,
       now,
       writeRemoteInstallationCheckpoint,
-      (next) => {
-        manifest = next;
+      onManifestChange: (next) => {
+        state.manifest = next;
       },
-    ));
-    workerCutoverGeneration = nextWorkerCutoverGeneration(manifest);
-    if (workerSecretUpdateIntent) {
-      manifest = recordWorkerSecretUpdateState(
-        manifest,
-        workerCutoverGeneration,
+    }));
+    state.workerCutoverGeneration = nextWorkerCutoverGeneration(state.manifest);
+    if (state.workerSecretUpdateIntent) {
+      state.manifest = recordWorkerSecretUpdateState(
+        state.manifest,
+        state.workerCutoverGeneration,
         'pending',
-        workerSecretUpdateIntent.id,
+        state.workerSecretUpdateIntent.id,
         now(),
       );
-      writeInstallationManifest(manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-      workerSecretUpdateIntent = {
-        ...workerSecretUpdateIntent,
-        generation: workerCutoverGeneration,
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+      state.workerSecretUpdateIntent = {
+        ...state.workerSecretUpdateIntent,
+        generation: state.workerCutoverGeneration,
       };
       writePendingInstallationSecrets(
-        manifest,
-        secretCheckpoint(secrets, workerSecretUpdateIntent),
+        state.manifest,
+        secretCheckpoint(state.secrets, state.workerSecretUpdateIntent),
       );
     }
     await uploadInstallationWorkers({
+      state,
       dependencies,
       requiresStagedCommit,
-      workerSecretUpdateIntent,
       recoveringUnsafeTraffic,
       workerActions,
       workerKeys,
       workerDeploymentSecrets,
-      plan,
       zoneId,
-      get manifest() {
-        return manifest!;
-      },
-      set manifest(value: PlatformInstallationManifest) {
-        manifest = value;
-      },
       now,
       writeRemoteInstallationCheckpoint,
       configs,
       previousConfigs,
       cloudflareApiBaseUrl,
-      workerCutoverGeneration,
       preserveDisabled,
       managedRoutes,
       previousPublicEndpoints,
       ids,
       runParallelPinnedPlatformWrangler,
       runPinnedPlatformWrangler,
-      workerRollbacks,
     });
 
-    manifest = setInstallationEndpoints(
-      manifest,
+    state.manifest = setInstallationEndpoints(
+      state.manifest,
       {
-        apiUrl: plan.apiUrl,
-        dashboardUrl: platformDashboardUrl(plan.deployment),
-        proxyUrl: plan.proxyUrl,
+        apiUrl: state.plan.apiUrl,
+        dashboardUrl: platformDashboardUrl(state.plan.deployment),
+        proxyUrl: state.plan.proxyUrl,
       },
       now(),
     );
     if (preserveDisabled) {
-      workerDeploymentCommitted = true;
-      manifest = recordWorkerCutoverResolution(
-        manifest,
-        workerCutoverGeneration,
+      state.workerDeploymentCommitted = true;
+      state.manifest = recordWorkerCutoverResolution(
+        state.manifest,
+        state.workerCutoverGeneration,
         'committed',
         now(),
       );
-      manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
-      if (workerSecretUpdateIntent) {
-        manifest = recordWorkerSecretUpdateState(
-          manifest,
-          workerCutoverGeneration,
+      state.manifest = recordWorkerTrafficState(
+        state.manifest,
+        state.workerCutoverGeneration,
+        false,
+        now(),
+      );
+      if (state.workerSecretUpdateIntent) {
+        state.manifest = recordWorkerSecretUpdateState(
+          state.manifest,
+          state.workerCutoverGeneration,
           'committed',
-          workerSecretUpdateIntent.id,
+          state.workerSecretUpdateIntent.id,
           now(),
         );
       }
-      manifest = {
-        ...manifest,
-        deployment: plan.deployment,
+      state.manifest = {
+        ...state.manifest,
+        deployment: state.plan.deployment,
         deploymentExecution: runtime.deploymentExecution,
         platformVersion: version,
         runtime: runtimeProvenance,
         updatedAt: now(),
         usageProtocolVersion: targetUsageProtocolVersion,
       };
-      manifest = transitionInstallation(manifest, 'disabled', now());
+      state.manifest = transitionInstallation(state.manifest, 'disabled', now());
       await checkpointOperation('complete');
-      writeInstallationManifest(manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-      writePendingInstallationSecrets(manifest, secretCheckpoint(secrets));
-      promoteInstallationSecrets(manifest);
-      saveInstalledPlatformConnection(plan, manifest);
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+      writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets));
+      promoteInstallationSecrets(state.manifest);
+      saveInstalledPlatformConnection(state.plan, state.manifest);
       return {
-        manifest,
+        manifest: state.manifest,
         waitingForDns: false,
         waitingForSandboxDrain: false,
         zoneNameServers: zone?.nameServers ?? [],
@@ -796,29 +776,34 @@ export async function installPlatform(
     }
     let authenticationCutoverCommitted = false;
     if (authenticationProtocolTransition && requiresStagedCommit) {
-      manifest = recordWorkerCutoverResolution(
-        manifest,
-        workerCutoverGeneration,
+      state.manifest = recordWorkerCutoverResolution(
+        state.manifest,
+        state.workerCutoverGeneration,
         'committed',
         now(),
       );
-      manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
-      writeInstallationManifest(manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+      state.manifest = recordWorkerTrafficState(
+        state.manifest,
+        state.workerCutoverGeneration,
+        false,
+        now(),
+      );
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
       // From this point onward the database may enforce revocable sessions. Retain the
       // compatible maintenance runtime on failure instead of restoring incapable Workers.
-      workerRollbacks = [];
+      state.workerRollbacks = [];
       authenticationCutoverCommitted = true;
     }
-    let authenticationStep = secrets.authenticationSetupJson
-      ? 'authentication-initialized:v1:' + hash(secrets.authenticationSetupJson)
+    let authenticationStep = state.secrets.authenticationSetupJson
+      ? 'authentication-initialized:v1:' + hash(state.secrets.authenticationSetupJson)
       : '';
     let setupPending = false;
-    manifest = transitionInstallation(manifest, 'verifying', now());
+    state.manifest = transitionInstallation(state.manifest, 'verifying', now());
     await checkpointOperation('verifying');
-    writeInstallationManifest(manifest);
-    if (plan.deployment.authentication.configurable && authenticationStep) {
-      if (!secrets.authenticationSetupJson || !secrets.authSetupToken) {
+    writeInstallationManifest(state.manifest);
+    if (state.plan.deployment.authentication.configurable && authenticationStep) {
+      if (!state.secrets.authenticationSetupJson || !state.secrets.authSetupToken) {
         throw new Error(
           'platform: Restore the encrypted authentication setup checkpoint before resuming.',
         );
@@ -826,17 +811,17 @@ export async function installPlatform(
       dependencies.onProgress?.('Initializing platform authentication');
       const authentication = await resumeInstalledPlatformAuthentication(
         {
-          apiUrl: plan.apiUrl,
-          installationId: manifest.id,
-          setupToken: secrets.authSetupToken,
-          setupJson: secrets.authenticationSetupJson,
+          apiUrl: state.plan.apiUrl,
+          installationId: state.manifest.id,
+          setupToken: state.secrets.authSetupToken,
+          setupJson: state.secrets.authenticationSetupJson,
           checkpoint: (replacement) => {
-            secrets = { ...secrets, ...replacement };
+            state.secrets = { ...state.secrets, ...replacement };
             authenticationStep =
               'authentication-initialized:v1:' + hash(replacement.authenticationSetupJson);
             writePendingInstallationSecrets(
-              manifest!,
-              secretCheckpoint(secrets, workerSecretUpdateIntent),
+              state.manifest,
+              secretCheckpoint(state.secrets, state.workerSecretUpdateIntent),
             );
           },
         },
@@ -844,111 +829,116 @@ export async function installPlatform(
       );
       if (authentication.setupPending) {
         setupPending = true;
-        dependencies.onProgress?.(`Administrator setup pending: ${plan.apiUrl}/setup`);
+        dependencies.onProgress?.(`Administrator setup pending: ${state.plan.apiUrl}/setup`);
       }
-      manifest = recordInstallationStep(
-        manifest,
+      state.manifest = recordInstallationStep(
+        state.manifest,
         {
           key: authenticationStep,
           completedAt: now(),
-          resultHash: hash(secrets.authenticationSetupJson),
+          resultHash: hash(state.secrets.authenticationSetupJson),
         },
         now(),
       );
-      writeInstallationManifest(manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
     }
     if (
-      plan.deployment.appAccess &&
-      !manifest.steps.some((step) => step.key === 'app-access-initialized:v1')
+      state.plan.deployment.appAccess &&
+      !state.manifest.steps.some((step) => step.key === 'app-access-initialized:v1')
     ) {
       dependencies.onProgress?.('Configuring and verifying deployed-app access');
       try {
         await (dependencies.initializeAppAccess ?? initializeInstalledAppAccess)({
-          apiUrl: plan.apiUrl,
-          installationId: manifest.id,
-          probeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
-          setupJson: secrets.appAccessSetupJson!,
-          setupToken: secrets.appAccessSetupToken!,
+          apiUrl: state.plan.apiUrl,
+          installationId: state.manifest.id,
+          probeToken: createPlatformHealthProbeToken(state.manifest.ownershipNonce),
+          setupJson: state.secrets.appAccessSetupJson!,
+          setupToken: state.secrets.appAccessSetupToken!,
         });
       } catch (error) {
         if (error instanceof PlatformAppAccessCredentialError) {
-          secrets = {
-            ...secrets,
+          state.secrets = {
+            ...state.secrets,
             authenticationPreparation: {
-              ...secrets.authenticationPreparation,
+              ...state.secrets.authenticationPreparation,
               appAccessTokenRejected: 'true',
             },
           };
           writePendingInstallationSecrets(
-            manifest,
-            secretCheckpoint(secrets, workerSecretUpdateIntent),
+            state.manifest,
+            secretCheckpoint(state.secrets, state.workerSecretUpdateIntent),
           );
         }
         throw error;
       }
-      manifest = recordInstallationStep(
-        manifest,
+      state.manifest = recordInstallationStep(
+        state.manifest,
         {
           key: 'app-access-initialized:v1',
           completedAt: now(),
-          resultHash: hash(secrets.appAccessSetupJson!),
+          resultHash: hash(state.secrets.appAccessSetupJson!),
         },
         now(),
       );
-      writeInstallationManifest(manifest);
-      await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+      writeInstallationManifest(state.manifest);
+      await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
     }
     dependencies.onProgress?.('Verifying platform health');
     const emailGatewayUrl =
-      hasEmailGatewayArtifact && plan.deployment.capabilities.email
-        ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev`
+      hasEmailGatewayArtifact && state.plan.deployment.capabilities.email
+        ? platformWorkersDevUrl(state.plan, state.plan.deployment.resources.emailGatewayWorker)
         : undefined;
-    if (plan.deployment.authentication.accessProtection) {
-      ensurePlatformAccessToken(plan.apiUrl, false, true);
-      ensurePlatformAccessToken(plan.proxyUrl, false, true);
+    if (state.plan.deployment.authentication.accessProtection) {
+      ensurePlatformAccessToken(state.plan.apiUrl, false, true);
+      ensurePlatformAccessToken(state.plan.proxyUrl, false, true);
     }
     const healthCheckContext: PlatformHealthCheckContext = {
-      accountName: plan.account.name,
-      ...(plan.deployment.authentication.accessProtection ? { accessProtected: true } : {}),
+      accountName: state.plan.account.name,
+      ...(state.plan.deployment.authentication.accessProtection ? { accessProtected: true } : {}),
       workers: [
-        plan.deployment.resources.apiWorker,
-        plan.deployment.resources.proxyWorker,
-        ...(emailGatewayUrl ? [plan.deployment.resources.emailGatewayWorker] : []),
-        plan.deployment.resources.dispatchWorker,
+        state.plan.deployment.resources.apiWorker,
+        state.plan.deployment.resources.proxyWorker,
+        ...(emailGatewayUrl ? [state.plan.deployment.resources.emailGatewayWorker] : []),
+        state.plan.deployment.resources.dispatchWorker,
       ],
       resumeCommand: dependencies.healthCheckResumeCommand,
       ...(emailGatewayUrl ? { emailGatewayUrl } : {}),
     };
     await (dependencies.verifyHealth ?? verifyPlatformHealth)(
-      plan.apiUrl,
-      manifest.id,
-      plan.proxyUrl,
-      plan.deployment.application.baseDomain,
+      state.plan.apiUrl,
+      state.manifest.id,
+      state.plan.proxyUrl,
+      state.plan.deployment.application.baseDomain,
       version,
       targetUsageProtocolVersion,
-      createPlatformHealthProbeToken(manifest.ownershipNonce),
+      createPlatformHealthProbeToken(state.manifest.ownershipNonce),
       undefined,
-      !plan.deployment.application.zoneName
-        ? `https://${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`
+      !state.plan.deployment.application.zoneName
+        ? platformWorkersDevUrl(state.plan, state.plan.deployment.resources.dispatchWorker)
         : undefined,
       healthCheckContext,
     );
     if (requiresSandboxDrain) {
       const drainComplete = await (dependencies.verifySandboxDrain ?? verifyPlatformSandboxDrain)(
-        plan.apiUrl,
-        createPlatformHealthProbeToken(manifest.ownershipNonce),
+        state.plan.apiUrl,
+        createPlatformHealthProbeToken(state.manifest.ownershipNonce),
       );
       if (!drainComplete) {
-        manifest = recordWorkerCutoverResolution(
-          manifest,
-          workerCutoverGeneration,
+        state.manifest = recordWorkerCutoverResolution(
+          state.manifest,
+          state.workerCutoverGeneration,
           'committed',
           now(),
         );
-        manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
-        manifest = recordInstallationStep(
-          manifest,
+        state.manifest = recordWorkerTrafficState(
+          state.manifest,
+          state.workerCutoverGeneration,
+          false,
+          now(),
+        );
+        state.manifest = recordInstallationStep(
+          state.manifest,
           {
             completedAt: now(),
             key: 'sandbox-drain:maintenance-runtime:v1',
@@ -957,13 +947,13 @@ export async function installPlatform(
           now(),
         );
         await checkpointOperation('waiting-for-sandbox-drain');
-        writeInstallationManifest(manifest);
-        await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-        workerRollbacks = [];
-        workerDeploymentCommitted = true;
-        saveInstalledPlatformConnection(plan, manifest);
+        writeInstallationManifest(state.manifest);
+        await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+        state.workerRollbacks = [];
+        state.workerDeploymentCommitted = true;
+        saveInstalledPlatformConnection(state.plan, state.manifest);
         return {
-          manifest,
+          manifest: state.manifest,
           waitingForDns: false,
           waitingForSandboxDrain: true,
           zoneNameServers: zone?.nameServers ?? [],
@@ -977,38 +967,13 @@ export async function installPlatform(
       }
     }
     const enableInstallationServicesResult = await enableInstallationServices({
+      state,
       checkpointOperation,
       requiresStagedCommit,
       authenticationCutoverCommitted,
-      get manifest() {
-        return manifest!;
-      },
-      set manifest(value: PlatformInstallationManifest) {
-        manifest = value;
-      },
-      get workerCutoverGeneration() {
-        return workerCutoverGeneration!;
-      },
-      set workerCutoverGeneration(value: number) {
-        workerCutoverGeneration = value;
-      },
       now,
       writeRemoteInstallationCheckpoint,
       dependencies,
-      plan,
-      get workerRollbacks() {
-        return workerRollbacks!;
-      },
-      set workerRollbacks(value: Array<PlatformWorkerRollback>) {
-        workerRollbacks = value;
-      },
-      get workerSecretUpdateIntent() {
-        return workerSecretUpdateIntent!;
-      },
-      set workerSecretUpdateIntent(value: PlatformWorkerSecretUpdateIntent | null) {
-        workerSecretUpdateIntent = value;
-      },
-      secrets,
       workerKeys,
       workerActions,
       workerDeploymentSecrets,
@@ -1020,15 +985,7 @@ export async function installPlatform(
       ids,
       runPinnedPlatformWrangler,
       shouldBootstrapSharedEmail,
-      get workerDeploymentCommitted() {
-        return workerDeploymentCommitted!;
-      },
-      set workerDeploymentCommitted(value: boolean) {
-        workerDeploymentCommitted = value;
-      },
       releaseDatabaseLock,
-      wasDisabled,
-      previousPublicEndpoints,
       version,
       targetUsageProtocolVersion,
       healthCheckContext,
@@ -1037,14 +994,14 @@ export async function installPlatform(
     });
     const emailOperationId = enableInstallationServicesResult.emailOperationId;
     await checkpointOperation('complete');
-    writeInstallationManifest(manifest);
-    await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+    writeInstallationManifest(state.manifest);
+    await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
     workerTrafficGuarded = false;
-    writePendingInstallationSecrets(manifest, secretCheckpoint(secrets));
-    promoteInstallationSecrets(manifest);
-    saveInstalledPlatformConnection(plan, manifest);
+    writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets));
+    promoteInstallationSecrets(state.manifest);
+    saveInstalledPlatformConnection(state.plan, state.manifest);
     return {
-      manifest,
+      manifest: state.manifest,
       ...(emailOperationId ? { emailOperationId } : {}),
       setupPending,
       waitingForDns: false,
@@ -1052,105 +1009,40 @@ export async function installPlatform(
       zoneNameServers: zone?.nameServers ?? [],
     };
   } catch (error) {
-    throw await recoverFailedPlatformInstallation(
-      error,
-      manifest,
-      plan,
+    throw await recoverFailedPlatformInstallation(error, {
+      ...state,
       dependencies,
       workerTrafficGuarded,
-      workerDeploymentCommitted,
-      workerRollbacks,
-      authenticationEnforcementActive,
       authenticationProtocolTransition,
-      workerCutoverGeneration,
       previousPublicEndpoints,
       operationStarted,
       now,
       writeRemoteInstallationCheckpoint,
-    );
+    });
   } finally {
     await releaseDatabaseLock();
   }
 }
 
-export {
-  type PlatformInstallationSecrets,
-  type PlatformDatabaseLifecycleLock,
-  mergePlatformLiveAuthenticationDeployment,
-  type PlatformDatabaseState,
-  type PlatformSandboxDrainPreparation,
-  type PlatformDatabaseMigrationResult,
-  PlatformWorkerRecoveryIncompleteError,
-  type PlatformInstallerDependencies,
-  type PlatformInstallationResult,
-  type PlatformWorkerDeployment,
-  type PlatformHealthCheckContext,
-} from './platform-installer-types.ts';
+export { type PlatformDatabaseLifecycleLock } from './platform-installer-types.ts';
 
 export {
   createPlatformInstallationSecrets,
-  apiWorkerSecrets,
-  platformWorkerSecretPayload,
   resolveBootstrapGitHubId,
-  assertRequiredPlatformSecrets,
   createPlatformHealthProbeToken,
 } from './platform-installer-secrets.ts';
 
-export {
-  recordResource,
-  r2BucketConfigHash,
-  retainReplacedInstallationResource,
-  inventoryUnmanagedPlatformWorkerTraffic,
-  mergePlatformWorkerTrafficConfig,
-  mergePreservedTriggerRoutes,
-  isolatePlatformWorkerCustomDomains,
-  withoutPlatformWorkerTrafficAttachments,
-} from './platform-installer-resources.ts';
+export { recordResource } from './platform-installer-resources.ts';
 
 export {
   platformDatabaseClientUrl,
-  claimPlatformDatabase,
   acquirePlatformDatabaseLifecycleLock,
+  acquirePlatformDatabaseLifecycleLockConnection,
   readPlatformDatabaseLifecycleManifest,
   readPlatformProjectSlugs,
   readPlatformProjectZeroTrustState,
-  inspectPlatformDatabaseStateConnection,
-  preparePlatformDatabaseConnection,
-  readPlatformDatabaseLifecycleManifestConnection,
-  acquirePlatformDatabaseLifecycleLockConnection,
-  preparePlatformSandboxDrainConnection,
-  verifyPlatformDatabaseConnection,
-  assertPlatformRuntimeSafety,
-  claimPlatformDatabaseConnection,
 } from './platform-installer-database.ts';
 
-export {
-  platformWorkerUploadFingerprint,
-  deployPlatformWorker,
-  recoverFailedPlatformWorkerDeployment,
-  runPlatformWrangler,
-  withConditionalPlatformWorkerCreate,
-  readPlatformWorkerDeployments,
-  restorePlatformWorkerDeployment,
-  classifyPlatformWorkerDeploymentLineage,
-  inspectNewPlatformWorker,
-  readActivePlatformWorkerSnapshot,
-  withoutCompletedPlatformWorkerMigrations,
-  verifyPlatformWorkerCutoverVersions,
-  stablePublicEndpointState,
-  resolvePlatformPreviousTriggerConfig,
-} from './platform-installer-workers.ts';
+export { loadPlatformRuntime } from './platform-installer-runtime.ts';
 
-export {
-  loadPlatformRuntime,
-  verifyRuntimeArtifacts,
-  verifyPlatformDatabaseArtifacts,
-} from './platform-installer-runtime.ts';
-
-export {
-  PlatformAccessBlockedError,
-  verifyPlatformHealth,
-  verifyPlatformSandboxDrain,
-  verifyPlatformDeploymentExecutionDrain,
-  bootstrapPlatformSharedEmail,
-} from './platform-installer-health.ts';
+export { PlatformAccessBlockedError } from './platform-installer-health.ts';
diff --git a/packages/void/src/cli/platform-lifecycle.ts b/packages/void/src/cli/platform-lifecycle.ts
index dd7f386fd..e31793604 100644
--- a/packages/void/src/cli/platform-lifecycle.ts
+++ b/packages/void/src/cli/platform-lifecycle.ts
@@ -85,7 +85,6 @@ import {
   platformSetupPages,
   platformSetupFieldHelp,
 } from './platform-setup.ts';
-import { passwordWithPlaceholder } from './prompt-password.ts';
 
 export function resolvePlatformInstallDatabaseUrl(
   checkpoint: Record<string, string> | null,
@@ -1341,11 +1340,7 @@ export async function verifyPlatformAiGatewayPlan(
       deploymentExecution: preview.actions.some((entry) => entry.key === 'deployment-queue'),
     });
   } catch (error) {
-    if (
-      error instanceof PlatformCloudflareApiError &&
-      (error.status === 401 || error.status === 403) &&
-      error.requestPath?.includes('/ai-gateway/')
-    ) {
+    if (isPlatformTokenAuthorizationError(error, '/ai-gateway/')) {
       throw new Error(
         'platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.',
         { cause: error },
@@ -1494,9 +1489,7 @@ async function promptSecret(
     validate: (input: string | undefined) => (input ? validate?.(input) : 'A value is required.'),
   };
   const value = masked
-    ? placeholder
-      ? await passwordWithPlaceholder({ ...options, placeholder })
-      : await password(options)
+    ? await password({ ...options, placeholder })
     : await text({ ...options, placeholder });
   if (isCancel(value) || typeof value === 'symbol') {
     throw new Error('platform: Cancelled.');
diff --git a/packages/void/src/cli/platform-management.ts b/packages/void/src/cli/platform-management.ts
index 63573dc01..200d7afa1 100644
--- a/packages/void/src/cli/platform-management.ts
+++ b/packages/void/src/cli/platform-management.ts
@@ -1,8 +1,6 @@
-import { createHash } from 'node:crypto';
+import { setTimeout as delay } from 'node:timers/promises';
 import {
-  createPlatformResourceOwnershipMarker,
   parsePlatformInstallationManifest,
-  parsePlatformResourceOwnershipMarker,
   PLATFORM_DISABLED_KEY,
   PLATFORM_DISABLED_VALUE,
   PLATFORM_R2_OWNERSHIP_MARKER_KEY,
@@ -47,9 +45,14 @@ import {
 } from './platform-lifecycle.ts';
 import {
   createPlatformInstallPlan,
+  dnsRecordConfigHash,
   formatPlatformInstallPlan,
+  hasProvisionIntentStep,
+  legacyResourceConfigHash,
+  matchesRecordedR2Fingerprint,
   platformAdoptionIntentHash,
-  platformProvisionIntentHash,
+  r2BucketConfigHash,
+  resourceMarkerProblem,
   revalidatePlatformInstallAction,
 } from './platform-plan.ts';
 import {
@@ -79,13 +82,12 @@ import {
   type PurgeResourcesClient,
   type PurgeResourcesCredential,
 } from './platform-teardown.ts';
-import { trackedPlatformWorkerTraffic } from './platform-traffic.ts';
 import {
   assertProjectZeroTrustAllowsUninstall,
   type PlatformProjectZeroTrustState,
 } from './platform-zero-trust-uninstall.ts';
 
-export type PlatformManagementClient = Pick<
+type PlatformManagementClient = Pick<
   PlatformCloudflareClient,
   | 'deleteKvValue'
   | 'deleteResource'
@@ -103,14 +105,13 @@ export type PlatformManagementClient = Pick<
   | 'listR2Buckets'
   | 'listWorkerNames'
   | 'putKvValue'
-  | 'removeRoutes'
 >;
 
-export type PlatformUninstallClient = PlatformManagementClient &
+type PlatformUninstallClient = PlatformManagementClient &
   Pick<PlatformCloudflareClient, 'listWorkerDomains' | 'listWorkerServiceRoutes'> &
-  Partial<PurgeResourcesClient>;
+  PurgeResourcesClient;
 
-export type PlatformOwnershipClient = Pick<
+type PlatformOwnershipClient = Pick<
   PlatformManagementClient,
   | 'findZone'
   | 'getHyperdriveConfig'
@@ -168,7 +169,7 @@ export async function verifyPlatformInstallationOwnership(
   );
 }
 
-export type PlatformManagementDependencies = Readonly<{
+type PlatformManagementDependencies = Readonly<{
   checkpoint?: (manifest: PlatformInstallationManifest) => Promise<void>;
   confirm?: (message: string, initialValue: boolean) => Promise<boolean>;
   databaseUrl?: string;
@@ -282,11 +283,10 @@ export async function runInstalledPlatformCommand(args: PlatformArgs): Promise<v
   let reportResult: (() => void) | undefined;
 
   const execute = async (
-    currentManifest: PlatformInstallationManifest,
+    manifest: PlatformInstallationManifest,
     databaseLock?: PlatformDatabaseLifecycleLock,
     databaseCheckpointExists = false,
   ): Promise<void> => {
-    const manifest = currentManifest;
     if (args.subcommand === 'rollback') {
       assertPlatformRollbackCompatibility(manifest, runtime!, rollbackSourceRuntime!);
     }
@@ -724,10 +724,7 @@ export function assertPlatformRollbackCompatibility(
       'platform: The authoritative installation checkpoint does not record the installed runtime database schema. Repair or roll forward before rollback.',
     );
   }
-  if (
-    (target.manifest.safetyProtocols?.sandboxDrain ?? 0) <
-    (installation.safetyProtocols?.sandboxDrain ?? 0)
-  ) {
+  if (target.manifest.safetyProtocols.sandboxDrain < installation.safetyProtocols.sandboxDrain) {
     throw new Error(
       'platform: The rollback target predates the installed sandbox-drain safety protocol.',
     );
@@ -800,25 +797,11 @@ export async function disablePlatform(
   planOnly: boolean,
   dependencies: PlatformManagementDependencies = {},
 ): Promise<void> {
-  const reconciled = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
-  const writeLifecycleCheckpoint = (
-    checkpointClient: PlatformManagementClient,
-    checkpointManifest: PlatformInstallationManifest,
-  ) =>
-    writeLifecycleCheckpointWithoutDatabase(
-      checkpointClient,
-      checkpointManifest,
-      dependencies.checkpoint,
-    );
-  const writeRemoteManifestIfPresent = (
-    checkpointClient: PlatformManagementClient,
-    checkpointManifest: PlatformInstallationManifest,
-  ) =>
-    writeRemoteManifestIfPresentWithoutDatabase(
-      checkpointClient,
-      checkpointManifest,
-      dependencies.checkpoint,
-    );
+  const manifest = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
+  const saveCheckpoint = (state: PlatformInstallationManifest) =>
+    writeLifecycleCheckpoint(client, state, dependencies.checkpoint);
+  const saveRemoteManifest = (state: PlatformInstallationManifest) =>
+    writeRemoteManifest(client, state, dependencies.checkpoint);
   note(
     'Block all platform traffic and the platform API. Routes, custom domains, Workers, and data stay installed.',
     'Disable plan',
@@ -827,12 +810,11 @@ export async function disablePlatform(
     outro('No Cloudflare or local installation state was changed.');
     return;
   }
-  const manifest = reconciled;
   if (manifest !== initialManifest) {
     writeInstallationManifest(manifest);
   }
   const alreadyDisabled = manifest.status === 'disabled';
-  const missing = await verifyPlatformMutationOwnership(
+  await verifyPlatformMutationOwnership(
     client,
     manifest,
     new Set([
@@ -851,8 +833,7 @@ export async function disablePlatform(
     writeInstallationManifest(next);
   }
   try {
-    await writeRemoteManifestIfPresent(client, next);
-    const zone = next.resources.find((resource) => resource.key === 'zone');
+    await saveRemoteManifest(next);
     const routing = requireResource(next, 'routing-kv');
     const trafficGeneration = currentTrafficGeneration(next);
     await client.putKvValue(
@@ -861,24 +842,18 @@ export async function disablePlatform(
       PLATFORM_DISABLED_KEY,
       PLATFORM_DISABLED_VALUE,
     );
-    const trackedTraffic = trackedPlatformWorkerTraffic(next);
-    await client.removeRoutes(
-      next.account.id,
-      !zone || missing.has(zone.key) ? null : zone.id,
-      trackedTraffic,
-    );
     next = markTrafficAttachmentsRetained(next);
     if (!hasLifecycleStep(next, `disable:${trafficGeneration}:routes`)) {
       next = recordLifecycleStep(next, `disable:${trafficGeneration}:routes`);
     }
-    await writeLifecycleCheckpoint(client, next);
+    await saveCheckpoint(next);
     next = transitionInstallation(next, 'disabled', new Date().toISOString());
-    await writeLifecycleCheckpoint(client, next);
+    await saveCheckpoint(next);
     printSuccess(`${next.deployment.displayName} is disabled. Its data was not changed.`);
   } catch (error) {
     next = transitionInstallation(next, 'failed', new Date().toISOString());
     writeInstallationManifest(next);
-    await writeRemoteManifestIfPresent(client, next).catch(() => {});
+    await saveRemoteManifest(next).catch(() => {});
     throw error;
   }
 }
@@ -889,26 +864,11 @@ export async function uninstallPlatform(
   args: Extract<PlatformArgs, { subcommand: 'uninstall' }>,
   dependencies: PlatformManagementDependencies = {},
 ): Promise<void> {
-  const reconciled = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
-  const manifest = reconciled;
-  const writeLifecycleCheckpoint = (
-    checkpointClient: PlatformManagementClient,
-    checkpointManifest: PlatformInstallationManifest,
-  ) =>
-    writeLifecycleCheckpointWithoutDatabase(
-      checkpointClient,
-      checkpointManifest,
-      dependencies.checkpoint,
-    );
-  const writeRemoteManifestIfPresent = (
-    checkpointClient: PlatformManagementClient,
-    checkpointManifest: PlatformInstallationManifest,
-  ) =>
-    writeRemoteManifestIfPresentWithoutDatabase(
-      checkpointClient,
-      checkpointManifest,
-      dependencies.checkpoint,
-    );
+  const manifest = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
+  const saveCheckpoint = (state: PlatformInstallationManifest) =>
+    writeLifecycleCheckpoint(client, state, dependencies.checkpoint);
+  const saveRemoteManifest = (state: PlatformInstallationManifest) =>
+    writeRemoteManifest(client, state, dependencies.checkpoint);
   const retainData = !args.purgeData;
   const purgeResources = args.purgeResources;
   const routingKv = manifest.resources.find((resource) => resource.key === 'routing-kv');
@@ -933,7 +893,6 @@ export async function uninstallPlatform(
   if (purgeResources) {
     await assertNoPlatformProjects(dependencies.readProjects);
   }
-  const purgeResourcesClient = purgeResources ? requirePurgeResourcesClient(client) : null;
   if (args.plan || (interactive && !args.yes)) {
     note(
       purgeResources
@@ -954,9 +913,9 @@ export async function uninstallPlatform(
       pc.bold('Uninstall plan'),
     );
   }
-  if (purgeResourcesClient) {
+  if (purgeResources) {
     const credentialCheck = checkPurgeResourcesCredentials(
-      purgeResourcesClient,
+      client,
       manifest,
       dependencies.credential ?? { source: 'environment', aiGatewayToken: false },
     );
@@ -975,11 +934,6 @@ export async function uninstallPlatform(
   if (manifest !== initialManifest) {
     writeInstallationManifest(manifest);
   }
-  if (!interactive && !args.yes) {
-    throw new Error(
-      'platform: Non-interactive `void platform uninstall` requires --yes to acknowledge Cloudflare changes. Run with --plan first to inspect them.',
-    );
-  }
   if (interactive && !args.yes) {
     const proceed = await confirmAction(
       purgeResources
@@ -1104,7 +1058,7 @@ export async function uninstallPlatform(
     throw error;
   }
   try {
-    await writeRemoteManifestIfPresent(client, next);
+    await saveRemoteManifest(next);
     const routing = hasRoutingCheckpoint ? requireResource(next, 'routing-kv') : undefined;
     disablingTraffic = true;
     if (routing) {
@@ -1123,7 +1077,7 @@ export async function uninstallPlatform(
         key,
         resource.ownership === 'created' ? 'deleted' : 'retained',
       );
-      await writeLifecycleCheckpoint(client, next);
+      await saveCheckpoint(next);
     }
     const workers = new Set(
       next.resources
@@ -1143,22 +1097,20 @@ export async function uninstallPlatform(
           { databaseUrl: dependencies.databaseUrl },
         );
         if (!missing.has(worker.key)) {
-          const trackedTraffic = trackedPlatformWorkerTraffic(next, new Set([worker.name]));
-          await client.removeRoutes(next.account.id, zone.id, trackedTraffic);
           next = markTrafficAttachmentsRetained(next);
           next = recordLifecycleStep(next, `uninstall:routes:${worker.key}`);
-          await writeLifecycleCheckpoint(client, next);
+          await saveCheckpoint(next);
         }
       }
     }
-    if (purgeResourcesClient && hasRoutingCheckpoint) {
+    if (purgeResources && hasRoutingCheckpoint) {
       next = await runPurgeResourcesTeardown(
         {
-          client: purgeResourcesClient,
+          client,
           checkpoint: async (checkpointManifest) => {
             // Keep `next` current so a failure records the progress made.
             next = checkpointManifest;
-            await writeLifecycleCheckpoint(client, checkpointManifest);
+            await saveCheckpoint(checkpointManifest);
           },
           verify: (checkpointManifest, keys) =>
             verifyPlatformMutationOwnership(client, checkpointManifest, keys, {
@@ -1218,7 +1170,7 @@ export async function uninstallPlatform(
       }
       if (!hasRoutingCheckpoint && resource.kind !== 'zone') {
         next = updateResourceState(next, resource.key, 'retained');
-        await writeLifecycleCheckpoint(client, next);
+        await saveCheckpoint(next);
         continue;
       }
       if (!shouldDeleteResource(resource, retainData)) {
@@ -1229,12 +1181,12 @@ export async function uninstallPlatform(
           resource.ownership === 'created' &&
           !hasNamedResource(await client.listAiGateways(next.account.id), resource);
         next = updateResourceState(next, resource.key, removed ? 'deleted' : 'retained');
-        await writeLifecycleCheckpoint(client, next);
+        await saveCheckpoint(next);
         continue;
       }
       if ((resource.kind === 'dns-record' && !zone) || (resource.kind === 'queue' && queuesInUse)) {
         next = updateResourceState(next, resource.key, 'retained');
-        await writeLifecycleCheckpoint(client, next);
+        await saveCheckpoint(next);
         continue;
       }
       const immediatelyMissing = await verifyPlatformMutationOwnership(
@@ -1252,15 +1204,15 @@ export async function uninstallPlatform(
           resource.key,
           resource.ownership === 'created' ? 'deleted' : 'retained',
         );
-        await writeLifecycleCheckpoint(client, next);
+        await saveCheckpoint(next);
         continue;
       }
       await client.deleteResource(next.account.id, resource, zone?.id);
       next = updateResourceState(next, resource.key, 'deleted');
-      await writeLifecycleCheckpoint(client, next);
+      await saveCheckpoint(next);
     }
     const completed = transitionInstallation(next, 'uninstalled', new Date().toISOString());
-    await writeRemoteManifestIfPresent(client, completed);
+    await saveRemoteManifest(completed);
     next = completed;
     writeInstallationManifest(completed);
     if (!retainData) {
@@ -1282,7 +1234,7 @@ export async function uninstallPlatform(
     await stopProjectZeroTrustHold().catch(() => {});
     next = transitionInstallation(next, 'failed', new Date().toISOString());
     writeInstallationManifest(next);
-    await writeRemoteManifestIfPresent(client, next).catch(() => {});
+    await saveRemoteManifest(next).catch(() => {});
     throw error;
   }
 }
@@ -1302,12 +1254,7 @@ export async function recoverDurablyMarkedProvisionIntents(
   const pending = candidates.filter(
     ([key, kind, name]) =>
       !manifest.resources.some((resource) => resource.key === key) &&
-      manifest.steps.some(
-        (step) =>
-          (step.key === `provision-intent:${key}` ||
-            step.key.startsWith(`provision-intent:${key}:`)) &&
-          step.resultHash === platformProvisionIntentHash(manifest, key, kind, name),
-      ),
+      hasProvisionIntentStep(manifest, key, kind, name),
   );
   if (pending.length === 0) {
     return manifest;
@@ -1328,7 +1275,7 @@ export async function recoverDurablyMarkedProvisionIntents(
       continue;
     }
     const resource: InstallationResource = {
-      configHash: createHash('sha256').update(JSON.stringify({ kind, name })).digest('hex'),
+      configHash: legacyResourceConfigHash(kind, name),
       id: live.id,
       key,
       kind,
@@ -1448,32 +1395,6 @@ function purgeResourcesPlanText(manifest: PlatformInstallationManifest): string
   ].join('\n');
 }
 
-function requirePurgeResourcesClient(client: PlatformUninstallClient): PurgeResourcesClient {
-  const required: ReadonlyArray<keyof PurgeResourcesClient> = [
-    'deleteAccessResource',
-    'deleteDispatchNamespaceScript',
-    'deleteEmailRoutingRule',
-    'deleteQueueConsumer',
-    'deleteR2Object',
-    'deleteWorkerDomain',
-    'deleteWorkerRoute',
-    'emptyR2Bucket',
-    'forceDeleteWorker',
-    'getAccessResource',
-    'getEmailRoutingCatchAll',
-    'listDispatchNamespaceScripts',
-    'listEmailRoutingRules',
-    'listQueueConsumers',
-    'listWorkerDependents',
-    'listWorkerRoutes',
-    'resetEmailRoutingCatchAll',
-  ];
-  if (required.some((method) => typeof client[method] !== 'function')) {
-    throw new Error('platform: This Cloudflare client cannot run --purge-resources.');
-  }
-  return client as PurgeResourcesClient;
-}
-
 function describeKeptResources(
   manifest: PlatformInstallationManifest,
   resources: ReadonlyArray<InstallationResource>,
@@ -1646,7 +1567,7 @@ async function verifyPlatformMutationOwnership(
       }
     }
     if (attempt < 2) {
-      await new Promise((resolve) => setTimeout(resolve, 50 * 2 ** attempt));
+      await delay(50 * 2 ** attempt);
     }
   }
   if (rawRemote === null) {
@@ -1738,9 +1659,7 @@ async function verifyPlatformMutationOwnership(
         const live = await client.getHyperdriveConfig(accountId, resource.id);
         exists = live.id === resource.id && live.name === resource.name;
         if (exists) {
-          const legacyHash = createHash('sha256')
-            .update(JSON.stringify({ kind: resource.kind, name: resource.name }))
-            .digest('hex');
+          const legacyHash = legacyResourceConfigHash(resource.kind, resource.name);
           const malformedLegacyHash = !/^[a-f0-9]{64}$/.test(resource.configHash);
           if (options.databaseUrl && resource.ownership !== 'adopted') {
             const expected = hyperdriveOriginFromConnectionString(options.databaseUrl);
@@ -1798,9 +1717,7 @@ async function verifyPlatformMutationOwnership(
             current.content,
             current.proxied,
           );
-          const legacyHash = createHash('sha256')
-            .update(JSON.stringify({ kind: resource.kind, name: resource.name }))
-            .digest('hex');
+          const legacyHash = legacyResourceConfigHash(resource.kind, resource.name);
           const expectedHash = dnsRecordConfigHash(resource.name, 'AAAA', '100::', true);
           if (
             liveHash !== resource.configHash &&
@@ -1827,16 +1744,7 @@ async function verifyPlatformMutationOwnership(
       );
       exists = live !== undefined;
       if (live) {
-        const liveHash = live.fingerprint
-          ? r2BucketConfigHash(resource.name, live.fingerprint)
-          : null;
-        const legacyHash = createHash('sha256')
-          .update(JSON.stringify({ kind: resource.kind, name: resource.name }))
-          .digest('hex');
-        if (
-          liveHash === null ||
-          (resource.configHash !== liveHash && resource.configHash !== legacyHash)
-        ) {
+        if (!matchesRecordedR2Fingerprint(resource.configHash, live)) {
           throw ownershipError(`r2-bucket ${resource.name} changed creation fingerprint`);
         }
         const marker = await client.getR2Object(
@@ -1874,21 +1782,7 @@ function hasMatchingResourceIntent(
   resource: InstallationResource,
 ): boolean {
   if (resource.ownership === 'created') {
-    const previousResourceId =
-      manifest.resources.find((entry) => entry.key === resource.key)?.id ?? null;
-    return manifest.steps.some(
-      (step) =>
-        (step.key === `provision-intent:${resource.key}` ||
-          step.key.startsWith(`provision-intent:${resource.key}:`)) &&
-        step.resultHash ===
-          platformProvisionIntentHash(
-            manifest,
-            resource.key,
-            resource.kind,
-            resource.name,
-            previousResourceId,
-          ),
-    );
+    return hasProvisionIntentStep(manifest, resource.key, resource.kind, resource.name);
   }
   if (resource.ownership === 'adopted') {
     return manifest.steps.some(
@@ -1957,48 +1851,14 @@ function hasNamedResource(
   return entries.some((entry) => entry.id === resource.id && entry.name === resource.name);
 }
 
-function dnsRecordConfigHash(
-  name: string,
-  type: string,
-  content: string,
-  proxied: boolean,
-): string {
-  return createHash('sha256')
-    .update(JSON.stringify({ content, kind: 'dns-record', name, proxied, type }))
-    .digest('hex');
-}
-
-function r2BucketConfigHash(name: string, fingerprint: string): string {
-  return createHash('sha256')
-    .update(JSON.stringify({ fingerprint, kind: 'r2-bucket', name }))
-    .digest('hex');
-}
-
 function verifyResourceMarker(
   value: string | null | undefined,
   manifest: PlatformInstallationManifest,
   resource: InstallationResource,
 ): void {
-  if (!value) {
-    throw ownershipError(`${resource.kind} ${resource.name} has no ownership marker`);
-  }
-  let actual;
-  try {
-    actual = parsePlatformResourceOwnershipMarker(JSON.parse(value) as unknown);
-  } catch {
-    throw ownershipError(`${resource.kind} ${resource.name} has an invalid ownership marker`);
-  }
-  const expected = createPlatformResourceOwnershipMarker({
-    accountId: manifest.account.id,
-    installationId: manifest.id,
-    ownershipNonce: manifest.ownershipNonce,
-    resourceId: resource.id,
-    resourceKey: resource.key,
-    resourceKind: resource.kind,
-    resourceName: resource.name,
-  });
-  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
-    throw ownershipError(`${resource.kind} ${resource.name} belongs to another installation`);
+  const problem = resourceMarkerProblem(value, manifest, resource);
+  if (problem) {
+    throw ownershipError(`${resource.kind} ${resource.name} ${problem}`);
   }
 }
 
@@ -2038,6 +1898,9 @@ function updateResourceState(
   return recordInstallationResource(manifest, { ...resource, state }, new Date().toISOString());
 }
 
+// Cloudflare has no precondition for route or custom domain deletion, so even a
+// checked record id can be reused before DELETE. The routing KV gate blocks
+// traffic instead, and attachments stay for dashboard cleanup.
 function markTrafficAttachmentsRetained(
   manifest: PlatformInstallationManifest,
 ): PlatformInstallationManifest {
@@ -2075,16 +1938,16 @@ function recordLifecycleStep(
   return recordInstallationStep(manifest, { completedAt: now, key, resultHash: 'completed' }, now);
 }
 
-async function writeLifecycleCheckpointWithoutDatabase(
+async function writeLifecycleCheckpoint(
   client: PlatformManagementClient,
   manifest: PlatformInstallationManifest,
   databaseCheckpoint?: (manifest: PlatformInstallationManifest) => Promise<void>,
 ): Promise<void> {
   writeInstallationManifest(manifest);
-  await writeRemoteManifestIfPresentWithoutDatabase(client, manifest, databaseCheckpoint);
+  await writeRemoteManifest(client, manifest, databaseCheckpoint);
 }
 
-async function writeRemoteManifestIfPresentWithoutDatabase(
+async function writeRemoteManifest(
   client: PlatformManagementClient,
   manifest: PlatformInstallationManifest,
   databaseCheckpoint?: (manifest: PlatformInstallationManifest) => Promise<void>,
diff --git a/packages/void/src/cli/platform-plan.ts b/packages/void/src/cli/platform-plan.ts
index ec92718d2..5d7e7b805 100644
--- a/packages/void/src/cli/platform-plan.ts
+++ b/packages/void/src/cli/platform-plan.ts
@@ -12,7 +12,9 @@ import {
   parsePlatformResourceOwnershipMarker,
   PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY,
   PLATFORM_R2_OWNERSHIP_MARKER_KEY,
+  type InstallationResource,
   type InstallationResourceKind,
+  type PlatformAppAccess,
   type PlatformDeploymentManifest,
   type PlatformInstallationManifest,
 } from '@void/platform';
@@ -58,9 +60,9 @@ export type PlatformExternalHyperdrive = Readonly<{
   user: string;
 }>;
 
-export type PlatformInstallPlanInput = Readonly<{
-  appAccess?: import('@void/platform').PlatformAppAccess;
-  authentication?: import('@void/platform').PlatformDeploymentManifest['authentication'];
+type PlatformInstallPlanInput = Readonly<{
+  appAccess?: PlatformAppAccess;
+  authentication?: PlatformDeploymentManifest['authentication'];
   accountId: string;
   applicationDomain: string;
   controlPlaneDomain: string;
@@ -328,7 +330,6 @@ export async function createPlatformInstallPlan(
     throw error;
   });
   const [
-    workersSubdomain,
     aiGateways,
     routingKv,
     isrKv,
@@ -341,7 +342,6 @@ export async function createPlatformInstallPlan(
     hyperdrives,
     workers,
   ] = await Promise.all([
-    Promise.resolve(accountSubdomain),
     gatewayInventory,
     client.listKvNamespaces(account.id, names.routingKv),
     client.listKvNamespaces(account.id, names.isrCacheKv),
@@ -379,7 +379,12 @@ export async function createPlatformInstallPlan(
         PLATFORM_R2_OWNERSHIP_MARKER_KEY,
       );
       if (
-        !matchesResourceMarker(marker, existing, 'assets-bucket', 'r2-bucket', bucket) ||
+        resourceMarkerProblem(marker, existing, {
+          id: bucket.id,
+          key: 'assets-bucket',
+          kind: 'r2-bucket',
+          name: bucket.name,
+        }) ||
         !matchesRecordedR2Fingerprint(recordedBucket.configHash, bucket)
       ) {
         ambiguousResources.add('assets-bucket');
@@ -394,7 +399,14 @@ export async function createPlatformInstallPlan(
         bucket.name,
         PLATFORM_R2_OWNERSHIP_MARKER_KEY,
       );
-      if (matchesResourceMarker(marker, existing, 'assets-bucket', 'r2-bucket', bucket)) {
+      if (
+        !resourceMarkerProblem(marker, existing, {
+          id: bucket.id,
+          key: 'assets-bucket',
+          kind: 'r2-bucket',
+          name: bucket.name,
+        })
+      ) {
         intentProofs.add('assets-bucket');
       }
     }
@@ -408,8 +420,10 @@ export async function createPlatformInstallPlan(
       if (workers.includes(name) && hasUnrecordedProvisionIntent(existing, key, 'worker', name)) {
         const bindings = await client.getWorkerPlainTextBindings(account.id, name);
         if (
-          matchesResourceMarker(bindings.PLATFORM_OWNERSHIP_MARKER, existing, key, 'worker', {
+          !resourceMarkerProblem(bindings.PLATFORM_OWNERSHIP_MARKER, existing, {
             id: name,
+            key,
+            kind: 'worker',
             name,
           })
         ) {
@@ -487,6 +501,14 @@ export async function createPlatformInstallPlan(
     }
   }
   const actions: Array<PlatformInstallPlanAction> = [];
+  const named: NamedPlanContext = {
+    actions,
+    existing,
+    options,
+    remoteOwnership,
+    intentProofs,
+    ambiguousResources,
+  };
   if (!testing) {
     const recordedZone = existing?.resources.find((resource) => resource.key === 'zone');
     const remotelyOwnedZone = remoteOwnership?.resources.some(
@@ -536,115 +558,66 @@ export async function createPlatformInstallPlan(
         'AI Gateway access will be verified with the runtime token before provisioning (AI Gateway: Edit required).',
     });
   } else {
-    addNamedPlan(
-      actions,
-      existing,
-      'ai-gateway',
-      'ai-gateway',
-      names.aiGateway,
-      aiGateways.filter((resource) => resource.id === names.aiGateway),
-      'reuse',
-      options,
-      remoteOwnership,
-      intentProofs,
-    );
+    addNamedPlan(named, {
+      key: 'ai-gateway',
+      kind: 'ai-gateway',
+      name: names.aiGateway,
+      matches: aiGateways.filter((resource) => resource.id === names.aiGateway),
+    });
   }
-  addNamedPlan(
-    actions,
-    existing,
-    'routing-kv',
-    'kv-namespace',
-    names.routingKv,
-    routingKv,
-    'reuse',
-    options,
-    remoteOwnership,
-    intentProofs,
-  );
-  addNamedPlan(
-    actions,
-    existing,
-    'isr-cache-kv',
-    'kv-namespace',
-    names.isrCacheKv,
-    isrKv,
-    'reuse',
-    options,
-    remoteOwnership,
-  );
-  addNamedPlan(
-    actions,
-    existing,
-    'legacy-assets-kv',
-    'kv-namespace',
-    names.legacyAssetsKv,
-    legacyKv,
-    'reuse',
-    options,
-    remoteOwnership,
-  );
-  addNamedPlan(
-    actions,
-    existing,
-    'assets-bucket',
-    'r2-bucket',
-    names.assetsBucket,
-    r2Buckets.filter((resource) => resource.name === names.assetsBucket),
-    'reuse',
-    options,
-    remoteOwnership,
-    intentProofs,
-    ambiguousResources,
-  );
-  addNamedPlan(
-    actions,
-    existing,
-    'usage-queue',
-    'queue',
-    names.usageQueue,
-    usageQueues,
-    'reuse',
-    options,
-    remoteOwnership,
-  );
-  addNamedPlan(
-    actions,
-    existing,
-    'cron-queue',
-    'queue',
-    names.cronQueue,
-    cronQueues,
-    'reuse',
-    options,
-    remoteOwnership,
-  );
+  addNamedPlan(named, {
+    key: 'routing-kv',
+    kind: 'kv-namespace',
+    name: names.routingKv,
+    matches: routingKv,
+  });
+  addNamedPlan(named, {
+    key: 'isr-cache-kv',
+    kind: 'kv-namespace',
+    name: names.isrCacheKv,
+    matches: isrKv,
+  });
+  addNamedPlan(named, {
+    key: 'legacy-assets-kv',
+    kind: 'kv-namespace',
+    name: names.legacyAssetsKv,
+    matches: legacyKv,
+  });
+  addNamedPlan(named, {
+    key: 'assets-bucket',
+    kind: 'r2-bucket',
+    name: names.assetsBucket,
+    matches: r2Buckets.filter((resource) => resource.name === names.assetsBucket),
+  });
+  addNamedPlan(named, {
+    key: 'usage-queue',
+    kind: 'queue',
+    name: names.usageQueue,
+    matches: usageQueues,
+  });
+  addNamedPlan(named, {
+    key: 'cron-queue',
+    kind: 'queue',
+    name: names.cronQueue,
+    matches: cronQueues,
+  });
   if (
     options?.deploymentExecution ??
     existing?.resources.some((resource) => resource.key === 'deployment-queue')
   ) {
-    addNamedPlan(
-      actions,
-      existing,
-      'deployment-queue',
-      'queue',
-      names.deploymentQueue,
-      deploymentQueues,
-      'reuse',
-      options,
-      remoteOwnership,
-    );
+    addNamedPlan(named, {
+      key: 'deployment-queue',
+      kind: 'queue',
+      name: names.deploymentQueue,
+      matches: deploymentQueues,
+    });
   }
-  addNamedPlan(
-    actions,
-    existing,
-    'dispatch-namespace',
-    'dispatch-namespace',
-    names.dispatchNamespace,
-    dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace),
-    'reuse',
-    options,
-    remoteOwnership,
-  );
+  addNamedPlan(named, {
+    key: 'dispatch-namespace',
+    kind: 'dispatch-namespace',
+    name: names.dispatchNamespace,
+    matches: dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace),
+  });
   const recordedHyperdrive = existing?.resources.find((resource) => resource.key === 'hyperdrive');
   const externalHyperdriveId =
     input.externalHyperdrive?.id ||
@@ -681,17 +654,12 @@ export async function createPlatformInstallPlan(
         : 'Use the externally managed Hyperdrive without taking ownership.',
     });
   } else {
-    addNamedPlan(
-      actions,
-      existing,
-      'hyperdrive',
-      'hyperdrive',
-      names.hyperdrive,
-      hyperdrives.filter((resource) => resource.name === names.hyperdrive),
-      'reuse',
-      options,
-      remoteOwnership,
-    );
+    addNamedPlan(named, {
+      key: 'hyperdrive',
+      kind: 'hyperdrive',
+      name: names.hyperdrive,
+      matches: hyperdrives.filter((resource) => resource.name === names.hyperdrive),
+    });
   }
   for (const [key, name] of [
     ['api-worker', names.apiWorker],
@@ -702,19 +670,13 @@ export async function createPlatformInstallPlan(
     ['tail-worker', names.tailWorker],
     ['dispatch-worker', names.dispatchWorker],
   ] as const) {
-    const matches = workers.includes(name) ? [{ id: name, name }] : [];
-    addNamedPlan(
-      actions,
-      existing,
+    addNamedPlan(named, {
       key,
-      'worker',
+      kind: 'worker',
       name,
-      matches,
-      'update',
-      options,
-      remoteOwnership,
-      intentProofs,
-    );
+      matches: workers.includes(name) ? [{ id: name, name }] : [],
+      existingAction: 'update',
+    });
   }
   const resolvedResources = { ...deployment.resources };
   for (const action of actions) {
@@ -729,10 +691,8 @@ export async function createPlatformInstallPlan(
   });
   const apiUrl = resolvedDeployment.controlPlane.apiHostname
     ? `https://${deployment.controlPlane.apiHostname}`
-    : `https://${resolvedDeployment.resources.apiWorker}.${workersSubdomain}.workers.dev`;
-  const proxyUrl = resolvedDeployment.controlPlane.proxyHostname
-    ? `https://${deployment.controlPlane.proxyHostname}`
-    : `https://${resolvedDeployment.resources.proxyWorker}.${workersSubdomain}.workers.dev`;
+    : `https://${resolvedDeployment.resources.apiWorker}.${accountSubdomain}.workers.dev`;
+  const proxyUrl = `https://${resolvedDeployment.resources.proxyWorker}.${accountSubdomain}.workers.dev`;
   return {
     account,
     actions,
@@ -748,11 +708,15 @@ export async function createPlatformInstallPlan(
     ...(input.externalHyperdrive ? { externalHyperdrive: input.externalHyperdrive } : {}),
     installationId,
     proxyUrl,
-    workersSubdomain,
+    workersSubdomain: accountSubdomain,
     zone,
   };
 }
 
+export function platformWorkersDevUrl(plan: PlatformInstallPlan, workerName: string): string {
+  return `https://${workerName}.${plan.workersSubdomain}.workers.dev`;
+}
+
 export async function revalidatePlatformInstallAction(
   client: PlanningClient,
   original: PlatformInstallPlan,
@@ -806,8 +770,10 @@ export async function revalidatePlatformInstallAction(
     }
     const bindings = await client.getWorkerPlainTextBindings(original.account.id, action.name);
     if (
-      !matchesResourceMarker(bindings.PLATFORM_OWNERSHIP_MARKER, manifest, action.key, 'worker', {
+      resourceMarkerProblem(bindings.PLATFORM_OWNERSHIP_MARKER, manifest, {
         id: action.name,
+        key: action.key,
+        kind: 'worker',
         name: action.name,
       })
     ) {
@@ -852,8 +818,10 @@ export async function revalidatePlatformInstallAction(
   if (action.kind === 'worker' && action.action === 'update') {
     const bindings = await client.getWorkerPlainTextBindings(original.account.id, action.name);
     if (
-      !matchesResourceMarker(bindings.PLATFORM_OWNERSHIP_MARKER, manifest, action.key, 'worker', {
+      resourceMarkerProblem(bindings.PLATFORM_OWNERSHIP_MARKER, manifest, {
         id: action.name,
+        key: action.key,
+        kind: 'worker',
         name: action.name,
       })
     ) {
@@ -953,19 +921,27 @@ function resolveAccount(
   return matches[0]!;
 }
 
+type NamedPlanContext = Readonly<{
+  actions: Array<PlatformInstallPlanAction>;
+  existing: PlatformInstallationManifest | null;
+  options?: { authoritativeProvisionIntents?: boolean; repairMissing?: boolean };
+  remoteOwnership: PlatformInstallationManifest | null;
+  intentProofs: ReadonlySet<string>;
+  ambiguousResources: ReadonlySet<string>;
+}>;
+
 function addNamedPlan(
-  actions: Array<PlatformInstallPlanAction>,
-  existing: PlatformInstallationManifest | null,
-  key: string,
-  kind: InstallationResourceKind,
-  name: string,
-  matches: ReadonlyArray<CloudflareNamedResource>,
-  existingAction: 'reuse' | 'update' = 'reuse',
-  options?: { authoritativeProvisionIntents?: boolean; repairMissing?: boolean },
-  remoteOwnership?: PlatformInstallationManifest | null,
-  intentProofs: ReadonlySet<string> = new Set(),
-  ambiguousResources: ReadonlySet<string> = new Set(),
+  context: NamedPlanContext,
+  target: Readonly<{
+    key: string;
+    kind: InstallationResourceKind;
+    name: string;
+    matches: ReadonlyArray<CloudflareNamedResource>;
+    existingAction?: 'reuse' | 'update';
+  }>,
 ): void {
+  const { actions, existing, options, remoteOwnership, intentProofs, ambiguousResources } = context;
+  const { key, kind, name, matches, existingAction = 'reuse' } = target;
   if (matches.length > 1) {
     throw new Error(`platform: More than one ${kind} named ${JSON.stringify(name)} exists.`);
   }
@@ -1081,11 +1057,7 @@ function hasUnrecordedProvisionIntent(
 ): boolean {
   return (
     !manifest.resources.some((resource) => resource.key === key && resource.state === 'ready') &&
-    manifest.steps.some(
-      (step) =>
-        isProvisionIntentStep(step.key, key) &&
-        step.resultHash === platformProvisionIntentHash(manifest, key, kind, name),
-    )
+    hasProvisionIntentStep(manifest, key, kind, name)
   );
 }
 
@@ -1100,18 +1072,22 @@ function hasAmbiguousProvisionIntent(
   if (recorded?.id === remoteId && recorded.kind === kind && recorded.name === name) {
     return false;
   }
+  return hasProvisionIntentStep(manifest, key, kind, name, recorded?.id ?? null);
+}
+
+/** Whether the manifest records an intent to provision this resource. */
+export function hasProvisionIntentStep(
+  manifest: Pick<PlatformInstallationManifest, 'ownershipNonce' | 'steps'>,
+  key: string,
+  kind: InstallationResourceKind,
+  name: string,
+  previousResourceId: string | null = null,
+): boolean {
   return manifest.steps.some(
     (step) =>
-      isProvisionIntentStep(step.key, key) &&
+      (step.key === `provision-intent:${key}` || step.key.startsWith(`provision-intent:${key}:`)) &&
       step.resultHash ===
-        platformProvisionIntentHash(manifest, key, kind, name, recorded?.id ?? null),
-  );
-}
-
-function isProvisionIntentStep(stepKey: string, resourceKey: string): boolean {
-  return (
-    stepKey === `provision-intent:${resourceKey}` ||
-    stepKey.startsWith(`provision-intent:${resourceKey}:`)
+        platformProvisionIntentHash(manifest, key, kind, name, previousResourceId),
   );
 }
 
@@ -1128,53 +1104,71 @@ function interruptedProvisionRetryName(
   return `${name.slice(0, 63 - suffix.length).replace(/-+$/, '')}${suffix}`;
 }
 
-function matchesRecordedR2Fingerprint(
+// Installation manifests store these config hashes, so their JSON shape must not change.
+
+/** Name-only config hash, recorded for resources without a live fingerprint. */
+export function legacyResourceConfigHash(kind: InstallationResourceKind, name: string): string {
+  return createHash('sha256').update(JSON.stringify({ kind, name })).digest('hex');
+}
+
+export function r2BucketConfigHash(name: string, fingerprint: string): string {
+  return createHash('sha256')
+    .update(JSON.stringify({ fingerprint, kind: 'r2-bucket', name }))
+    .digest('hex');
+}
+
+export function dnsRecordConfigHash(
+  name: string,
+  type: string,
+  content: string,
+  proxied: boolean,
+): string {
+  return createHash('sha256')
+    .update(JSON.stringify({ content, kind: 'dns-record', name, proxied, type }))
+    .digest('hex');
+}
+
+/** Whether a live R2 bucket still matches the creation fingerprint recorded for it. */
+export function matchesRecordedR2Fingerprint(
   configHash: string,
-  resource: CloudflareNamedResource,
+  bucket: CloudflareNamedResource,
 ): boolean {
-  if (!resource.fingerprint) {
+  if (!bucket.fingerprint) {
     return false;
   }
-  const liveHash = createHash('sha256')
-    .update(
-      JSON.stringify({
-        fingerprint: resource.fingerprint,
-        kind: 'r2-bucket',
-        name: resource.name,
-      }),
-    )
-    .digest('hex');
-  const legacyHash = createHash('sha256')
-    .update(JSON.stringify({ kind: 'r2-bucket', name: resource.name }))
-    .digest('hex');
-  return configHash === liveHash || configHash === legacyHash;
+  return (
+    configHash === r2BucketConfigHash(bucket.name, bucket.fingerprint) ||
+    configHash === legacyResourceConfigHash('r2-bucket', bucket.name)
+  );
 }
 
-function matchesResourceMarker(
+/** Why `value` is not this installation's ownership marker for the resource, or null when it is. */
+export function resourceMarkerProblem(
   value: string | null | undefined,
   manifest: PlatformInstallationManifest,
-  key: string,
-  kind: InstallationResourceKind,
-  resource: CloudflareNamedResource,
-): boolean {
+  resource: Pick<InstallationResource, 'id' | 'key' | 'kind' | 'name'>,
+): string | null {
   if (!value) {
-    return false;
+    return 'has no ownership marker';
   }
+  let actual;
   try {
-    const actual = parsePlatformResourceOwnershipMarker(JSON.parse(value) as unknown);
-    const expected = createPlatformResourceOwnershipMarker({
-      accountId: manifest.account.id,
-      installationId: manifest.id,
-      ownershipNonce: manifest.ownershipNonce,
-      resourceId: resource.id,
-      resourceKey: key,
-      resourceKind: kind,
-      resourceName: resource.name,
-    });
-    return JSON.stringify(actual) === JSON.stringify(expected);
+    actual = parsePlatformResourceOwnershipMarker(JSON.parse(value) as unknown);
   } catch {
-    return false;
+    return 'has an invalid ownership marker';
   }
+  const expected = createPlatformResourceOwnershipMarker({
+    accountId: manifest.account.id,
+    installationId: manifest.id,
+    ownershipNonce: manifest.ownershipNonce,
+    resourceId: resource.id,
+    resourceKey: resource.key,
+    resourceKind: resource.kind,
+    resourceName: resource.name,
+  });
+  return JSON.stringify(actual) === JSON.stringify(expected)
+    ? null
+    : 'belongs to another installation';
 }
 
 // Preserve recovery for previously installed, suffixed namespaces. New platforms
diff --git a/packages/void/src/cli/platform-plans-args.ts b/packages/void/src/cli/platform-plans-args.ts
index d3f9a8d63..4d4b047e2 100644
--- a/packages/void/src/cli/platform-plans-args.ts
+++ b/packages/void/src/cli/platform-plans-args.ts
@@ -1,4 +1,7 @@
-export const PLATFORM_PLAN_ACTIONS = [
+import { parsePlatformPlanId } from '@void/platform/plans';
+import { parseConfigFlags } from './platform-config-args.ts';
+
+const PLATFORM_PLAN_ACTIONS = [
   'show',
   'add',
   'set',
@@ -9,7 +12,7 @@ export const PLATFORM_PLAN_ACTIONS = [
   'default',
   'sync',
 ] as const;
-export type PlatformPlanAction = (typeof PLATFORM_PLAN_ACTIONS)[number];
+type PlatformPlanAction = (typeof PLATFORM_PLAN_ACTIONS)[number];
 export type PlatformPlansArgs = Readonly<{
   subcommand: 'config';
   configGroup: 'plans';
@@ -26,36 +29,13 @@ export type PlatformPlansArgs = Readonly<{
 }>;
 
 export function parsePlatformPlansArgs(args: ReadonlyArray<string>): PlatformPlansArgs {
-  const positional: Array<string> = [];
-  const flags = new Set<string>();
-  const values = new Map<string, string>();
-  const valueFlags = ['connection', 'file', 'name', 'copy', 'replacement'];
-  for (let index = 1; index < args.length; index++) {
-    const arg = args[index]!;
-    if (!arg.startsWith('-')) {
-      positional.push(arg);
-      continue;
-    }
-    const name = arg.slice(2);
-    if (
-      !arg.startsWith('--') ||
-      (!['json', 'plan', 'yes'].includes(name) && !valueFlags.includes(name))
-    ) {
-      throw new Error(`platform: Unknown config plans flag ${arg}.`);
-    }
-    if (flags.has(name) || values.has(name)) {
-      throw new Error(`platform: Duplicate flag ${arg}.`);
-    }
-    if (!valueFlags.includes(name)) {
-      flags.add(name);
-      continue;
-    }
-    const value = args[++index];
-    if (!value || value.startsWith('-')) {
-      throw new Error(`platform: ${arg} requires a value.`);
-    }
-    values.set(name, value);
-  }
+  const { positional, flags, values } = parseConfigFlags(args, 'plans', [
+    'connection',
+    'file',
+    'name',
+    'copy',
+    'replacement',
+  ]);
   const [action = '', target = '', ...extra] = positional;
   if (extra.length || (action && !PLATFORM_PLAN_ACTIONS.includes(action as PlatformPlanAction))) {
     throw new Error(
@@ -102,4 +82,3 @@ export function parsePlatformPlansArgs(args: ReadonlyArray<string>): PlatformPla
     yes: flags.has('yes'),
   };
 }
-import { parsePlatformPlanId } from '@void/platform/plans';
diff --git a/packages/void/src/cli/platform-plans-config.ts b/packages/void/src/cli/platform-plans-config.ts
index 76c97c20a..ee0555ad1 100644
--- a/packages/void/src/cli/platform-plans-config.ts
+++ b/packages/void/src/cli/platform-plans-config.ts
@@ -48,6 +48,32 @@ function limitValue(value: number, key?: (typeof PLAN_EDITABLE_LIMIT_KEYS)[numbe
   return value === 0 ? 'unlimited' : value.toLocaleString('en-US');
 }
 
+function shortSlugsLabel(allowed: boolean): string {
+  return allowed ? 'allowed' : 'not allowed';
+}
+
+function writePlanDiff(
+  from: PlatformPlanDefinition,
+  to: PlatformPlanDefinition,
+  write: (line: string) => void,
+): void {
+  if (from.buildInstanceType !== to.buildInstanceType) {
+    write(`Build size: ${from.buildInstanceType} → ${to.buildInstanceType}`);
+  }
+  if (from.allowShortSlugs !== to.allowShortSlugs) {
+    write(
+      `Short project slugs: ${shortSlugsLabel(from.allowShortSlugs)} → ${shortSlugsLabel(to.allowShortSlugs)}`,
+    );
+  }
+  for (const key of PLAN_EDITABLE_LIMIT_KEYS) {
+    if (from.limits[key] !== to.limits[key]) {
+      write(
+        `${limitLabels[key]}: ${limitValue(from.limits[key], key)} → ${limitValue(to.limits[key], key)}`,
+      );
+    }
+  }
+}
+
 function showListing(listing: Listing, json: boolean): void {
   if (json) {
     print(listing);
@@ -87,7 +113,7 @@ function showPreview(
       for (const key of PLAN_EDITABLE_LIMIT_KEYS) {
         write(`  ${limitLabels[key]}: ${limitValue(plan.limits[key], key)}`);
       }
-      write(`  Short project slugs: ${plan.allowShortSlugs ? 'allowed' : 'not allowed'}`);
+      write(`  Short project slugs: ${shortSlugsLabel(plan.allowShortSlugs)}`);
       continue;
     }
     if (previous.name !== plan.name) {
@@ -96,21 +122,7 @@ function showPreview(
     if (previous.archived !== plan.archived) {
       write(`${plan.id}: ${plan.archived ? 'archive for new assignments' : 'restore assignments'}`);
     }
-    if (previous.buildInstanceType !== plan.buildInstanceType) {
-      write(`Build size: ${previous.buildInstanceType} → ${plan.buildInstanceType}`);
-    }
-    if (previous.allowShortSlugs !== plan.allowShortSlugs) {
-      write(
-        `Short project slugs: ${previous.allowShortSlugs ? 'allowed' : 'not allowed'} → ${plan.allowShortSlugs ? 'allowed' : 'not allowed'}`,
-      );
-    }
-    for (const key of PLAN_EDITABLE_LIMIT_KEYS) {
-      if (previous.limits[key] !== plan.limits[key]) {
-        write(
-          `${limitLabels[key]}: ${limitValue(previous.limits[key], key)} → ${limitValue(plan.limits[key], key)}`,
-        );
-      }
-    }
+    writePlanDiff(previous, plan, write);
   }
   for (const plan of before.plans) {
     if (!after.plans.some((entry) => entry.id === plan.id)) {
@@ -118,21 +130,7 @@ function showPreview(
       const replacement = after.plans.find((entry) => entry.id === preview.replacementPlanId);
       if (replacement) {
         write(`Move accounts to ${label(replacement)}`);
-        if (plan.buildInstanceType !== replacement.buildInstanceType) {
-          write(`Build size: ${plan.buildInstanceType} → ${replacement.buildInstanceType}`);
-        }
-        if (plan.allowShortSlugs !== replacement.allowShortSlugs) {
-          write(
-            `Short project slugs: ${plan.allowShortSlugs ? 'allowed' : 'not allowed'} → ${replacement.allowShortSlugs ? 'allowed' : 'not allowed'}`,
-          );
-        }
-        for (const key of PLAN_EDITABLE_LIMIT_KEYS) {
-          if (plan.limits[key] !== replacement.limits[key]) {
-            write(
-              `${limitLabels[key]}: ${limitValue(plan.limits[key], key)} → ${limitValue(replacement.limits[key], key)}`,
-            );
-          }
-        }
+        writePlanDiff(plan, replacement, write);
       }
     }
   }
@@ -439,7 +437,7 @@ export async function runPlatformPlansConfig(args: PlatformPlansArgs): Promise<v
         const plan = result.plan as PlatformPlanDefinition;
         console.log(`${label(plan)}${result.default ? ' — default for new accounts' : ''}`);
         console.log(`Accounts: ${result.accounts}; build size: ${plan.buildInstanceType}`);
-        console.log(`Short project slugs: ${plan.allowShortSlugs ? 'allowed' : 'not allowed'}`);
+        console.log(`Short project slugs: ${shortSlugsLabel(plan.allowShortSlugs)}`);
         for (const key of PLAN_EDITABLE_LIMIT_KEYS) {
           console.log(`${limitLabels[key]}: ${limitValue(plan.limits[key], key)}`);
         }
diff --git a/packages/void/src/cli/platform-recovery.ts b/packages/void/src/cli/platform-recovery.ts
index 1fe5f9b79..ded6bc1b1 100644
--- a/packages/void/src/cli/platform-recovery.ts
+++ b/packages/void/src/cli/platform-recovery.ts
@@ -50,10 +50,6 @@ export async function recoverPlatformInstallations(
   ) => Promise<void> = verifyInstallationEndpoint,
   selector = '',
 ): Promise<ReadonlyArray<PlatformInstallationManifest>> {
-  const accounts = await client.listAccounts();
-  if (!accounts.some((account) => account.id === accountId)) {
-    throw new Error(`platform: Cloudflare account ${JSON.stringify(accountId)} is unavailable.`);
-  }
   // The routing namespace is the durable recovery root. Interrupted creates
   // can intentionally move it to a deterministic `-retry-*` name, and future
   // naming changes must not make an otherwise valid installation invisible.
@@ -150,18 +146,14 @@ export async function recoverPlatformInstallations(
         if (isPlatformManifestMonotonicExtension(manifest, collision)) {
           await verifyPlatformInstallationOwnership(client, collision);
           manifest = collision;
-        } else if (isPlatformManifestMonotonicExtension(collision, manifest)) {
-          writeInstallationManifest(manifest);
-        } else {
+        } else if (!isPlatformManifestMonotonicExtension(collision, manifest)) {
           throw new Error(
             `platform: Local installation ${manifest.id} differs from its remote checkpoint. Resolve or remove the local record before discovery; it was not overwritten.`,
           );
         }
       }
       manifest = reconcileRecoveredEndpoints(manifest, plan);
-      if (!collision) {
-        writeInstallationManifest(manifest);
-      } else if (JSON.stringify(collision) !== JSON.stringify(manifest)) {
+      if (!collision || JSON.stringify(collision) !== JSON.stringify(manifest)) {
         writeInstallationManifest(manifest);
       }
       if (manifest.endpoints.apiUrl !== null && manifest.endpoints.proxyUrl !== null) {
diff --git a/packages/void/src/cli/platform-registry.ts b/packages/void/src/cli/platform-registry.ts
index 9a83a1497..be0497f7d 100644
--- a/packages/void/src/cli/platform-registry.ts
+++ b/packages/void/src/cli/platform-registry.ts
@@ -5,7 +5,6 @@ import {
   openSync,
   readFileSync,
   readdirSync,
-  renameSync,
   rmSync,
   statSync,
   writeFileSync,
@@ -16,9 +15,10 @@ import {
   type PlatformInstallationManifest,
 } from '@void/platform';
 import { join, resolve } from 'pathslash';
+import { writeFileAtomic } from '../shared/atomic-write.ts';
 import { readKeyringPassword, writeKeyringPassword } from './keyring.ts';
 
-export const PLATFORM_REGISTRY_SCHEMA_VERSION = 1 as const;
+const PLATFORM_REGISTRY_SCHEMA_VERSION = 1 as const;
 
 export type PlatformConnection = Readonly<{
   accountId: string | null;
@@ -80,7 +80,7 @@ export function normalizePlatformApiUrl(value: string): string {
   return url.origin;
 }
 
-export function platformConnectionId(apiUrl: string): string {
+function platformConnectionId(apiUrl: string): string {
   return createHash('sha256').update(normalizePlatformApiUrl(apiUrl)).digest('hex').slice(0, 20);
 }
 
@@ -180,13 +180,7 @@ function withRegistryLock<T>(directory: string, operation: () => T): T {
 }
 
 function writeJsonAtomically(path: string, value: unknown): void {
-  const temporary = `${path}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
-  try {
-    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
-    renameSync(temporary, path);
-  } finally {
-    rmSync(temporary, { force: true });
-  }
+  writeFileAtomic(path, `${JSON.stringify(value, null, 2)}\n`, 0o600);
 }
 
 export function acquirePlatformLifecycleLock(
@@ -372,7 +366,7 @@ export function selectPlatformConnection(
   });
 }
 
-export function installationManifestPath(
+function installationManifestPath(
   accountId: string,
   installationId: string,
   directory: string = platformRegistryDirectory(),
diff --git a/packages/void/src/cli/platform-saved-plans.ts b/packages/void/src/cli/platform-saved-plans.ts
index f3cd2dfce..cfeb5716d 100644
--- a/packages/void/src/cli/platform-saved-plans.ts
+++ b/packages/void/src/cli/platform-saved-plans.ts
@@ -1,10 +1,11 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'pathslash';
+import { writeFileAtomic } from '../shared/atomic-write.ts';
 import { parsePlatformArgs, type PlatformArgs } from './platform-args.ts';
 import { platformRegistryDirectory } from './platform-registry.ts';
 
-export type SavedPlatformInstallPlan = Readonly<{
+type SavedPlatformInstallPlan = Readonly<{
   id: string;
   accountName: string;
   savedAt: string;
@@ -65,14 +66,11 @@ export function savePlatformInstallChoices(
   };
   const plan = parseSavedPlan(record);
   mkdirSync(directory, { recursive: true, mode: 0o700 });
-  const path = join(directory, `plan-${plan.id}.json`);
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
-    writeFileSync(temporary, JSON.stringify(record, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-    renameSync(temporary, path);
-  } finally {
-    rmSync(temporary, { force: true });
-  }
+  writeFileAtomic(
+    join(directory, `plan-${plan.id}.json`),
+    JSON.stringify(record, null, 2) + '\n',
+    0o600,
+  );
   return plan;
 }
 
diff --git a/packages/void/src/cli/platform-secret-update-authority.ts b/packages/void/src/cli/platform-secret-update-authority.ts
index 61246a27b..dd1b8907a 100644
--- a/packages/void/src/cli/platform-secret-update-authority.ts
+++ b/packages/void/src/cli/platform-secret-update-authority.ts
@@ -1,22 +1,14 @@
 import type { PlatformInstallationManifest } from '@void/platform';
-
-const COMPLETE_WORKER_SECRET_UPDATE_NAMES = [
-  'CF_API_TOKEN',
-  'GITHUB_CLIENT_ID',
-  'GITHUB_CLIENT_SECRET',
-  'R2_ACCESS_KEY_ID',
-  'R2_SECRET_ACCESS_KEY',
-] as const;
-
-const EMAIL_WORKER_SECRET_UPDATE_NAME = 'EMAIL_SIGNING_SECRET';
+import {
+  PLATFORM_WORKER_SECRET_UPDATE_NAMES,
+  type PlatformWorkerSecretUpdates,
+} from './platform-installer-types.ts';
 
 type PendingWorkerSecretUpdateIntent = Readonly<{
   generation: number | null;
   id: string;
 }>;
 
-type WorkerSecretUpdates = Readonly<Partial<Record<string, string>>>;
-
 type WorkerSecretUpdateMarker = Readonly<{
   generation: number;
   id: string;
@@ -27,7 +19,7 @@ type WorkerSecretUpdateMarker = Readonly<{
  * update from carrying an opaque, possibly partial update into another cutover.
  */
 export function assertPlatformWorkerSecretUpdateAuthority(input: {
-  explicitUpdates: WorkerSecretUpdates;
+  explicitUpdates: Readonly<PlatformWorkerSecretUpdates>;
   localIntent?: PendingWorkerSecretUpdateIntent;
   manifest: PlatformInstallationManifest;
   requiresEmailSigningSecret: boolean;
@@ -95,15 +87,12 @@ function readLatestWorkerGeneration(manifest: PlatformInstallationManifest): num
 }
 
 function hasCompleteWorkerSecretReplacement(
-  updates: WorkerSecretUpdates,
+  updates: Readonly<PlatformWorkerSecretUpdates>,
   requiresEmailSigningSecret: boolean,
 ): boolean {
-  return (
-    COMPLETE_WORKER_SECRET_UPDATE_NAMES.every(
-      (name) => typeof updates[name] === 'string' && updates[name] !== '',
-    ) &&
-    (!requiresEmailSigningSecret ||
-      (typeof updates[EMAIL_WORKER_SECRET_UPDATE_NAME] === 'string' &&
-        updates[EMAIL_WORKER_SECRET_UPDATE_NAME] !== ''))
+  return PLATFORM_WORKER_SECRET_UPDATE_NAMES.every(
+    (name) =>
+      (name === 'EMAIL_SIGNING_SECRET' && !requiresEmailSigningSecret) ||
+      (typeof updates[name] === 'string' && updates[name] !== ''),
   );
 }
diff --git a/packages/void/src/cli/platform-setup.ts b/packages/void/src/cli/platform-setup.ts
index 031875e1d..35155d209 100644
--- a/packages/void/src/cli/platform-setup.ts
+++ b/packages/void/src/cli/platform-setup.ts
@@ -1,4 +1,3 @@
-import { execFile } from 'node:child_process';
 import type { PlatformDeploymentManifest } from '@void/platform';
 import { type CANCEL_SYMBOL, isCancel, log } from '@voidzero-dev/vite-plus-prompts';
 import { openBrowser } from './auth.ts';
@@ -6,7 +5,7 @@ import { pc } from './output.ts';
 import type { PlatformManagementAccess } from './platform-auth.ts';
 import type { PlatformInstallPlan } from './platform-plan.ts';
 
-export type PlatformSetupPage = Readonly<{
+type PlatformSetupPage = Readonly<{
   title: string;
   url: string;
   instructions: string;
@@ -109,17 +108,12 @@ function plansZoneCreation(plan: PlatformInstallPlan): boolean {
 
 export function platformManagementSetupPage(
   plan: PlatformInstallPlan,
-  options: { access?: PlatformManagementAccess | false } = {},
+  options: { access: PlatformManagementAccess | false },
 ): PlatformSetupPage {
   const createsZone = plansZoneCreation(plan);
   const zoneName = plan.deployment.application.zoneName;
   const apiHostname = plan.deployment.controlPlane.apiHostname;
-  const access =
-    options.access ??
-    (plan.deployment.authentication.accessProtection ||
-    plan.deployment.authentication.providers.includes('cloudflare-access')
-      ? { protection: !!plan.deployment.authentication.accessProtection, readOnly: false }
-      : undefined);
+  const { access } = options;
   const zones = [
     ...(zoneName ? [zoneName] : []),
     ...(apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`)
@@ -406,7 +400,7 @@ export function openPlatformSetupPage(
   }
   if (dependencies.interactive ?? process.stdin.isTTY === true) {
     try {
-      (dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
+      (dependencies.open ?? openBrowser)(page.url);
     } catch {
       log.info('Could not open the browser. Use the link above.');
     }
diff --git a/packages/void/src/cli/platform-teardown.ts b/packages/void/src/cli/platform-teardown.ts
index d4c4eb0e2..b2a0b1b94 100644
--- a/packages/void/src/cli/platform-teardown.ts
+++ b/packages/void/src/cli/platform-teardown.ts
@@ -10,6 +10,7 @@ import {
   type PlatformCloudflareClient,
 } from './platform-cloudflare.ts';
 import { platformTrafficAttachmentWorker } from './platform-traffic.ts';
+import { readPlatformDatabase } from './platform-zero-trust-uninstall.ts';
 
 /**
  * `void platform uninstall --purge-resources` deletes every Cloudflare resource the
@@ -558,31 +559,8 @@ export async function checkPurgeResourcesCredentials(
   }
 }
 
-type QueryConnection = Readonly<{
-  query: <Row extends Record<string, unknown> = Record<string, unknown>>(
-    sql: string,
-    values?: ReadonlyArray<unknown>,
-  ) => Promise<{ rows: ReadonlyArray<Row> }>;
-}>;
-
 const LISTED_PROJECTS = 20;
 
-/** Slugs of every project row, including projects whose deletion stopped partway. */
-export async function readPlatformProjectSlugsConnection(
-  client: QueryConnection,
-): Promise<ReadonlyArray<string>> {
-  const table = await client.query<{ present: boolean }>(
-    `SELECT to_regclass('public.projects') IS NOT NULL AS "present"`,
-  );
-  if (table.rows[0]?.present !== true) {
-    return [];
-  }
-  const rows = await client.query<{ slug: string }>(
-    'SELECT "slug" FROM "projects" ORDER BY "slug"',
-  );
-  return rows.rows.map((row) => row.slug);
-}
-
 /**
  * Projects own Workers, storage, and domains that only the running platform
  * can delete. --purge-resources deletes the platform, so it refuses before any
@@ -591,21 +569,11 @@ export async function readPlatformProjectSlugsConnection(
 export async function assertNoPlatformProjects(
   read: (() => Promise<ReadonlyArray<string>>) | undefined,
 ): Promise<void> {
-  let slugs: ReadonlyArray<string>;
-  try {
-    if (!read) {
-      throw new Error('no platform database connection is available');
-    }
-    slugs = await read();
-  } catch (error) {
-    const reason = (error instanceof Error ? error.message : String(error)).replace(
-      /^platform: /,
-      '',
-    );
-    throw new Error(
+  const slugs = await readPlatformDatabase(
+    read,
+    (reason) =>
       `platform: Refusing --purge-resources because the project list could not be read from the platform database: ${reason}\nMake the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry.`,
-    );
-  }
+  );
   if (slugs.length) {
     throw new Error(
       [
diff --git a/packages/void/src/cli/platform-traffic.ts b/packages/void/src/cli/platform-traffic.ts
index ad0227f93..41d280f1d 100644
--- a/packages/void/src/cli/platform-traffic.ts
+++ b/packages/void/src/cli/platform-traffic.ts
@@ -10,7 +10,6 @@ import type {
   CloudflareWorkerDomain,
   CloudflareWorkerRoute,
   PlatformManagedWorkerTraffic,
-  PlatformTrackedWorkerTraffic,
 } from './platform-cloudflare.ts';
 
 export function platformManagedWorkerTraffic(
@@ -71,18 +70,6 @@ export function platformTrafficAttachmentWorker(
   return null;
 }
 
-export function trackedPlatformWorkerTraffic(
-  _manifest: PlatformInstallationManifest,
-  _workers?: ReadonlySet<string>,
-): PlatformTrackedWorkerTraffic {
-  // Cloudflare does not expose a generation precondition for route or custom
-  // domain deletion. Even an immutable record id can be repurposed between a
-  // client-side ownership check and DELETE, so no observed attachment is safe
-  // for unattended cleanup. Disable traffic through the installation-owned KV
-  // gate and retain attachments for explicit dashboard cleanup.
-  return { customDomains: [], routes: [] };
-}
-
 export function recordPlatformWorkerTraffic(
   manifest: PlatformInstallationManifest,
   workerName: string,
diff --git a/packages/void/src/cli/platform-trigger-proof.ts b/packages/void/src/cli/platform-trigger-proof.ts
index 8814382d8..501a9e5e0 100644
--- a/packages/void/src/cli/platform-trigger-proof.ts
+++ b/packages/void/src/cli/platform-trigger-proof.ts
@@ -1,11 +1,10 @@
 import type { CloudflareTriggerConfig } from '@void/deploy-cloudflare';
+import { isRecord } from '@void/deploy-core';
 
 type ReadCloudflare = (path: string) => Promise<unknown>;
 
 function record(value: unknown): Record<string, unknown> | null {
-  return value !== null && typeof value === 'object' && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : null;
+  return isRecord(value) ? value : null;
 }
 
 function sameStrings(actual: ReadonlyArray<string>, expected: ReadonlyArray<string>): boolean {
diff --git a/packages/void/src/cli/platform-zero-trust-uninstall.ts b/packages/void/src/cli/platform-zero-trust-uninstall.ts
index 66e00072f..e845ef944 100644
--- a/packages/void/src/cli/platform-zero-trust-uninstall.ts
+++ b/packages/void/src/cli/platform-zero-trust-uninstall.ts
@@ -17,13 +17,32 @@ const ZERO_TRUST_LOCK = "hashtext('zero-trust:configuration')";
 const UNINSTALL_SETTING = 'platform.uninstall';
 const LISTED_APPLICATIONS = 20;
 
-type QueryConnection = Readonly<{
+export type QueryConnection = Readonly<{
   query: <Row extends Record<string, unknown> = Record<string, unknown>>(
     sql: string,
     values?: ReadonlyArray<unknown>,
   ) => Promise<{ rows: ReadonlyArray<Row> }>;
 }>;
 
+/** Runs an uninstall precheck read; any failure becomes the refusal `refuse` builds. */
+export async function readPlatformDatabase<T>(
+  read: (() => Promise<T>) | undefined,
+  refuse: (reason: string) => string,
+): Promise<T> {
+  try {
+    if (!read) {
+      throw new Error('no platform database connection is available');
+    }
+    return await read();
+  } catch (error) {
+    const reason = (error instanceof Error ? error.message : String(error)).replace(
+      /^platform: /,
+      '',
+    );
+    throw new Error(refuse(reason));
+  }
+}
+
 export type PlatformZeroTrustApplication = Readonly<{
   role: string;
   id: string | null;
@@ -280,25 +299,13 @@ function unfinishedDeletionLines(state: PlatformProjectZeroTrustState): Readonly
 export async function assertProjectZeroTrustAllowsUninstall(
   read: (() => Promise<PlatformProjectZeroTrustState>) | undefined,
 ): Promise<void> {
-  let state: PlatformProjectZeroTrustState;
-  try {
-    if (!read) {
-      throw new Error('no platform database connection is available');
-    }
-    state = await read();
-  } catch (error) {
-    const reason = (error instanceof Error ? error.message : String(error)).replace(
-      /^platform: /,
-      '',
-    );
-    throw new Error(
-      [
-        `platform: Refusing to uninstall because the project Zero Trust state could not be read from the platform database: ${reason}`,
-        'Uninstall turns off the platform API, which Void needs to remove the Cloudflare Access applications that project Zero Trust created.',
-        'Make the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry. If project Zero Trust was ever enabled, run `void platform zero-trust disable` first.',
-      ].join('\n'),
-    );
-  }
+  const state = await readPlatformDatabase(read, (reason) =>
+    [
+      `platform: Refusing to uninstall because the project Zero Trust state could not be read from the platform database: ${reason}`,
+      'Uninstall turns off the platform API, which Void needs to remove the Cloudflare Access applications that project Zero Trust created.',
+      'Make the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry. If project Zero Trust was ever enabled, run `void platform zero-trust disable` first.',
+    ].join('\n'),
+  );
   if (state.active) {
     const covered = state.destinations.length
       ? ` on ${state.destinations.join(' and ')}`
diff --git a/packages/void/src/cli/prepare-args.ts b/packages/void/src/cli/prepare-args.ts
index 2be0730cb..9bb09188e 100644
--- a/packages/void/src/cli/prepare-args.ts
+++ b/packages/void/src/cli/prepare-args.ts
@@ -1,8 +1,6 @@
 import { parseArgs } from 'node:util';
 
-export type PrepareArgs = {};
-
-export function parsePrepareArgs(args: Array<string>): PrepareArgs {
+export function parsePrepareArgs(args: Array<string>): void {
   const parsed = parseArgs({
     args,
     options: {},
@@ -13,6 +11,4 @@ export function parsePrepareArgs(args: Array<string>): PrepareArgs {
   if (parsed.positionals.length > 0) {
     throw new Error(`prepare: Unexpected argument '${parsed.positionals[0]}'.`);
   }
-
-  return {};
 }
diff --git a/packages/void/src/cli/prepare.ts b/packages/void/src/cli/prepare.ts
index e43ce0ee2..98ce06b27 100644
--- a/packages/void/src/cli/prepare.ts
+++ b/packages/void/src/cli/prepare.ts
@@ -1,9 +1,8 @@
 import { log } from '@voidzero-dev/vite-plus-prompts';
 import { prepareProject } from '../codegen/prepare.ts';
 import { printSuccess, note } from './output.ts';
-import type { PrepareArgs } from './prepare-args.ts';
 
-export async function runPrepareCommand(root: string, _args: PrepareArgs): Promise<void> {
+export async function runPrepareCommand(root: string): Promise<void> {
   console.log();
 
   const result = await prepareProject(root);
diff --git a/packages/void/src/cli/preset.ts b/packages/void/src/cli/preset.ts
index 70190df35..6b6b4a471 100644
--- a/packages/void/src/cli/preset.ts
+++ b/packages/void/src/cli/preset.ts
@@ -194,7 +194,7 @@ function shellQuoteExecutable(value: string): string {
 }
 
 /** Resolve the bundled cf transport without consulting project dependencies. */
-export function resolveCloudflareOperationArgv(_root: string): Array<string> {
+export function resolveCloudflareOperationArgv(): Array<string> {
   const directory = dirname(fileURLToPath(import.meta.url));
   const entry = [
     join(directory, 'cloudflare-operation-process.ts'),
diff --git a/packages/void/src/cli/project-args.ts b/packages/void/src/cli/project-args.ts
index 6ea07dc3c..d39bb6a19 100644
--- a/packages/void/src/cli/project-args.ts
+++ b/packages/void/src/cli/project-args.ts
@@ -115,26 +115,8 @@ export type ProjectArgs =
 export function parseProjectArgs(args: Array<string>): ProjectArgs {
   const [subcommand, ...rest] = args;
 
-  if (subcommand === 'status') {
-    const [name, extra] = rest;
-    if (name?.startsWith('-')) {
-      throw new Error(`project: Unknown flag '${name}'.`);
-    }
-    if (extra) {
-      throw new Error(`project: Unexpected argument '${extra}'.`);
-    }
-    return { subcommand, name: name ?? '' };
-  }
-
-  if (subcommand === 'link') {
-    const [name, extra] = rest;
-    if (name?.startsWith('-')) {
-      throw new Error(`project: Unknown flag '${name}'.`);
-    }
-    if (extra) {
-      throw new Error(`project: Unexpected argument '${extra}'.`);
-    }
-    return { subcommand, name: name ?? '' };
+  if (subcommand === 'status' || subcommand === 'link') {
+    return { subcommand, name: parseOptionalPositional(rest) };
   }
 
   if (subcommand === 'list') {
@@ -278,26 +260,8 @@ export function parseProjectArgs(args: Array<string>): ProjectArgs {
     return { subcommand, status, range };
   }
 
-  if (subcommand === 'rollback') {
-    const [deployId, extra] = rest;
-    if (deployId?.startsWith('-')) {
-      throw new Error(`project: Unknown flag '${deployId}'.`);
-    }
-    if (extra) {
-      throw new Error(`project: Unexpected argument '${extra}'.`);
-    }
-    return { subcommand, deployId: deployId ?? '' };
-  }
-
-  if (subcommand === 'cancel') {
-    const [deployId, extra] = rest;
-    if (deployId?.startsWith('-')) {
-      throw new Error(`project: Unknown flag '${deployId}'.`);
-    }
-    if (extra) {
-      throw new Error(`project: Unexpected argument '${extra}'.`);
-    }
-    return { subcommand, deployId: deployId ?? '' };
+  if (subcommand === 'rollback' || subcommand === 'cancel') {
+    return { subcommand, deployId: parseOptionalPositional(rest) };
   }
 
   if (subcommand === 'delete') {
@@ -334,6 +298,17 @@ export function parseProjectArgs(args: Array<string>): ProjectArgs {
   );
 }
 
+function parseOptionalPositional(rest: Array<string>): string {
+  const [value, extra] = rest;
+  if (value?.startsWith('-')) {
+    throw new Error(`project: Unknown flag '${value}'.`);
+  }
+  if (extra) {
+    throw new Error(`project: Unexpected argument '${extra}'.`);
+  }
+  return value ?? '';
+}
+
 function parseTeamArgs(rest: Array<string>): ProjectArgs {
   const [action, ...args] = rest;
   const usage =
diff --git a/packages/void/src/cli/project-slug.ts b/packages/void/src/cli/project-slug.ts
index 865c7f76a..00c8747ba 100644
--- a/packages/void/src/cli/project-slug.ts
+++ b/packages/void/src/cli/project-slug.ts
@@ -11,17 +11,12 @@ export function validateProjectSlug(value: string | undefined): string | undefin
     return 'Project slug is required.';
   }
 
-  // Allows lowercase alphanumeric with interior dashes.
   const valid =
     slug.length === 1 ? /^[a-z0-9]$/.test(slug) : /^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(slug);
   if (!valid) {
     return 'Slug must be lowercase alphanumeric with dashes.';
   }
 
-  // The slug is an email local-part prefix (`<slug>+noreply@`, `<slug>+<tag>@`)
-  // and RFC 5321 caps a local-part at 64 octets; the API refuses anything over
-  // 56 with the same rule (`MAX_SLUG_LENGTH`). Checked here too so the prompt
-  // answers before the round trip.
   if (slug.length > MAX_SLUG_LENGTH) {
     return `Slug must be at most ${MAX_SLUG_LENGTH} characters (it forms the email sender <slug>+noreply@).`;
   }
diff --git a/packages/void/src/cli/project.ts b/packages/void/src/cli/project.ts
index 5434b9760..df045652b 100644
--- a/packages/void/src/cli/project.ts
+++ b/packages/void/src/cli/project.ts
@@ -154,6 +154,11 @@ export function writePlatformSelection(
   return true;
 }
 
+/** The raw `projectId` field, without the slug and URL checks of `readProjectConfig`. */
+export function readProjectIdField(root: string): string | undefined {
+  return readProjectConfigFile(root)?.projectId as string | undefined;
+}
+
 export function readProjectPlatformUrl(root: string): string | null {
   const value = readProjectConfigFile(root)?.platformUrl;
   return typeof value === 'string' && value !== '' ? normalizePlatformApiUrl(value) : null;
@@ -173,7 +178,6 @@ export function shouldLinkDeployProject(root: string, apiUrl: string): boolean {
 
 /** Resolve the immutable platform identity that every newly linked project records. */
 export function attachSelectedPlatform(
-  root: string,
   config: Pick<ProjectConfig, 'projectId' | 'slug'>,
   platformApiUrl: string,
 ): ProjectConfig {
diff --git a/packages/void/src/cli/prompt-password.ts b/packages/void/src/cli/prompt-password.ts
deleted file mode 100644
index 1f42dc9cb..000000000
--- a/packages/void/src/cli/prompt-password.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import {
-  password,
-  type CANCEL_SYMBOL,
-  type PasswordOptions,
-} from '@voidzero-dev/vite-plus-prompts';
-
-/** A visual example for an empty secret field; never a default value or unmasked input. */
-export function passwordWithPlaceholder(
-  options: PasswordOptions & { placeholder: string },
-): Promise<string | typeof CANCEL_SYMBOL> {
-  return password(options);
-}
diff --git a/packages/void/src/cli/provision.ts b/packages/void/src/cli/provision.ts
index 18ce9d0dc..bc38fdf96 100644
--- a/packages/void/src/cli/provision.ts
+++ b/packages/void/src/cli/provision.ts
@@ -16,7 +16,6 @@ import {
 import { createRequire } from 'node:module';
 import { resolve as resolvePosixPath } from 'node:path/posix';
 import { resolve as resolveWindowsPath } from 'node:path/win32';
-import { types as utilTypes } from 'node:util';
 import type { CloudflareOperation } from '@void/deploy-cloudflare';
 import { isRecord } from '@void/deploy-core';
 import { parse, type ParseError } from 'jsonc-parser';
@@ -37,21 +36,9 @@ import {
   type WriteProvisionedWranglerResult,
 } from './wrangler.ts';
 
-/**
- * The set of Cloudflare resources an app needs, computed by the deploy
- * orchestrator from inferred bindings + config. The provisioner
- * consumes this as-is; it never computes the set itself.
- *
- * `binding` values are the pre-validated uppercase names the app already uses
- * (`DB`, `KV`, `ISR_CACHE`, `STORAGE`, `HYPERDRIVE`) and are passed to wrangler
- * verbatim.
- */
+/** The Cloudflare resources an app needs, computed by the deploy orchestrator. */
 export interface DesiredResourceSet {
-  /**
-   * D1 database — `{ binding: 'DB', name: 'myapp-db' }`. `migrationsDir` is the
-   * config-relative `migrations_dir` to write on the D1 entry (sourceDir-aware);
-   * when omitted the provisioner falls back to the default `./db/migrations`.
-   */
+  /** `migrationsDir` is config-relative and defaults to `./db/migrations`. */
   d1?: { binding: string; name: string; migrationsDir?: string };
   /** KV namespaces (app KV + `ISR_CACHE`). Titles are NOT account-unique. */
   kvNamespaces: Array<{ binding: string; title: string }>;
@@ -78,22 +65,8 @@ export interface ProvisionDriftResult {
 }
 
 /**
- * Diff the DESIRED id-bearing resources against the ACTUAL bindings in the root
- * wrangler config, WITHOUT any remote/wrangler call. A resource counts as
- * provisioned ONLY when its binding entry exists with a REAL (non-placeholder)
- * identifier — the SAME predicate the provisioner's read-first uses:
- *   - D1 `database_id` is a real UUID ({@link isRealD1Id}, not `'local'`);
- *   - KV `id` is a real 32-hex ({@link isRealKvId}, not `'local'`);
- *   - R2 `bucket_name` names a real bucket ({@link isRealStoredR2BucketName});
- *   - Hyperdrive `id` is a real 32-hex ({@link isRealHyperdriveId}).
- *
- * Queues are NAME-bearing (no id in the config), so they are NOT part of this
- * id-drift check. A missing config file yields every desired resource as missing.
- *
- * Used by the deploy orchestrator to decide whether automatic provisioning is needed
- * and to verify that every id-bearing resource was satisfied afterward.
- * A malformed/duplicate-binding config makes {@link readProvisionedBindingEntry}
- * throw — fail closed, exactly as the provisioner would.
+ * Desired id-bearing resources whose binding has no real id in the root config, using the
+ * same rule as read-first. Reads only the local config; queues have no id and are skipped.
  */
 export function checkCloudflareProvisionDrift(
   configPath: string,
@@ -141,12 +114,8 @@ export function checkCloudflareProvisionDrift(
 }
 
 /**
- * Result of one `runWrangler` invocation, carrying STRUCTURED PROVENANCE so a
- * signal-killed or unspawnable child is never mistaken for a clean exit. The
- * single rule ({@link isHardFailure}) every classifier defers to: a result with a
- * non-null `signal` or a `error` did NOT run to completion, so its buffered
- * status/stdout/stderr is unreliable and must NEVER be read as "absent" or
- * "success".
+ * Result of one Cloudflare operation. A non-null `signal` or `error` means the child did not
+ * finish, so its output is never read as success or absence ({@link isHardFailure}).
  */
 export type RunWranglerResult = {
   data?: unknown;
@@ -155,32 +124,20 @@ export type RunWranglerResult = {
   stdout: string;
   stderr: string;
   status: number;
-  /**
-   * Non-null ONLY when the child was terminated by a signal — a HARD failure.
-   * (Optional so injected test stubs may omit it, meaning "clean".)
-   */
+  /** Non-null only when the child was killed by a signal. */
   signal?: NodeJS.Signals | null;
   /** The spawn-error message when the child could not be started — a HARD failure. */
   error?: string | null;
 };
 
 /**
- * The transport context threaded into EVERY wrangler invocation (default AND
- * injected). Its `accountId` is the ONE reconciled effective account this whole
- * provision is pinned to: the default runner uses it to pin the spawned wrangler's
- * env (`CLOUDFLARE_ACCOUNT_ID`), and an
- * injected seam MUST bind its own transport to the SAME account (so it can never
- * query account B while the config pins A and write a same-name B result into A).
+ * Transport context passed to every Cloudflare operation. `accountId` is the one account this
+ * provision is pinned to; an injected runner must use the same account.
  */
 export interface WranglerCallContext {
   /** The reconciled effective Cloudflare account (never empty for a real call). */
   accountId: string;
-  /**
-   * The ONE pinned Cloudflare API base URL this provision resolved (mirroring
-   * wrangler's own `getCloudflareApiBaseUrl`), threaded so the default runner can pin the
-   * spawned wrangler's `CLOUDFLARE_API_BASE_URL` to the SAME endpoint the Hyperdrive REST
-   * lister uses. An injected seam may ignore it (it owns its own transport).
-   */
+  /** The pinned API base URL, shared with the Hyperdrive REST lister. */
   apiBaseUrl?: string;
   /** Pin the operator credential selected by the caller for every subprocess. */
   apiToken?: string;
@@ -191,13 +148,8 @@ export interface WranglerCallContext {
 }
 
 /**
- * The seam returns a Promise (or a plain value, which the choke point coerces
- * with `Promise.resolve`). The default runner is ASYNC (`spawn`, awaited) so a slow
- * wrangler call NEVER blocks the event loop, which keeps `proper-lockfile`'s heartbeat
- * timer firing (a synchronous `spawnSync` would freeze the loop, so the heartbeat could
- * not refresh the mutex mtime and another process could steal a lock we still hold).
- * Injected unit-test stubs may stay synchronous (returning a plain `RunWranglerResult`)
- * — `Promise.resolve` at the choke point wraps them transparently.
+ * Returns a Promise, or a plain value from a test stub. The default runner is async so a slow
+ * call never blocks the event loop and starves the lock heartbeat.
  */
 export type RunWrangler = (
   args: CloudflareOperation,
@@ -211,27 +163,13 @@ export interface HyperdriveConfig {
 }
 
 /**
- * Seam over listing the account's Hyperdrive configs (wrangler 4.131 has NO
- * machine-readable `hyperdrive list` and no get-by-name, so existence is checked
- * via the Cloudflare REST API). The default implementation
- * ({@link createDefaultListHyperdriveConfigs}) calls
- * `GET /accounts/{id}/hyperdrive/configs`; unit tests inject a stub so no real
- * network call runs.
- *
- * The lister receives the reconciled `accountId` AND the pinned `apiBaseUrl` as an
- * explicit transport context (never a closure-only binding), so an injected lister can
- * never query a DIFFERENT account/endpoint than the one wrangler + the config are pinned
- * to. The default lister builds its REST URL from `apiBaseUrl` instead of hardcoding prod.
+ * Lists the account's Hyperdrive configs. There is no machine-readable Hyperdrive list
+ * command, so the default uses the REST API. It always receives the pinned account and base.
  */
 export type ListHyperdriveConfigs = (ctx: {
   accountId: string;
   apiBaseUrl: string;
-  /**
-   * The abort signal enforcing the caller's OVERALL lister deadline. The default lister
-   * threads it into EVERY paginated `fetch`; an injected seam SHOULD honor it too. The caller
-   * ALSO races the whole call against the same deadline, so even a seam that ignores the signal
-   * cannot hold the whole-provision lock past the deadline.
-   */
+  /** Aborts at the overall lister deadline; the caller also races the call against it. */
   signal: AbortSignal;
 }) => Promise<Array<HyperdriveConfig>>;
 
@@ -277,53 +215,26 @@ const D1_MIGRATIONS_DIR = './db/migrations';
 /** UTF-8 byte-order mark. Node's utf-8 read preserves a leading one. */
 const UTF8_BOM = '';
 
-// --- Per-resource local-dev placeholder metadata -----------------
-// Exactly what `syncWranglerBindings` (wrangler.ts) writes for a not-yet-provisioned
-// binding — a D1 entry gets `database_id: 'local'`, a KV entry `id: 'local'`, an R2
-// entry `bucket_name: 'default'`. Each placeholder belongs to ITS OWN field only: the
-// shared "reject both `local` and `default` everywhere" check this replaces falsely
-// treated a stored R2 bucket_name of `local` — a grammar-valid, legitimately usable
-// bucket name that is NOT Void's R2 placeholder — as unprovisioned, bypassing the
-// stored-name contradiction gate (silent rewrite) and failing the create postcondition
-// for a bucket genuinely named `default`. Placeholder rules are judged ONLY where
-// read-first identity is resolved (and the R2 create postcondition's probe fallback);
-// Hyperdrive has no placeholder (its 32-hex format alone excludes these words).
+// Placeholders `syncWranglerBindings` writes for a not-yet-provisioned binding. Each belongs
+// to its own field only: `local` is a valid R2 bucket name.
 const D1_ID_PLACEHOLDER = 'local';
 const KV_ID_PLACEHOLDER = 'local';
 const R2_BUCKET_NAME_PLACEHOLDER = 'default';
 
-// --- Resource-SPECIFIC real-id format validators --------------------------
-// A merely non-empty string — `" "`, `"xyz"` — must never satisfy read-first reuse or
-// the create postcondition, else a resource could be reported provisioned with no valid
-// identifier and NO discovery. Each id class has a FIXED Cloudflare format (verified
-// 2026-07 against wrangler 4.107 + live account resources):
-//   - D1 `database_id`:  a hyphenated UUID (e.g. `52b3bbc7-c473-4b26-9486-1345f5de61c4`).
-//   - KV namespace `id`: 32 lowercase-hex chars, no hyphens (e.g. `7c07b54c…153aa11a`).
-//   - Hyperdrive `id`:   32 lowercase-hex chars, no hyphens (e.g. `a8097c6a…34ad195c`) —
-//                        NOT a hyphenated UUID (confirmed from a live config).
-//   - R2 identity IS the `bucket_name` (see {@link R2_BUCKET_NAME_RE}).
-// These gate read-first reuse, discovery/adoption results, adoption writes, AND create
-// postconditions — so a placeholder OR a malformed id fails closed (→ discovery, or a
-// hard error) instead of being recorded as a real resource.
+// Cloudflare id formats; a placeholder or malformed id never counts as provisioned.
+//   - D1 `database_id`: a hyphenated UUID.
+//   - KV namespace and Hyperdrive `id`: 32 hex chars, no hyphens.
+//   - R2 identity is the `bucket_name`.
 const D1_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const HEX32_ID_RE = /^[0-9a-f]{32}$/i;
-/** R2 bucket names ARE the identity: wrangler 4.131's `isValidR2BucketName`. */
+/** R2 bucket-name grammar (wrangler's `isValidR2BucketName`). */
 const R2_BUCKET_NAME_RE = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
 
-/**
- * A D1 `database_id` that is a real (non-placeholder) hyphenated UUID. Exported so
- * the deploy orchestrator applies the SAME placeholder rule when deciding whether a
- * stored `database_name` names a real DB (a synced `database_id: "local"` must not
- * let its paired name become the production database identity).
- */
+/** A real (non-placeholder) D1 `database_id`. */
 export function isRealD1Id(value: unknown): value is string {
   return typeof value === 'string' && value !== D1_ID_PLACEHOLDER && D1_ID_RE.test(value);
 }
-/**
- * A KV namespace `id` that is a real (non-placeholder) 32-hex string. Exported so the
- * deploy orchestrator applies the SAME placeholder rule when checking whether two KV
- * bindings already share one provisioned namespace.
- */
+/** A real (non-placeholder) KV namespace `id`. */
 export function isRealKvId(value: unknown): value is string {
   return typeof value === 'string' && value !== KV_ID_PLACEHOLDER && HEX32_ID_RE.test(value);
 }
@@ -336,11 +247,8 @@ function isValidR2BucketNameFormat(value: unknown): value is string {
   return typeof value === 'string' && R2_BUCKET_NAME_RE.test(value);
 }
 /**
- * A STORED R2 `bucket_name` that names a REAL bucket, i.e. any non-empty string
- * other than the placeholder (`default`), unless `default` itself is desired.
- * `local` IS a real name here. Grammar is
- * deliberately not required: a grammar-invalid stored name that contradicts the desired
- * bucket must still fail closed as a contradiction, never be silently rewritten.
+ * A stored R2 `bucket_name` naming a real bucket: any non-empty string except the `default`
+ * placeholder (unless desired). Grammar is not checked, so a contradicting name still fails.
  */
 function isRealStoredR2BucketName(value: unknown, desiredName?: string): value is string {
   return (
@@ -356,16 +264,8 @@ const defaultLogger: ProvisionLogger = {
 };
 
 /**
- * The transport-redirecting env vars wrangler 4.131 honors. Each can point
- * wrangler's authenticated API transport at a DIFFERENT endpoint (or select a
- * different env-block/account) than the ONE this provision pinned:
- *   - `CLOUDFLARE_API_BASE_URL` / `CF_API_BASE_URL` — override the API base URL directly
- *     (`getCloudflareApiBaseUrlFromEnv`).
- *   - `WRANGLER_API_ENVIRONMENT=staging` — routes to `api.staging.cloudflare.com`.
- *   - `CLOUDFLARE_COMPLIANCE_REGION=fedramp_high` — routes to `api.fed.cloudflare.com`.
- *   - `CLOUDFLARE_ENV` — selects a named `env.*` config block (different account/bindings).
- * We pin ONE resolved base explicitly (see {@link provisionEnv}) and fail closed when a
- * project dotenv would reselect one (see {@link assertNoTransportRedirectInProjectDotenv}).
+ * Env vars that move wrangler's API transport to another endpoint or select another config
+ * env. Provisioning pins one base ({@link provisionEnv}) and rejects them in project dotenv.
  */
 const TRANSPORT_REDIRECT_ENV_VARS = [
   'CLOUDFLARE_API_BASE_URL',
@@ -376,20 +276,9 @@ const TRANSPORT_REDIRECT_ENV_VARS = [
 ] as const;
 
 /**
- * Wrangler 4.131's diagnostic-output sinks that would PERSIST the raw provisioning
- * argv (including a Hyperdrive connection string, password and all) to disk:
- *   - `WRANGLER_OUTPUT_FILE_PATH` / `WRANGLER_OUTPUT_FILE_DIRECTORY` — when either is set
- *     (`getOutputFilePathFromEnv`/`getOutputFileDirectoryFromEnv`), wrangler's startup
- *     middleware appends a `wrangler-session` entry with the VERBATIM
- *     `command_line_args: argv` to that file (`writeOutput` in wrangler-dist/cli.js) — so
- *     `hyperdrive create --connection-string=postgres://user:PASSWORD@…` lands on disk.
- * They are scrubbed from every provisioner child env ({@link provisionEnv}) and fenced in
- * the project dotenv ({@link assertNoTransportRedirectInProjectDotenv}) — wrangler reloads
- * dotenv into `process.env` BEFORE writing the session entry, so a dotenv-declared sink
- * would resurrect the leak. `WRANGLER_LOG_SANITIZE` (`getSanitizeLogs`, default true) is
- * PINNED to `true` instead: a truthy ambient value survives wrangler's dotenv reload
- * (dotenv-expand keeps an already-set truthy `process.env` value), so the pin cannot be
- * overridden into unsanitized logging of the secret-bearing API request.
+ * Wrangler session-output sinks. When set, wrangler writes the raw argv to disk, which can
+ * include a Hyperdrive password. They are scrubbed from the child env and rejected in project
+ * dotenv, which wrangler reloads before writing.
  */
 const OUTPUT_FILE_ENV_VARS = [
   'WRANGLER_OUTPUT_FILE_PATH',
@@ -397,67 +286,32 @@ const OUTPUT_FILE_ENV_VARS = [
 ] as const;
 
 /**
- * Resolve the ONE Cloudflare API base URL this provision is pinned to, mirroring
- * wrangler 4.131's `getCloudflareApiBaseUrl` EXACTLY (wrangler-dist/cli.js) so the
- * Hyperdrive REST lister and the spawned wrangler agree on the endpoint:
- *
- *   getCloudflareApiBaseUrl = (complianceConfig) =>
- *     getCloudflareApiBaseUrlFromEnv() ??
- *     `https://api${getComplianceRegionSubdomain(complianceConfig)}${getStagingSubdomain()}.cloudflare.com/client/v4`
- *
- * Order + semantics mirrored exactly:
- *   1. The DIRECT base override is evaluated FIRST, by PRESENCE (wrangler's env factory
- *      checks `variableName in process.env`), with `CLOUDFLARE_API_BASE_URL` taking
- *      precedence over the deprecated `CF_API_BASE_URL`. A present-but-EMPTY override is
- *      returned AS-IS: `"" ?? derived` keeps the empty string (NULLISH, not falsy,
- *      coalescing), so wrangler pins the empty base (its API calls then fail on the
- *      unparsable URL) — we mirror that instead of silently substituting an endpoint.
- *   2. Only on the DERIVED branch are the staging/compliance selectors read — wrangler's
- *      `??` short-circuits past `getComplianceRegionSubdomain`/`getStagingSubdomain` when a
- *      direct base is present, so a direct base + conflicting compliance settings resolves
- *      to the direct base in wrangler (NO conflict error) and must not be rejected here.
- *   3. On the derived branch both env selectors are choice-VALIDATED (wrangler's
- *      `getProcessEnv` → `assertOneOf` throws on any present value outside the choices,
- *      e.g. `WRANGLER_API_ENVIRONMENT=stagng` or an empty string), so an invalid selector
- *      FAILS CLOSED instead of silently pinning public production.
- *   4. The config's own `compliance_region` VALUE is validated UNCONDITIONALLY — wrangler's
- *      config validation (`isOneOf("public", "fedramp_high")` on the `compliance_region`
- *      field) rejects an invalid config value for every command regardless of which branch
- *      resolves the base.
- * Read ONCE from the REAL ambient `process.env` (which does NOT include the project `.env`
- * — Node never auto-loads it), so an ambient/CI pin is honored while a project dotenv
- * redirect is rejected up front by {@link assertNoTransportRedirectInProjectDotenv}.
+ * The one API base URL this provision uses, resolved like wrangler's `getCloudflareApiBaseUrl`
+ * so the Hyperdrive REST lister and wrangler agree:
+ *   1. a present `CLOUDFLARE_API_BASE_URL` (then `CF_API_BASE_URL`) is used as-is, even empty;
+ *   2. otherwise the staging and compliance selectors derive it, and invalid values fail;
+ *   3. the config's `compliance_region` is always validated.
  */
 export function resolvePinnedApiBaseUrl(
   env: NodeJS.ProcessEnv = process.env,
   configComplianceRegion?: string,
 ): string {
-  // (4) — validate the config's compliance_region value unconditionally, like wrangler's
-  // config validation (a PRESENT empty string is invalid there too).
   const configRegion =
     configComplianceRegion !== undefined
       ? assertComplianceChoice(configComplianceRegion, 'the wrangler config "compliance_region"')
       : undefined;
-  // (1) — presence (not truthiness) of the direct override wins, CLOUDFLARE_* first.
   const direct =
     env.CLOUDFLARE_API_BASE_URL !== undefined ? env.CLOUDFLARE_API_BASE_URL : env.CF_API_BASE_URL;
   if (direct !== undefined) {
     return direct;
   }
-  // (2)+(3) — derived branch only: validate the selectors, reconcile the region.
   const region = resolveComplianceRegion(env, configRegion);
   const fed = region === 'fedramp_high' ? '.fed' : '';
   const staging = resolveApiEnvironment(env) === 'staging' ? '.staging' : '';
   return `https://api${fed}${staging}.cloudflare.com/client/v4`;
 }
 
-/**
- * Mirror wrangler 4.131's `getCloudflareApiEnvironmentFromEnv` (env factory with
- * `choices: ["production", "staging"]`, default `"production"`): an ABSENT variable
- * defaults to production; a PRESENT value outside the choices — `"stagng"`, an empty
- * string — makes wrangler's `assertOneOf` throw, so we fail closed identically instead of
- * silently pinning public production where wrangler stops.
- */
+/** `WRANGLER_API_ENVIRONMENT` like wrangler: absent means production; other values fail. */
 function resolveApiEnvironment(env: NodeJS.ProcessEnv): 'production' | 'staging' {
   const raw = env.WRANGLER_API_ENVIRONMENT;
   if (raw === undefined) {
@@ -473,7 +327,7 @@ function resolveApiEnvironment(env: NodeJS.ProcessEnv): 'production' | 'staging'
   return raw;
 }
 
-/** The compliance-region choices wrangler 4.131 accepts (`getCloudflareComplianceRegionFromEnv`). */
+/** Compliance-region values wrangler accepts. */
 const COMPLIANCE_REGIONS = ['public', 'fedramp_high'] as const;
 type ComplianceRegion = (typeof COMPLIANCE_REGIONS)[number];
 
@@ -488,20 +342,7 @@ function assertComplianceChoice(value: string, source: string): ComplianceRegion
   return value;
 }
 
-/**
- * Reconcile the effective Cloudflare compliance region, mirroring wrangler 4.131's
- * `getCloudflareComplianceRegion(complianceConfig)` EXACTLY (evaluated only on the
- * DERIVED-base branch — with a direct base override wrangler never calls it):
- *   - reads `CLOUDFLARE_COMPLIANCE_REGION` by PRESENCE and validates it against the
- *     `public`/`fedramp_high` choices (wrangler's `getProcessEnv` → `assertOneOf`, which
- *     throws on ANY present out-of-choices value — an empty string included);
- *   - when BOTH the env var AND the (already-validated) config region are set to
- *     DIFFERENT values, THROWS (fail closed) — wrangler raises a `UserError` for exactly
- *     this conflict, so we must not paper over it by pinning one endpoint while the config
- *     declares the other region;
- *   - otherwise returns `env || config || "public"` (both values are validated choices by
- *     now, so wrangler's falsy-coalescing is equivalent to nullish here).
- */
+/** Effective compliance region like wrangler: values are validated and a conflict fails. */
 function resolveComplianceRegion(
   env: NodeJS.ProcessEnv,
   configRegion: ComplianceRegion | undefined,
@@ -523,57 +364,23 @@ function resolveComplianceRegion(
   return envRegion ?? configRegion ?? 'public';
 }
 
-/**
- * Mirror wrangler 4.131's `getDefaultEnvFiles(env)`: base `.env`/`.env.local`, then —
- * when the environment argument is DEFINED (we always pass `--env=`, so wrangler sees
- * `args.env === ""`, which is `!== undefined`) — the per-env pair `.env.${env}`/`.env.${env}.local`.
- * With the empty environment those are the empty-env filenames `.env.` and `.env..local`.
- */
+/** Dotenv files wrangler loads for `--env=<env>`; provisioning always passes an empty env. */
 function defaultWranglerEnvFiles(env: string): Array<string> {
   return ['.env', '.env.local', `.env.${env}`, `.env.${env}.local`];
 }
 
 /**
- * FAIL CLOSED when the project's dotenv files declare a transport-redirecting
- * variable. wrangler 4.131 reloads `.env`/`.env.local` (and the dev-vars files) from the
- * project root into `process.env` on EVERY command with `override: true`, so a repo `.env`
- * setting `CLOUDFLARE_API_BASE_URL` / `WRANGLER_API_ENVIRONMENT` /
- * `CLOUDFLARE_COMPLIANCE_REGION` / `CLOUDFLARE_ENV` would redirect wrangler's authenticated
- * transport (and credentials) to a staging / FedRAMP / arbitrary endpoint AFTER we resolved
- * the pinned base — while the Hyperdrive existence check runs against the pinned base.
- * Single-account/single-endpoint provisioning cannot reason about a transport redirected
- * out from under it, so we refuse. The fix is to export the variable in the shell/CI
- * environment (which we DO honor, pinning both wrangler and the lister to it) instead of
- * the project dotenv.
- *
- * Exported for direct unit testing of the file-set and the Windows case rule; production
- * always calls it with the real `process.platform`.
+ * Fail when a project dotenv file sets a transport-redirect or session-output variable.
+ * Wrangler reloads these files on every command, which would move its authenticated transport
+ * away from the pinned base. Values exported in the shell are honored instead.
  */
 export function assertNoTransportRedirectInProjectDotenv(
   root: string,
   platform: NodeJS.Platform = process.platform,
 ): void {
-  // Scan the EXACT files wrangler 4.131 loads for the
-  // provisioner's `--env=` (EMPTY environment string), with wrangler's own per-family
-  // SELECTION and CASE semantics, using a KEY scanner that mirrors wrangler's dotenv
-  // parser (accepts the optional `export ` prefix + quoting):
-  //   - DOTENV family — the per-command `process.env` reload (the startup middleware's
-  //     `check`) loads ALL of `getDefaultEnvFiles("")` = [".env", ".env.local", ".env.",
-  //     ".env..local"] via `loadDotEnv`, which parses into `caseInsensitiveEnv()` when
-  //     `process.platform === "win32"` (a Proxy canonicalizing property names via
-  //     `toLowerCase`) — so dotenv KEYS fold case ONLY on win32, exactly elsewhere.
-  //   - DEV-VARS family — `loadDotDevDotVars(envPath, env)` is (wrangler-dist/cli.js):
-  //       env !== undefined && tryLoadDotDevDotVars(`${envPath}.${env}`)
-  //         || tryLoadDotDevDotVars(envPath)
-  //     For the empty env it probes `.dev.vars.` FIRST and reads `.dev.vars` ONLY when
-  //     `.dev.vars.` is ABSENT — exactly ONE file is ever parsed, so the fence inspects
-  //     only the SELECTED one (fencing both falsely rejected a benign `.dev.vars.`
-  //     paired with an unused redirect var in `.dev.vars` that wrangler never reads).
-  //     `tryLoadDotDevDotVars` parses via `dotenv.parse` into a PLAIN object —
-  //     case-SENSITIVE on EVERY platform (`caseInsensitiveEnv` is used only by
-  //     `loadDotEnv`), so no case folding applies to dev-vars keys anywhere. It NEVER
-  //     loads `.dev.vars.local`, so that file stays deliberately unfenced.
-  // We do NOT expand — presence of the KEY is the signal.
+  // Scan the files wrangler loads for an empty `--env=`, with its case rules:
+  //   - all four dotenv files; keys fold case only on win32;
+  //   - `.dev.vars.` if present, else `.dev.vars`; keys are always case-sensitive.
   const dotenvCaseInsensitive = platform === 'win32';
   const devVarsFile = existsSync(join(root, '.dev.vars.')) ? '.dev.vars.' : '.dev.vars';
   const files: Array<{ file: string; caseInsensitive: boolean }> = [
@@ -603,11 +410,7 @@ export function assertNoTransportRedirectInProjectDotenv(
           `the existence check.`,
       );
     }
-    // Wrangler's session-output sinks are fenced too: wrangler reloads this dotenv
-    // into `process.env` BEFORE writing its `wrangler-session` output entry, whose
-    // `command_line_args` is the VERBATIM argv — including a Hyperdrive connection
-    // string's password — so a dotenv-declared sink would resurrect the leak the child-env
-    // scrub (see provisionEnv) just closed.
+    // A session-output sink would write the raw argv, with a Hyperdrive password, to disk.
     const outputOffenders = OUTPUT_FILE_ENV_VARS.filter(declares);
     if (outputOffenders.length > 0) {
       throw new Error(
@@ -623,14 +426,8 @@ export function assertNoTransportRedirectInProjectDotenv(
 }
 
 /**
- * Delete `name` from `env` IN PLACE, honoring the platform's env-key case rule.
- * Windows environment keys are CASE-INSENSITIVE: a spawned child's `process.env`
- * resolves `WRANGLER_OUTPUT_FILE_PATH` from an ambient `Wrangler_Output_File_Path`
- * too, so an exact-case `delete` leaves a mixed-case spelling live. On win32 every
- * case-insensitive spelling is removed; elsewhere POSIX env vars are case-sensitive,
- * so only the exact key is a match. Exported so the deploy orchestrator scrubs its
- * OWN extra deploy-time keys (worker-name override, build-config-path) through the
- * SAME rule the provisioner uses, instead of re-deriving it.
+ * Delete `name` from `env` in place. Windows env keys are case-insensitive, so every spelling
+ * is removed there; elsewhere only the exact key.
  */
 export function deleteEnvVarCaseAware(
   env: NodeJS.ProcessEnv,
@@ -650,19 +447,8 @@ export function deleteEnvVarCaseAware(
 }
 
 /**
- * Child-process env with every CF Access credential scrubbed. Mirrors `buildEnv`
- * in `deploy.ts`: Access credentials are needed only by this CLI's own guarded
- * HTTP requests and must never leak into the spawned wrangler process (which may
- * in turn run user hooks). This includes the short-lived cloudflared
- * `CF_ACCESS_TOKEN` JWT used by local readiness probes.
- *
- * Pins ONE transport context: scrubs every {@link TRANSPORT_REDIRECT_ENV_VARS}
- * from the child env, then re-sets `CLOUDFLARE_API_BASE_URL` to the SINGLE resolved
- * `apiBaseUrl` so the spawned wrangler and the Hyperdrive REST lister hit the exact same
- * endpoint. Scrubbing the compliance/staging/env selectors makes the explicit base
- * authoritative (they can no longer re-derive a different base). Combined with
- * {@link assertNoTransportRedirectInProjectDotenv} (which blocks a project dotenv from
- * repopulating any of them via wrangler's per-command reload), the pin cannot be moved.
+ * Child env for a Cloudflare operation. CF Access credentials, transport selectors and output
+ * sinks are scrubbed; the account, API base and sanitized logging are pinned.
  */
 export function provisionEnv(ctx?: {
   accountId?: string;
@@ -672,14 +458,6 @@ export function provisionEnv(ctx?: {
   platform?: NodeJS.Platform;
 }): NodeJS.ProcessEnv {
   const env = { ...process.env };
-  // Windows environment keys are CASE-INSENSITIVE: the spawned child's
-  // `process.env` resolves `WRANGLER_OUTPUT_FILE_PATH` from an ambient
-  // `Wrangler_Output_File_Path` too, so an exact-case `delete` left every scrub below
-  // bypassable by a mixed-case spelling (wrangler would then see the sink var and
-  // persist the raw argv — Hyperdrive password included — to disk). Scrub EVERY
-  // case-insensitive spelling of EVERY scrubbed/pinned key on win32; exact-case
-  // elsewhere (POSIX env vars are case-sensitive, so other spellings are genuinely
-  // different variables).
   const platform = ctx?.platform ?? process.platform;
   const scrub = (name: string): void => deleteEnvVarCaseAware(env, name, platform);
   scrub('CF_ACCESS_CLIENT_ID');
@@ -687,41 +465,20 @@ export function provisionEnv(ctx?: {
   scrub('CF_ACCESS_TOKEN');
   scrub('VOID_ACCESS_CREDENTIALS');
   scrub('VOID_ACCESS_ORIGIN');
-  // Scrub EVERY transport-redirecting selector (CLOUDFLARE_ENV, the API-base overrides,
-  // WRANGLER_API_ENVIRONMENT, CLOUDFLARE_COMPLIANCE_REGION). CLOUDFLARE_ENV would select a
-  // named env-block whose account_id/bindings differ; the others would re-derive a
-  // different API base. We fold their effect into the ONE explicit base below.
   for (const name of TRANSPORT_REDIRECT_ENV_VARS) {
     scrub(name);
   }
-  // Scrub wrangler's session-output sinks (they would persist the raw argv —
-  // a Hyperdrive connection string's password included — to disk) and PIN sanitized
-  // logging: never pass through an ambient `WRANGLER_LOG_SANITIZE=false` for a
-  // secret-bearing invocation. A truthy pinned value also survives wrangler's
-  // per-command dotenv reload (dotenv-expand keeps a set truthy process.env value).
-  // The pinned keys' case-variants are scrubbed FIRST so the canonical spelling
-  // below is the ONLY one the child sees — a mixed-case ambient value must never
-  // shadow a pin on win32.
+  // Scrub output sinks and pin sanitized logging (a truthy value survives the dotenv reload).
   for (const name of OUTPUT_FILE_ENV_VARS) {
     scrub(name);
   }
   scrub('WRANGLER_LOG_SANITIZE');
   env.WRANGLER_LOG_SANITIZE = 'true';
-  // Pin the ONE resolved API base so wrangler's `getCloudflareApiBaseUrlFromEnv()` returns
-  // exactly the endpoint the Hyperdrive REST lister uses (no staging/FedRAMP/arbitrary
-  // split-brain). The explicit `--env=` on every argv still forces the top-level config
-  // env even if a stray CLOUDFLARE_ENV survived elsewhere. Pinned by PRESENCE: a
-  // resolved EMPTY base (a present-but-empty ambient override, which wrangler honors via
-  // its `in process.env` + nullish coalescing) is pinned as empty too, so the child
-  // wrangler fails on it exactly as the ambient environment would — never silently
-  // re-derived into a different endpoint than the lister uses.
+  // Pinned by presence: an empty base stays empty, so wrangler fails the same way.
   if (ctx?.apiBaseUrl !== undefined) {
     env.CLOUDFLARE_API_BASE_URL = ctx.apiBaseUrl;
   }
-  // Pin the target account non-interactively (CI-safe) when known, so
-  // `wrangler <res> list/create` never prompts for disambiguation AND never falls
-  // back to a DIFFERENT ambient account than the one we resolved + persisted.
-  // Case-variants scrubbed first so the pin is unambiguous on win32.
+  // Pin the account so wrangler never prompts or falls back to an ambient account.
   if (ctx?.accountId) {
     scrub('CLOUDFLARE_ACCOUNT_ID');
     env.CLOUDFLARE_ACCOUNT_ID = ctx.accountId;
@@ -742,56 +499,27 @@ export function provisionEnv(ctx?: {
   return env;
 }
 
-/**
- * Hard per-command timeout for a single wrangler invocation. A hung wrangler must
- * NEVER hang the whole provision, so the default runner SIGKILLs a child that runs
- * past this and reports a HARD failure (a non-null signal — see
- * {@link normalizeRunWranglerResult}). With the ASYNC runner this bound is
- * INDEPENDENT of {@link LOCK_STALE_MS}: awaiting the child keeps the event loop free,
- * so `proper-lockfile`'s heartbeat refreshes the mutex throughout — the timeout only
- * bounds a hang, it is not load-bearing for lock safety.
- */
+/** Per-command timeout; the default runner SIGKILLs a child that runs longer. */
 const COMMAND_TIMEOUT_MS = 120_000;
 
 /**
- * After a timeout SIGKILL, how long to keep confirming the child is ACTUALLY gone —
- * BOTH its `close` event AND whole-group disappearance (`kill(-pid, 0)` → ESRCH) — before
- * giving up. SIGKILL is uncatchable, so a healthy kernel reaps the group within
- * milliseconds; this generous bound only guards a pathological uninterruptible-sleep child.
- * The runner NEVER settles a timeout as "done" until both facts are confirmed; an expiry
- * (or a failed kill) REJECTS with a {@link WranglerQuarantineError} instead, so the
- * whole-provision lock — released only after a CONFIRMED settle — is intentionally
- * retained while the real wrangler CLI may still be creating resources.
+ * After a SIGKILL, how long to wait for both `close` and the whole process group to be gone.
+ * If that cannot be confirmed, the runner rejects with {@link WranglerQuarantineError}.
  */
 const CONFIRM_KILL_GRACE_MS = 5_000;
 /** The pid-poll interval while confirming post-SIGKILL termination. */
 const CONFIRM_KILL_POLL_MS = 20;
-/**
- * The margin the coordinator-WIDE teardown deadline adds on top of a
- * runner's own confirmation grace window: a signal teardown is bounded at
- * `confirmGraceMs + this` even if the runner's bounded confirmation never calls back.
- */
+/** Extra time a signal teardown allows beyond a runner's confirmation window. */
 const SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS = 5_000;
 
-/**
- * Classify a process-group kill error. `ESRCH` means the group ALREADY exited (there was
- * nothing left to kill) → success. ANY other code (`EPERM`, …) is a REAL kill failure: the
- * child may still be running, so it must be surfaced, never swallowed. Exported for direct
- * unit testing of the classification the timeout/cancel paths rely on.
- */
+/** ESRCH means the group already exited; any other kill error is a real failure. */
 export function isAlreadyGoneKillError(error: unknown): boolean {
   return (error as NodeJS.ErrnoException | null)?.code === 'ESRCH';
 }
 
 /**
- * A QUARANTINE failure: the runner could NOT confirm that a spawned
- * wrangler child (and its whole process group) is dead — the group kill failed for a
- * non-ESRCH reason (EPERM, …), or the post-SIGKILL confirmation window expired with the
- * group still (possibly) alive. The child may STILL be creating resources / writing
- * config, so the whole-provision mutex must be INTENTIONALLY RETAINED — never released —
- * and this error surfaces with manual-recovery guidance naming the surviving pid.
- * {@link provisionCloudflareResources} detects it via {@link isQuarantineError} and calls
- * `lock.quarantine()` instead of `lock.release()`.
+ * The runner could not confirm that a spawned child and its process group are dead. The child
+ * may still be creating resources, so the provision lock is kept instead of released.
  */
 export class WranglerQuarantineError extends Error {
   readonly quarantine = true as const;
@@ -813,30 +541,14 @@ export class WranglerQuarantineError extends Error {
   }
 }
 
-/**
- * The owner metadata a quarantine records: the unconfirmed wrangler
- * child's pid (on POSIX the child is spawned `detached`, so its pid IS its process-GROUP
- * id) and a human-readable reason. Persisted in the quarantine sidecar next to the lock
- * (see {@link acquireProvisionLock}) so EVERY later acquisition can probe the recorded
- * group before the mutex could otherwise be stolen by the mtime-stale path.
- */
+/** Quarantine owner metadata: the child's pid (its process-group id on POSIX) and a reason. */
 export interface QuarantineInfo {
   pid?: number;
   reason: string;
 }
 
-// --- AT MOST ONE active provision per process --------------------------
-// THE structural invariant the signal coordinator (below) relies on: a single CLI
-// process runs AT MOST ONE provision at a time — the deploy orchestrator
-// calls `provisionCloudflareResources` exactly once per process, and CROSS-process
-// concurrency is what the on-disk whole-provision lock serializes. Because every
-// wrangler call inside a provision is awaited sequentially, this guard means the
-// signal coordinator manages AT MOST ONE {wrangler child group, provision lock} pair
-// at any moment — which is what makes its dispatch barrier, its 1:1 quarantine
-// binding, and its bounded teardown structurally simple instead of racy.
-// A second in-process provision fails fast and loudly here rather than eroding those
-// invariants. The slot is taken SYNCHRONOUSLY at provision entry (before the first
-// await), so two same-tick calls cannot both pass.
+// At most one provision runs per process, so the signal coordinator manages at most one
+// {child group, provision lock} pair. Other processes are serialized by the on-disk lock.
 let activeProvisionSlot: symbol | undefined;
 
 function acquireProcessProvisionSlot(): () => void {
@@ -848,9 +560,7 @@ function acquireProcessProvisionSlot(): () => void {
         'by the on-disk provision lock instead.',
     );
   }
-  // While a previous provision's retention watchdog is still nursing an
-  // undurably-quarantined lock (unconfirmed child, no durable sidecar yet), a new
-  // provision would hand the coordinator a second pair; refuse until it resolves.
+  // A previous provision's watchdog still holds a lock that is not durably quarantined.
   if (retentionWatchdog !== undefined) {
     throw new Error(
       'provision: a previous provision in this process is still retaining its lock — an ' +
@@ -871,17 +581,8 @@ function acquireProcessProvisionSlot(): () => void {
 }
 
 /**
- * The ONE active provision's lock-quarantine hook, 1:1 with the
- * provision slot above. When the parent process is about to DIE re-raising a forwarded
- * SIGINT/SIGTERM while a spawned wrangler child's teardown could NOT be confirmed,
- * proper-lockfile's signal-exit sweep would remove the still-TRACKED provision mutex —
- * releasing the lock under a possibly-live child. {@link provisionCloudflareResources}
- * sets this for the duration of the provision; a registering wrangler child CAPTURES it
- * at registration (see {@link registerRunner}) so an unresolved teardown quarantines
- * exactly ITS OWNING provision lock with ITS OWN pid metadata — never a broadcast
- * through every lock (the previous Set this replaces stamped the FIRST unresolved
- * registrant's pid into every lock's sidecar, so a foreign group's death could clear a
- * quarantine whose real child was alive).
+ * The active provision's lock-quarantine hook. A child captures it at registration, so a
+ * failed teardown quarantines only its own provision lock with its own pid.
  */
 let activeProvisionQuarantineHook: ((info: QuarantineInfo) => void) | undefined;
 
@@ -893,22 +594,9 @@ export function isQuarantineError(error: unknown): error is WranglerQuarantineEr
   );
 }
 
-// --- THE process-wide signal coordinator ----------------------
-// ONE coordinator owns forward → confirm → quarantine → re-raise for the (at most one
-// — see the provision slot above) active {wrangler child group, provision lock} pair:
-// the runner registers its pair for the child's lifetime; listeners are installed only
-// while a registration / teardown / retention watchdog is active; on the FIRST
-// SIGINT/SIGTERM the coordinator forwards the signal to the registered group, awaits
-// its bounded both-facts confirmation, quarantines it if unresolved (the OWNING lock's
-// hook, bound at registration, with THIS pair's own pid metadata), and then re-raises
-// EXACTLY ONCE. Repeated signals during the teardown are coalesced by the
-// still-installed handler (no second re-raise, no default-action bypass).
-// The barrier is PRE-ACCOUNTED from a snapshot taken BEFORE dispatch
-// (a synchronously-failing registrant can never finish the teardown mid-dispatch), new
-// wrangler spawns are REJECTED outright once a teardown began (fail fast, no child
-// spawned → nothing to confirm — never a late join with a fresh deadline), and one
-// coordinator-WIDE deadline backstops the whole teardown (an unconfirmable pair is
-// quarantined at the bound, so `pending` can never wedge the re-raise forever).
+// Process-wide signal coordinator. On the first SIGINT/SIGTERM it forwards the signal to the
+// registered child group, waits (bounded) for confirmed termination, quarantines the lock if
+// that fails, then re-raises once. Repeated signals are coalesced and new spawns are rejected.
 
 /** What a runner registers with the coordinator for its child's lifetime. */
 interface TerminationRegistrant {
@@ -924,19 +612,11 @@ interface TerminationRegistrant {
   ) => void;
   /** Reject the runner promise with a quarantine error (idempotent once settled). */
   quarantine: (detail: string) => void;
-  /**
-   * The coordinator-WIDE teardown deadline for this pair: if the bounded
-   * both-facts confirmation has not called back by then, the coordinator quarantines the
-   * pair itself, so a fatal signal's teardown is ALWAYS globally bounded.
-   */
+  /** After this deadline the coordinator quarantines the pair itself. */
   teardownDeadlineMs: number;
 }
 
-/**
- * A registration binds the registrant to ITS OWNING provision lock's
- * quarantine hook (captured from the active provision at registration time), so
- * an unresolved teardown quarantines exactly that lock with exactly this pair's pid.
- */
+/** A registrant bound to its owning provision lock's quarantine hook. */
 interface ActiveRegistration {
   registrant: TerminationRegistrant;
   lockQuarantine: ((info: QuarantineInfo) => void) | undefined;
@@ -1003,9 +683,7 @@ function registerRunner(registrant: TerminationRegistrant, parallelWorkerUpload:
   }
   activeRegistrations.set(registrant, {
     registrant,
-    // Bind the OWNING provision lock at registration (1:1). Undefined
-    // for a bare runner used outside a provision (unit tests): there is no lock to
-    // retain, so an unresolved pair only rejects its own promise.
+    // Undefined outside a provision: there is no lock to retain.
     lockQuarantine: activeProvisionQuarantineHook,
     parallelWorkerUpload,
   });
@@ -1014,9 +692,7 @@ function registerRunner(registrant: TerminationRegistrant, parallelWorkerUpload:
 
 function deregisterRunner(registrant: TerminationRegistrant): void {
   activeRegistrations.delete(registrant);
-  // Keep the listeners through an active teardown (they COALESCE repeated signals) and
-  // while a retention watchdog is unresolved (a default-action death would sweep
-  // the still-tracked mutex under the possibly-live child).
+  // Keep listeners during a teardown (to coalesce signals) and while a watchdog holds a lock.
   if (
     activeRegistrations.size === 0 &&
     activeTeardown === undefined &&
@@ -1027,16 +703,11 @@ function deregisterRunner(registrant: TerminationRegistrant): void {
 }
 
 function coordinatorHandleSignal(signal: NodeJS.Signals): void {
-  // Coalesce: repeated signals during an in-flight teardown are swallowed by this
-  // still-installed handler — no second re-raise, no bypass of the confirmation
-  // barrier.
+  // Coalesce repeated signals during a teardown.
   if (activeTeardown !== undefined) {
     return;
   }
-  // While the retention watchdog holds an undurably-quarantined lock,
-  // the process must NOT die of a re-raise: the exit sweep would release the tracked
-  // mutex under the possibly-live child. Swallow the signal with a warning; the
-  // watchdog resolves by confirming the child dead or persisting the sidecar.
+  // Dying now would let the exit sweep release a lock the watchdog must keep.
   if (retentionWatchdog !== undefined && activeRegistrations.size === 0) {
     process.stderr.write(
       `provision: ignoring ${signal} — a provision lock is retained while an unconfirmed ` +
@@ -1055,17 +726,11 @@ function coordinatorHandleSignal(signal: NodeJS.Signals): void {
     expirePendingPairs: [],
   };
   activeTeardown = teardown;
-  // Snapshot + PRE-ACCOUNT the barrier BEFORE dispatch: `pending` is
-  // initialized from the snapshot size, so a registrant that fails/settles
-  // SYNCHRONOUSLY during dispatch can never drop it to 0 and finish the teardown while
-  // the dispatch loop is still outstanding, and the `dispatching` latch
-  // defers the finish until the loop below has fully completed.
+  // Count every registrant before dispatch, so a synchronous settle cannot finish early.
   const snapshot = [...activeRegistrations.values()];
   teardown.pending = snapshot.length;
   if (snapshot.length > 0) {
-    // The coordinator-WIDE deadline backstop: even if a pair's bounded
-    // confirmation never calls back, the teardown quarantines the pair and completes at
-    // this bound. REFERENCED — the teardown must hold the loop open until resolved.
+    // Backstop: quarantine any pair still unconfirmed at the deadline. Referenced on purpose.
     const deadlineMs = Math.max(...snapshot.map((r) => r.registrant.teardownDeadlineMs));
     teardown.deadlineTimer = setTimeout(() => {
       for (const expire of teardown.expirePendingPairs) {
@@ -1083,8 +748,7 @@ function coordinatorHandleSignal(signal: NodeJS.Signals): void {
   maybeFinishCoordinatorTeardown(teardown);
 }
 
-/** Finish only after the initial dispatch fully completed AND every
- * snapshot registrant resolved (confirmed or quarantined). */
+/** Finish after dispatch completes and every registrant is resolved. */
 function maybeFinishCoordinatorTeardown(teardown: CoordinatorTeardown): void {
   if (!teardown.dispatching && teardown.pending === 0) {
     finishCoordinatorTeardown(teardown);
@@ -1109,11 +773,7 @@ function coordinatorTearDownRegistrant(
     if (done) {
       return;
     }
-    // Before-death retention of ONLY this pair's OWNING provision lock,
-    // with THIS registrant's own pid metadata (bound 1:1 at registration — never a
-    // broadcast through every lock hook, which stamped a foreign pair's pid into
-    // unrelated sidecars). Synchronous: the sidecar must be persisted and the lock
-    // detached from the exit sweep before the process could die of the re-raise.
+    // Synchronous: the sidecar must persist before a re-raise can end the process.
     if (lockQuarantine !== undefined) {
       try {
         lockQuarantine({
@@ -1123,9 +783,7 @@ function coordinatorTearDownRegistrant(
             `${teardown.signal} — ${detail}`,
         });
       } catch (failure) {
-        // The lock could NOT be quarantined durably; it
-        // stays TRACKED and the retention watchdog (armed by the hook wrapper) now owns
-        // the unresolved state. The finish below must not re-raise.
+        // Not durable: the watchdog now owns the lock, so the finish must not re-raise.
         teardown.persistFailed = true;
         process.stderr.write(`provision: ${(failure as Error).message}\n`);
       }
@@ -1167,16 +825,10 @@ function finishCoordinatorTeardown(teardown: CoordinatorTeardown): void {
   if (teardown.deadlineTimer !== undefined) {
     clearTimeout(teardown.deadlineTimer);
   }
-  // Remove the listeners so the re-raise below takes Node's DEFAULT exit-on-signal
-  // action instead of being swallowed by this very handler.
+  // Remove the listeners so the re-raise takes Node's default action.
   removeCoordinatorListeners();
   if (teardown.persistFailed || retentionWatchdog !== undefined) {
-    // A provision lock could NOT be quarantined durably;
-    // it stays TRACKED (heartbeat running — see {@link ProvisionLock.quarantine}) under
-    // the retention watchdog. Re-raising would kill this process, whose exit sweep
-    // releases the tracked mutex under the possibly-live child — so do NOT re-raise.
-    // The watchdog keeps signal handling installed, retries durable persistence, and
-    // probes the recorded group for death.
+    // A lock is not durably quarantined; re-raising would let the exit sweep release it.
     activeTeardown = undefined;
     installCoordinatorListeners();
     process.stderr.write(
@@ -1187,34 +839,19 @@ function finishCoordinatorTeardown(teardown: CoordinatorTeardown): void {
     );
     return;
   }
-  // Exactly-once re-raise (process-wide): the registered group is now confirmed dead
-  // or durably quarantined, so the parent may take the signal's default action.
+  // Re-raise exactly once.
   if (reRaisedOnce) {
     return;
   }
   reRaisedOnce = true;
   process.kill(process.pid, teardown.signal);
-  // Signals are delivered asynchronously: if the event loop has drained by now, the
-  // process would exit NORMALLY (status 0) before the pending signal lands. A short
-  // REFERENCED no-op keeps the loop alive so the re-raised signal's default action
-  // terminates the process (it fires within milliseconds; the timer is only a bounded
-  // fallback if something else swallowed the signal).
+  // Signals arrive asynchronously; keep the loop alive so the process cannot exit 0 first.
   setTimeout(() => {}, 2_000);
 }
 
-// --- The retention WATCHDOG for an undurable quarantine -----------
-// When quarantine persistence FAILS, the lock stays TRACKED (heartbeat running, not
-// stealable) — but a tracked mutex is exactly what proper-lockfile's exit sweep removes
-// when the process drains and exits naturally, leaving the possibly-live wrangler child
-// with NO mutex and NO sidecar. While that state is unresolved the process must not
-// drain unprotected: a REFERENCED watchdog timer holds the loop open and, each tick,
-//   (a) probes the recorded group for death (ESRCH → clear state, release the mutex
-//       normally, resolve), then
-//   (b) retries the DURABLE quarantine persistence with backoff (success → sidecar
-//       durable + lock detached from the sweep → safe to resume normal exit semantics).
-// Signal handling stays installed throughout (the coordinator swallows further
-// SIGINT/SIGTERM with a warning — see {@link coordinatorHandleSignal}) and no new
-// provision may start in this process until the watchdog resolves (see the slot guard).
+// Retention watchdog for a quarantine that could not be persisted. The lock stays tracked,
+// but proper-lockfile's exit sweep would remove it, so a referenced timer keeps the process
+// alive. Each tick releases normally if the group is gone, else retries persisting the sidecar.
 
 const RETENTION_RETRY_MIN_MS = 250;
 const RETENTION_RETRY_MAX_MS = 5_000;
@@ -1227,12 +864,7 @@ interface RetentionWatchdogState {
 
 let retentionWatchdog: RetentionWatchdogState | undefined;
 
-/**
- * Quarantine `lock`, and on a PERSISTENCE failure arm the retention
- * watchdog BEFORE rethrowing. THE single quarantine entry point for provision-level
- * code (the body-error path and the signal coordinator's hook both route through it),
- * so no persistence failure can leave the process free to drain unprotected.
- */
+/** Quarantine `lock`; if persisting fails, arm the retention watchdog before rethrowing. */
 function retainQuarantinedLock(lock: ProvisionLock, info: QuarantineInfo): void {
   try {
     lock.quarantine(info);
@@ -1266,8 +898,7 @@ function armRetentionWatchdog(lock: ProvisionLock, info: QuarantineInfo): void {
     }
   };
   const tick = (): void => {
-    // (a) probe the recorded group for death FIRST: a dead group needs no quarantine —
-    // release the mutex normally and resume normal exit semantics.
+    // A dead group needs no quarantine: release normally.
     if (info.pid !== undefined) {
       let dead = false;
       try {
@@ -1290,8 +921,7 @@ function armRetentionWatchdog(lock: ProvisionLock, info: QuarantineInfo): void {
         return;
       }
     }
-    // (b) retry the DURABLE persistence: success detaches the lock behind a durable
-    // sidecar, so the process may exit while the retained mutex keeps blocking.
+    // Retry durable persistence.
     try {
       lock.quarantine(info);
       resolveWatchdog();
@@ -1309,17 +939,8 @@ function armRetentionWatchdog(lock: ProvisionLock, info: QuarantineInfo): void {
 }
 
 /**
- * Default provider runner: launches the isolated typed operation entry through
- * {@link resolveCloudflareOperationArgv} with `shell: false`. Public request fields
- * travel as literal JSON argv; secrets travel through stdin. Captured stdout carries
- * the structured result envelope, while stderr carries provider diagnostics.
- *
- * ASYNC (returns a Promise). `spawn` + `await` (vs. the old blocking
- * `spawnSync`) keeps the Node event loop free while wrangler runs, so
- * `proper-lockfile`'s update timer keeps refreshing the mutex mtime for the WHOLE
- * provision — no wrangler call, however slow, can freeze the loop long enough for
- * another process to see the lock stale and steal it while we still hold it. A
- * {@link COMMAND_TIMEOUT_MS} SIGKILL guards against a hung child.
+ * Default runner: spawns the typed operation entry ({@link resolveCloudflareOperationArgv})
+ * without a shell; secrets go through stdin. It is async so the lock heartbeat keeps running.
  */
 export function createDefaultRunWrangler(
   root: string,
@@ -1330,45 +951,24 @@ export function createDefaultRunWrangler(
     launcher?: Array<string>;
     /** Test seam — the per-command timeout. Defaults to {@link COMMAND_TIMEOUT_MS}. */
     timeoutMs?: number;
-    /**
-     * Test seam — the process-GROUP signaller (`target` is the value passed to
-     * `process.kill`: a NEGATIVE pid for the group). Defaults to `process.kill`. Tests inject
-     * it to exercise the ESRCH-already-gone and real-kill-failure branches.
-     */
+    /** Test seam for `process.kill` (a negative pid targets the group). */
     killProcessGroup?: (target: number, signal: NodeJS.Signals) => void;
-    /**
-     * Test seam — the post-kill termination-confirmation window. Defaults to
-     * {@link CONFIRM_KILL_GRACE_MS}. Tests shrink it to exercise the quarantine expiry.
-     */
+    /** Test seam for {@link CONFIRM_KILL_GRACE_MS}. */
     confirmKillGraceMs?: number;
-    /**
-     * Test seam — the coordinator-WIDE signal-teardown deadline for this
-     * runner's pair. Defaults to `confirmKillGraceMs + `{@link SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS}.
-     * Tests shrink it to exercise the backstop quarantine.
-     */
+    /** Test seam for the coordinator-wide teardown deadline. */
     signalTeardownDeadlineMs?: number;
-    /**
-     * Test seam — observe the spawned ChildProcess (unit tests use it to inject a
-     * post-spawn `error` event). Never set in production.
-     */
+    /** Test seam to observe the spawned child. */
     onSpawnedChild?: (child: ChildProcess) => void;
   },
 ): RunWrangler {
-  // The operation entry executes provider work in this process group. Killing the
-  // group reaches the entry and any provider subprocess, and exit provenance is
-  // retained independently of the structured result envelope.
-  const launcher = options?.launcher ?? resolveCloudflareOperationArgv(root);
+  const launcher = options?.launcher ?? resolveCloudflareOperationArgv();
   const timeoutMs = options?.timeoutMs ?? COMMAND_TIMEOUT_MS;
   const confirmGraceMs = options?.confirmKillGraceMs ?? CONFIRM_KILL_GRACE_MS;
   const killProcessGroup =
     options?.killProcessGroup ??
     ((target: number, signal: NodeJS.Signals) => process.kill(target, signal));
   const [command, ...prefix] = launcher;
-  // POSIX: spawn the child as its OWN process-group leader (`detached`) so the timeout
-  // can SIGKILL the WHOLE group (`process.kill(-pid, …)`) — reaping any grandchildren
-  // (e.g. an esbuild service) that would otherwise linger holding the inherited pipes.
-  // Windows has no process groups here; the direct (wrapper-free) CLI has no grandchild
-  // to strand, so a plain `child.kill` suffices.
+  // POSIX: the child leads its own process group, so a group kill also reaches grandchildren.
   const isWindows = process.platform === 'win32';
   const teardownDeadlineMs =
     options?.signalTeardownDeadlineMs ?? confirmGraceMs + SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS;
@@ -1376,10 +976,7 @@ export function createDefaultRunWrangler(
     new Promise<RunWranglerResult>((resolvePromise, rejectPromise) => {
       const parallelWorkerUpload =
         options?.parallelWorkerUpload === true && args.type === 'versions.upload';
-      // Once a fatal-signal teardown has begun, this process is
-      // terminating: REJECT new wrangler work outright BEFORE spawning (fail fast — no
-      // child spawned means nothing to confirm), never join the teardown late with a
-      // fresh deadline.
+      // A fatal-signal teardown is in progress: start no new work.
       if (activeTeardown !== undefined) {
         rejectPromise(
           new Error(
@@ -1389,9 +986,8 @@ export function createDefaultRunWrangler(
         );
         return;
       }
-      // Ordinary commands stay serial. Only two immutable platform Worker uploads
-      // can overlap outside provisioning. This check and the spawn+registration below
-      // run in ONE synchronous block, so no signal dispatch can interleave between them.
+      // Only two immutable Worker uploads may overlap. This check, the spawn and the
+      // registration run in one synchronous block.
       if (!canRegisterRunner(parallelWorkerUpload)) {
         rejectPromise(
           new Error(
@@ -1405,10 +1001,6 @@ export function createDefaultRunWrangler(
       const child = spawn(command, [...prefix, ...encodeCloudflareOperation(args)], {
         cwd: opts.cwd ?? root,
         shell: false,
-        // Pin the account + API base PER CALL from the transport context, so the
-        // spawned wrangler targets the SAME reconciled account + endpoint the config +
-        // Hyperdrive REST path use (no split-brain between the config pin and the
-        // ambient/dotenv env).
         env: {
           ...provisionEnv({
             accountId: opts.accountId,
@@ -1425,24 +1017,10 @@ export function createDefaultRunWrangler(
       let stderr = '';
       let timedOut = false;
       let settled = false;
-      // Whether the spawn SUCCEEDED. The direct-settle carve-out in the
-      // `error` handler is reserved for a GENUINE pre-spawn failure (no pid, `spawn`
-      // never fired — the child never ran, so there is nothing to confirm dead).
       let spawned = false;
-      // A post-spawn `error` event routes through the termination
-      // machine; this makes the `close` handler defer to that path (like `timedOut`).
       let postSpawnError: Error | undefined;
-      // ONE termination state machine for EVERY spawned-child outcome
-      // (normal close, timeout, parent signal, post-spawn error, kill failure). The TWO
-      // facts every path must confirm before the promise may settle — and before a
-      // forwarded parent signal may be re-raised:
-      //   `closed`    — the child's `close` event fired (process exited + stdio drained);
-      //   `groupGone` — the whole process GROUP is confirmed gone (`kill(-pid, 0)` → ESRCH;
-      //                 trivially true where no group exists: Windows, or no pid).
-      // NO path settles-and-releases (or re-raises) without BOTH; an unconfirmable
-      // teardown instead QUARANTINES — rejects with a {@link WranglerQuarantineError}
-      // (lock intentionally retained; on the signal path the before-death hooks retain
-      // it synchronously first).
+      // Every outcome settles only after two facts: `closed` (the close event fired) and
+      // `groupGone` (the whole process group is gone). Otherwise the runner quarantines.
       let closed = false;
       let groupGone = false;
       child.once('spawn', () => {
@@ -1457,9 +1035,7 @@ export function createDefaultRunWrangler(
         stderr += chunk;
       });
 
-      // Signal the child's WHOLE process group (it is `detached`, so its own group leader).
-      // Returns a STRUCTURED outcome so the caller distinguishes ESRCH ("already gone" →
-      // success) from a REAL kill failure (EPERM/… → the child may still be running → surface).
+      // Signal the whole process group; ESRCH counts as already gone.
       const signalGroup = (signal: NodeJS.Signals): 'signaled' | 'gone' | { error: Error } => {
         try {
           if (!isWindows && typeof child.pid === 'number') {
@@ -1467,38 +1043,19 @@ export function createDefaultRunWrangler(
             return 'signaled';
           }
           if (isWindows && typeof child.pid === 'number') {
-            // Windows has NO process groups, so the signal target is the child ITSELF.
-            // Consult Node's own bookkeeping FIRST: once the exit has been observed there is
-            // nothing left to signal. This ORDERING is also what makes the pid-based call below
-            // free of any pid-reuse hazard. Windows destroys a pid only when the process OBJECT
-            // is destroyed, which requires the process to have exited AND every handle to it to
-            // be closed; libuv closes its handle (`CloseHandle(handle->process_handle)` in
-            // `uv__process_proc_exit`, win/process.c) in the SAME straight-line frame that then
-            // invokes `exit_cb` — Node's `onexit`, whose first statements set
-            // `exitCode`/`signalCode`. No JavaScript runs in between, so a pid observed here
-            // with a null exit code is still pinned by libuv's open handle and cannot have been
-            // reassigned. (`child.kill()` is no safer in that instant: libuv sets
-            // UV_HANDLE_ESRCH on the very next line and `uv_process_kill` then short-circuits to
-            // ESRCH, which `ChildProcess.kill` reports as the same ambiguous `false`.)
+            // Windows has no process groups. Check Node's exit bookkeeping first: until it is
+            // set, libuv still holds the process handle, so the pid cannot have been reused.
             if (child.exitCode !== null || child.signalCode !== null) {
               return 'gone';
             }
-            // Routed through the SAME seam POSIX uses, because `process.kill` THROWS ESRCH
-            // (classified "already gone" below), whereas `child.kill()` collapses ESRCH and
-            // EPERM into one silent `false`. Node sets `exitCode`/`signalCode` asynchronously
-            // in its `exit` handler, so a child that died a moment ago still reads as
-            // "running" here — and the ambiguous `false` would then be reported as a FAILED
-            // delivery, quarantining the lock over a child that had simply already exited.
+            // `process.kill` reports ESRCH and EPERM separately; `child.kill()` returns false for both.
             killProcessGroup(child.pid, signal);
             return 'signaled';
           }
           if (child.kill(signal)) {
             return 'signaled';
           }
-          // `child.kill()` returning FALSE is Node's non-throwing way of
-          // reporting a failed signal delivery. An already-exited child has nothing left
-          // to signal ("gone"); otherwise it is a FAILED signal attempt that must be
-          // surfaced (same path as a thrown non-ESRCH kill error), never read as sent.
+          // `false` means the signal was not delivered, unless the child already exited.
           if (child.exitCode !== null || child.signalCode !== null) {
             return 'gone';
           }
@@ -1520,13 +1077,8 @@ export function createDefaultRunWrangler(
           return true;
         }
         if (isWindows) {
-          // No process GROUP to probe, but the child ITSELF is still confirmable: libuv
-          // implements `kill(pid, 0)` on Windows as a real liveness check
-          // (GetExitCodeProcess + WaitForSingleObject). Descendants are covered separately —
-          // libuv assigns every non-`detached` child to a global Job Object with
-          // KILL_ON_JOB_CLOSE, so they die with this process. Prefer Node's own bookkeeping
-          // (immune to pid reuse) and fall back to the signal-0 probe while the exit has not
-          // been observed yet — so confirmation stays EARNED rather than assumed.
+          // libuv's `kill(pid, 0)` is a real liveness check on Windows, and descendants die
+          // with libuv's job object. Prefer Node's exit bookkeeping when it is set.
           if (child.exitCode !== null || child.signalCode !== null) {
             groupGone = true;
             return true;
@@ -1541,9 +1093,8 @@ export function createDefaultRunWrangler(
         try {
           process.kill(-child.pid, 0);
         } catch (error) {
+          // EPERM: a member exists but cannot be signalled, so it counts as alive.
           groupGone = isAlreadyGoneKillError(error);
-          // EPERM → some group member exists but we cannot signal it — treat as ALIVE
-          // (fail safe: never confirm on a probe we could not perform).
         }
         return groupGone;
       };
@@ -1553,8 +1104,6 @@ export function createDefaultRunWrangler(
           .filter(Boolean)
           .join('\n');
 
-      // This runner's pair is registered with the process-wide
-      // signal coordinator (below) for the child's lifetime; settling deregisters it.
       const deregisterSelf = (): void => deregisterRunner(registrant);
 
       const finish = (result: RunWranglerResult): void => {
@@ -1567,9 +1116,7 @@ export function createDefaultRunWrangler(
         resolvePromise(decodeCloudflareOperationResult(result));
       };
 
-      // Settle by REJECTING with a quarantine error: the child could not be confirmed
-      // dead, so the caller must retain the whole-provision lock (never release it under a
-      // possibly-live child) and surface manual-recovery guidance.
+      // Reject with a quarantine error: the child could not be confirmed dead.
       const quarantine = (detail: string): void => {
         if (settled) {
           return;
@@ -1580,15 +1127,8 @@ export function createDefaultRunWrangler(
         rejectPromise(new WranglerQuarantineError(child.pid, detail));
       };
 
-      // The ONE bounded both-facts confirmation loop, shared by the
-      // settle side (normal close + timeout) and the parent-signal side. Polls until
-      // BOTH facts hold, then `onConfirmed`; at `confirmGraceMs` unconfirmed,
-      // `onExpiry`. `close` nudges every active poll for promptness. Poll timers are
-      // REFERENCED (no unref): confirmation must keep the event loop alive until the
-      // outcome is known — an unref'd timer would let the process exit mid-confirm
-      // (status 0, exit hooks sweeping the mutex). A settle-side poll self-terminates
-      // once the promise settled (≤ one 20ms tick later); the signal-side poll must
-      // keep going regardless (it still has a fatal signal to re-raise).
+      // Bounded confirmation loop shared by the settle side and the signal side. Poll timers
+      // are referenced so the process cannot exit mid-confirmation.
       const confirmPollNudges: Array<() => void> = [];
       const nudgeConfirmPolls = (): void => {
         // A poll never registers new waiters while running, so direct iteration is safe.
@@ -1622,9 +1162,7 @@ export function createDefaultRunWrangler(
         poll();
       };
 
-      // Settle side of the machine: confirm BOTH facts, then resolve with `makeResult`;
-      // an unconfirmed window QUARANTINES (rejects; lock retained) — never a silent
-      // settle-and-release while the real CLI (or a group member) may still be running.
+      // Confirm both facts, then resolve; quarantine when the window expires.
       const confirmThenSettle = (makeResult: () => RunWranglerResult, what: string): void => {
         awaitConfirmedDead({
           stopWhenSettled: true,
@@ -1637,14 +1175,7 @@ export function createDefaultRunWrangler(
         });
       };
 
-      // Forward a parent SIGINT/SIGTERM to the child's process GROUP so a Ctrl-C /
-      // termination tears the DETACHED child (+ grandchildren) down instead of orphaning it.
-      // Signal handling lives in the ONE process-wide coordinator (see
-      // {@link registerRunner}); this runner registers its own pair. The coordinator forwards the first
-      // SIGINT/SIGTERM to the registered group, awaits its bounded both-facts
-      // confirmation (via this registrant's `awaitConfirmedDead`), quarantines it if
-      // unresolved, coalesces repeated signals during the teardown, and re-raises
-      // EXACTLY ONCE — never over a pending child.
+      // The signal coordinator forwards parent signals to the group through this registrant.
       const registrant: TerminationRegistrant = {
         pid: () => child.pid,
         signalGroup,
@@ -1669,15 +1200,12 @@ export function createDefaultRunWrangler(
         quarantine,
       };
 
-      // Hard timeout: SIGKILL the whole group, then AWAIT CONFIRMED termination before
-      // settling — so the whole-provision lock (released only after this promise settles)
-      // can NEVER be released while the real wrangler CLI is still alive. A kill FAILURE is
-      // a QUARANTINE (rejects; lock retained), never a settle-and-release.
+      // Hard timeout: SIGKILL the group, then confirm termination before settling.
       const commandTimer = setTimeout(() => {
         timedOut = true;
         const outcome = signalGroup('SIGKILL');
         if (typeof outcome === 'object') {
-          // A REAL kill failure (not ESRCH). The child MAY still be running — QUARANTINE.
+          // A real kill failure: the child may still be running.
           quarantine(`the process group could not be killed: ${outcome.error.message}`);
           return;
         }
@@ -1695,33 +1223,20 @@ export function createDefaultRunWrangler(
           `the timeout SIGKILL (${timeoutStderr()})`,
         );
       }, timeoutMs);
-      // REFERENCED (no unref): if every other handle unrefs (pipes closed by a child that
-      // never exits), an unref'd deadline would let the event loop drain and the process
-      // exit 0 mid-command. It is cleared in finish/quarantine, so a completed call never
-      // holds the loop open.
-
-      // Node emits `error` on a ChildProcess AFTER a successful spawn
-      // too (e.g. a failed in-flight signal delivery; the Windows timeout/signal paths
-      // go through `child.kill()`), and the old handler ALWAYS settled directly — an
-      // ordinary hard failure that RELEASED the whole-provision lock while the child
-      // could still be alive. The direct-settle carve-out is reserved for a GENUINE
-      // pre-spawn failure (ENOENT/EACCES: no pid, `spawn` never fired — the child never
-      // ran, so there is nothing to confirm dead, and `close` may never follow). Every
-      // POST-spawn `error` routes through the ONE bounded termination-confirmation →
-      // quarantine machine like any other outcome.
+      // The timer stays referenced, so the process cannot exit 0 mid-command.
+
+      // Node can emit `error` after a successful spawn. Only a genuine pre-spawn failure (no
+      // pid, `spawn` never fired) settles directly; any other error goes through confirmation.
       const handleProcessError = (error: Error): void => {
         if (!spawned && typeof child.pid !== 'number') {
           finish(normalizeRunWranglerResult({ stdout, stderr, status: null, signal: null, error }));
           return;
         }
         if (settled || timedOut || postSpawnError !== undefined) {
-          // Already settling through another arm of the machine (its confirm poll
-          // still owns the outcome) — never double-drive it.
+          // Already settling through another path.
           return;
         }
         postSpawnError = error;
-        // The command is over as far as the caller is concerned — the machine's own
-        // grace window bounds the rest.
         clearTimeout(commandTimer);
         const outcome = signalGroup('SIGKILL');
         if (typeof outcome === 'object') {
@@ -1756,21 +1271,13 @@ export function createDefaultRunWrangler(
       child.on('close', (code, signal) => {
         closed = true;
         if (timedOut || postSpawnError !== undefined) {
-          // The timeout / post-spawn-error path's confirm poll settles once the group
-          // is ALSO confirmed gone (both facts). Nudge every active poll now for
-          // promptness.
+          // That path settles once the group is also gone; nudge its poll.
           nudgeConfirmPolls();
           return;
         }
-        // The command itself is DONE — the hard timeout no longer applies; only group
-        // confirmation remains (bounded by its own grace window below).
         clearTimeout(commandTimer);
-        // `close` alone is NOT sufficient to settle: a same-group
-        // grandchild with its OWN stdio survives the leader (so `close` fires with the
-        // group still alive) and could keep creating resources after the provision lock
-        // is released. Resolve ONLY once the whole group is confirmed gone; if members
-        // linger, SIGKILL the group (exactly like the timeout path) and confirm within
-        // the bounded window — an unconfirmable group QUARANTINES.
+        // `close` alone is not enough: a grandchild with its own stdio can outlive the leader.
+        // Settle only once the group is gone, killing any survivors first.
         const makeResult = (): RunWranglerResult =>
           normalizeRunWranglerResult({ stdout, stderr, status: code, signal });
         if (probeGroupGone()) {
@@ -1797,10 +1304,7 @@ export function createDefaultRunWrangler(
         nudgeConfirmPolls();
       });
 
-      // Register with the coordinator LAST (after commandTimer +
-      // every handler exists). The pre-spawn checks at the top of this executor ran in
-      // the SAME synchronous block, so no teardown can have begun and no other
-      // registration can exist by the time this runs.
+      // Register last, in the same synchronous block as the pre-spawn checks.
       registerRunner(registrant, parallelWorkerUpload);
       options?.onSpawnedChild?.(child);
       if (opts.input !== undefined) {
@@ -1810,14 +1314,8 @@ export function createDefaultRunWrangler(
 }
 
 /**
- * Normalize a `spawnSync` result into a {@link RunWranglerResult}, treating a
- * signal-killed child or a spawn error as a FAILURE — never success.
- *
- * The naive `status ?? (error ? 1 : 0)` collapses a SIGTERM'd child (which
- * returns `status: null`, a non-null `signal`, and NO `error`) to `0`, so a
- * killed `create` would be recorded as `created` though nothing happened. So we
- * fail on ANY non-numeric `status`, a non-null `signal`, or a present `error`,
- * and surface the signal/spawn-error text in `stderr` for diagnostics.
+ * Normalize a finished child into a {@link RunWranglerResult}. A signal, a spawn error or a
+ * non-numeric status is a non-zero failure, never success.
  */
 export function normalizeRunWranglerResult(result: {
   stdout?: string | null;
@@ -1844,9 +1342,7 @@ export function normalizeRunWranglerResult(result: {
     : (result.status as number);
   const baseStderr = result.stderr ?? '';
   const stderr = notes.length > 0 ? [baseStderr, ...notes].filter(Boolean).join('\n') : baseStderr;
-  // Preserve the provenance STRUCTURALLY (not just folded into stderr text) so
-  // downstream classifiers can distinguish a clean non-zero exit (which MAY carry
-  // a not-found signal) from a kill/spawn-error (which never may).
+  // Keep provenance structured so classifiers can tell a clean failure from a kill.
   return {
     stdout,
     stderr,
@@ -1856,12 +1352,7 @@ export function normalizeRunWranglerResult(result: {
   };
 }
 
-/**
- * THE single provenance rule. A result is a HARD failure when the child was
- * signal-killed or could not be spawned: it did not run to completion, so its
- * buffered status/stdout/stderr is unreliable and must NEVER be read as "absent"
- * or "success". Every success/absence/adopt classifier below defers to this.
- */
+/** A signal-killed or unspawned child: its output is never read as success or absence. */
 function isHardFailure(result: RunWranglerResult): boolean {
   return result.signal != null || result.error != null;
 }
@@ -1871,29 +1362,15 @@ function isCleanSuccess(result: RunWranglerResult): boolean {
   return !isHardFailure(result) && result.status === 0;
 }
 
-/**
- * The child ran to completion and reported a FAILURE status (a numeric non-zero
- * exit, no signal, no spawn error) — the ONLY case whose stdout/stderr may be
- * classified for a resource-specific not-found signal.
- */
+/** A completed child with a non-zero exit: the only result that may mean "not found". */
 function isCleanFailure(result: RunWranglerResult): boolean {
   return !isHardFailure(result) && Number.isSafeInteger(result.status) && result.status > 0;
 }
 
-/**
- * The OVERALL deadline for the Hyperdrive existence lister (across ALL its paginated
- * requests). A stalled body or a never-settling injected seam must never hold the
- * whole-provision lock (whose heartbeat keeps refreshing while the loop is free) forever, so
- * the caller fails closed at this bound.
- */
+/** Overall deadline for the Hyperdrive lister, so a stalled list cannot hold the lock forever. */
 const HYPERDRIVE_LIST_TIMEOUT_MS = 60_000;
 
-/**
- * Run a lister call under an OVERALL deadline. Builds one `AbortController`, hands its
- * signal to `start` (threaded into every paginated `fetch`), and races the returned promise
- * against a timer that ABORTS the signal AND rejects — so even a seam that ignores the signal
- * (never settling) can NOT hold the caller (and thus the provision lock) past `ms`.
- */
+/** Run `start` under an overall deadline: abort and reject at `ms`, even if it ignores the signal. */
 function withListerDeadline<T>(start: (signal: AbortSignal) => Promise<T>, ms: number): Promise<T> {
   return new Promise<T>((resolve, reject) => {
     const controller = new AbortController();
@@ -1901,12 +1378,8 @@ function withListerDeadline<T>(start: (signal: AbortSignal) => Promise<T>, ms: n
       controller.abort();
       reject(new Error(`the existence check exceeded the ${ms}ms deadline`));
     }, ms);
-    // The deadline timer stays REFERENCED until the lister settles (both
-    // settle arms below clear it). An unref'd timer let a real CLI process EXIT 0 before
-    // the deadline fired: with a never-settling lister nothing else holds the loop —
-    // proper-lockfile's heartbeat is unref'd too — so the loop drained and the process
-    // exited mid-provision reporting success. Vitest's own handles masked this in-worker;
-    // the child-process regression test spawns a real node process to prove it.
+    // Referenced until settled: the lock heartbeat is unref'd, so an unref'd timer could let
+    // the process exit 0 while a lister never settles.
     // Defer `start` into the promise chain so a synchronous throw is captured as a rejection.
     Promise.resolve()
       .then(() => start(controller.signal))
@@ -1924,11 +1397,8 @@ function withListerDeadline<T>(start: (signal: AbortSignal) => Promise<T>, ms: n
 }
 
 /**
- * The Cloudflare API token the default Hyperdrive existence check authenticates with:
- * the caller-supplied one, else the ambient `CLOUDFLARE_API_TOKEN`. An empty value is
- * treated as absent. This is the ONE resolver — the up-front Hyperdrive fence and the
- * default lister below both use it, so the fence can never promise a check the lister
- * then declines to make.
+ * API token for the Hyperdrive REST check: the caller's, else `CLOUDFLARE_API_TOKEN`. Shared by
+ * the up-front fence and the default lister so they always agree.
  */
 function resolveHyperdriveApiToken(apiToken?: string): string | undefined {
   const token = apiToken ?? process.env.CLOUDFLARE_API_TOKEN;
@@ -1936,56 +1406,28 @@ function resolveHyperdriveApiToken(apiToken?: string): string | undefined {
 }
 
 /**
- * Default Hyperdrive existence check: `GET /accounts/{id}/hyperdrive/configs`
- * with the CF API token, matched by name in the caller. Returns `undefined` when
- * it cannot be built (no account id / no token) — the caller then fails closed
- * before any blind create. Never called in unit tests — those inject a stub.
+ * Default Hyperdrive lister over the REST API. Returns `undefined` without a token, so the
+ * caller fails closed before a blind create.
  */
 function createDefaultListHyperdriveConfigs(apiToken?: string): ListHyperdriveConfigs | undefined {
   const token = resolveHyperdriveApiToken(apiToken);
   if (!token) {
     return undefined;
   }
-  // The account AND the pinned API base come from the per-call transport context
-  // (not a closure), so this default REST lister always targets the reconciled effective
-  // account at the SAME endpoint the spawned wrangler uses (never a hardcoded prod base
-  // while wrangler was redirected to staging/FedRAMP/an arbitrary endpoint).
   return async ({ accountId, apiBaseUrl, signal }) => {
-    // Build every request URL with wrangler 4.131's EXACT concatenation
-    // semantics. wrangler's `performApiFetchBase` (wrangler-dist/cli.js) fetches
-    //   `${getCloudflareApiBaseUrl(complianceConfig)}${resource}${queryString}`
-    // where the pinned base is used VERBATIM (a direct CLOUDFLARE_API_BASE_URL override
-    // is returned as-is by `getCloudflareApiBaseUrlFromEnv() ?? …` — never trimmed or
-    // normalized) and its hyperdrive `listConfigs` resource interpolates the account id
-    // RAW: `/accounts/${accountId}/hyperdrive/configs`. The old one-sided
-    // trailing-slash strip made this lister and the spawned wrangler hit DIFFERENT
-    // endpoints on a custom base ending in `/` (`…/api/accounts/…` vs
-    // `…/api//accounts/…`), so the existence check could disagree with the create.
-    // Mirror the concatenation byte-for-byte instead — no trimming, no encoding.
+    // Concatenate exactly like wrangler (no trimming, no encoding), so both hit the same URL.
     const perPage = 100;
     const listUrl = (page: number): string =>
       `${apiBaseUrl}/accounts/${accountId}/hyperdrive/configs?page=${page}&per_page=${perPage}`;
-    // Fetch ALL pages (Hyperdrive names are NOT unique — paid accounts allow
-    // ~25 configs, paginated) and FAIL CLOSED on any non-2xx, `success !== true`,
-    // or a malformed entry. Never coerce a malformed envelope/entry to "absence":
-    // that would mint a duplicate config on a re-run.
-    //
-    // Completeness is PROVEN, not assumed: we require consistent pagination
-    // metadata (`result_info.total_count`) and keep going until the DISTINCT
-    // config count equals it. Any of — missing metadata, an empty page before all
-    // configs are seen, a repeated/duplicate id, an inconsistent total, or an
-    // overshoot — throws (fail closed) rather than silently declaring the list
-    // complete (which could miss a same-named config on an unread page and mint a
-    // duplicate).
+    // Read every page and prove the list is complete against `result_info.total_count`. A
+    // malformed payload, missing metadata, duplicate id or early empty page fails closed.
     const byId = new Map<string, HyperdriveConfig>();
     let expectedTotal: number | undefined;
     for (let page = 1; ; page++) {
-      const res = await fetch(
-        listUrl(page),
-        // Apply the caller's deadline signal to EVERY paginated request, so a stalled
-        // body / never-settling page is aborted rather than holding the provision lock forever.
-        { headers: { Authorization: `Bearer ${token}` }, signal },
-      );
+      const res = await fetch(listUrl(page), {
+        headers: { Authorization: `Bearer ${token}` },
+        signal,
+      });
       if (!res.ok) {
         throw new Error(`Cloudflare API returned HTTP ${res.status} listing Hyperdrive configs`);
       }
@@ -1995,8 +1437,6 @@ function createDefaultListHyperdriveConfigs(apiToken?: string): ListHyperdriveCo
           'Cloudflare API returned an unsuccessful or malformed Hyperdrive configs payload',
         );
       }
-      // Pagination metadata is REQUIRED to prove completeness. Its absence means
-      // we cannot know whether more pages exist → fail closed.
       const info = body.result_info;
       const totalCount =
         isRecord(info) && typeof info.total_count === 'number' && Number.isInteger(info.total_count)
@@ -2016,7 +1456,6 @@ function createDefaultListHyperdriveConfigs(apiToken?: string): ListHyperdriveCo
             'cannot prove the list is complete',
         );
       }
-      // An empty page before we have gathered every config is premature truncation.
       if (body.result.length === 0 && byId.size < expectedTotal) {
         throw new Error(
           'Cloudflare API returned an empty Hyperdrive page before all configs were listed; ' +
@@ -2049,32 +1488,18 @@ function createDefaultListHyperdriveConfigs(apiToken?: string): ListHyperdriveCo
             'cannot prove the list is complete',
         );
       }
-      // Done ONLY when the distinct count matches the proven total. Each remaining
-      // iteration adds ≥1 distinct id (a duplicate or empty page threw above), so
-      // this loop is bounded by `expectedTotal`.
+      // Each page adds at least one new id, so the loop ends.
       if (byId.size === expectedTotal) {
         break;
       }
     }
-    // NOTE: the per-entry id/name + duplicate-id checks above are needed for this REST
-    // path's pagination-completeness PROOF (the `byId` map). They are NOT the adoption
-    // gate: `selectHyperdriveMatch` at the CALLER is the single authoritative validator
-    // that covers BOTH this default path AND any injected lister.
     return [...byId.values()];
   };
 }
 
 /**
- * The ONE strict Hyperdrive-list validator, applied at the CALLER after EITHER
- * lister returns (the default fetch OR an injected seam), so validation can never live
- * only inside the default fetch. Validates EVERY member up front — BEFORE any name
- * filtering: rejects any non-object member, empty/non-string `name`, and duplicate `id`,
- * AND requires every member's `id` to be a REAL 32-hex Hyperdrive id (not merely
- * non-empty). A malformed id on ANY member means the list is untrustworthy, so we fail
- * closed rather than skip that member and mistake the target for absent. Then requires
- * EXACTLY 0 or 1 exact-name match (>1 is ambiguous — Hyperdrive names are NOT
- * account-unique — and fails closed) BEFORE any match/write. Returns the single
- * exact-name match, or `undefined` when none matches.
+ * Validate a Hyperdrive list from any lister and return the config named `name`, if any. A
+ * malformed member, a bad or duplicate id, or more than one match fails closed.
  */
 function selectHyperdriveMatch(
   configs: Array<unknown>,
@@ -2097,10 +1522,6 @@ function selectHyperdriveMatch(
           `${JSON.stringify(name)} already exists; refusing to create a possible duplicate.`,
       );
     }
-    // EVERY member's id must be a real 32-hex Hyperdrive id, checked BEFORE name
-    // filtering. A non-empty-but-malformed id (`" "`, `"xyz"`) on any member means the
-    // list is untrustworthy → fail closed (never skip it and mistake the target for
-    // absent, which would mint a duplicate config).
     if (!isRealHyperdriveId(config.id)) {
       throw new Error(
         `provision: the Hyperdrive existence check returned a config ` +
@@ -2131,59 +1552,18 @@ function selectHyperdriveMatch(
   return named[0];
 }
 
-// --- Whole-provision cross-process lock (proper-lockfile) ----------------
-// TWO independent races must be serialized across processes, so ONE lock is held for
-// the WHOLE provision (acquired before the first config read, released in `finally`):
-//   1. Account reconciliation. A first-run provision READS → RECONCILES → PERSISTS
-//      one effective `account_id`. Two first-run processes for accounts A and B could
-//      otherwise both see no `account_id`, overwrite each other, and then write an
-//      A-side result into a now-B-pinned config. Under the lock the second process
-//      re-reads the persisted account and FAILS CLOSED on mismatch (or reuses).
-//   2. Hyperdrive list→create. Hyperdrive is unguarded and its names are NOT
-//      account-unique, so two concurrent provisions could both see "no match" and both
-//      create a permanent orphaned duplicate. Under the lock the second run's
-//      read-first sees the id the first wrote and SKIPS.
-// The hand-rolled O_EXCL lock this replaces had classic protocol bugs (a freshly
-// created file is visible before its metadata is written; age-only expiry ignoring a
-// live owner; a check-then-unlink stale-takeover race; an ownerless release that could
-// remove a successor's lock). `proper-lockfile` does atomic `mkdir`-based acquisition,
-// mtime-refresh so a live owner never expires by age, stale-compromise detection, and
-// ownership-scoped release.
+// Cross-process lock held for the whole provision. It serializes account reconciliation and
+// Hyperdrive list→create (names are not unique), so a second run sees the first run's writes.
 
 interface ProvisionLock {
   /** The synthetic lock target (`<configPath>.void-provision.lock`), for diagnostics. */
   readonly lockTargetPath: string;
-  /**
-   * Drop the mutex. REJECTS on a genuine (non-`onCompromised`) unlock failure so a
-   * LEAKED lock is surfaced, never hidden behind a "successful" provision. Idempotent:
-   * repeated calls return the SAME settled promise.
-   */
+  /** Drop the mutex. Rejects on a real unlock failure; repeated calls share one promise. */
   release: () => Promise<void>;
   /**
-   * RETAIN the mutex intentionally (quarantine): a spawned wrangler child
-   * could not be confirmed dead, so the on-disk mutex directory must OUTLIVE this process
-   * to keep blocking concurrent provisions. `proper-lockfile` registers a signal-exit
-   * sweep that `rmdirSync`s every still-TRACKED lock on process exit, so simply "not
-   * releasing" is not enough — this detaches the lock from the library's internal
-   * tracking (stopping the mtime heartbeat too), leaving the mutex directory on disk.
-   *
-   * It ALSO persists the quarantine OWNER METADATA (`info`: the
-   * unconfirmed child's pid/pgid + reason + timestamp) in an atomically-written sidecar
-   * next to the lock (`<lock>.quarantine.json`). The retained mutex is NO LONGER
-   * released by mere age: every later acquisition gates on the sidecar first (see
-   * {@link acquireProvisionLock}) — it proceeds only after probing the recorded group
-   * dead (ESRCH), clearing the sidecar + stale mutex itself; while the group may live
-   * (or the probe fails) it FAILS CLOSED. Idempotent; a later `release()` becomes a
-   * no-op (`ERELEASED` → success) and never removes the retained directory.
-   *
-   * DURABLE sidecar persistence is a PRECONDITION for the detach: the
-   * detached mutex's heartbeat stops, so without a durable sidecar there is nothing for
-   * the acquisition gate to gate on and the mutex would go mtime-stale and be STOLEN
-   * while the child may live (the previous code warned and detached anyway — fail open).
-   * If the sidecar cannot be written+verified this THROWS instead, leaving the lock
-   * fully TRACKED (heartbeat running, `release()` still functional, NOT stealable): the
-   * error states the lock is intentionally still held and how to recover manually. A
-   * later `quarantine()` call retries the persistence.
+   * Keep the mutex on disk past this process's exit, because a child could not be confirmed
+   * dead. A durable sidecar is written first; if that fails this throws and the lock stays
+   * tracked. Later acquisitions probe the recorded group before taking the lock.
    */
   quarantine: (info: QuarantineInfo) => void;
 }
@@ -2194,18 +1574,8 @@ function quarantineSidecarPath(lockTarget: string): string {
 }
 
 /**
- * Atomically persist the quarantine owner metadata: write a temp file,
- * then `rename` over the final path, so a concurrent acquisition gate can never read
- * partial JSON. On POSIX the spawned wrangler child is `detached` (its own process-group
- * leader), so the recorded `pgid` IS its pid; Windows has no process groups (the gate
- * probes the pid directly there).
- *
- * DURABLE: the temp file is fsync'd before the rename, the directory is
- * fsync'd after it (see the classification below), and the final sidecar is READ
- * BACK and verified. Any failure THROWS — callers treat persistence as a PRECONDITION
- * for detaching the lock from proper-lockfile's tracking (see
- * {@link ProvisionLock.quarantine}); a sidecar that merely "probably" landed is not a
- * durable marker the acquisition gate can rely on.
+ * Persist quarantine metadata durably (temp file, fsync, rename, directory fsync), then read it
+ * back. Throws on any failure.
  */
 function writeQuarantineSidecar(
   sidecarPath: string,
@@ -2219,11 +1589,7 @@ function writeQuarantineSidecar(
       reason: info.reason,
       quarantinedAt: new Date().toISOString(),
       quarantinedBy: process.pid,
-      // The sidecar GENERATION: a recovery decision may only remove the
-      // exact generation it just inspected under the recovery mutex (see
-      // {@link assertQuarantineClearedOrClear}), so a decision made against a dead
-      // generation can never delete a NEWER quarantine persisted meanwhile. Random UUID
-      // + a monotonic timestamp so two generations can never collide.
+      // A recovery may only clear the exact generation it inspected.
       generation: `${randomUUID()}.${process.hrtime.bigint().toString()}`,
     },
     null,
@@ -2247,19 +1613,8 @@ function writeQuarantineSidecar(
     }
     throw error;
   }
-  // The DIRECTORY entry (the rename above) must be durable too: without
-  // a directory fsync a crash can lose the just-renamed sidecar, leaving the retained
-  // heartbeat-less mutex stale-reclaimable under a live child. Only codes meaning "this
-  // platform/filesystem genuinely cannot fsync a directory" are ignored — enumerated:
-  //   - EISDIR / EPERM — Windows cannot open a directory with O_RDONLY at all (libuv
-  //     surfaces one of these depending on the Windows version/path kind);
-  //   - EINVAL         — fsync(2) on a directory fd is rejected by some filesystems
-  //     (certain FUSE/network mounts) and platforms;
-  //   - ENOTSUP/ENOSYS — the operation is not supported/implemented at all.
-  // EVERYTHING else (EIO, ENOSPC, EBADF, …) is a REAL durability failure: the sidecar
-  // is NOT a durable marker, so the just-renamed (non-durable) file is best-effort
-  // rolled back and the error PROPAGATES — the caller keeps the lock fully tracked and
-  // the retention watchdog retries the persistence.
+  // Fsync the directory so the rename survives a crash. Errors that mean "directory fsync is
+  // unsupported here" (Windows, some mounts) are ignored; any other error rolls back and throws.
   const dirOpen = dirDurability?.openSync ?? openSync;
   const dirFsync = dirDurability?.fsyncSync ?? fsyncSync;
   const dirClose = dirDurability?.closeSync ?? closeSync;
@@ -2276,9 +1631,7 @@ function writeQuarantineSidecar(
       try {
         unlinkSync(sidecarPath);
       } catch {
-        // Best-effort rollback of the non-durable file — the propagated error below is
-        // the real signal either way (a leftover sidecar is conservative: it makes the
-        // gate fail closed until its recorded pid is probed).
+        // Best-effort rollback; a leftover sidecar only makes the gate stricter.
       }
       throw error;
     }
@@ -2300,33 +1653,11 @@ function readPositiveInt(value: unknown): number | undefined {
 }
 
 /**
- * The quarantine acquisition GATE. Every provision acquires its mutex
- * through {@link acquireProvisionLock} (the single choke point — grep-proven: no other
- * code calls `lockfile.lock`), and this gate runs BEFORE proper-lockfile is even
- * consulted, so a QUARANTINED mutex can never be stolen by the mtime-stale path while
- * the recorded wrangler process group may still be alive:
- *   - no sidecar → nothing quarantined → proceed to normal acquisition;
- *   - sidecar present → probe the recorded group (`kill(-pgid, 0)`; the plain pid where
- *     no group exists): ESRCH (confirmed dead) → clear the sidecar and proceed; still
- *     alive OR the probe fails (EPERM, no recorded pid, unreadable sidecar) → FAIL
- *     CLOSED with the recorded metadata + manual-recovery guidance. PID reuse can make
- *     a dead group probe "alive" — that keeps failing closed (the safe direction; the
- *     guidance covers manual clearance).
- * Clearing touches ONLY the sidecar (unlink, ENOENT-tolerant — concurrent clearers are
- * fine). The retained mutex DIRECTORY is deliberately NOT removed by hand: its
- * heartbeat stopped at quarantine, so proper-lockfile's own stale lifecycle reclaims it
- * during the acquisition below — a manual rmdir here could race a concurrent acquirer's
- * fresh mutex (remove-then-acquire is not atomic across processes) and let two
- * provisions hold the lock at once.
- *
- * This gate now ALWAYS runs under the RECOVERY mutex (see
- * {@link acquireProvisionLock}), so its read IS the re-read-under-the-mutex every
- * recoverer must base its decision on, and a clear may only remove the exact sidecar
- * GENERATION it just inspected: the sidecar is re-read immediately before the unlink
- * and the decision fails closed if the generation changed (a newer quarantine was
- * persisted by the current main-mutex holder — whose quarantine writes are the one
- * interleaving the recovery mutex cannot serialize — while this decision was pending).
- * `onBeforeClear` is a test seam injecting exactly that interleaving deterministically.
+ * Quarantine gate, run under the recovery mutex before each lock attempt. With a sidecar
+ * present, the recorded group is probed: confirmed dead clears the sidecar, alive or unknown
+ * fails closed. Only the sidecar generation that was inspected is cleared; the mutex directory
+ * is left for proper-lockfile's stale handling, since removing it by hand could race another
+ * acquirer.
  */
 function assertQuarantineClearedOrClear(lockTarget: string, onBeforeClear?: () => void): void {
   const sidecarPath = quarantineSidecarPath(lockTarget);
@@ -2345,12 +1676,8 @@ function assertQuarantineClearedOrClear(lockTarget: string, onBeforeClear?: () =
   const reason = typeof recorded?.reason === 'string' ? recorded.reason : undefined;
   const quarantinedAt =
     typeof recorded?.quarantinedAt === 'string' ? recorded.quarantinedAt : undefined;
-  // Prefer the recorded GROUP (negative-pid probe); fall back to the plain pid where no
-  // group was recorded (Windows). No probe target at all → cannot verify → fail closed.
-  // A NEGATIVE target is POSIX-ONLY: on win32 `process.kill(-n, 0)` resolves to
-  // OpenProcess((DWORD)-n), which fails with ERROR_INVALID_PARAMETER and surfaces as ESRCH —
-  // i.e. it would report ANY recorded owner "confirmed dead" and clear a LIVE quarantine,
-  // inverting this gate from fail-closed to fail-open. Mirrors the watchdog's guard above.
+  // Probe the group (negative pid) on POSIX only: on win32 a negative pid reports ESRCH for
+  // any process, which would clear a live quarantine.
   const probeTarget = pgid !== undefined && process.platform !== 'win32' ? -pgid : (pid ?? pgid);
   let confirmedDead = false;
   if (probeTarget !== undefined) {
@@ -2378,13 +1705,8 @@ function assertQuarantineClearedOrClear(lockTarget: string, onBeforeClear?: () =
         `"${lockTarget}.lock" directory manually, then retry.`,
     );
   }
-  // Confirmed dead → clear the sidecar ONLY (see the doc comment: the retained mutex
-  // directory is reclaimed by proper-lockfile's stale lifecycle, never by hand).
-  //
-  // Generation-verified: RE-READ the sidecar and remove it ONLY if it
-  // still carries the exact generation this decision inspected. A holder quarantining
-  // (the one write the recovery mutex cannot serialize) between the read above and this
-  // unlink would otherwise have its NEWER sidecar deleted by this now-stale decision.
+  // Clear only if the sidecar still has the generation inspected above: the current lock
+  // holder may have written a newer one meanwhile.
   const inspectedGeneration =
     typeof recorded?.generation === 'string' ? recorded.generation : undefined;
   onBeforeClear?.();
@@ -2420,12 +1742,8 @@ function assertQuarantineClearedOrClear(lockTarget: string, onBeforeClear?: () =
 }
 
 /**
- * `proper-lockfile`'s INTERNAL lock registry, used ONLY by {@link ProvisionLock.quarantine}
- * to detach a retained lock from the library's exit sweep (`onExit` → `rmdirSync` of every
- * tracked mutex) and stop its mtime-refresh heartbeat. `getLocks` is exported by
- * `proper-lockfile/lib/lockfile.js` (not re-exported from the package root). Loaded lazily
- * and defensively: if a future proper-lockfile reshapes its internals, quarantine degrades
- * to "retained until process exit" instead of crashing.
+ * proper-lockfile's internal registry, used only to detach a quarantined lock from its exit
+ * sweep and heartbeat. If the internals change, quarantine degrades to "retained until exit".
  */
 type ProperLockfileInternals = {
   getLocks?: () => Record<
@@ -2444,58 +1762,31 @@ function loadProperLockfileInternals(): ProperLockfileInternals | undefined {
   }
 }
 
-/**
- * `realpathSync` is `node:fs`, so it returns a NATIVE path — backslashes on Windows —
- * while every other path in this module comes from `pathslash` and is POSIX-normalized,
- * including the not-yet-created branch below (whose `join()` already normalizes). Without
- * this, `canonicalizeConfigPath` hands back TWO different spellings of the same file
- * depending only on whether it happens to exist yet, defeating the "ONE identity" contract
- * the function exists to provide — and splitting the lock identity, the wrangler `-c` argv,
- * and the paths printed in error messages. No-op off Windows, where `\` is a legal filename
- * character that must survive byte-for-byte.
- */
+/** `realpathSync` returns backslashes on Windows; normalize so one file has one spelling. */
 function toPosixConfigPath(nativePath: string): string {
   return process.platform === 'win32' ? normalize(nativePath) : nativePath;
 }
 
 /**
- * Canonicalize an already-absolute config path via `realpath` so the lock identity
- * and every read/write/`-c` key on the REAL file, not a lexical symlink alias. When the
- * config file EXISTS, its own realpath is returned (a symlink resolves to its target).
- * When it does NOT yet exist, `realpath` would throw (ENOENT), so we canonicalize the
- * PARENT directory (which normally exists — the project root) and rejoin the basename, so
- * two aliases to the same not-yet-created config still resolve to one identity. If neither
- * the file nor its parent can be canonicalized, the lexical path is returned unchanged (no
- * worse than before, and the common case — an existing project dir — is always canonical).
+ * Canonical config path, so symlink aliases share one lock identity. A dangling symlink is
+ * followed; a missing file canonicalizes its parent directory instead.
  */
 function canonicalizeConfigPath(absoluteConfigPath: string, depth = 0): string {
   try {
     return toPosixConfigPath(realpathSync(absoluteConfigPath));
   } catch (error) {
-    // ONLY ENOENT (a path component does not exist yet) is the benign "not created yet" case
-    // we handle below. Any OTHER realpath error (EACCES, ELOOP for a real symlink cycle,
-    // ENOTDIR) means the path is genuinely unresolvable — RETHROW so it is never swallowed
-    // into a bogus lexical fallback that both aliases and the target could disagree on.
+    // Only ENOENT means "not created yet"; other errors are real.
     if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
       throw error;
     }
   }
-  // ENOENT: the FINAL path component may itself be a DANGLING SYMLINK — it exists as a link,
-  // but its target does not exist YET (a not-yet-created config). If so, resolve the link to
-  // its intended target and canonicalize THAT, so an alias and its target share ONE lock
-  // identity (both writes hit the same real file). `lstatSync` does NOT follow the link, so it
-  // reports the link itself.
   let linkStat: ReturnType<typeof lstatSync> | undefined;
   try {
     linkStat = lstatSync(absoluteConfigPath);
   } catch {
-    // The final component is genuinely absent (not even a link) — fall through to the
-    // parent-dir fallback below.
     linkStat = undefined;
   }
   if (linkStat?.isSymbolicLink()) {
-    // Bound the walk so a pathological chain of dangling links (that `realpathSync` did not
-    // already reject as ELOOP) cannot recurse forever — surface it as an ELOOP instead.
     if (depth >= 40) {
       throw Object.assign(
         new Error(`ELOOP: too many symbolic links while resolving "${absoluteConfigPath}"`),
@@ -2505,9 +1796,6 @@ function canonicalizeConfigPath(absoluteConfigPath: string, depth = 0): string {
     const target = readlinkSync(absoluteConfigPath);
     return canonicalizeConfigPath(resolve(dirname(absoluteConfigPath), target), depth + 1);
   }
-  // Genuinely absent, NON-symlink file — canonicalize the PARENT dir (normally the project
-  // root, which exists) + rejoin the real basename, so two lexical aliases to the same
-  // not-yet-created config still resolve to one identity.
   const dir = dirname(absoluteConfigPath);
   try {
     return join(realpathSync(dir), basename(absoluteConfigPath));
@@ -2519,29 +1807,15 @@ function canonicalizeConfigPath(absoluteConfigPath: string, depth = 0): string {
   }
 }
 
-/**
- * Overridable `proper-lockfile` knobs — production uses the module defaults; unit tests
- * pass a SHORT `stale`/`update` (to exercise heartbeat freshness under a slow call) or a
- * failing `fs` (to exercise a leaked-mutex unlock failure). `fs` is `proper-lockfile`'s
- * callback-style filesystem seam (mkdir/stat/utimes/rmdir/realpath).
- */
+/** proper-lockfile overrides for tests; production uses the defaults. */
 export interface ProvisionLockOptions {
   stale?: number;
   update?: number;
   retries?: number | { retries: number; factor?: number; minTimeout?: number; maxTimeout?: number };
   fs?: unknown;
-  /**
-   * Test seam — runs between a confirmed-dead recovery decision and its
-   * generation-verified sidecar clear, so a test can deterministically inject the ONE
-   * interleaving the recovery mutex cannot serialize (the current main-mutex holder
-   * persisting a NEWER quarantine generation). Never set in production.
-   */
+  /** Test seam: runs between a recovery decision and its sidecar clear. */
   onBeforeQuarantineClear?: () => void;
-  /**
-   * Test seam — overrides the fs functions used for the quarantine
-   * sidecar's DIRECTORY fsync, so a test can inject ENOSPC/EINVAL and exercise the
-   * durability classification. Never set in production.
-   */
+  /** Test seam for the sidecar directory fsync. */
   dirDurability?: {
     openSync?: typeof openSync;
     fsyncSync?: typeof fsyncSync;
@@ -2550,46 +1824,19 @@ export interface ProvisionLockOptions {
 }
 
 /**
- * A lock whose owner has not refreshed it within this window is treated as abandoned
- * (crashed) and may be compromised/stolen, so a crashed provision cannot wedge every
- * future one. A LIVE owner refreshes the mutex mtime every {@link LOCK_UPDATE_MS}
- * (strictly less than this), so it never expires by age. Generous vs. a real
- * provision's duration.
- *
- * CORRECTNESS — this heartbeat is a `setTimeout` on the Node event loop, so it only
- * fires while the loop is FREE. The default runner is ASYNC (`spawn`, awaited), so no
- * wrangler call blocks the loop; between/`during` every `await` the pending update timer
- * runs and refreshes the mtime. Fast synchronous bookkeeping (JSON parse, small config
- * reads) is « `LOCK_UPDATE_MS`, so the mtime is continuously refreshed and NO other
- * process ever sees this lock stale → it can never be stolen while we hold it. (The old
- * blocking `spawnSync` could freeze the loop past `LOCK_STALE_MS`, starving the
- * heartbeat AND `onCompromised`, which is exactly the race this closes.)
+ * A lock not refreshed for this long counts as abandoned. A live owner refreshes it every
+ * {@link LOCK_UPDATE_MS}; this needs a free event loop, which is why the runner is async.
  */
 const LOCK_STALE_MS = 120_000;
 /** Refresh interval keeping a live owner's lock fresh (must be < {@link LOCK_STALE_MS}). */
 const LOCK_UPDATE_MS = 20_000;
-/**
- * Backoff budget while waiting for a held (non-stale) lock. Polls with jittered backoff
- * for roughly a minute before giving up, so a concurrent provision blocks (not spins)
- * until the holder releases, then proceeds.
- */
+/** Backoff while waiting for a held lock (about a minute). */
 const LOCK_RETRIES = { retries: 100, factor: 1.5, minTimeout: 200, maxTimeout: 2_000 } as const;
 
-/**
- * The stale window of the RECOVERY mutex (the small proper-lockfile
- * lock serializing every gate→probe→clear→acquire→revalidate decision — see
- * {@link acquireProvisionLock}). Deliberately SHORT: its critical section is a few
- * synchronous fs reads plus one mkdir, so a crashed recoverer frees it within seconds
- * (proper-lockfile's own heartbeat keeps a live recoverer's window fresh).
- */
+/** Stale window of the short-lived recovery mutex. */
 const RECOVERY_LOCK_STALE_MS = 6_000;
 
-/**
- * Normalize the `retries` knob into the ONE backoff schedule OUR
- * acquisition loop runs (proper-lockfile's internal retrying is disabled with
- * `retries: 0` so the quarantine gate runs on EVERY attempt — see
- * {@link acquireProvisionLock}). A bare number keeps {@link LOCK_RETRIES}' backoff shape.
- */
+/** Backoff schedule for our own retry loop (proper-lockfile runs with `retries: 0`). */
 function normalizeLockRetries(retries: ProvisionLockOptions['retries']): {
   retries: number;
   factor: number;
@@ -2607,13 +1854,7 @@ function normalizeLockRetries(retries: ProvisionLockOptions['retries']): {
   };
 }
 
-/**
- * Match the key spelling `proper-lockfile` stores when `realpath: false`.
- *
- * The library uses the host's native `node:path.resolve`, including backslashes on
- * Windows. Most Void paths intentionally use `pathslash`, but its forward-slash output
- * cannot address `proper-lockfile`'s internal registry on Windows.
- */
+/** The registry key proper-lockfile uses with `realpath: false` (native separators). */
 export function resolveProperLockfileKey(
   file: string,
   platform: NodeJS.Platform = process.platform,
@@ -2622,41 +1863,13 @@ export function resolveProperLockfileKey(
 }
 
 /**
- * Acquire the cross-process provision lock over the resolved config path via
- * `proper-lockfile` (an atomic `mkdir`-based mutex at `<configPath>.void-provision.lock.lock`).
- * The library normally realpaths the pathname being locked, which requires it to exist.
- * Both lock identities here are deliberately SYNTHETIC adjacent paths, so acquisition
- * passes `realpath: false`: proper-lockfile resolves the identity lexically and creates
- * only its temporary mutex directory — never an empty marker file in the user's project.
- * This is safe because the config path was already canonicalized (including missing-file
- * and symlink cases) before reaching this function. It also preserves the writer's
- * missing-vs-empty config semantics. Returns a handle whose `release()` drops the mutex;
- * ALWAYS call it in a `finally` so an interruption never leaks the lock.
- *
- * `onCompromised` FAILS CLOSED (re-throws): if the lock is ever detected stolen (its
- * mtime changed, or the mutex vanished under a live owner), provisioning must NEVER
- * continue — a compromised lock means another process may be racing the same config.
+ * Acquire the provision lock (`<configPath>.void-provision.lock.lock`). The lock targets are
+ * synthetic paths, so `realpath: false` avoids creating marker files; the config path is
+ * already canonical. A compromised lock throws.
  *
- * Acquisition is ONE atomic recovery protocol, applied on EVERY
- * attempt: quarantine GATE → single non-retrying proper-lockfile acquisition →
- * REVALIDATE the gate under ownership → clear-or-abort. Retrying is owned by THIS
- * function (proper-lockfile runs with `retries: 0`), so a waiter that entered while the
- * holder was healthy re-runs the gate on every backoff attempt and can never stale-take
- * a mutex whose holder QUARANTINED mid-wait; the post-acquire revalidation catches a
- * sidecar that appeared between the last gate and the acquisition itself (the fresh
- * lock is released and the acquisition fails closed).
- *
- * The ENTIRE per-attempt protocol runs under a second small
- * proper-lockfile RECOVERY mutex (`<lockTarget>.recovery`, `retries: 0`, short stale):
- * without it, two recoverers could interleave ACROSS processes — B reads a dead sidecar
- * S0, gets descheduled; A clears S0, acquires the main mutex, quarantines again writing
- * a LIVE sidecar S1; B resumes and unlinks the PATHNAME (now S1) on its stale decision,
- * then stale-reclaims A's retained mutex (the revalidation sees no sidecar). Under the
- * recovery mutex every decision re-reads the sidecar after acquiring it, and the clear
- * is additionally GENERATION-verified (see {@link assertQuarantineClearedOrClear}) for
- * the one interleaving the recovery mutex cannot serialize (the current MAIN-mutex
- * holder quarantining mid-decision). The recovery mutex deliberately does NOT take the
- * caller's `fs` seam — that seam simulates main-mutex failures.
+ * Each attempt runs under a short recovery mutex: quarantine gate, one non-retrying
+ * acquisition, then the gate again under ownership. This loop owns retries, so the gate runs
+ * on every attempt and a quarantined lock is never taken over by age.
  */
 export async function acquireProvisionLock(
   configPath: string,
@@ -2675,51 +1888,30 @@ export async function acquireProvisionLock(
         Math.min(retryCfg.minTimeout * retryCfg.factor ** attempt, retryCfg.maxTimeout),
       ),
     );
-  // One NON-retrying proper-lockfile acquisition (it still performs the library's own
-  // internal stale-reclaim of an abandoned mutex within the single attempt).
   const acquireOnce = (): ReturnType<typeof lockfile.lock> =>
     lockfile.lock(lockTarget, {
       stale: staleMs,
       update: lockOptions?.update ?? LOCK_UPDATE_MS,
       retries: 0,
-      // `lockTarget` is a synthetic identity derived from an already-canonical config
-      // path. Do not require/create an on-disk marker merely so it can be realpathed.
       realpath: false,
-      // `proper-lockfile`'s callback-style fs seam — overridable so a test can force an
-      // unlock failure. Production uses the library default (graceful-fs).
       ...(lockOptions?.fs !== undefined ? { fs: lockOptions.fs as never } : {}),
       onCompromised: (error) => {
         throw error;
       },
     });
-  // One non-retrying RECOVERY-mutex acquisition (retrying is owned by
-  // the loop below, so contention on a recovery decision backs off like a held main
-  // mutex). Always the default fs — never the caller's failure-injection seam.
+  // The recovery mutex always uses the default fs, never the test seam.
   const acquireRecoveryOnce = (): ReturnType<typeof lockfile.lock> =>
     lockfile.lock(recoveryTarget, {
       stale: RECOVERY_LOCK_STALE_MS,
       retries: 0,
-      // Same synthetic-identity contract as the main mutex above. Distinct config paths
-      // remain distinct, so different apps can provision concurrently on one machine.
       realpath: false,
       onCompromised: (error) => {
         throw error;
       },
     });
-  // ONE atomic recovery protocol: gate → acquire → revalidate →
-  // clear-or-abort, on EVERY attempt — and every attempt's WHOLE protocol
-  // runs under the recovery mutex. This function is the single acquisition choke point
-  // for every provision (grep-proven: no other code calls `lockfile.lock`), and
-  // proper-lockfile's INTERNAL retrying is disabled (`retries: 0` above) in favor of
-  // OUR loop, because the previous code gated on the quarantine sidecar ONCE before the
-  // library's retry loop: a contender could pass that gate while the holder was still
-  // healthy, keep retrying while the holder QUARANTINED (sidecar written, heartbeat
-  // detached), then stale-take the retained mutex without ever seeing the sidecar —
-  // acquiring the lock while the recorded wrangler group was alive.
   let release: Awaited<ReturnType<typeof lockfile.lock>> | undefined;
   for (let attempt = 0; ; attempt++) {
-    // (0) the RECOVERY mutex, serializing this whole attempt's decision across
-    // processes. Held by another recoverer → back off and re-run the WHOLE protocol.
+    // (0) Recovery mutex; back off while another process holds it.
     let releaseRecovery: Awaited<ReturnType<typeof lockfile.lock>>;
     try {
       releaseRecovery = await acquireRecoveryOnce();
@@ -2732,11 +1924,9 @@ export async function acquireProvisionLock(
     }
     let mainHeldByOther = false;
     try {
-      // (1) the GATE, on every attempt UNDER the recovery mutex (this read is the
-      // re-read every recoverer's decision must be based on): fail closed while a
-      // recorded group may live; generation-verified clear once it is confirmed dead.
+      // (1) Quarantine gate.
       assertQuarantineClearedOrClear(lockTarget, lockOptions?.onBeforeQuarantineClear);
-      // (2) one acquisition attempt; a held (non-stale) mutex backs off and loops.
+      // (2) One acquisition attempt; a held mutex backs off and loops.
       try {
         release = await acquireOnce();
       } catch (error) {
@@ -2747,13 +1937,8 @@ export async function acquireProvisionLock(
         }
       }
       if (!mainHeldByOther) {
-        // (3) REVALIDATE under ownership, before the provision body may run: the one
-        // writer the recovery mutex cannot serialize — the PREVIOUS main-mutex holder
-        // quarantining — can have persisted a sidecar between this attempt's gate and
-        // the acquisition (its retained mutex going mtime-stale and being reclaimed by
-        // the very `acquireOnce` above). A recorded group that is alive/unprobeable →
-        // release the fresh mutex + fail closed; a dead group → the gate cleared the
-        // sidecar → ownership is valid.
+        // (3) Revalidate under ownership: the previous holder may have quarantined after
+        // the gate ran.
         try {
           assertQuarantineClearedOrClear(lockTarget, lockOptions?.onBeforeQuarantineClear);
         } catch (gateError) {
@@ -2781,9 +1966,7 @@ export async function acquireProvisionLock(
       try {
         await releaseRecovery();
       } catch {
-        // The recovery mutex has a SHORT stale window (seconds), so a failed rmdir
-        // self-heals promptly and must never fail an otherwise-valid acquisition (or
-        // mask the real error propagating out of the protocol above).
+        // The recovery mutex goes stale within seconds; never fail on its release.
       }
     }
     if (!mainHeldByOther) {
@@ -2791,21 +1974,8 @@ export async function acquireProvisionLock(
     }
     await backoffDelay(attempt);
   }
-  // Cache ONE shared release promise so a double-release is idempotent (the SAME
-  // settled promise is returned, never a second `proper-lockfile` unlock), and PROPAGATE
-  // a genuine unlock failure instead of swallowing it. `proper-lockfile` drops its own
-  // ownership state (`released = true`, `delete locks[file]`) BEFORE it rmdir's the mutex
-  // dir, so an EACCES/EBUSY/I/O rmdir failure leaves the `.lock` directory on disk — a
-  // LEAKED cross-process mutex that blocks future provisions until it goes stale — while
-  // the old code resolved "released" and reported the provision a success. We now surface
-  // it: the caller fails the provision. (Because that same drop-before-rmdir ordering
-  // makes `proper-lockfile`'s own release non-retryable — a second call returns
-  // `ERELEASED` without re-attempting the rmdir — we do NOT retry via a manual dir sweep,
-  // which could race a successor; the leaked mutex self-heals for future runs after the
-  // stale window.) An `ERELEASED` error means the lock was ALREADY dropped (e.g. by an
-  // `onCompromised` sweep, whose re-throw is the authority) — not a leak we caused — so
-  // it is treated as success.
-  // The loop above only breaks after a successful acquisition + revalidation.
+  // One shared release promise. A real unlock failure is surfaced, because the mutex
+  // directory may remain; ERELEASED means it was already dropped and counts as success.
   const acquiredRelease = release!;
   let releasePromise: Promise<void> | undefined;
   const doRelease = async (): Promise<void> => {
@@ -2826,30 +1996,14 @@ export async function acquireProvisionLock(
   return {
     lockTargetPath: lockTarget,
     release: () => (releasePromise ??= doRelease()),
-    // Quarantine: detach this lock from proper-lockfile's internal
-    // tracking WITHOUT removing the on-disk mutex directory, so:
-    //   1. the library's signal-exit sweep (which rmdirSync's every tracked lock on
-    //      process exit) no longer removes it — the retained mutex OUTLIVES this process
-    //      and keeps blocking concurrent provisions while the unconfirmed child may live;
-    //   2. the mtime heartbeat stops; the sidecar below then guards the
-    //      retained mutex — the acquisition gate probes the recorded group and fails
-    //      closed while it may live, and clears the quarantine once it is confirmed
-    //      dead (so a permanent wedge is impossible, but mere age no longer suffices);
-    //   3. any late release() gets ERELEASED (untracked) → treated as success, never an
-    //      rmdir of the retained directory.
-    // Prevent a compromise-callback race too: mark it released before detaching.
+    // Detach the lock from proper-lockfile's tracking but keep the mutex directory, so the
+    // exit sweep leaves it and the heartbeat stops; the sidecar then guards it.
     quarantine: (info: QuarantineInfo) => {
       // A no-op after a successful release (nothing to retain).
       if (releasePromise !== undefined) {
         return;
       }
-      // DURABLE sidecar persistence is a PRECONDITION for everything
-      // below: the detach stops the mtime heartbeat, so a mutex retained WITHOUT a
-      // durable sidecar has nothing for the acquisition gate to gate on — it goes
-      // mtime-stale and is stolen while the unconfirmed child may live (the previous
-      // code warned and detached anyway — fail open). On persistence failure the lock
-      // stays fully TRACKED (heartbeat running, release() functional, NOT stealable)
-      // and this throws the hard error below; a later quarantine() call retries.
+      // The sidecar must be durable before detaching; otherwise the lock stays tracked.
       try {
         writeQuarantineSidecar(quarantineSidecarPath(lockTarget), info, lockOptions?.dirDurability);
       } catch (error) {
@@ -2872,12 +2026,12 @@ export async function acquireProvisionLock(
       if (!locks) {
         return; // degraded: retained only until process exit (internals unavailable)
       }
-      // With `realpath: false`, proper-lockfile keys its registry using node:path.resolve.
-      // Use that same NATIVE spelling here (not pathslash's POSIX spelling) so quarantine
-      // detaches correctly on Windows too.
+      // Use the native key spelling proper-lockfile stores.
       const key = resolveProperLockfileKey(lockTarget);
       const tracked = locks[key];
       if (tracked) {
+        // Mark it released first: an in-flight heartbeat callback then skips it instead of
+        // reporting the retained lock as compromised (our onCompromised throws).
         tracked.released = true;
         if (tracked.updateTimeout !== undefined) {
           clearTimeout(tracked.updateTimeout);
@@ -2888,30 +2042,7 @@ export async function acquireProvisionLock(
   };
 }
 
-/**
- * Parse a wrangler `--json` stdout into an array, distinguishing a VALID JSON
- * array (returns it, possibly empty) from unparseable/non-array output (returns
- * `undefined`). Members are returned UNFILTERED — a malformed member (e.g. a
- * `null`) is preserved, NOT silently dropped, so {@link validateResourceList}
- * can fail closed on it (a dropped malformed member could BE the target and look
- * like "absent", minting a duplicate). Used everywhere an empty list must mean
- * "authoritatively absent" and garbage must NOT be coerced to "absent".
- */
-function parseJsonArrayStrict(value: unknown): Array<unknown> | undefined {
-  return Array.isArray(value) ? value : undefined;
-}
-function parseJsonObject(value: unknown): Record<string, unknown> | undefined {
-  return isRecord(value) ? value : undefined;
-}
-
-/**
- * Read the single provisioned binding entry for `field`/`binding` from the resolved
- * config, delegating to the STRICT canonical reader in `wrangler.ts`
- * ({@link readProvisionedBindingEntry}). Unlike the old loose first-match `.find()`, this
- * validates the target field's outer shape, fails closed on a DUPLICATE binding, and runs
- * the worker-wide CROSS-TYPE collision check — so a
- * duplicate/collision config can never be reported `reused` or pass a create postcondition.
- */
+/** One binding entry, via the strict reader that fails on duplicate or colliding bindings. */
 function readBindingEntry(
   configPath: string,
   field: string,
@@ -2921,12 +2052,8 @@ function readBindingEntry(
 }
 
 /**
- * Read + parse the root wrangler config (fresh each call — wrangler mutates it).
- * BOM-aware (wrangler + `writeProvisionedWranglerConfig` strip a leading BOM before
- * parsing, so we must too, else a BOM-prefixed config would look unparseable). FAILS CLOSED
- * on a genuine parse error or a non-object root: never silently treat a real
- * config as `{}`, which would miss existing ids (re-provision/orphan) and mask a
- * corrupt file. A missing file is fine (nothing to read-first → `{}`).
+ * Read the root config fresh (wrangler edits it), without a BOM. A parse error or a non-object
+ * fails; a missing file reads as `{}`.
  */
 function readRootConfig(configPath: string): Record<string, unknown> {
   if (!existsSync(configPath)) {
@@ -2947,26 +2074,7 @@ function readRootConfig(configPath: string): Record<string, unknown> {
   return parsed;
 }
 
-// --- Shared fail-closed discovery gates (one place per class of check) --------
-// The three helpers below are the SINGLE decision points every resource path
-// routes through, so no sibling path can drift into a per-path bug again:
-//   1. assertDiscoverySucceeded — a discovery/list/info result is only trusted
-//      when it exited cleanly (numeric status 0). Called BEFORE inspecting data.
-//   2. validateResourceList     — a structured list is rejected WHOLE if ANY member
-//      is malformed (never silently filtered — a malformed member could BE the
-//      target and look "absent", minting a duplicate).
-//   3. isConfirmedAbsent        — a NON-zero `<res> info`-by-name probe means
-//      "absent" (→ create) ONLY on the structured provider not-found classification;
-//      a signal/spawn failure or any other nonzero is NEVER absence.
-
-/**
- * FAIL-CLOSED gate over a discovery/list/info result. Throws (no create) unless
- * the child exited cleanly — a NUMERIC `status === 0`. Because
- * {@link normalizeRunWranglerResult} already folds a signal-killed child or a
- * spawn error into a non-zero status, a single numeric check here rejects ALL of
- * nonzero-exit / SIGTERM / spawn-error / non-numeric status. MUST be called
- * BEFORE reading provider data, so failed discovery never implies absence.
- */
+/** Throw unless a discovery call exited cleanly, so a failed list never means "absent". */
 function assertDiscoverySucceeded(result: RunWranglerResult, label: string): void {
   if (!isCleanSuccess(result)) {
     throw new Error(
@@ -2983,16 +2091,7 @@ interface ResourceListSpec {
   resource: string;
   /** Command name for messages, e.g. `wrangler kv namespace list`. */
   command: string;
-  /**
-   * The resource-SPECIFIC member-identity validator, run over EVERY member
-   * inside the whole-list gate BEFORE any name filtering: KV requires a real 32-hex
-   * `id`; D1 requires its TWO id aliases to RECONCILE ({@link reconcileD1IdAliases} —
-   * every present alias a well-formed UUID, all agreeing on one id). A member whose
-   * identity is merely non-empty but MALFORMED (`" "`, `"bogus"`, a `local`
-   * placeholder) — or whose secondary alias conflicts — no longer passes: the list is
-   * untrustworthy, so we reject it WHOLE and fail closed rather than skip that member
-   * and mistake the target for absent (which would mint a duplicate).
-   */
+  /** Identity check for every member, before name filtering. */
   hasValidId: (member: Record<string, unknown>) => boolean;
   /** Human description of the id requirement for the whole-list rejection message. */
   idRule: string;
@@ -3003,15 +2102,8 @@ interface ResourceListSpec {
 }
 
 /**
- * STRICT list validator shared by KV + D1. Rejects the ENTIRE list (throws) if ANY
- * member is not a well-formed object carrying a non-empty name AND a
- * FORMAT-VALID id (per {@link ResourceListSpec.hasValidId}). A member is NEVER
- * silently filtered, and a member with a malformed id is NEVER accepted, because
- * either could BE the requested target (or signal a corrupt list) and treating it as
- * "absent" would mint a duplicate. Validates EVERY member up front — BEFORE any
- * name-filtering by the caller — so a nonmatching member with a bogus id can no longer
- * pass the gate as authoritative absence. Returns the validated members (every one
- * guaranteed to have a real id + name) on success.
+ * Reject the whole list if any member lacks a non-empty name or a valid id. A malformed member
+ * could be the target, so it is never filtered out as "absent".
  */
 function validateResourceList(
   list: Array<unknown>,
@@ -3027,7 +2119,6 @@ function validateResourceList(
     }
     const rawName = member[spec.nameField];
     const nameValid = typeof rawName === 'string' && rawName.length > 0;
-    // A REAL, RECONCILED identity — not merely one non-empty alias.
     const idValid = spec.hasValidId(member);
     if (nameValid && !idValid) {
       throw new Error(
@@ -3047,25 +2138,12 @@ function validateResourceList(
   return validated;
 }
 
-/**
- * The one D1 identity outcome, so a caller can distinguish "not the requested
- * database" (skip → maybe create) from "IS the requested database but ambiguous"
- * (fail closed → never adopt, never mistake for absent).
- */
+/** D1 identity outcome: the requested database, another one, or an ambiguous claim. */
 type D1Match = { kind: 'match'; id: string } | { kind: 'claimed-but-invalid' } | { kind: 'other' };
 
 /**
- * THE one D1 id-alias reconciler, shared by the WHOLE-LIST gate (every
- * `d1 list` member, BEFORE any name filtering) and {@link normalizeD1} (the requested
- * database's identity). D1 carries TWO id aliases (`database_id`, `uuid`); `undefined`
- * or an EMPTY STRING means "not provided" (wrangler omits/blanks the secondary alias).
- * The reconciled id exists ONLY when at least one alias is present, EVERY present alias
- * is a well-formed real D1 UUID, and ALL present aliases agree on one id. Anything
- * else — a non-string alias, a malformed value (`"bogus"`), or two disagreeing UUIDs —
- * is `invalid`: the entry's identity cannot be trusted. The old gate accepted a member
- * when ANY ONE alias validated, so `{ name: "other-db", uuid: <valid>,
- * database_id: "bogus" }` passed the whole-list gate and authorized authoritative
- * absence for the target — a corrupt list minting a duplicate.
+ * Reconcile D1's two id aliases (`database_id`, `uuid`; empty means absent). Valid only when
+ * every present alias is a real D1 UUID and all agree.
  */
 type D1ReconciledId = { kind: 'id'; id: string } | { kind: 'absent' } | { kind: 'invalid' };
 
@@ -3090,25 +2168,9 @@ function reconcileD1IdAliases(entry: Record<string, unknown>): D1ReconciledId {
 }
 
 /**
- * THE single strict D1 identity normalizer, shared by `d1 list --json` and
- * `d1 info <name> --json`. It reconciles the TWO name aliases (`name`,
- * `database_name`) and TWO id aliases (`database_id`, `uuid`) — an EMPTY STRING is
- * treated as ABSENT for each — and returns a usable id ONLY when the entry
- * unambiguously IS the requested database:
- *   - `{ kind: 'other' }` — no non-empty name alias equals `requestedName`, so this
- *     entry is a different database (the caller skips it, never mistakes it for the
- *     target, and never adopts it under a normalization of a DIFFERENT name);
- *   - `{ kind: 'claimed-but-invalid' }` — a name alias DOES equal `requestedName`
- *     but the entry is ambiguous: CONFLICTING non-empty name aliases (e.g.
- *     `name:"wanted"` + `database_name:"other"`), OR not EXACTLY ONE distinct
- *     non-empty id (0 → no id; >1 → conflicting/blank uuid vs database_id). The
- *     caller fails closed (never adopt, never create a duplicate);
- *   - `{ kind: 'match', id }` — exactly one requested-name alias and exactly one
- *     unambiguous non-empty id.
- * The old two-helper split (`normalizeD1Identity` preferring `database_name`,
- * `d1EntryName` preferring `name`) let a `{name,database_name}` mismatch be
- * SELECTED under one alias yet KEYED under the other. This collapses both into one
- * exact-match rule so no sibling gap remains.
+ * Strict D1 identity check shared by `d1 list` and `d1 info`. `other` when no name alias
+ * (`name`, `database_name`) equals `requestedName`; `claimed-but-invalid` when one does but the
+ * name or id aliases conflict; otherwise `match`.
  */
 function normalizeD1(entry: Record<string, unknown> | undefined, requestedName: string): D1Match {
   if (entry === undefined) {
@@ -3117,18 +2179,12 @@ function normalizeD1(entry: Record<string, unknown> | undefined, requestedName:
   const names = [entry.name, entry.database_name].filter(
     (value): value is string => typeof value === 'string' && value.length > 0,
   );
-  // Not the requested database unless SOME non-empty alias equals it exactly.
   if (!names.includes(requestedName)) {
     return { kind: 'other' };
   }
-  // It claims the requested name — now it must be UNAMBIGUOUS to adopt.
-  // Conflicting non-empty name aliases → ambiguous identity.
   if (new Set(names).size > 1) {
     return { kind: 'claimed-but-invalid' };
   }
-  // The ONE alias reconciler: no id, ANY malformed/non-string present alias, or
-  // disagreeing aliases → ambiguous, never adoptable — fail closed rather than adopt
-  // or (worse) mistake it for absent and mint a duplicate.
   const reconciled = reconcileD1IdAliases(entry);
   if (reconciled.kind !== 'id') {
     return { kind: 'claimed-but-invalid' };
@@ -3136,49 +2192,14 @@ function normalizeD1(entry: Record<string, unknown> | undefined, requestedName:
   return { kind: 'match', id: reconciled.id };
 }
 
-/**
- * `wrangler kv namespace list` → the `{ id }` of every namespace whose title
- * matches. The list has ALREADY been through {@link validateResourceList} (every
- * member has a non-empty string `id` + `title`), so this only filters + collects.
- *
- * A title-matching namespace whose `id` is NOT a real KV id (32-hex) is ambiguous:
- * we can neither adopt it nor treat it as absent (which would mint a duplicate title), so
- * we FAIL CLOSED. Real wrangler always returns 32-hex ids; this guards a malformed seam.
- */
-function extractKvMatches(
-  list: Array<Record<string, unknown>>,
-  title: string,
-): Array<{ id: string }> {
-  const matches: Array<{ id: string }> = [];
-  for (const ns of list) {
-    if (ns.title !== title) {
-      continue;
-    }
-    if (!isRealKvId(ns.id)) {
-      throw new Error(
-        `provision: "wrangler kv namespace list" returned a namespace titled ${JSON.stringify(title)} ` +
-          `with a malformed id ${JSON.stringify(ns.id)} (expected a 32-character hex namespace id). ` +
-          `Cannot verify whether it already exists; refusing to create a possible duplicate.`,
-      );
-    }
-    matches.push({ id: ns.id });
-  }
-  return matches;
-}
-
 /** True when a `d1 create` failure means the name is already taken (code 7502). */
 function isAlreadyExistsError(result: RunWranglerResult): boolean {
   return result.errorCode === 7502;
 }
 
 /**
- * Not-found classifier shared by R2 + queues. Given an `<res> info`-by-name probe,
- * returns `true` (confirmed absent → safe to create) ONLY on a clean non-zero exit
- * with the provider's typed not-found result (R2 error code 10006; the queue
- * operation's `not-found` failure). Everything else returns `false` so the caller
- * fails closed — a signal/spawn failure, an auth/network/metrics error, or a
- * GENERIC "not found" (e.g. `Account not found`) is NEVER treated as absence,
- * which would mint a duplicate resource.
+ * True only for a completed non-zero probe with the provider's typed not-found result (R2
+ * code 10006, or the queue operation's `not-found`). Nothing else counts as absence.
  */
 function isConfirmedAbsent(result: RunWranglerResult, kind: 'r2' | 'queue'): boolean {
   return (
@@ -3188,7 +2209,7 @@ function isConfirmedAbsent(result: RunWranglerResult, kind: 'r2' | 'queue'): boo
 }
 
 /** Only a completed, typed not-found response confirms queue absence. */
-export function isQueueConfirmedAbsent(result: RunWranglerResult, _name: string): boolean {
+export function isQueueConfirmedAbsent(result: RunWranglerResult): boolean {
   return isConfirmedAbsent(result, 'queue');
 }
 
@@ -3197,13 +2218,7 @@ function queueInfoConfirmsExists(result: RunWranglerResult, name: string): boole
   return isCleanSuccess(result) && isRecord(result.data) && result.data.name === name;
 }
 
-/**
- * Throw when the writer could not attach `migrations_dir` because no matching
- * `d1_databases[]` entry exists. The provisioner only writes `migrations_dir`
- * AFTER establishing the D1 entry (create/adopt/reuse), so a skip here means the
- * D1 resource is unexpectedly absent from the config — never silently succeed
- * with the gap unfilled.
- */
+/** Throw when the writer found no D1 entry to attach `migrations_dir` to. */
 function assertD1MigrationsDirApplied(
   result: WriteProvisionedWranglerResult,
   binding: string,
@@ -3224,21 +2239,9 @@ interface CreatePostcondition {
   field: string;
   /** The member key that must hold a REAL (non-placeholder) id afterward. */
   idField: string;
-  /**
-   * Resource-SPECIFIC id-format validator (D1 UUID / KV 32-hex / R2 bucket-name /
-   * Hyperdrive 32-hex). Replaces the loose `isRealValue`, so a create that reported
-   * success but wrote a placeholder/garbage id (e.g. a signal-killed child masked as
-   * exit 0) fails closed instead of being recorded as provisioned.
-   */
+  /** Resource-specific id format check. */
   idValidator: (value: unknown) => value is string;
-  /**
-   * When set, the member key that must EXACTLY equal the requested name (the
-   * resource's IDENTITY). R2's `bucket_name` and D1's `database_name` ARE the
-   * identity, so a create that wrote a DIFFERENT resource's name (a race, a stale
-   * `--update-config`, a wrong-account write) must fail closed rather than binding the
-   * app to the wrong resource. KV/Hyperdrive config entries carry no name to
-   * cross-check, so they verify only a real id.
-   */
+  /** Field that must equal the requested name (R2 `bucket_name`, D1 `database_name`). */
   nameField?: string;
   /** Human resource name for the message. */
   resource: string;
@@ -3247,20 +2250,8 @@ interface CreatePostcondition {
 }
 
 /**
- * Backstop — verify a create's POSTCONDITION, RESOURCE-SPECIFICALLY + identity
- * checked. wrangler 4.131's `bin.wrangler` is a WRAPPER that spawns
- * `wrangler-dist/cli.js` and maps a signal-killed child (`code === null`) to
- * `process.exit(0)`, so `spawnSync` can see a `create` report "success" though the
- * real CLI was killed and `--update-config` wrote NO id. After every config-writing
- * create (d1/kv/r2/hyperdrive) reports success we RE-READ the resolved config and
- * CONFIRM the target binding now holds a REAL id AND — where the resource's name is
- * its identity (R2 `bucket_name`, D1 `database_name`) — that the recorded name EXACTLY
- * matches the requested one; otherwise we FAIL CLOSED. A bare "some non-placeholder
- * value" check is NOT enough: for R2, `bucket_name` IS the identity, so
- * `{ bucket_name: 'other' }` would otherwise pass and bind the WRONG bucket. This also
- * catches any partial/silent create failure, not only kills. (Queue creates write NO
- * config, so they cannot be verified this way — a killed queue-create self-heals on
- * the next read-first/probe run, which re-detects absence and re-creates.)
+ * After a create reports success, re-read the config and require a real id, plus the exact
+ * name where the name is the identity. A killed child can still report exit 0.
  */
 function assertCreateWroteRealId(
   configPath: string,
@@ -3283,21 +2274,10 @@ function assertCreateWroteRealId(
   }
 }
 
-// --- Option-injection guard SEPARATE from per-resource service grammar -----
-// The old single regex `^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$` was applied to EVERY
-// resource, but wrangler 4.131 forwards the KV namespace positional VERBATIM as the KV
-// TITLE, and Cloudflare permits titles like "My Own Namespace" (spaces) — so valid KV
-// namespaces were REJECTED before discovery. It was also wrong for R2 (whose real
-// grammar is lowercase DNS-like). We therefore split the two concerns:
-//   1. OPTION-INJECTION guard  — a SECURITY invariant applied to EVERY positional,
-//      identical across resources: shell-free spawning stops shell injection but NOT CLI
-//      OPTION injection, so a positional starting with `-` (`--help`, `-c`, `--config`)
-//      would be parsed by wrangler as a FLAG (a queue name is derived from a filename →
-//      attacker-influenced). We reject empty, a leading `-`, and any control char /
-//      newline (which could smuggle a token or corrupt argv).
-//   2. SERVICE grammar         — each resource's ACTUAL Cloudflare grammar (verified
-//      2026-07 against wrangler 4.107 + live resources), so a valid name is never
-//      rejected AND obvious garbage still fails before a remote call.
+// Two separate name checks:
+//   1. An option-injection guard for every argv positional: no empty value, leading `-` or
+//      control character (queue names come from filenames).
+//   2. Each resource's own Cloudflare naming grammar.
 
 /** True when `value` contains an ASCII control character (0x00–0x1F or 0x7F). */
 function hasControlChar(value: string): boolean {
@@ -3328,19 +2308,7 @@ function assertNoOptionInjection(kind: string, name: string): void {
 
 type ResourceNameKind = 'd1' | 'kvTitle' | 'r2' | 'hyperdrive' | 'queue';
 
-/**
- * Per-resource Cloudflare naming GRAMMAR, verified 2026-07 against wrangler 4.107
- * and live account resources:
- *   - `r2`      — wrangler's own `isValidR2BucketName`: 3–63 chars, lowercase letters /
- *                 digits / `-`, begin+end alphanumeric (DNS-like). This IS the identity.
- *   - `kvTitle` — the KV namespace positional is forwarded verbatim as the account TITLE;
- *                 Cloudflare allows a broad charset INCLUDING SPACES (≤512 chars). We only
- *                 forbid control chars (already covered by the injection guard) — spaces
- *                 and mixed case are legal, so "My Own Namespace" is accepted.
- *   - `d1` / `hyperdrive` / `queue` — 1–63 chars, begin with a letter/digit, then
- *                 letters / digits / `-` / `_` (matches every live D1 `name`, Hyperdrive
- *                 config `name`, and Void's `QUEUE_<NAME>`-derived queue names).
- */
+/** Per-resource Cloudflare naming grammar. KV titles may contain spaces and mixed case. */
 const RESOURCE_NAME_GRAMMARS: Record<
   ResourceNameKind,
   { re: RegExp; label: string; rule: string }
@@ -3351,8 +2319,7 @@ const RESOURCE_NAME_GRAMMARS: Record<
     rule: 'be 3–63 characters, contain only lowercase letters, digits and "-", and begin and end with a letter or digit',
   },
   kvTitle: {
-    // 1–512 chars, any non-control character (spaces allowed). The leading-"-" / control
-    // guard is enforced separately by assertNoOptionInjection.
+    // Control characters and a leading "-" are rejected by assertNoOptionInjection.
     re: /^[\s\S]{1,512}$/,
     label: 'KV namespace',
     rule: 'be 1–512 characters and contain no control characters (spaces are allowed)',
@@ -3368,26 +2335,13 @@ const RESOURCE_NAME_GRAMMARS: Record<
     rule: 'be 1–63 characters, start with a letter or digit, and contain only letters, digits, "-" or "_"',
   },
   queue: {
-    // Cloudflare Queues: 1–63 chars, letters/digits/dashes only (NO underscores),
-    // and the FIRST and LAST char must be alphanumeric (no leading/trailing dash). The
-    // leading-`-` case is also covered by the option-injection guard, kept as belt+braces.
     re: /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/,
     label: 'queue',
     rule: 'be 1–63 characters, contain only letters, digits and "-", and begin and end with a letter or digit',
   },
 };
 
-/**
- * Validate a name destined for a wrangler ARGV positional: FIRST the universal
- * option-injection guard, THEN the resource's own Cloudflare grammar. Fail closed on any
- * violation, before the account gate or any wrangler/REST call.
- *
- * Exported — like {@link isQueueConfirmedAbsent} — so the deploy orchestrator's
- * pre-provision queue probe (`cli/deploy.ts`) gates names on the SAME rules this
- * provisioner enforces. Queue names
- * are taken verbatim from filenames with no sanitization, so without this gate a name
- * beginning with `-` reaches wrangler as a FLAG rather than a positional.
- */
+/** Validate an argv positional: the option-injection guard, then the resource grammar. */
 export function assertValidResourceName(kind: ResourceNameKind, name: string): void {
   assertNoOptionInjection(RESOURCE_NAME_GRAMMARS[kind].label, name);
   const grammar = RESOURCE_NAME_GRAMMARS[kind];
@@ -3399,18 +2353,7 @@ export function assertValidResourceName(kind: ResourceNameKind, name: string): v
   }
 }
 
-/**
- * Build a redactor that strips connection-string secrets from every string the
- * provisioner PROPAGATES (buffered wrangler stdout/stderr, error strings, logged
- * warnings). Two layers:
- *   1. the EXACT desired connection string (when this provision carries one) is replaced
- *      whole, so no derived message can echo it verbatim;
- *   2. any URL userinfo password (`scheme://user:secret@…`) is masked generically, so a
- *      wrangler error that re-renders a connection string in ANY spelling still never
- *      leaks the password (the scheme + user survive for diagnostics).
- * Applied at the single runWrangler choke point (every call site reads pre-redacted
- * results) and to the Hyperdrive lister's propagated failure message.
- */
+/** Redactor that replaces the exact connection string and masks any URL userinfo password. */
 function createSecretRedactor(connectionString?: string): (text: string) => string {
   return (text) => {
     let out = text;
@@ -3422,454 +2365,21 @@ function createSecretRedactor(connectionString?: string): (text: string) => stri
   };
 }
 
-// --- THE one no-throw redaction boundary --------------------------
-// ALL classification and inspection of a seam rejection happens INSIDE the boundary
-// ({@link redactRejection}): a hostile Proxy's `instanceof`/property traps can throw an
-// error of the attacker's choosing (potentially secret-bearing), so no read of the
-// original value — not even `isQuarantineError` — may run outside it. If inspection is
-// unsafe anywhere, the boundary FAILS CLOSED AS QUARANTINE: a fresh INERT carrier
-// marked `{ quarantine: true }` propagates, so the whole-provision mutex is RETAINED
-// (conservative — the hostile value could have been hiding a real quarantine) and no
-// trap error ever replaces the rejection. Values bearing user accessors or Proxies are
-// NEVER returned as the original — a stateful/hostile getter can present clean text
-// during sanitization and mint the secret on a later read — they are converted to an
-// inert plain carrier (data properties only, prototype restored only for KNOWN error
-// classes). No logging path may coerce an unknown value (`String()`/template invokes an
-// arbitrary `toString`): {@link safeRedactedErrorMessage} extracts only safely-read
-// fields inside the boundary.
-
-/**
- * The engine's own lazy `Error#stack` accessor pair, captured ONCE at
- * module init. V8 defines `stack` as an own get/set accessor on every Error instance,
- * sharing ONE getter/setter function across all of them — so FUNCTION IDENTITY proves
- * "this is the engine's deterministic lazy-stack slot" (user code cannot forge these
- * function identities). It is the ONLY accessor the in-place sanitizer may handle;
- * every other accessor forces the inert fallback carrier.
- */
-const engineStackDescriptor = Object.getOwnPropertyDescriptor(new Error(), 'stack');
-const ENGINE_STACK_GET = engineStackDescriptor?.get;
-const ENGINE_STACK_SET = engineStackDescriptor?.set;
-
-/**
- * The ONLY prototypes a rebuilt carrier may have restored. Restoring an
- * ARBITRARY prototype would reintroduce hostile behavior on the otherwise-inert carrier
- * (a prototype getter or `toString` the carrier's readers would still hit), so an
- * unknown prototype degrades to the base Error/Object/Array prototype the fresh carrier
- * was built with. `WranglerQuarantineError` is included so a rebuilt quarantine carrier
- * keeps its `instanceof` classification.
- */
-const KNOWN_SAFE_PROTOTYPES = new Set<object>([
-  Error.prototype,
-  TypeError.prototype,
-  RangeError.prototype,
-  ReferenceError.prototype,
-  SyntaxError.prototype,
-  EvalError.prototype,
-  URIError.prototype,
-  AggregateError.prototype,
-  WranglerQuarantineError.prototype,
-  Object.prototype,
-  Array.prototype,
-]);
-
-/**
- * Deep-redact an UNKNOWN rejection value through the ONE text
- * redactor, inside one no-throw attempt. A seam may reject with ANYTHING — an Error, a
- * plain STRING, an object, an array, a FROZEN value, a graph carrying secrets in
- * non-enumerable slots (`Error.cause`, `AggregateError.errors`, `message`/`stack`),
- * Maps/Sets, cycles, Proxies, accessor-bearing objects. The contract:
- *   1. NEVER throw — any internal throw (hostile trap/getter anywhere) returns
- *      `{ ok: false }` so the caller fails closed;
- *   2. NEVER propagate an unsanitized OR non-inert value: a graph of plain data
- *      properties (plus the engine's own lazy `stack` slot) that can be fully redacted
- *      IN PLACE returns the ORIGINAL (identity preserved — quarantine detection and
- *      metadata fields survive untouched); anything else — a Proxy anywhere, ANY user
- *      accessor, a frozen/non-writable secret-bearing slot — returns a fully sanitized
- *      INERT deep copy (data properties only, every string redacted, only KNOWN
- *      prototypes restored);
- *   3. traverse own property DESCRIPTORS (string + symbol keys, non-enumerable
- *      included — covering `message`, `stack`, `cause`, `errors`), plus Map keys/values
- *      and Set members (whose internal slots `Object.freeze` never covers), cycle-safely.
- */
-type RedactAttempt = { ok: true; value: unknown } | { ok: false };
-
-function tryRedactValue(value: unknown, redactText: (text: string) => string): RedactAttempt {
-  try {
-    if (typeof value === 'string') {
-      return { ok: true, value: redactText(value) };
-    }
-    if (typeof value !== 'object' || value === null) {
-      return { ok: true, value };
-    }
-    if (!utilTypes.isProxy(value) && sanitizeInPlace(value, redactText)) {
-      return { ok: true, value };
-    }
-    return { ok: true, value: deepSanitizedCopy(value, redactText) };
-  } catch {
-    // Rule 1: never throw out of the attempt — a pathological value (throwing traps or
-    // getters anywhere) makes the caller fail closed instead.
-    return { ok: false };
-  }
-}
-
-/**
- * Attempt to redact `root` fully IN PLACE. Returns `true` only when EVERY string
- * that needed redaction was verifiably rewritten (assignment read back); any immutable
- * or unverifiable slot holding a secret returns `false` so the caller switches to the
- * fallback-carrier copy. Partial rewrites applied before a `false` are harmless — they
- * only ever REMOVE secret text, and the caller then discards the original anyway.
- */
-function sanitizeInPlace(root: object, redactText: (text: string) => string): boolean {
-  const seen = new WeakSet<object>();
-  let ok = true;
-  const visitChild = (child: unknown): void => {
-    if (typeof child === 'object' && child !== null) {
-      visit(child);
-    }
-  };
-  const visit = (v: object): void => {
-    if (!ok || seen.has(v)) {
-      return;
-    }
-    seen.add(v);
-    // A Proxy ANYWHERE in the graph forces the inert fallback carrier:
-    // its traps run arbitrary code on every later read, so a proxied original can mint
-    // fresh secrets (or throw) after "passing" this walk. Detection is native
-    // (`util.types.isProxy`), not trap-observable.
-    if (utilTypes.isProxy(v)) {
-      ok = false;
-      return;
-    }
-    // Map/Set data lives in internal slots `Object.freeze` does NOT cover, so their
-    // members are always rewritable in place (delete + re-add / set).
-    if (v instanceof Map) {
-      // Snapshot first — the loop mutates the Map while iterating.
-      for (const [key, val] of Array.from(v.entries())) {
-        const newKey = typeof key === 'string' ? redactText(key) : key;
-        const newVal = typeof val === 'string' ? redactText(val) : val;
-        visitChild(key);
-        visitChild(val);
-        if (newKey !== key) {
-          v.delete(key);
-        }
-        if (newKey !== key || newVal !== val) {
-          v.set(newKey, newVal);
-        }
-        if (!ok) {
-          return;
-        }
-      }
-      return;
-    }
-    if (v instanceof Set) {
-      // Snapshot first — the loop mutates the Set while iterating.
-      for (const member of Array.from(v.values())) {
-        if (typeof member === 'string') {
-          const red = redactText(member);
-          if (red !== member) {
-            v.delete(member);
-            v.add(red);
-          }
-        } else {
-          visitChild(member);
-        }
-        if (!ok) {
-          return;
-        }
-      }
-      return;
-    }
-    // EVERY own property — string AND symbol keys, non-enumerable included (an Error's
-    // `message`/`stack`/`cause` and an AggregateError's `errors` are non-enumerable own
-    // data properties the old `Object.keys` walk missed entirely).
-    for (const key of Reflect.ownKeys(v)) {
-      const desc = Object.getOwnPropertyDescriptor(v, key);
-      if (!desc) {
-        continue;
-      }
-      if (desc.get !== undefined || desc.set !== undefined) {
-        // ONLY the engine's own lazy `Error#stack` pair may be handled
-        // in place: its getter is deterministic (formats the captured frames + the
-        // current message) and rewriting through its setter morphs the slot into a
-        // verified data property. EVERY other accessor forces the fallback carrier — a
-        // stateful/hostile getter can return clean text during THIS walk and mint the
-        // secret on a later read, so an accessor-bearing original must never be
-        // returned as "sanitized" (rule 2).
-        const isEngineStackSlot =
-          key === 'stack' &&
-          ENGINE_STACK_GET !== undefined &&
-          desc.get === ENGINE_STACK_GET &&
-          desc.set === ENGINE_STACK_SET;
-        if (!isEngineStackSlot) {
-          ok = false;
-          return;
-        }
-        // The engine stack slot passes when its CURRENT text is verifiably clean, or
-        // when a secret-bearing string can be rewritten THROUGH its setter with the
-        // result read back (the stack text embeds the message, so it routinely carries
-        // the secret). An unverifiable write still forces the fallback carrier.
-        let current: unknown;
-        try {
-          current = desc.get !== undefined ? desc.get.call(v) : undefined;
-        } catch {
-          ok = false;
-          return;
-        }
-        if (typeof current === 'string') {
-          const red = redactText(current);
-          if (red !== current) {
-            if (desc.set === undefined) {
-              ok = false;
-              return;
-            }
-            try {
-              desc.set.call(v, red);
-            } catch {
-              ok = false;
-              return;
-            }
-            // The setter may have morphed the slot into a data property (V8's stack
-            // setter does) — verify via a FRESH descriptor read.
-            let after: unknown;
-            try {
-              const afterDesc = Object.getOwnPropertyDescriptor(v, key);
-              after = afterDesc?.get !== undefined ? afterDesc.get.call(v) : afterDesc?.value;
-            } catch {
-              ok = false;
-              return;
-            }
-            if (after !== red) {
-              ok = false;
-              return;
-            }
-          }
-        } else {
-          visitChild(current);
-        }
-        if (!ok) {
-          return;
-        }
-        continue;
-      }
-      const val = desc.value;
-      if (typeof val === 'string') {
-        const red = redactText(val);
-        if (red === val) {
-          continue;
-        }
-        if (desc.writable !== true) {
-          ok = false; // frozen / non-writable data slot holding a secret
-          return;
-        }
-        try {
-          (v as Record<PropertyKey, unknown>)[key] = red;
-        } catch {
-          ok = false;
-          return;
-        }
-        // VERIFY the write took (a sloppy-mode swallow / hostile Proxy must not pass).
-        if (Object.getOwnPropertyDescriptor(v, key)?.value !== red) {
-          ok = false;
-          return;
-        }
-      } else {
-        visitChild(val);
-        if (!ok) {
-          return;
-        }
-      }
-    }
-  };
-  visit(root);
-  return ok;
-}
-
-/**
- * The fallback CARRIER: a fully sanitized deep copy of `root`, built when in-place
- * redaction is impossible. Fresh objects/arrays/Errors/Maps/Sets (all mutable), every
- * string redacted, every own property — enumerable or not, string or symbol key —
- * carried over as a plain data property, accessors snapshotted (an unreadable getter
- * becomes `'[unredactable]'`), the original PROTOTYPE restored so `instanceof`
- * classification (e.g. {@link WranglerQuarantineError}) survives the rebuild. Cycle-safe
- * (a cycle in the original maps to the same cycle among the copies).
- */
-function deepSanitizedCopy(root: unknown, redactText: (text: string) => string): unknown {
-  const copies = new WeakMap<object, unknown>();
-  const copy = (v: unknown): unknown => {
-    if (typeof v === 'string') {
-      return redactText(v);
-    }
-    if (typeof v !== 'object' || v === null) {
-      return v;
-    }
-    if (copies.has(v)) {
-      return copies.get(v);
-    }
-    if (v instanceof Map) {
-      const out = new Map<unknown, unknown>();
-      copies.set(v, out);
-      for (const [key, val] of v.entries()) {
-        out.set(copy(key), copy(val));
-      }
-      return out;
-    }
-    if (v instanceof Set) {
-      const out = new Set<unknown>();
-      copies.set(v, out);
-      for (const member of v.values()) {
-        out.add(copy(member));
-      }
-      return out;
-    }
-    const out: object = Array.isArray(v) ? [] : v instanceof Error ? new Error() : {};
-    // Restore the prototype ONLY for KNOWN error/base classes. The
-    // carrier must be INERT: an arbitrary prototype could carry hostile getters or a
-    // hostile `toString` that later reads/coercions of the carrier would invoke, so an
-    // unknown prototype degrades to the base one `out` was built with (the structural
-    // fields below still carry the metadata; `redactRejection` restores the quarantine
-    // classification structurally when it was lost this way).
-    const proto: unknown = Object.getPrototypeOf(v);
-    if (typeof proto === 'object' && proto !== null && KNOWN_SAFE_PROTOTYPES.has(proto)) {
-      try {
-        Object.setPrototypeOf(out, proto);
-      } catch {
-        // Keep the base prototype.
-      }
-    }
-    copies.set(v, out);
-    for (const key of Reflect.ownKeys(v)) {
-      const desc = Object.getOwnPropertyDescriptor(v, key);
-      if (!desc) {
-        continue;
-      }
-      let val: unknown;
-      if (desc.get !== undefined || desc.set !== undefined) {
-        try {
-          val = desc.get !== undefined ? desc.get.call(v) : undefined;
-        } catch {
-          val = '[unredactable]';
-        }
-      } else {
-        val = desc.value;
-      }
-      try {
-        Object.defineProperty(out, key, {
-          value: copy(val),
-          writable: true,
-          enumerable: desc.enumerable === true,
-          configurable: true,
-        });
-      } catch {
-        // e.g. an array's non-configurable `length` — the index copies already set it.
-      }
-    }
-    return out;
-  };
-  return copy(root);
-}
-
-/**
- * Extract a SAFELY-READ, redacted one-line message from an unknown
- * value, for logging. Never coerces an object (`String()`/template literals invoke an
- * arbitrary — possibly hostile — `toString`): only primitives are stringified, and for
- * objects only a plain string `message` field is read (inside the no-throw boundary; a
- * throwing trap/getter degrades to the generic placeholder). THE one helper every
- * logging path uses for unknown rejection values (grep-proven: the Hyperdrive lister
- * warning and the rebuilt-carrier message below).
- */
-function safeRedactedErrorMessage(value: unknown, redactText: (text: string) => string): string {
-  try {
-    if (typeof value === 'string') {
-      return redactText(value);
-    }
-    if (
-      value === null ||
-      value === undefined ||
-      typeof value === 'number' ||
-      typeof value === 'boolean' ||
-      typeof value === 'bigint'
-    ) {
-      return String(value);
-    }
-    const message = (value as { message?: unknown }).message;
-    if (typeof message === 'string') {
-      return redactText(message);
-    }
-  } catch {
-    // A throwing trap/getter — fall through to the withheld placeholder.
+/** Redact a runner rejection, keeping the same Error object so quarantine fields survive. */
+function redactRejection(error: unknown, redactText: (text: string) => string): Error {
+  if (!(error instanceof Error)) {
+    return new Error(redactText(String(error)));
   }
-  return 'the rejection could not be rendered safely; its content was withheld';
-}
-
-/** The conservative carrier for a rejection that resists inspection. */
-function unsafeInspectionQuarantineCarrier(): Error {
-  const carrier = new Error(
-    'provision: a propagated rejection could not be safely inspected (a property or ' +
-      'prototype trap threw during redaction); its content was withheld. Treating it ' +
-      'conservatively as an unconfirmed-wrangler-child (quarantine) failure: the ' +
-      'whole-provision lock is retained, not released.',
-  );
-  Object.assign(carrier, { quarantine: true as const, pid: undefined });
-  return carrier;
-}
-
-/**
- * Redact a seam REJECTION with EVERYTHING — the quarantine
- * classification included — inside the ONE no-throw boundary, GUARANTEEING:
- *   1. this function NEVER throws (pre-fix, `isQuarantineError`'s `instanceof` ran on
- *      the ORIGINAL value before any boundary — a Proxy with throwing
- *      `getPrototypeOf`/property traps made the redactor itself throw a
- *      secret-bearing, classification-free replacement error, and the outer path then
- *      RELEASED the mutex under a possibly-live child);
- *   2. if inspection is unsafe ANYWHERE (classification, redaction, message reads), it
- *      FAILS CLOSED AS QUARANTINE: a fresh INERT sanitized carrier marked
- *      `{ quarantine: true }` propagates, so the mutex is retained (conservative — the
- *      hostile value could have been hiding a real quarantine) and no trap error or
- *      secret ever escapes;
- *   3. a quarantined rejection can never degrade into an ordinary failure: the
- *      classification + pid are captured inside the boundary and restored structurally
- *      on the carrier when a rebuild lost them.
- */
-function redactRejection(error: unknown, redactText: (text: string) => string): unknown {
-  try {
-    const wasQuarantine = isQuarantineError(error);
-    const quarantinePid =
-      wasQuarantine && typeof (error as WranglerQuarantineError).pid === 'number'
-        ? (error as WranglerQuarantineError).pid
-        : undefined;
-    const attempt = tryRedactValue(error, redactText);
-    if (!attempt.ok) {
-      return unsafeInspectionQuarantineCarrier();
-    }
-    const redacted = attempt.value;
-    if (!wasQuarantine || isQuarantineError(redacted)) {
-      return redacted;
-    }
-    // The redactor had to rebuild and the carrier lost the classification (e.g. the
-    // original relied on a prototype outside the known-safe set) — restore it
-    // structurally on the (always freshly-built, inert) carrier.
-    const carrier =
-      redacted instanceof Error
-        ? redacted
-        : new Error(safeRedactedErrorMessage(redacted, redactText));
-    Object.assign(carrier, { quarantine: true as const, pid: quarantinePid });
-    return carrier;
-  } catch {
-    // Rule 2 — anything that slipped past the inner boundaries still fails closed as
-    // an inert quarantine-conservative carrier, never a throw out of the redactor.
-    return unsafeInspectionQuarantineCarrier();
+  error.message = redactText(error.message);
+  if (typeof error.stack === 'string') {
+    error.stack = redactText(error.stack);
   }
+  return error;
 }
 
 /**
- * Ensure every resource in `desired` exists in the user's own Cloudflare account,
- * creating the missing ones by shelling out to `wrangler` and letting
- * `wrangler <res> create --update-config` write real ids into the root config.
- * For resources that already exist (adopt path) — where `create` cannot run —
- * the real id is captured from `wrangler <res> list/info` (or, for Hyperdrive,
- * the account-list existence seam) and written through `writeProvisionedWranglerConfig`'s
- * adopt fields. Pure provisioning: NO build, deploy, or drift-check. Idempotent +
- * read-first: a binding already pointing at a real id is left untouched.
+ * Ensure every desired resource exists in the user's Cloudflare account and record its id in
+ * the root config, creating or adopting as needed. A binding with a real id is left as is.
  */
 export async function provisionCloudflareResources(
   root: string,
@@ -3877,10 +2387,7 @@ export async function provisionCloudflareResources(
   desired: DesiredResourceSet,
   opts?: ProvisionOptions,
 ): Promise<ProvisionResult> {
-  // The at-most-one-provision-per-process guard, taken SYNCHRONOUSLY at
-  // entry (before the first await) so two same-tick calls cannot both pass. See the
-  // invariant documented at {@link acquireProcessProvisionSlot}: the signal coordinator
-  // manages at most one {wrangler child group, provision lock} pair because of it.
+  // Taken synchronously, so two same-tick calls cannot both pass.
   const releaseProvisionSlot = acquireProcessProvisionSlot();
   try {
     return await provisionWithProcessSlot(root, rootWranglerPath, desired, opts);
@@ -3896,54 +2403,17 @@ async function provisionWithProcessSlot(
   desired: DesiredResourceSet,
   opts?: ProvisionOptions,
 ): Promise<ProvisionResult> {
-  await Promise.resolve();
-  // ONE ABSOLUTE config path threaded through read-first, wrangler `-c`, AND the
-  // writer, so reads and writes can never hit different files (no split-brain).
-  // Resolve it against `root` ONCE, up front: Node reads/writes here resolve a
-  // RELATIVE path against `process.cwd()`, but the default wrangler runs with
-  // `cwd: root` and resolves `-c` there — so with `root !== process.cwd()` a bare
-  // relative `rootWranglerPath` would let Node inspect one file while wrangler
-  // creates against another (orphan). An already-absolute path is returned as-is.
-  //
-  // Then CANONICALIZE it with `realpath` so the lock identity (and every read/
-  // write/`-c`) is keyed on the REAL file, not a lexical alias. Without this, a real
-  // config and a symlink alias to it resolve to DIFFERENT lexical paths → DIFFERENT lock
-  // mutex dirs (`<path>.void-provision.lock.lock`), so both processes acquire "the" lock at
-  // once and race the same underlying file. Canonicalizing collapses all aliases to one
-  // identity; a missing config canonicalizes its parent dir so the identity is still
-  // alias-stable before the file is created.
+  // One absolute, canonical path for reads, writes, `-c` and the lock, resolved against
+  // `root` (wrangler runs there) so symlink aliases share one lock.
   const configPath = canonicalizeConfigPath(resolve(root, rootWranglerPath));
 
-  // Hold ONE cross-process lock for the WHOLE provision: acquire it BEFORE
-  // the first config read (so account reconciliation + persistence + all discovery,
-  // remote work, and config writes happen against the state the lock protects), and
-  // ALWAYS release it (both the success and error paths below call `lock.release()`, so
-  // an interruption never leaks the lock; a genuine unlock failure fails the provision).
-  // The reconciliation + duplicate-member guard + resource work all run UNDER the lock in
-  // `provisionCloudflareResourcesLocked`, so a racing first-run serializes: the second
-  // process re-reads the persisted account/ids and fails closed (or reuses).
-  //
-  // This mutex is keyed on the local CONFIG PATH, so it only
-  // serializes provisions of the same config on ONE machine; two different HOSTS
-  // provisioning the same project can still race and create duplicates. Accepted by
-  // design: provision is a single-operator dev-machine action, so no remote coordination
-  // is built.
+  // One lock for the whole provision, keyed on the local config path. It does not
+  // coordinate across machines; provisioning is a single-operator action.
   const lock = await acquireProvisionLock(configPath, opts?.lockOptions);
-  // While this provision runs, a fatal-signal death under an
-  // UNCONFIRMED wrangler child must RETAIN the mutex: publish the lock's quarantine as
-  // THE single active hook (1:1 with this process's one provision slot). A registering
-  // wrangler child captures it at registration, and the coordinator's signal path
-  // invokes it SYNCHRONOUSLY — sidecar written, lock detached from the exit sweep —
-  // before re-raising the signal. Routed through {@link retainQuarantinedLock} so a
-  // persistence failure arms the retention watchdog.
+  // A fatal signal with an unconfirmed child quarantines this lock through the hook.
   const quarantineHook = (info: QuarantineInfo): void => retainQuarantinedLock(lock, info);
   activeProvisionQuarantineHook = quarantineHook;
-  // ALWAYS release, but do NOT swallow a release failure. On body SUCCESS a failed
-  // unlock means the mutex leaked, so the provision must FAIL (surfaced, not hidden). On
-  // body FAILURE the body error is primary, but a release failure means the mutex LEAKED,
-  // so it must NOT be silently discarded (a leaked mutex blocks future retries). We
-  // preserve BOTH via an AggregateError. (`release()` is idempotent — one shared promise —
-  // so these paths never double-unlock.)
+  // Always release, and never hide a release failure; with a body error, keep both.
   let result: ProvisionResult | undefined;
   let threw = false;
   let bodyError: unknown;
@@ -3953,31 +2423,20 @@ async function provisionWithProcessSlot(
     threw = true;
     bodyError = error;
   }
-  // Every wrangler call has settled by here (each is awaited), so the before-death hook
-  // is no longer needed on any terminal path below.
+  // Every call has settled, so the hook is no longer needed.
   if (activeProvisionQuarantineHook === quarantineHook) {
     activeProvisionQuarantineHook = undefined;
   }
   if (threw) {
-    // QUARANTINE: the failure means a spawned wrangler child could not be
-    // confirmed dead — it may STILL be creating resources — so the mutex is INTENTIONALLY
-    // RETAINED (never released here; `quarantine()` also detaches it from proper-lockfile's
-    // exit sweep so the on-disk directory outlives this process). Releasing it would let a
-    // concurrent provision race the surviving child on the same config/account.
+    // An unconfirmed child may still be running, so keep the lock.
     if (isQuarantineError(bodyError)) {
       try {
         retainQuarantinedLock(lock, {
-          // Defensive reads: `isQuarantineError` also accepts a structural match (a
-          // `{ quarantine: true }` carrier that is not the class instance).
           pid: typeof bodyError.pid === 'number' ? bodyError.pid : undefined,
           reason: typeof bodyError.message === 'string' ? bodyError.message : String(bodyError),
         });
       } catch (quarantineError) {
-        // The quarantine sidecar could not be persisted,
-        // so the lock is intentionally STILL HELD (tracked, heartbeat running) under the
-        // retention watchdog {@link retainQuarantinedLock} just armed: the process will
-        // not drain unprotected while the unconfirmed wrangler child may still be
-        // creating resources. NEVER release the lock here. Surface BOTH errors.
+        // Not persisted: the watchdog keeps the lock held. Surface both errors.
         throw new AggregateError(
           [bodyError, quarantineError],
           `provision failed with an unconfirmed wrangler child AND its quarantine metadata ` +
@@ -3992,10 +2451,7 @@ async function provisionWithProcessSlot(
       }
       throw bodyError;
     }
-    // Attempt release; if IT also fails, surface BOTH (the body error is primary but
-    // the leaked-mutex error must never be swallowed). An AggregateError carries both in
-    // `.errors`, with `.cause` set to the primary body error so a `cause`-walking logger
-    // still sees it.
+    // A release failure is surfaced together with the body error.
     let releaseError: unknown;
     try {
       await lock.release();
@@ -4075,21 +2531,12 @@ async function reconcileD1(
   transportApiBaseUrl: string,
   opts?: ProvisionOptions,
 ): Promise<void> {
-  // --- D1 ------------------------------------------------------------------
   if (desired.d1) {
     const { binding, name } = desired.d1;
-    // The config-relative `migrations_dir` to stamp on the D1 entry. The orchestrator
-    // passes the sourceDir-aware value; fall back to the default when unset so a direct
-    // provisioner call (no orchestrator) keeps the historical `./db/migrations`.
     const migrationsDir = desired.d1.migrationsDir ?? D1_MIGRATIONS_DIR;
     const entry = readBindingEntry(configPath, 'd1_databases', binding);
     if (entry && isRealD1Id(entry.database_id)) {
-      // Stored-name identity: when the entry
-      // STORES a `database_name`, it must EQUAL the desired name before the id is
-      // reused. A real id under a CONTRADICTING stored name means the binding points at
-      // a DIFFERENT database than this deploy wants — reusing it would silently run the
-      // app (and its migrations) against the wrong database. An entry storing NO name
-      // keeps ID-only reuse (the id alone is the identity then).
+      // A stored name that differs from the desired one points at another database.
       const storedName = entry.database_name;
       if (storedName !== undefined && storedName !== name) {
         throw new Error(
@@ -4101,21 +2548,15 @@ async function reconcileD1(
             `desired database, then retry.`,
         );
       }
-      // Read-first hit. A prior run may have created the D1 (id written) then
-      // crashed BEFORE migrations_dir was set, so ensure + verify it here too —
-      // idempotent when already present — so the retry converges rather than
-      // leaving the gap unfilled forever.
+      // A crash after create may have skipped migrations_dir, so set it on every run.
       const res = write({ d1MigrationsDir: { binding, dir: migrationsDir } });
       assertD1MigrationsDirApplied(res, binding, configPath);
       resources.push({ kind: 'd1', binding, name, action: 'reused', id: entry.database_id });
     } else {
-      // Discovery must SUCCEED (gate) before its stdout is parsed, then the whole
-      // list is strictly validated — a nonzero/SIGTERM/spawn-error or a malformed
-      // member never parses as "absent" and mints a duplicate D1.
       const listResult = await runWrangler({ type: 'd1.list', configPath }, {});
       assertDiscoverySucceeded(listResult, 'wrangler d1 list');
-      const rawList = parseJsonArrayStrict(listResult.data);
-      if (!rawList) {
+      const rawList = listResult.data;
+      if (!Array.isArray(rawList)) {
         throw new Error(
           `provision: "wrangler d1 list --json" did not return a JSON array; cannot verify whether ` +
             `D1 database ${JSON.stringify(name)} exists. Refusing to create a possible duplicate.`,
@@ -4124,20 +2565,13 @@ async function reconcileD1(
       const databases = validateResourceList(rawList, {
         resource: 'D1 database',
         command: 'wrangler d1 list',
-        // The ONE alias reconciler gates EVERY member (never "any one alias
-        // valid"): a conflicting or malformed secondary alias rejects the whole list.
         hasValidId: (member) => reconcileD1IdAliases(member).kind === 'id',
         idRule:
           'its uuid/database_id aliases must be present, well-formed D1 UUIDs agreeing on one id',
         nameField: 'name',
         nameLabel: 'named',
       });
-      // Run the ONE strict normalizer over EVERY member against the requested
-      // name. Collect the members that CLAIM the requested name (match or ambiguous).
-      // - >1 claimant → ambiguous which to adopt → fail closed;
-      // - 1 ambiguous claimant → fail closed (never adopt an ambiguous id, never
-      //   mistake it for absent and mint a duplicate);
-      // - 1 valid claimant → adopt; 0 → create.
+      // Adopt a single valid claimant; several or an ambiguous one fail closed; none creates.
       const claimants = databases
         .map((db) => normalizeD1(db, name))
         .filter((m): m is Exclude<D1Match, { kind: 'other' }> => m.kind !== 'other');
@@ -4171,9 +2605,7 @@ async function reconcileD1(
       } else {
         const created = await runWrangler({ type: 'd1.create', name: name, binding, configPath });
         if (isCleanSuccess(created)) {
-          // wrangler wrote database_id/database_name via --update-config; VERIFY the
-          // real id landed (postcondition), then fill the migrations_dir it does
-          // not write.
+          // Verify the id landed, then set migrations_dir.
           assertCreateWroteRealId(
             configPath,
             {
@@ -4192,14 +2624,10 @@ async function reconcileD1(
           assertD1MigrationsDirApplied(res, binding, configPath);
           resources.push({ kind: 'd1', binding, name, action: 'created' });
         } else if (isCleanFailure(created) && isAlreadyExistsError(created)) {
-          // TOCTOU: created between our list and create (clean non-zero, code 7502).
-          // Capture the id via `d1 info` — which must SUCCEED (gate) and POSITIVELY
-          // identify THIS database (EXACT name match) before we adopt its id.
+          // Created between list and create (code 7502): adopt only an exact `d1 info` match.
           const infoResult = await runWrangler({ type: 'd1.info', name: name, configPath }, {});
           assertDiscoverySucceeded(infoResult, `wrangler d1 info ${name}`);
-          // SAME strict normalizer as the list path — must POSITIVELY identify THIS
-          // database by an exact name match with an unambiguous id.
-          const info = normalizeD1(parseJsonObject(infoResult.data), name);
+          const info = normalizeD1(isRecord(infoResult.data) ? infoResult.data : undefined, name);
           if (info.kind !== 'match') {
             throw new Error(
               `provision: "wrangler d1 create ${name}" reported the database already exists, ` +
@@ -4215,8 +2643,6 @@ async function reconcileD1(
           assertD1MigrationsDirApplied(res, binding, configPath);
           resources.push({ kind: 'd1', binding, name, action: 'adopted', id: info.id });
         } else {
-          // Everything else — a hard failure (signal/spawn error) or a clean
-          // non-7502 error — fails closed.
           throw new Error(
             `provision: "wrangler d1 create ${name}" failed: ${created.stderr || created.stdout}`,
           );
@@ -4269,23 +2695,17 @@ async function reconcileKv(
   resources: Array<ProvisionOutcome>,
   log: ProvisionLogger,
 ): Promise<void> {
-  // --- KV ------------------------------------------------------------------
   for (const { binding, title } of desired.kvNamespaces) {
     const entry = readBindingEntry(configPath, 'kv_namespaces', binding);
     if (entry && isRealKvId(entry.id)) {
       resources.push({ kind: 'kv', binding, name: title, action: 'reused', id: entry.id });
       continue;
     }
-    // KV titles are NOT account-unique and `kv namespace create` never dedupes,
-    // so this list is the ONLY orphan guard. Route it through the SHARED gate +
-    // strict validator: the discovery must exit 0 (nonzero/SIGTERM/spawn-error →
-    // throw), return a real JSON array, and have EVERY member well-formed (a
-    // malformed member — which could BE the target — fails closed rather than being
-    // filtered to a false "absent" that mints a duplicate namespace).
+    // KV titles are not unique and create never dedupes, so this list is the only orphan guard.
     const listResult = await runWrangler({ type: 'kv.namespace.list', configPath }, {});
     assertDiscoverySucceeded(listResult, 'wrangler kv namespace list');
-    const rawList = parseJsonArrayStrict(listResult.data);
-    if (!rawList) {
+    const rawList = listResult.data;
+    if (!Array.isArray(rawList)) {
       throw new Error(
         `provision: "wrangler kv namespace list" did not return a JSON array; cannot verify whether ` +
           `KV namespace ${JSON.stringify(title)} exists. Refusing to create a possible duplicate.`,
@@ -4299,10 +2719,12 @@ async function reconcileKv(
       nameField: 'title',
       nameLabel: 'titled',
     });
-    const matches = extractKvMatches(namespaces, title);
+    // validateResourceList already required a real KV id on every member.
+    const matches = namespaces
+      .filter((ns) => ns.title === title)
+      .map((ns) => ({ id: ns.id as string }));
     if (matches.length > 0) {
-      // KV titles are NOT account-unique. Tie-break deterministically on the
-      // lexicographically-smallest id so re-runs adopt the same namespace.
+      // Pick the smallest id so re-runs adopt the same namespace.
       const chosen = matches.reduce((min, ns) => (ns.id < min.id ? ns : min));
       if (matches.length > 1) {
         log.warn(
@@ -4326,8 +2748,6 @@ async function reconcileKv(
           `provision: "wrangler kv namespace create ${title}" failed: ${created.stderr || created.stdout}`,
         );
       }
-      // Postcondition: confirm --update-config wrote a REAL id (a killed create
-      // masked as exit 0 by wrangler's launcher would leave none).
       assertCreateWroteRealId(
         configPath,
         {
@@ -4355,19 +2775,10 @@ async function reconcileR2(
   resources: Array<ProvisionOutcome>,
   log: ProvisionLogger,
 ): Promise<void> {
-  // --- R2 ------------------------------------------------------------------
   if (desired.r2) {
     const { binding, bucketName } = desired.r2;
     const entry = readBindingEntry(configPath, 'r2_buckets', binding);
-    // `bucket_name` IS the R2 identity: a stored
-    // REAL (non-placeholder) bucket_name that differs from the desired name is a
-    // CONTRADICTION — reusing it would keep the app bound to a different bucket while
-    // reporting the desired one provisioned. Equal → reuse as before (the desired name
-    // already passed the R2 grammar gate, so an equal stored name is format-valid too).
-    // ONLY R2's own placeholder (`default`) or an absent/non-string name
-    // keeps the discovery path: a stored `local` is a grammar-valid REAL bucket name
-    // (the shared check that also rejected `local` let it bypass this contradiction
-    // gate and be silently rewritten).
+    // `bucket_name` is the identity: a stored real name that differs is a contradiction.
     const storedBucketName = entry?.bucket_name;
     if (entry && isRealStoredR2BucketName(storedBucketName, bucketName)) {
       if (storedBucketName !== bucketName) {
@@ -4382,29 +2793,22 @@ async function reconcileR2(
       }
       resources.push({ kind: 'r2', binding, name: bucketName, action: 'reused' });
     } else {
-      // `wrangler r2 bucket list` is a human table, not JSON. Bucket names ARE
-      // account-unique, so probe the single bucket by name.
+      // Bucket names are account-unique, so probe by name.
       const info = await runWrangler({ type: 'r2.bucket.info', name: bucketName, configPath }, {});
       if (isCleanSuccess(info)) {
-        // A clean exit 0 is not enough to adopt — the success payload must
-        // POSITIVELY identify the requested bucket (its `name`) before we write the
-        // entry, else a mismatched/garbled 0-exit payload could bind the wrong
-        // bucket. (A signal-killed probe is NOT a clean success — see the rule.)
-        const payload = parseJsonObject(info.data);
-        if (!payload || payload.name !== bucketName) {
+        // Adopt only when the payload names this bucket.
+        const payload = info.data;
+        if (!isRecord(payload) || payload.name !== bucketName) {
           throw new Error(
             `provision: "wrangler r2 bucket info ${bucketName} --json" exited 0 but did not identify ` +
               `the requested bucket (expected name ${JSON.stringify(bucketName)}). Refusing to adopt an ` +
               `unverified bucket. Output: ${info.stdout || info.stderr}`,
           );
         }
-        // Adopt it — write the `{binding,bucket_name}` entry via the writer.
         log.info(`adopted existing R2 bucket ${bucketName}`);
         write({ r2: { binding, bucketName } });
         resources.push({ kind: 'r2', binding, name: bucketName, action: 'adopted' });
       } else if (isConfirmedAbsent(info, 'r2')) {
-        // CONFIRMED not-found (clean non-zero + exact signal) → create.
-        // `--update-config` upserts by binding.
         const created = await runWrangler({
           type: 'r2.bucket.create',
           name: bucketName,
@@ -4416,10 +2820,7 @@ async function reconcileR2(
             `provision: "wrangler r2 bucket create ${bucketName}" failed: ${created.stderr || created.stdout}`,
           );
         }
-        // Postcondition: confirm --update-config wrote the requested bucket_name
-        // (grammar-valid + EXACT name equality — the name IS the R2 identity).
-        // No placeholder heuristic here — a desired bucket genuinely
-        // named `default` must not fail a create that succeeded.
+        // No placeholder rule here: a bucket really named `default` is valid.
         assertCreateWroteRealId(
           configPath,
           {
@@ -4433,18 +2834,18 @@ async function reconcileR2(
           binding,
           bucketName,
         );
-        // When the DESIRED name IS R2's placeholder string, the config
-        // postcondition is vacuous: a pre-existing placeholder entry is byte-identical
-        // to a real create result, so a masked signal-killed create (wrangler's
-        // launcher can report exit 0) would pass it. Verify via the EXACT remote probe
-        // instead — the same positive identification the adopt path uses.
+        // For a bucket named `default`, the config cannot tell a real create from the
+        // placeholder, so confirm remotely.
         if (bucketName === R2_BUCKET_NAME_PLACEHOLDER) {
           const verify = await runWrangler(
             { type: 'r2.bucket.info', name: bucketName, configPath },
             {},
           );
-          const payload = isCleanSuccess(verify) ? parseJsonObject(verify.data) : undefined;
-          if (!payload || payload.name !== bucketName) {
+          if (
+            !isCleanSuccess(verify) ||
+            !isRecord(verify.data) ||
+            verify.data.name !== bucketName
+          ) {
             throw new Error(
               `provision: "wrangler r2 bucket create ${bucketName}" reported success but a ` +
                 `follow-up "wrangler r2 bucket info ${bucketName}" did not confirm the bucket ` +
@@ -4458,9 +2859,7 @@ async function reconcileR2(
         persistCreatedConfig();
         resources.push({ kind: 'r2', binding, name: bucketName, action: 'created' });
       } else {
-        // A non-zero that is NOT the confirmed not-found signal (auth/metrics/
-        // network) — the bucket may well EXIST. Surface the real error instead of
-        // attempting a create that would spuriously fail or risk a duplicate.
+        // Any other failure: the bucket may exist, so do not create.
         throw new Error(
           `provision: "wrangler r2 bucket info ${bucketName}" failed: ${info.stderr || info.stdout}. ` +
             `Cannot determine whether the bucket exists; refusing to create a possible duplicate.`,
@@ -4483,42 +2882,21 @@ async function reconcileHyperdrive(
   redactSecrets: (value: string) => string,
   opts?: ProvisionOptions,
 ): Promise<void> {
-  // --- Hyperdrive ----------------------------------------------------------
-  // wrangler 4.131 has NO machine-readable Hyperdrive list (`hyperdrive list`
-  // prints a cli-table3 box table; there is no `--json`, and `hyperdrive get`
-  // takes an id, not a name). `hyperdrive create` on a NON-UNIQUE name silently
-  // mints a DUPLICATE config (new UUID), so a re-run without the id in config
-  // would keep minting duplicates. Existence is therefore checked via an
-  // INJECTABLE Cloudflare REST seam (GET …/hyperdrive/configs, matched by name):
-  // reliable + fully testable (unit tests stub it, no real network). Adoption is
-  // attempted BEFORE the connection-string gate (it needs no connection string).
+  // Hyperdrive create duplicates same-named configs and there is no machine-readable list, so
+  // existence is checked through the REST lister. Adoption needs no connection string.
   if (desired.hyperdrive) {
     const { binding, name, connectionString } = desired.hyperdrive;
-    // The whole-provision lock already serializes this unguarded list→create
-    // across processes: the read-first check below runs UNDER that lock, so a second
-    // concurrent provision sees the id the first wrote and SKIPS (no duplicate).
     const entry = readBindingEntry(configPath, 'hyperdrive', binding);
     if (entry && isRealHyperdriveId(entry.id)) {
       resources.push({ kind: 'hyperdrive', binding, name, action: 'reused', id: entry.id });
     } else {
       const lister =
         opts?.listHyperdriveConfigs ?? createDefaultListHyperdriveConfigs(opts?.apiToken);
-      // Treat the seam result as UNKNOWN until PROVEN a real array. The OUTER
-      // result is validated (`Array.isArray`) BEFORE existence is marked known, so a
-      // runtime `null`/`undefined`/non-array is NEVER coerced to "empty" (confirmed
-      // absence) — which would authorize a blind create. A malformed outer result and a
-      // failed async lister BOTH leave existence UNKNOWN → fail closed if we WOULD create.
+      // Existence stays unknown until the lister returns a real array.
       let validatedConfigs: Array<unknown> | undefined;
       let existenceUnknown = true;
       if (lister) {
         try {
-          // Always invoke the lister WITH the reconciled account, so an injected
-          // lister can never query a DIFFERENT account than the config is pinned to.
-          // Bound the WHOLE call by an overall deadline threaded as an `AbortSignal`.
-          // `withListerDeadline` aborts the signal AND rejects at the deadline, so even a
-          // seam that ignores the signal (a stalled body / never-settling promise) can NEVER
-          // keep the heartbeat refreshing the whole-provision lock forever — it fails closed
-          // (→ existence unknown → a create attempt throws below → the lock is released).
           const result = await withListerDeadline(
             (signal) =>
               lister({
@@ -4537,23 +2915,16 @@ async function reconcileHyperdrive(
           validatedConfigs = result;
           existenceUnknown = false;
         } catch (error) {
-          // Never coerce the unknown rejection (`String()`/template
-          // would invoke an arbitrary — possibly hostile — `toString`, and a lister/
-          // network error could echo a URL carrying userinfo credentials): log ONLY a
-          // safely-extracted, redacted message from inside the no-throw boundary.
+          // A network error can echo a URL carrying userinfo credentials.
           log.warn(
             `Hyperdrive existence check for ${name} failed: ` +
-              safeRedactedErrorMessage(error, redactSecrets),
+              redactSecrets(error instanceof Error ? error.message : String(error)),
           );
           existenceUnknown = true;
           validatedConfigs = undefined;
         }
       }
-      // The ONE strict per-entry validator runs OUTSIDE the try, on a PROVEN array
-      // only, so its malformed-member / duplicate-id / ambiguous-name throws stay HARD
-      // failures (never swallowed into "unknown"). It requires EXACTLY 0 or 1 exact-name
-      // match (>1 → fail closed) BEFORE matching or writing, so no injected list can be
-      // adopted with an empty/garbage id.
+      // Validate outside the try, so a malformed list is a hard failure, not "unknown".
       const existing =
         validatedConfigs !== undefined
           ? selectHyperdriveMatch(validatedConfigs, name, configPath)
@@ -4563,14 +2934,12 @@ async function reconcileHyperdrive(
         write({ hyperdrive: { binding, id: existing.id } });
         resources.push({ kind: 'hyperdrive', binding, name, action: 'adopted', id: existing.id });
       } else if (!connectionString) {
-        // No connection string → we can never CREATE, so there is no duplicate
-        // risk whether or not existence is known: skip (structured, never prompts).
+        // Without a connection string we can never create, so skip.
         const reason = 'no connection string provided';
         log.warn(`skipping Hyperdrive config ${name}: ${reason}`);
         resources.push({ kind: 'hyperdrive', binding, name, action: 'skipped', reason });
       } else if (existenceUnknown) {
-        // A connection string is present (we WOULD create) but existence is
-        // unverifiable → FAIL CLOSED. Blindly creating duplicates a same-named config.
+        // We would create but cannot check for a duplicate.
         throw new Error(
           `provision: cannot verify whether Hyperdrive config ${JSON.stringify(name)} already ` +
             `exists (no existence check available — provide an accountId + API token, or inject a ` +
@@ -4578,7 +2947,6 @@ async function reconcileHyperdrive(
             `same-named config, so provisioning refuses to create it blindly.`,
         );
       } else {
-        // Confirmed absent + connection string present → create.
         const created = await runWrangler(
           { type: 'hyperdrive.create', name: name, binding, configPath },
           { input: connectionString },
@@ -4588,7 +2956,6 @@ async function reconcileHyperdrive(
             `provision: "wrangler hyperdrive create ${name}" failed: ${created.stderr || created.stdout}`,
           );
         }
-        // Postcondition: confirm --update-config wrote a REAL Hyperdrive id.
         assertCreateWroteRealId(
           configPath,
           {
@@ -4614,26 +2981,15 @@ async function reconcileQueues(
   runWrangler: PinnedRunWrangler,
   resources: Array<ProvisionOutcome>,
 ): Promise<void> {
-  // --- Queues (resource only; NEVER writes queue config entries) -----------
-  // `wrangler queues list` is a human table, not JSON, and `queues create` has
-  // no `--update-config`. So probe each queue by name: `queues info` reports a
-  // typed not-found failure when absent. This step only ensures the queue RESOURCE
-  // exists — the deploy orchestrator binds producers/consumers into the config
-  // (app-class-aware) through `writeProvisionedWranglerConfig`.
+  // Only ensures each queue exists; the deploy orchestrator writes the queue bindings.
   for (const name of desired.queues) {
     const info = await runWrangler({ type: 'queues.info', name: name, configPath });
-    // "Exists → reuse" ONLY when the probe POSITIVELY names THIS queue. A bare
-    // clean 0 is NOT trusted: the bin wrapper can mask a signal-killed inner CLI as
-    // exit 0 with empty output, which a plain `isCleanSuccess` would misread as
-    // reused though nothing was verified.
+    // Reuse only when the probe names this queue; a bare exit 0 is not trusted.
     if (queueInfoConfirmsExists(info, name)) {
       resources.push({ kind: 'queue', name, action: 'reused' });
       continue;
     }
-    // Not confirmed-present. It is "absent" (→ create) ONLY on a CLEAN non-zero exit
-    // carrying the typed not-found failure. Everything else — a signal/spawn failure, an auth error, a generic
-    // `Account not found`, OR a masked-kill clean-0 that did NOT positively identify
-    // the queue — fails closed (never a blind create, never a false reuse).
+    // Create only on a typed not-found; anything else fails closed.
     if (!isConfirmedAbsent(info, 'queue')) {
       throw new Error(
         `provision: "wrangler queues info ${name}" failed or did not confirm the queue exists: ` +
@@ -4646,11 +3002,7 @@ async function reconcileQueues(
         `provision: "wrangler queues create ${name}" failed: ${created.stderr || created.stdout}`,
       );
     }
-    // Verify probe — queues write NO config, so `assertCreateWroteRealId` cannot
-    // cover them. A create reporting clean 0 is NOT enough (the bin wrapper masks a
-    // signal-killed inner CLI as exit 0, creating nothing). RE-RUN the SAME positive
-    // `queues info` probe and only record `created` if it now confirms THIS queue;
-    // otherwise fail closed (a killed create self-heals on the next run's probe).
+    // Queue creates write no config, so re-probe to confirm.
     const verify = await runWrangler({ type: 'queues.info', name: name, configPath });
     if (!queueInfoConfirmsExists(verify, name)) {
       throw new Error(
@@ -4664,38 +3016,21 @@ async function reconcileQueues(
   }
 }
 
-/**
- * The provision body, run entirely UNDER the whole-provision lock (see
- * {@link provisionCloudflareResources}). `configPath` is the ONE resolved absolute
- * config path the lock is keyed on — threaded through read-first, wrangler `-c`, and
- * the writer so reads/writes can never hit different files.
- */
+/** The provision body, run under the lock with the canonical config path. */
 async function provisionCloudflareResourcesLocked(
   root: string,
   configPath: string,
   desired: DesiredResourceSet,
   opts?: ProvisionOptions,
 ): Promise<ProvisionResult> {
-  // --- Strict duplicate-member guard at the PROVISIONER BOUNDARY --------
-  // `jsonc-parser.parse()` (used by `readRootConfig`) does NOT flag duplicate object
-  // members, and `writeProvisionedWranglerConfig`'s duplicate-member guard only runs when
-  // the writer is invoked — which is SKIPPED when `account_id` is already correct. So without
-  // this, a config with duplicated members (e.g. two `kv_namespaces` arrays) could
-  // reach `kv namespace create` (orphan) or be falsely "reused". Run the SAME strict
-  // detection the writer uses (reused, not re-implemented) at the boundary — before
-  // account persistence, discovery, or ANY remote side effect — and fail closed.
+  // jsonc-parser accepts duplicate members, so reject them before any remote work.
   if (existsSync(configPath)) {
     const raw = readFileSync(configPath, 'utf-8');
     const content = raw.startsWith(UTF8_BOM) ? raw.slice(UTF8_BOM.length) : raw;
     assertNoDuplicateMembers(content, configPath);
   }
 
-  // --- Resource-name validation (BEFORE any argv / remote work) ---------
-  // Every name that becomes a wrangler ARGV POSITIONAL runs through the universal
-  // option-injection guard (so an option-like name `--help`/`-h`/`--config` can never
-  // reach wrangler as a flag) AND its own per-resource Cloudflare grammar (so a valid KV
-  // title with spaces is accepted, while an invalid R2 bucket name is rejected). Fail
-  // closed here, before the account gate or any wrangler/REST call.
+  // Validate every argv name before any remote work.
   if (desired.d1) {
     assertValidResourceName('d1', desired.d1.name);
   }
@@ -4712,23 +3047,15 @@ async function provisionCloudflareResourcesLocked(
     assertValidResourceName('queue', queueName);
   }
 
-  // --- Resolve + pin the ONE effective Cloudflare account ---------------
-  // Precedence: the resolved config's `account_id` > `opts.accountId` > the ambient
-  // `CLOUDFLARE_ACCOUNT_ID`. wrangler 4.131 gives the resolved config's account_id
-  // PRECEDENCE over the env var, so if the config pins X while `opts.accountId`
-  // requests Y, wrangler create/list would target X while the Hyperdrive REST check
-  // targets Y — a cross-account create/orphan. Fail closed on a real mismatch;
-  // otherwise pin ONE value EVERYWHERE (the wrangler env, which scrubs CLOUDFLARE_ENV
-  // and overrides any different ambient account, AND the Hyperdrive REST call).
+  // Effective account: config `account_id`, then `opts.accountId`, then CLOUDFLARE_ACCOUNT_ID.
+  // Wrangler prefers the config value, so a config/option mismatch fails closed.
   const rootConfig = readRootConfig(configPath);
   const rawConfigAccountId = rootConfig.account_id;
   const configAccountId =
     typeof rawConfigAccountId === 'string' && rawConfigAccountId.length > 0
       ? rawConfigAccountId
       : undefined;
-  // The config's top-level `compliance_region` co-determines the ONE pinned API base
-  // (FedRAMP vs public). Read + type-check it here so it can be reconciled with the ambient
-  // `CLOUDFLARE_COMPLIANCE_REGION` (fail closed on conflict) when the base is resolved below.
+  // `compliance_region` selects the public or FedRAMP API base.
   const rawComplianceRegion = rootConfig.compliance_region;
   if (rawComplianceRegion !== undefined && typeof rawComplianceRegion !== 'string') {
     throw new Error(
@@ -4736,9 +3063,7 @@ async function provisionCloudflareResourcesLocked(
         `"fedramp_high". Fix the config and retry.`,
     );
   }
-  // A PRESENT string is passed through VERBATIM (an empty string included): wrangler's
-  // config validation (`isOneOf("public", "fedramp_high")`) rejects any present
-  // out-of-choices value, so the resolver must see it to fail closed identically.
+  // Passed through as-is so an invalid value fails like it does in wrangler.
   const configComplianceRegion =
     typeof rawComplianceRegion === 'string' ? rawComplianceRegion : undefined;
   if (configAccountId && opts?.accountId && configAccountId !== opts.accountId) {
@@ -4771,15 +3096,8 @@ async function provisionCloudflareResourcesLocked(
     !!desired.hyperdrive ||
     desired.queues.length > 0;
 
-  // The MANDATORY account fence, at the PROVISIONER BOUNDARY (not inside the
-  // default runWrangler). Whenever `desired` implies remote work, an effective
-  // account MUST be resolvable — UNCONDITIONALLY, whether the wrangler runner and
-  // Hyperdrive lister are the default seams or injected. Otherwise a seam could do
-  // remote work (list/info/create/REST) under an ambient/interactive account we
-  // never persisted, so a partial run under account A followed by a retry under B
-  // would rebind A's resources with no reconciliation (the pin needs a
-  // persisted `account_id` to fail closed on the retry). Fail closed BEFORE
-  // selecting or calling ANY seam.
+  // Remote work needs a pinned account; otherwise a retry under another account could
+  // rebind these resources.
   if (hasRemoteWork && !effectiveAccountId) {
     throw new Error(
       `provision: no Cloudflare account is resolvable — set "account_id" in your root wrangler ` +
@@ -4789,42 +3107,19 @@ async function provisionCloudflareResourcesLocked(
     );
   }
 
-  // Before ANY remote work, fail closed if the project dotenv would redirect
-  // wrangler's authenticated transport out from under the pinned base (wrangler reloads
-  // `.env`/`.env.local`/`.dev.vars` on every command). A single-endpoint provisioner
-  // cannot reason about a redirected transport vs. the pinned Hyperdrive REST base.
+  // Wrangler reloads project dotenv on every command; reject transport redirects first.
   if (hasRemoteWork) {
     assertNoTransportRedirectInProjectDotenv(root);
   }
 
-  // --- Hyperdrive blockers that are knowable BEFORE any account mutation ---
-  // Unlike D1/KV/R2/queues — each of which has a machine-readable wrangler probe that
-  // works under ANY wrangler credential, including a `wrangler login` OAuth session —
-  // Hyperdrive has none (wrangler 4.131 prints a human table and offers no get-by-name;
-  // see the Hyperdrive block below). Its existence check is therefore a direct Cloudflare
-  // REST call, which needs an API token of its own. Without one there is no way to tell
-  // "config absent" from "cannot look", and `hyperdrive create` silently mints a DUPLICATE
-  // on a name collision — so the run has to stop.
-  //
-  // It stops HERE, before the account pin is written and before the first create, rather
-  // than at the Hyperdrive block far below: by that point D1/KV/R2 have already been
-  // created, so the user pays for a half-provisioned account to learn about a missing
-  // token. The message names both ways out, because `wrangler login` is the documented
-  // setup and this is the one resource it does not cover.
-  //
-  // Two DIFFERENT blockers land here, and both are decided WITHOUT a network call — the
-  // gate is only ever "could this run reach a real Hyperdrive id by ANY route?":
-  //   - a connection string but no token → could create, cannot check first → stop;
-  //   - no connection string AND no token/lister → can neither create NOR adopt, so the
-  //     only reachable outcome is the fatal `skipped` below → stop.
-  // A stringless run that CAN look (token or injected lister) is deliberately let through:
-  // adoption needs no connection string, so it may still legitimately succeed.
+  // The Hyperdrive existence check needs an API token (browser OAuth cannot call it). Stop
+  // before the account pin and any create when no route can reach a real Hyperdrive id: a
+  // connection string without a token, or neither a string nor a way to look it up.
   if (desired.hyperdrive && !opts?.listHyperdriveConfigs) {
     const { binding, name, connectionString } = desired.hyperdrive;
     const entry = readBindingEntry(configPath, 'hyperdrive', binding);
     const alreadyProvisioned = entry !== undefined && isRealHyperdriveId(entry.id);
-    // The read-first path is pure config I/O and needs NO token: an already-provisioned
-    // Postgres app deploys fine under `wrangler login` alone.
+    // An already-provisioned Hyperdrive needs no token.
     if (!alreadyProvisioned && !resolveHyperdriveApiToken(opts?.apiToken)) {
       if (connectionString) {
         throw new Error(
@@ -4839,17 +3134,8 @@ async function provisionCloudflareResourcesLocked(
             `"${configPath}" — deploying an already-provisioned Hyperdrive needs no token.`,
         );
       }
-      // NO connection string AND no way to look the account up (no token, no injected
-      // lister) — so this run can neither CREATE nor ADOPT. Its only possible outcome is
-      // the structured `skipped` far below, which the deploy orchestrator treats as FATAL.
-      // Reaching that point would first create D1/KV/R2 and pin `account_id`, billing the
-      // user for a half-provisioned account to learn about an unset variable. Stop HERE,
-      // before the pin and before the first create, for the SAME reason as the token fence.
-      //
-      // Deliberately NOT loaded from the project's dotenv files: project-derived env is
-      // read only inside the credential-scrubbed build subprocess, so making `.env.local` a
-      // deploy input here would re-introduce exactly the plaintext leak deploy warns about.
-      // The variable has to come from the shell.
+      // This run could only skip, which deploy treats as fatal. DATABASE_URL must come from
+      // the shell: project dotenv is read only inside the credential-scrubbed build.
       throw new Error(
         `provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and ` +
           `there is no DATABASE_URL to create it from. Nothing was provisioned. ` +
@@ -4863,47 +3149,22 @@ async function provisionCloudflareResourcesLocked(
     }
   }
 
-  // --- account_id (PERSIST FIRST, before selecting/calling any seam) --------
-  // Pin the effective account_id NOW — before the runWrangler/lister seams are even
-  // selected, and before any create writes a real id — so a partial run can never
-  // leave freshly-minted ids in a config with NO account pin. Without this, a later
-  // retry under a DIFFERENT account would see the real id (read-first hit → skips
-  // discovery) and finally stamp its own `account_id`, binding the first account's
-  // resources under the second. With the pin written up front, a different-account
-  // retry instead hits the reconciliation above (config account ≠ requested → fail
-  // closed) before touching wrangler/REST. Skip the write when the config ALREADY
-  // pins that exact account (keeps byte-identical configs untouched).
+  // Persist account_id before any create, so a retry under another account fails the
+  // reconciliation above instead of rebinding these ids.
   let accountIdWritten = false;
   if (effectiveAccountId && configAccountId !== effectiveAccountId) {
     write({ accountId: effectiveAccountId });
     accountIdWritten = true;
   }
 
-  // The reconciled effective account, threaded as the transport context into
-  // EVERY wrangler + Hyperdrive invocation below (default AND injected). The boundary
-  // fence above guarantees a resolved account for ALL remote work, so this non-null
-  // assertion is sound wherever a seam is actually called (an empty `desired` reaches
-  // no seam and never reads it).
+  // The account fence above guarantees a value whenever a runner is called.
   const transportAccountId = effectiveAccountId!;
-  // The ONE pinned Cloudflare API base URL (mirroring wrangler's own derivation),
-  // resolved from the REAL ambient env AND the config's `compliance_region` (so a FedRAMP
-  // config pins the `.fed` endpoint even with no ambient override, and a config-vs-ambient
-  // region conflict fails closed like wrangler). Threaded into BOTH the wrangler runner (via
-  // the spawned env's `CLOUDFLARE_API_BASE_URL`) and the Hyperdrive REST lister, so both hit
-  // the same endpoint. The dotenv fence above guarantees no project `.env` can move it.
+  // One API base for the runner and the Hyperdrive REST lister.
   const transportApiBaseUrl = resolvePinnedApiBaseUrl(process.env, configComplianceRegion);
 
-  // Both seams are pinned to the SAME effective account + API base: the default wrangler
-  // runner via its env (`CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_API_BASE_URL` + the top-level
-  // `--env=` on every argv), and the default Hyperdrive lister via
-  // `createDefaultListHyperdriveConfigs` (below). An injected seam owns its own transport
-  // but is ALWAYS invoked WITH the reconciled account + base (via the single choke point
-  // below / the lister's `{ accountId, apiBaseUrl }` context), so it can never target a
-  // DIFFERENT account/endpoint than the one the config is pinned to.
   const selectedRunWrangler = opts?.runWrangler ?? createDefaultRunWrangler(root);
-  // Every wrangler result (and any rejection message) is redacted at THIS single
-  // choke point, so no call site can propagate a Hyperdrive connection string (or any URL
-  // userinfo password a wrangler error echoes) into thrown errors / logs / diagnostics.
+  // Every result and rejection is redacted here, so no error or log carries the connection
+  // string.
   const redactSecrets = createSecretRedactor(desired.hyperdrive?.connectionString);
   const redactResult = (result: RunWranglerResult): RunWranglerResult => ({
     ...result,
@@ -4911,11 +3172,7 @@ async function provisionCloudflareResourcesLocked(
     stderr: redactSecrets(result.stderr),
     error: result.error != null ? redactSecrets(result.error) : result.error,
   });
-  // Single choke point: inject the reconciled account + API base into EVERY call so no
-  // call site can forget them (grep-proven — every `runWrangler(...)` below routes through
-  // here). Async: `Promise.resolve` coerces a sync-stub result OR the default runner's
-  // Promise, and every call site `await`s it. Awaiting yields to the event loop, so a
-  // real (slow) wrangler call never blocks the lock heartbeat.
+  // Every call gets the pinned account and API base.
   const runWrangler = (
     args: CloudflareOperation,
     callOpts?: { cwd?: string; suppressLogs?: boolean; input?: string },
@@ -4927,12 +3184,6 @@ async function provisionCloudflareResourcesLocked(
         apiBaseUrl: transportApiBaseUrl,
       }),
     ).then(redactResult, (error: unknown) => {
-      // A REJECTING runner (a quarantine, an injected seam rejecting a plain
-      // string/object/array/frozen value) must not smuggle the secret either: EVERY
-      // rejection value is normalized through the ONE redaction carrier before
-      // propagation. In-place where possible (identity/metadata survive), a sanitized
-      // fallback carrier otherwise — with the quarantine classification captured BEFORE
-      // redaction so it can never be lost to a rebuild.
       throw redactRejection(error, redactSecrets);
     });
 
@@ -4969,7 +3220,5 @@ async function provisionCloudflareResourcesLocked(
 
   await reconcileQueues(desired, configPath, runWrangler, resources);
 
-  // account_id was persisted up front (before any remote side effect) — see the
-  // account_id block near the top of this function (fail-closed pin).
   return { resources, configPath, accountIdWritten };
 }
diff --git a/packages/void/src/cli/resolve-project.ts b/packages/void/src/cli/resolve-project.ts
index d89068fee..8548a0b19 100644
--- a/packages/void/src/cli/resolve-project.ts
+++ b/packages/void/src/cli/resolve-project.ts
@@ -1,7 +1,8 @@
 import { readFileSync } from 'node:fs';
+import { log } from '@voidzero-dev/vite-plus-prompts';
 import { join } from 'pathslash';
 import type { PlatformClient, ProjectResponse } from './client.ts';
-import type { ProjectConfig } from './project.ts';
+import { readProjectConfig, type ProjectConfig } from './project.ts';
 
 export function getRequestedProjectSlug(options?: { projectSlug?: string }): string | null {
   const cliSlug = options?.projectSlug?.trim();
@@ -36,6 +37,29 @@ export async function requireProjectBySlug(
   return project;
 }
 
+/** Resolves --project, then VOID_PROJECT, then the linked project; exits with an error otherwise. */
+export async function resolveCommandProjectId(
+  client: Pick<PlatformClient, 'listProjects'>,
+  root: string,
+  projectSlug: string | undefined,
+): Promise<string> {
+  const requestedSlug = projectSlug ?? process.env.VOID_PROJECT?.trim();
+  if (requestedSlug) {
+    const project = resolveProjectBySlug(await client.listProjects(), requestedSlug);
+    if (!project) {
+      log.error(`project: No project found with slug '${requestedSlug}'.`);
+      process.exit(1);
+    }
+    return project.projectId;
+  }
+  const config = readProjectConfig(root);
+  if (!config) {
+    log.error('No linked project. Run `void project link` or pass --project <name>.');
+    process.exit(1);
+  }
+  return config.projectId;
+}
+
 export function inferDefaultSlug(root: string): string {
   const pkgPath = join(root, 'package.json');
   const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
diff --git a/packages/void/src/cli/rollback.ts b/packages/void/src/cli/rollback.ts
index 09120c275..451cfc86f 100644
--- a/packages/void/src/cli/rollback.ts
+++ b/packages/void/src/cli/rollback.ts
@@ -1,7 +1,7 @@
 import { outro, log, select, confirm, isCancel, cancel } from '@voidzero-dev/vite-plus-prompts';
 import { getToken } from './auth.ts';
 import { PlatformClient } from './client.ts';
-import { createSpinner, dim, ensureUtc, formatCount, printSuccess } from './output.ts';
+import { createSpinner, dim, formatCount, formatRelativeTime, printSuccess } from './output.ts';
 import { readDeploymentPlatform, readProjectConfig } from './project.ts';
 
 export async function runRollbackCommand(root: string, deployId?: string): Promise<void> {
@@ -57,7 +57,7 @@ export async function runRollbackCommand(root: string, deployId?: string): Promi
       message: 'Select a deployment to roll back to:',
       options: candidates.map((d) => ({
         value: d.id,
-        label: `${d.id} ${dim(formatAge(d.deployed_at))}`,
+        label: `${d.id} ${dim(d.deployed_at ? formatRelativeTime(d.deployed_at) : '')}`,
         hint: d.source ? `via ${d.source}` : undefined,
       })),
     });
@@ -143,7 +143,7 @@ async function runCloudflareRollback(root: string, deployId?: string): Promise<v
       message: 'Select a version to roll back to:',
       options: candidates.map((version) => ({
         value: version.id,
-        label: `${version.id} ${dim(formatAge(version.createdAt))}`,
+        label: `${version.id} ${dim(version.createdAt ? formatRelativeTime(version.createdAt) : '')}`,
         hint: version.metadata
           ? formatCount(version.metadata.migrations.length, 'migration')
           : 'migration state unknown',
@@ -223,23 +223,3 @@ async function confirmUnrevertedMigrations(
   );
   await confirmRollbackOrExit();
 }
-
-function formatAge(deployedAt: string | null): string {
-  if (!deployedAt) {
-    return '';
-  }
-  const diffMs = Date.now() - new Date(ensureUtc(deployedAt)).getTime();
-  if (diffMs < 60_000) {
-    return 'just now';
-  }
-  const minutes = Math.floor(diffMs / 60_000);
-  if (minutes < 60) {
-    return `${minutes}m ago`;
-  }
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) {
-    return `${hours}h ago`;
-  }
-  const days = Math.floor(hours / 24);
-  return `${days}d ago`;
-}
diff --git a/packages/void/src/cli/secret.ts b/packages/void/src/cli/secret.ts
index 016119ccd..d8d182aec 100644
--- a/packages/void/src/cli/secret.ts
+++ b/packages/void/src/cli/secret.ts
@@ -8,58 +8,37 @@ import { readDeploymentPlatform, readProjectConfig } from './project.ts';
 import { getRequestedProjectSlug, resolveProjectBySlug } from './resolve-project.ts';
 import type { SecretArgs } from './secret-args.ts';
 
+type SecretEntry = { name: string; value: string };
+
+type SecretBackend = {
+  /** Named in the sync confirmation. */
+  target: string;
+  list(): Promise<Array<string>>;
+  put(name: string, value: string): Promise<void>;
+  sync(secrets: Array<SecretEntry>): Promise<void>;
+  delete(name: string): Promise<void>;
+};
+
 export async function runSecretCommand(root: string, args: SecretArgs): Promise<void> {
   console.log();
 
-  const platform = readDeploymentPlatform(root);
-  if (platform === 'cloudflare') {
-    return runCloudflareSecretCommand(root, args);
-  }
-  if (platform === 'none') {
-    throw new Error('secret: Deployment is disabled. Run `void init` to choose a platform.');
-  }
-
-  const token = getToken(root);
-  if (!token) {
-    log.error('Not logged in. Run `void account login` first.');
-    process.exit(1);
-  }
-
-  const client = new PlatformClient(token, { root });
-  const requestedProjectName = getRequestedProjectSlug({ projectSlug: args.projectName });
-  let projectId: string;
-  if (requestedProjectName) {
-    const projects = await client.listProjects();
-    const config = resolveProjectBySlug(projects, requestedProjectName);
-    if (!config) {
-      throw new Error(`secret: No project found with slug '${requestedProjectName}'.`);
-    }
-    projectId = config.projectId;
-  } else {
-    const config = readProjectConfig(root);
-    if (!config) {
-      throw new Error(
-        'No linked project found. Run `void project link`, `void deploy`, or pass --project <name>.',
-      );
-    }
-    projectId = config.projectId;
-  }
+  const backend = await resolveSecretBackend(root, args);
 
   if (args.action === 'list') {
-    const secrets = await client.listSecrets(projectId);
-    if (secrets.length === 0) {
+    const names = await backend.list();
+    if (names.length === 0) {
       outro('No secrets set.');
       return;
     }
-    note(secrets.map((s) => `  ${s.name}`).join('\n'), 'Secrets');
-    outro(formatCount(secrets.length, 'secret'));
+    note(names.map((name) => `  ${name}`).join('\n'), 'Secrets');
+    outro(formatCount(names.length, 'secret'));
     return;
   }
 
   if (args.action === 'put') {
     const value = args.value ?? (await readSecretValue());
     await validateSecretValues(root, [{ name: args.name, value }]);
-    await client.setSecret(projectId, args.name, value);
+    await backend.put(args.name, value);
     printSuccess(`Secret ${args.name} set.`);
     return;
   }
@@ -80,26 +59,79 @@ export async function runSecretCommand(root: string, args: SecretArgs): Promise<
     }
 
     const proceed = await confirm({
-      message: `This will overwrite ${formatCount(secrets.length, 'secret')} in the remote environment. Continue?`,
+      message: `This will overwrite ${formatCount(secrets.length, 'secret')} in the ${backend.target}. Continue?`,
     });
     if (isCancel(proceed) || !proceed) {
       cancel('Secret sync cancelled.');
       process.exit(0);
     }
 
-    for (const s of secrets) {
-      await client.setSecret(projectId, s.name, s.value);
-      log.step(`Set ${s.name}`);
-    }
+    await backend.sync(secrets);
     printSuccess(`Synced ${formatCount(secrets.length, 'secret')}.`);
     return;
   }
 
-  await client.deleteSecret(projectId, args.name);
+  await backend.delete(args.name);
   printSuccess(`Secret ${args.name} deleted.`);
 }
 
-async function runCloudflareSecretCommand(root: string, args: SecretArgs): Promise<void> {
+async function resolveSecretBackend(root: string, args: SecretArgs): Promise<SecretBackend> {
+  const platform = readDeploymentPlatform(root);
+  if (platform === 'cloudflare') {
+    return resolveCloudflareSecretBackend(root, args);
+  }
+  if (platform === 'none') {
+    throw new Error('secret: Deployment is disabled. Run `void init` to choose a platform.');
+  }
+
+  const token = getToken(root);
+  if (!token) {
+    log.error('Not logged in. Run `void account login` first.');
+    process.exit(1);
+  }
+
+  const client = new PlatformClient(token, { root });
+  const requestedProjectName = getRequestedProjectSlug({ projectSlug: args.projectName });
+  let projectId: string;
+  if (requestedProjectName) {
+    const projects = await client.listProjects();
+    const config = resolveProjectBySlug(projects, requestedProjectName);
+    if (!config) {
+      throw new Error(`secret: No project found with slug '${requestedProjectName}'.`);
+    }
+    projectId = config.projectId;
+  } else {
+    const config = readProjectConfig(root);
+    if (!config) {
+      throw new Error(
+        'No linked project found. Run `void project link`, `void deploy`, or pass --project <name>.',
+      );
+    }
+    projectId = config.projectId;
+  }
+
+  return {
+    target: 'remote environment',
+    list: async () => (await client.listSecrets(projectId)).map((s) => s.name),
+    put: async (name, value) => {
+      await client.setSecret(projectId, name, value);
+    },
+    sync: async (secrets) => {
+      for (const s of secrets) {
+        await client.setSecret(projectId, s.name, s.value);
+        log.step(`Set ${s.name}`);
+      }
+    },
+    delete: async (name) => {
+      await client.deleteSecret(projectId, name);
+    },
+  };
+}
+
+async function resolveCloudflareSecretBackend(
+  root: string,
+  args: SecretArgs,
+): Promise<SecretBackend> {
   if (args.projectName) {
     throw new Error(
       'secret: --project selects a Void platform project and is not used for direct Cloudflare apps.',
@@ -113,49 +145,13 @@ async function runCloudflareSecretCommand(root: string, args: SecretArgs): Promi
     syncCloudflareSecrets,
   } = await import('./cloudflare-operations.ts');
   const context = resolveCloudflareOperationContext(root);
-
-  if (args.action === 'list') {
-    const secrets = await listCloudflareSecrets(context);
-    if (secrets.length === 0) {
-      outro('No secrets set.');
-      return;
-    }
-    note(secrets.map((name) => `  ${name}`).join('\n'), 'Secrets');
-    outro(formatCount(secrets.length, 'secret'));
-    return;
-  }
-  if (args.action === 'put') {
-    const value = args.value ?? (await readSecretValue());
-    await validateSecretValues(root, [{ name: args.name, value }]);
-    await putCloudflareSecret(context, args.name, value);
-    printSuccess(`Secret ${args.name} set.`);
-    return;
-  }
-  if (args.action === 'sync') {
-    const secrets = parseDotenvFile(args.file);
-    if (secrets.length === 0) {
-      log.warn('No secrets found in file.');
-      outro('Nothing to sync.');
-      return;
-    }
-    await validateSecretValues(root, secrets);
-    log.info(`Found ${formatCount(secrets.length, 'secret')}:`);
-    for (const secret of secrets) {
-      log.message(`  ${secret.name}`);
-    }
-    const proceed = await confirm({
-      message: `This will overwrite ${formatCount(secrets.length, 'secret')} in the Cloudflare Worker. Continue?`,
-    });
-    if (isCancel(proceed) || !proceed) {
-      cancel('Secret sync cancelled.');
-      process.exit(0);
-    }
-    await syncCloudflareSecrets(context, secrets);
-    printSuccess(`Synced ${formatCount(secrets.length, 'secret')}.`);
-    return;
-  }
-  await deleteCloudflareSecret(context, args.name);
-  printSuccess(`Secret ${args.name} deleted.`);
+  return {
+    target: 'Cloudflare Worker',
+    list: () => listCloudflareSecrets(context),
+    put: (name, value) => putCloudflareSecret(context, name, value),
+    sync: (secrets) => syncCloudflareSecrets(context, secrets),
+    delete: (name) => deleteCloudflareSecret(context, name),
+  };
 }
 
 const SECRET_KEY_RE = /^[A-Z][A-Z0-9_]*$/;
diff --git a/packages/void/src/cli/subcommand-prompt.ts b/packages/void/src/cli/subcommand-prompt.ts
index dd03285a3..e528d8cf3 100644
--- a/packages/void/src/cli/subcommand-prompt.ts
+++ b/packages/void/src/cli/subcommand-prompt.ts
@@ -50,6 +50,12 @@ export type SubcommandResult = {
   extraArgs?: Array<string>;
 };
 
+const isUpKey = (key: string) => key === '\x1B[A' || key === '\x1BOA';
+const isDownKey = (key: string) => key === '\x1B[B' || key === '\x1BOB';
+const isEnterKey = (key: string) => key === '\r' || key === '\n';
+const isBackspaceKey = (key: string) => key === '\x7F' || key === '\b';
+const isPrintableKey = (key: string) => key.length === 1 && key >= ' ';
+
 export function promptSubcommand(
   command: string,
   subcommands: Array<SubcommandDef>,
@@ -64,18 +70,11 @@ export function promptSubcommand(
     let previousFrame = '';
     let resolved = false;
 
-    // Accumulated state across phases
     let selectedSub: SubcommandDef | null = null;
     let selectedArg: string | undefined;
     const selectedFlags: Record<string, string | true> = {};
-
-    // Flags phase state
     let flagStates: Array<{ enabled: boolean; value: string }> = [];
-
-    // Multi-select phase state
     let multiSelectStates: Array<boolean> = [];
-
-    // Repeat-input phase state
     let repeatEntries: Array<string> = [];
     let repeatInput = '';
 
@@ -129,6 +128,16 @@ export function promptSubcommand(
       );
     }
 
+    function checkboxMarker(selected: boolean, focused: boolean): string {
+      const checkbox = selected
+        ? pc.blue(S_CHECKBOX_SELECTED)
+        : focused
+          ? pc.blue(S_CHECKBOX_INACTIVE)
+          : pc.dim(S_CHECKBOX_INACTIVE);
+      const pointer = focused ? pc.blue(S_RADIO_ACTIVE) : S_RADIO_INACTIVE;
+      return pointer + ' ' + checkbox;
+    }
+
     function instructions(items: Array<string>): Array<string> {
       return formatInstructionFooter(items, getGuide(), stdout);
     }
@@ -170,7 +179,6 @@ export function promptSubcommand(
 
     const title = command ? `void ${command}` : 'void';
 
-    // Header for post-select phases
     function headerLine(): string {
       const argPart = selectedArg ? ` ${selectedArg}` : '';
       return promptTitle(
@@ -180,8 +188,6 @@ export function promptSubcommand(
       );
     }
 
-    // --- Renderers ---
-
     function renderSelect() {
       const lines: Array<string> = [];
       const focused = subcommands[cursor];
@@ -235,12 +241,6 @@ export function promptSubcommand(
         const flag = flags[i];
         const state = flagStates[i];
         const isFocused = i === cursor;
-
-        const checkbox = state.enabled
-          ? pc.blue(S_CHECKBOX_SELECTED)
-          : isFocused
-            ? pc.blue(S_CHECKBOX_INACTIVE)
-            : pc.dim(S_CHECKBOX_INACTIVE);
         const name = flag.name.padEnd(maxFlag);
 
         let valueText = '';
@@ -253,8 +253,9 @@ export function promptSubcommand(
           }
         }
 
-        const pointer = isFocused ? pc.blue(S_RADIO_ACTIVE) : S_RADIO_INACTIVE;
-        lines.push(renderOption(pointer + ' ' + checkbox, name, isFocused, valueText));
+        lines.push(
+          renderOption(checkboxMarker(state.enabled, isFocused), name, isFocused, valueText),
+        );
       }
 
       writeFrame(headerLine(), lines, [
@@ -271,19 +272,9 @@ export function promptSubcommand(
       const maxLabel = Math.max(...options.map((o) => o.label.length));
 
       for (let i = 0; i < options.length; i++) {
-        const opt = options[i];
-        const selected = multiSelectStates[i];
         const isFocused = i === cursor;
-
-        const checkbox = selected
-          ? pc.blue(S_CHECKBOX_SELECTED)
-          : isFocused
-            ? pc.blue(S_CHECKBOX_INACTIVE)
-            : pc.dim(S_CHECKBOX_INACTIVE);
-        const label = opt.label.padEnd(maxLabel);
-
-        const pointer = isFocused ? pc.blue(S_RADIO_ACTIVE) : S_RADIO_INACTIVE;
-        lines.push(renderOption(pointer + ' ' + checkbox, label, isFocused));
+        const label = options[i].label.padEnd(maxLabel);
+        lines.push(renderOption(checkboxMarker(multiSelectStates[i], isFocused), label, isFocused));
       }
 
       writeFrame(headerLine(), lines, instructions(MULTISELECT_INSTRUCTIONS));
@@ -309,8 +300,6 @@ export function promptSubcommand(
       writeFrame(headerLine(), lines, instructions(['Enter add', 'Empty input finish']));
     }
 
-    // --- Lifecycle ---
-
     function cleanup() {
       if (resolved) {
         return;
@@ -406,28 +395,28 @@ export function promptSubcommand(
       finalize();
     }
 
-    // --- Key handlers ---
+    function moveCursor(key: string, length: number): boolean {
+      if (isUpKey(key)) {
+        cursor = cursor === 0 ? length - 1 : cursor - 1;
+        return true;
+      }
+      if (isDownKey(key)) {
+        cursor = (cursor + 1) % length;
+        return true;
+      }
+      return false;
+    }
 
     function handleSelectKey(key: string) {
       const focused = subcommands[cursor];
 
-      // Up
-      if (key === '\x1B[A' || key === '\x1BOA') {
-        cursor = cursor === 0 ? subcommands.length - 1 : cursor - 1;
-        input = '';
-        render();
-        return;
-      }
-      // Down
-      if (key === '\x1B[B' || key === '\x1BOB') {
-        cursor = (cursor + 1) % subcommands.length;
+      if (moveCursor(key, subcommands.length)) {
         input = '';
         render();
         return;
       }
 
-      // Enter
-      if (key === '\r' || key === '\n') {
+      if (isEnterKey(key)) {
         const argRequired = focused.arg && focused.arg.startsWith('<');
         if (argRequired && input.length === 0) {
           return;
@@ -438,8 +427,7 @@ export function promptSubcommand(
         return;
       }
 
-      // Backspace
-      if (key === '\x7F' || key === '\b') {
+      if (isBackspaceKey(key)) {
         if (focused.arg && input.length > 0) {
           input = input.slice(0, -1);
           render();
@@ -447,8 +435,7 @@ export function promptSubcommand(
         return;
       }
 
-      // Printable characters — only if focused subcommand has arg
-      if (focused.arg && key.length === 1 && key >= ' ') {
+      if (focused.arg && isPrintableKey(key)) {
         input += key;
         render();
       }
@@ -459,20 +446,11 @@ export function promptSubcommand(
       const focused = flags[cursor];
       const state = flagStates[cursor];
 
-      // Up
-      if (key === '\x1B[A' || key === '\x1BOA') {
-        cursor = cursor === 0 ? flags.length - 1 : cursor - 1;
-        render();
-        return;
-      }
-      // Down
-      if (key === '\x1B[B' || key === '\x1BOB') {
-        cursor = (cursor + 1) % flags.length;
+      if (moveCursor(key, flags.length)) {
         render();
         return;
       }
 
-      // Space — toggle flag
       if (key === ' ') {
         state.enabled = !state.enabled;
         if (!state.enabled) {
@@ -482,28 +460,23 @@ export function promptSubcommand(
         return;
       }
 
-      // Enter — advance
-      if (key === '\r' || key === '\n') {
-        // Block if any enabled value flag has empty value
+      if (isEnterKey(key)) {
+        // An enabled value flag needs a value before advancing.
         for (let i = 0; i < flags.length; i++) {
           if (flagStates[i].enabled && flags[i].arg && flagStates[i].value.length === 0) {
             return;
           }
         }
-
-        // Collect enabled flags
         for (let i = 0; i < flags.length; i++) {
           if (flagStates[i].enabled) {
             selectedFlags[flags[i].name] = flags[i].arg ? flagStates[i].value : true;
           }
         }
-
         advancePhase();
         return;
       }
 
-      // Backspace — delete char from value
-      if (key === '\x7F' || key === '\b') {
+      if (isBackspaceKey(key)) {
         if (focused.arg && state.enabled && state.value.length > 0) {
           state.value = state.value.slice(0, -1);
           render();
@@ -511,11 +484,9 @@ export function promptSubcommand(
         return;
       }
 
-      // Printable characters — type value for enabled value flag (auto-enables)
-      if (focused.arg && key.length === 1 && key >= ' ') {
-        if (!state.enabled) {
-          state.enabled = true;
-        }
+      // Typing a value enables its flag.
+      if (focused.arg && isPrintableKey(key)) {
+        state.enabled = true;
         state.value += key;
         render();
       }
@@ -525,28 +496,18 @@ export function promptSubcommand(
       const followUp = selectedSub!.followUp as Extract<FollowUpDef, { type: 'multi-select' }>;
       const options = followUp.options;
 
-      // Up
-      if (key === '\x1B[A' || key === '\x1BOA') {
-        cursor = cursor === 0 ? options.length - 1 : cursor - 1;
-        render();
-        return;
-      }
-      // Down
-      if (key === '\x1B[B' || key === '\x1BOB') {
-        cursor = (cursor + 1) % options.length;
+      if (moveCursor(key, options.length)) {
         render();
         return;
       }
 
-      // Space — toggle
       if (key === ' ') {
         multiSelectStates[cursor] = !multiSelectStates[cursor];
         render();
         return;
       }
 
-      // Enter — submit
-      if (key === '\r' || key === '\n') {
+      if (isEnterKey(key)) {
         const selected = options.filter((_, i) => multiSelectStates[i]);
         if (selected.length === 0) {
           return;
@@ -558,8 +519,8 @@ export function promptSubcommand(
     }
 
     function handleRepeatInputKey(key: string) {
-      // Enter — add entry or finish
-      if (key === '\r' || key === '\n') {
+      // Enter adds the typed entry; Enter on empty input finishes.
+      if (isEnterKey(key)) {
         if (repeatInput.length > 0) {
           repeatEntries.push(repeatInput);
           repeatInput = '';
@@ -570,8 +531,7 @@ export function promptSubcommand(
         return;
       }
 
-      // Backspace
-      if (key === '\x7F' || key === '\b') {
+      if (isBackspaceKey(key)) {
         if (repeatInput.length > 0) {
           repeatInput = repeatInput.slice(0, -1);
           render();
@@ -579,8 +539,7 @@ export function promptSubcommand(
         return;
       }
 
-      // Printable characters
-      if (key.length === 1 && key >= ' ') {
+      if (isPrintableKey(key)) {
         repeatInput += key;
         render();
       }
@@ -602,8 +561,6 @@ export function promptSubcommand(
       }
     }
 
-    // --- Main event handler ---
-
     function onData(data: Buffer) {
       if (resolved) {
         return;
diff --git a/packages/void/src/cli/types.ts b/packages/void/src/cli/types.ts
index 0ef035a0b..9d6b6b7c9 100644
--- a/packages/void/src/cli/types.ts
+++ b/packages/void/src/cli/types.ts
@@ -2,32 +2,20 @@ import type { RedirectRule } from '@void/deploy-core';
 
 export type {
   AssetConfig,
-  DeployAppType,
-  DeployArtifact,
   DeployAssetManifestEntry,
   DeployAssetUploadRequest,
   DeployEvent,
-  DeployIntent,
   DeployManifest,
-  DeployRuntimeFeatures,
-  DeploySourceMetadata,
   DeployTarget,
   DeployTargetAdapter,
-  DeployTargetCapabilities,
-  DeployCapabilitySupport,
   DeployUploadPayload,
   HeaderRule,
   LiveManifestMeta,
-  LiveMigrationMeta,
-  MigrationMeta,
   QueueMeta,
   RedirectRule,
   SandboxManifestMeta,
-  SandboxMigrationMeta,
   ScheduleMeta,
   WebSocketManifestMeta,
-  WebSocketMigrationMeta,
-  WebSocketRouteMeta,
 } from '@void/deploy-core';
 
 /** CLI- and development-only routing metadata, stripped before serialization. */
diff --git a/packages/void/src/cli/wrangler.ts b/packages/void/src/cli/wrangler.ts
index 4a0ffe23b..06ebd3339 100644
--- a/packages/void/src/cli/wrangler.ts
+++ b/packages/void/src/cli/wrangler.ts
@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { isDeepStrictEqual } from 'node:util';
 import {
   appendSqliteClassMigration,
   isRecord,
@@ -28,15 +29,6 @@ import { readConfig, type VoidConfig } from '../config.ts';
 import type { DurableObjectModule } from '../durable/scan.ts';
 import type { InferredBindings } from '../inference/walk.ts';
 import type { WebSocketRouteDefinition } from '../router/websocket.ts';
-import {
-  DEFAULT_SANDBOX_BINDING,
-  SANDBOX_MIGRATION_TAG,
-  assertSandboxNamespaceConfig,
-  hasSandboxSqliteMigration,
-  resolveSandboxConfig,
-  sandboxContainerConfig,
-  type ResolvedSandboxConfig,
-} from '../sandbox/config.ts';
 
 const COMPAT_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 /** UTF-8 byte-order mark. Node's utf-8 read preserves a leading one. */
@@ -368,18 +360,9 @@ function resolveGeneratedName(base: string, used: Set<string>, kind: string): st
 }
 
 /**
- * Read compatibility settings from `wrangler.jsonc`/`wrangler.json`,
- * `void.json`, and build output, with priority:
- * void.json > wrangler.jsonc > build output > latest known-good date.
- *
- * This function is read-only: when no explicit `compatibility_date` exists, it
- * returns the latest known-good date without writing it anywhere. Use
- * `ensureWranglerCompat()` when the caller is in a real dev/build/deploy
- * lifecycle and wants to persist the default in `void.json`.
- *
- * @param buildOutputDir - Optional path to the build output directory (e.g.
- *   `dist/ssr`) which may contain a plugin-generated `wrangler.json` with the
- *   correct compat settings for the built worker.
+ * Read compatibility settings with priority: Void config > project Wrangler config >
+ * `<buildOutputDir>/wrangler.json` > latest known-good date. Read-only; use
+ * `ensureWranglerCompat()` to pin the default date.
  */
 export function readWranglerCompat(
   root: string,
@@ -389,11 +372,7 @@ export function readWranglerCompat(
   return resolveWranglerCompat(readWranglerCompatFields(root, config, buildOutputDir));
 }
 
-/**
- * Read compatibility settings and ensure the default date is pinned in
- * `void.json` when no explicit date exists in void.json, wrangler config, or
- * build output.
- */
+/** Like `readWranglerCompat()`, but pins the default date when no source sets one. */
 export function ensureWranglerCompat(
   root: string,
   config?: VoidConfig,
@@ -414,7 +393,6 @@ function readWranglerCompatFields(
 ): WranglerCompatFields {
   const voidConfig = config ?? readVoidConfigIfExists(root);
 
-  // 1. Read wrangler.jsonc / wrangler.json from project root
   let raw: string | undefined;
   for (const path of projectWranglerPaths(root)) {
     try {
@@ -441,7 +419,7 @@ function readWranglerCompatFields(
     }
   }
 
-  // 1b. Read build output wrangler.json as fallback (generated by @cloudflare/vite-plugin)
+  // Fallback: the build output config written by @cloudflare/vite-plugin.
   let buildDate: string | undefined;
   let buildFlags: Array<string> | undefined;
   if (buildOutputDir) {
@@ -463,17 +441,10 @@ function readWranglerCompatFields(
     }
   }
 
-  // 2. Override with void.json worker fields (higher priority)
-  const voidDate = voidConfig?.worker?.compatibility_date;
-  const voidFlags = voidConfig?.worker?.compatibility_flags;
-  if (voidDate !== undefined) {
-    validateCompatDate(voidDate, 'void.json worker config');
-  }
-
   return {
     voidConfig,
-    voidDate,
-    voidFlags,
+    voidDate: voidConfig?.worker?.compatibility_date,
+    voidFlags: voidConfig?.worker?.compatibility_flags,
     wranglerDate,
     wranglerFlags,
     buildDate,
@@ -485,7 +456,6 @@ function resolveWranglerCompat(
   fields: WranglerCompatFields,
   options?: { defaultDate?: string },
 ): WranglerCompat {
-  // 3. Merge: void.json > project wrangler.jsonc > build output
   const compatibilityDate =
     fields.voidDate ??
     fields.wranglerDate ??
@@ -553,26 +523,22 @@ function ensureVoidCompatibilityDate(root: string, config?: VoidConfig): string
 }
 
 /**
- * Sync inferred/configured bindings into the project's wrangler.jsonc for local dev.
- * Only adds bindings that are missing — existing bindings are preserved.
- * Returns true if the file was modified.
+ * Add missing inferred bindings to the project Wrangler config for local dev; existing
+ * bindings are kept. Returns true if the file was written.
  */
 export function syncWranglerBindings(
   root: string,
   bindings: InferredBindings,
   options?: {
-    bindingNames?: { d1?: string; kv?: string; r2?: string; ai?: string; sandbox?: string };
+    bindingNames?: { d1?: string; kv?: string; r2?: string; ai?: string };
     directCloudflareAi?: { gateway?: string };
-    durableObjects?: Array<DurableObjectModule>;
     websockets?: Array<WebSocketRouteDefinition>;
-    sandbox?: ResolvedSandboxConfig;
     live?: boolean | LiveBindingConfig;
   },
 ): boolean {
   const { configPath, parsed, created } = readOrCreateProjectWranglerConfig(root);
   let modified = false;
 
-  // D1
   const d1Name = options?.bindingNames?.d1 ?? 'DB';
   if (bindings.needsD1) {
     const existing = (parsed.d1_databases as Array<{ binding: string }> | undefined) ?? [];
@@ -585,7 +551,6 @@ export function syncWranglerBindings(
     }
   }
 
-  // KV
   const kvName = options?.bindingNames?.kv ?? 'KV';
   if (bindings.needsKV) {
     const existing = (parsed.kv_namespaces as Array<{ binding: string }> | undefined) ?? [];
@@ -595,7 +560,6 @@ export function syncWranglerBindings(
     }
   }
 
-  // R2
   const r2Name = options?.bindingNames?.r2 ?? 'STORAGE';
   if (bindings.needsR2) {
     const existing = (parsed.r2_buckets as Array<{ binding: string }> | undefined) ?? [];
@@ -605,9 +569,8 @@ export function syncWranglerBindings(
     }
   }
 
-  // Framework adapters read bindings from the root Wrangler config. Workers AI
-  // has no local simulator, so direct Cloudflare development needs remote mode.
-  // Managed projects keep using Void's proxy and do not gain a billable binding.
+  // Workers AI has no local simulator, so direct Cloudflare development binds it remotely.
+  // Managed projects keep using Void's proxy and gain no billable binding.
   if (bindings.needsAI && options?.directCloudflareAi) {
     const existing = parsed.ai as Record<string, unknown> | undefined;
     const binding =
@@ -634,11 +597,8 @@ export function syncWranglerBindings(
   }
 
   if (options?.websockets) {
-    // Registered Durable Object classes are data-bearing identities. Removing a
-    // route must not remove its binding or emit `deleted_classes`: either action
-    // can make the next upload invalid or destroy the object's SQLite storage.
-    // Historical WebSocket bindings remain attached and the compiler exports a
-    // tombstone class until an explicit destructive lifecycle command exists.
+    // Never remove a binding or emit `deleted_classes` for a removed route: that can break
+    // the next upload or destroy the class's SQLite storage. The compiler exports a tombstone.
     const existing = durableObjectBindingsOf(parsed);
     const migrations = Array.isArray(parsed.migrations)
       ? (parsed.migrations as Array<DurableObjectMigration>)
@@ -684,104 +644,6 @@ export function syncWranglerBindings(
     }
   }
 
-  if (options?.durableObjects && options.durableObjects.length > 0) {
-    const existingBindings = durableObjectBindingsOf(parsed);
-    for (const module of options.durableObjects) {
-      const conflict = existingBindings.find(
-        (binding) => binding.name === module.bindingName && binding.class_name !== module.className,
-      );
-      if (conflict) {
-        throw new Error(
-          `durable: binding '${module.bindingName}' is already configured for class '${conflict.class_name}', but durable-objects/ requires '${module.className}'.`,
-        );
-      }
-    }
-    const additions = options.durableObjects
-      .filter((module) => !existingBindings.some((binding) => binding.name === module.bindingName))
-      .map((module) => ({ name: module.bindingName, class_name: module.className }));
-    if (additions.length > 0) {
-      parsed.durable_objects = { bindings: [...existingBindings, ...additions] };
-      modified = true;
-    }
-
-    const migrations = Array.isArray(parsed.migrations)
-      ? (parsed.migrations as Array<DurableObjectMigration>)
-      : [];
-    for (const module of options.durableObjects) {
-      const tagConflict = migrations.find(
-        (migration) =>
-          migration.tag === module.migrationTag &&
-          !migration.new_sqlite_classes?.includes(module.className),
-      );
-      if (tagConflict) {
-        throw new Error(
-          `durable: migration tag '${module.migrationTag}' is already used by another Durable Object migration.`,
-        );
-      }
-      if (!hasDurableObjectSqliteMigration(migrations, module.className)) {
-        migrations.push({
-          tag: module.migrationTag,
-          new_sqlite_classes: [module.className],
-        });
-        modified = true;
-      }
-    }
-    if (modified) {
-      parsed.migrations = migrations;
-    }
-  }
-
-  if (bindings.needsSandbox) {
-    const sandbox = options?.sandbox ?? resolveSandboxConfig({ sandbox: true }, root);
-    const bindingName =
-      options?.bindingNames?.sandbox ?? sandbox?.binding ?? DEFAULT_SANDBOX_BINDING;
-    const className = sandbox.className;
-    assertSandboxNamespaceConfig(parsed, sandbox);
-    const existingDurableObjectBindings = durableObjectBindingsOf(parsed);
-    if (!existingDurableObjectBindings.some((binding) => binding.name === bindingName)) {
-      parsed.durable_objects = {
-        bindings: [
-          ...existingDurableObjectBindings,
-          {
-            name: bindingName,
-            class_name: className,
-          },
-        ],
-      };
-      modified = true;
-    }
-
-    const existingContainers =
-      (parsed.containers as Array<{ name?: string; class_name?: string }> | undefined) ?? [];
-    const containers = [
-      ...existingContainers.filter((container) => container.class_name !== className),
-      sandboxContainerConfig(sandbox),
-    ];
-    if (JSON.stringify(containers) !== JSON.stringify(existingContainers)) {
-      parsed.containers = containers;
-      modified = true;
-    }
-
-    const migrations = Array.isArray(parsed.migrations)
-      ? (parsed.migrations as Array<{
-          tag?: string;
-          new_classes?: Array<string>;
-          new_sqlite_classes?: Array<string>;
-        }>)
-      : [];
-    const hasMigration = hasSandboxSqliteMigration(migrations, className);
-    if (!hasMigration) {
-      parsed.migrations = [
-        ...migrations,
-        {
-          tag: SANDBOX_MIGRATION_TAG,
-          new_sqlite_classes: [className],
-        },
-      ];
-      modified = true;
-    }
-  }
-
   if (bindings.needsLive || options?.live) {
     const existingDurableObjectBindings = durableObjectBindingsOf(parsed);
     const liveConfig =
@@ -790,10 +652,7 @@ export function syncWranglerBindings(
         : resolveLiveBindingConfig(root, {
             existingBindings: existingDurableObjectBindings,
             reservedBindings: options?.websockets?.map((route) => route.bindingName),
-            reservedClasses: [
-              ...(options?.websockets?.map((route) => route.className) ?? []),
-              options?.sandbox?.className,
-            ],
+            reservedClasses: options?.websockets?.map((route) => route.className),
           });
     if (!existingDurableObjectBindings.some((binding) => binding.name === liveConfig.bindingName)) {
       parsed.durable_objects = {
@@ -831,17 +690,6 @@ export function syncWranglerBindings(
   return created || modified;
 }
 
-const NO_INFERRED_BINDINGS: InferredBindings = {
-  needsD1: false,
-  needsKV: false,
-  needsR2: false,
-  needsAuth: false,
-  needsQueues: false,
-  needsAI: false,
-  needsSandbox: false,
-  needsLive: false,
-};
-
 /** Persist convention-derived Durable Object bindings and append-only migration history. */
 export function syncWranglerDurableObjects(
   root: string,
@@ -850,7 +698,58 @@ export function syncWranglerDurableObjects(
   if (durableObjects.length === 0) {
     return false;
   }
-  return syncWranglerBindings(root, NO_INFERRED_BINDINGS, { durableObjects });
+  const { configPath, parsed, created } = readOrCreateProjectWranglerConfig(root);
+  let modified = false;
+
+  const existingBindings = durableObjectBindingsOf(parsed);
+  for (const module of durableObjects) {
+    const conflict = existingBindings.find(
+      (binding) => binding.name === module.bindingName && binding.class_name !== module.className,
+    );
+    if (conflict) {
+      throw new Error(
+        `durable: binding '${module.bindingName}' is already configured for class '${conflict.class_name}', but durable-objects/ requires '${module.className}'.`,
+      );
+    }
+  }
+  const additions = durableObjects
+    .filter((module) => !existingBindings.some((binding) => binding.name === module.bindingName))
+    .map((module) => ({ name: module.bindingName, class_name: module.className }));
+  if (additions.length > 0) {
+    parsed.durable_objects = { bindings: [...existingBindings, ...additions] };
+    modified = true;
+  }
+
+  const migrations = Array.isArray(parsed.migrations)
+    ? (parsed.migrations as Array<DurableObjectMigration>)
+    : [];
+  for (const module of durableObjects) {
+    const tagConflict = migrations.find(
+      (migration) =>
+        migration.tag === module.migrationTag &&
+        !migration.new_sqlite_classes?.includes(module.className),
+    );
+    if (tagConflict) {
+      throw new Error(
+        `durable: migration tag '${module.migrationTag}' is already used by another Durable Object migration.`,
+      );
+    }
+    if (!hasDurableObjectSqliteMigration(migrations, module.className)) {
+      migrations.push({
+        tag: module.migrationTag,
+        new_sqlite_classes: [module.className],
+      });
+      modified = true;
+    }
+  }
+  if (modified) {
+    parsed.migrations = migrations;
+  }
+
+  if (created || modified) {
+    writeProjectWranglerFile(configPath, JSON.stringify(parsed, null, 2) + '\n');
+  }
+  return created || modified;
 }
 
 /** Persist WebSocket Durable Object bindings and SQLite migration history. */
@@ -865,10 +764,8 @@ export function syncWranglerWebSockets(
 }
 
 /**
- * Return registered WebSocket classes that no longer have a source route.
- * These classes must remain exported while their data-bearing bindings remain
- * in Wrangler configuration. Arbitrary user Durable Objects are excluded by
- * requiring provenance from Void's WebSocket migration tag.
+ * Registered WebSocket classes without a source route. They stay exported while their
+ * bindings remain; only classes created by Void's WebSocket migration tag count.
  */
 export function readWranglerWebSocketTombstones(
   root: string,
@@ -906,14 +803,8 @@ export function readWranglerWebSocketTombstones(
   ].sort();
 }
 
-/**
- * Ensure a wrangler config has an explicit compatibility date.
- * Used when `worker.compatibility_date` is configured in void.json but the
- * active framework reads Cloudflare settings from wrangler.jsonc/json.
- */
+/** Write the resolved compatibility date for frameworks that read the Wrangler config. */
 export function ensureWranglerCompatibilityDate(root: string, compatibilityDate: string): boolean {
-  validateCompatDate(compatibilityDate, 'void.json worker config');
-
   const { configPath, parsed } = readOrCreateProjectWranglerConfig(root);
   if (parsed.compatibility_date === compatibilityDate) {
     return false;
@@ -924,10 +815,7 @@ export function ensureWranglerCompatibilityDate(root: string, compatibilityDate:
   return true;
 }
 
-/**
- * Ensure the `nodejs_als` compatibility flag exists in wrangler config.
- * Returns true if the config file was modified.
- */
+/** Add the `nodejs_als` compatibility flag. Returns true if the file was written. */
 export function ensureWranglerNodejsAlsFlag(root: string): boolean {
   const { configPath, parsed } = readOrCreateProjectWranglerConfig(root);
   const compatibilityFlags = Array.isArray(parsed.compatibility_flags)
@@ -942,16 +830,13 @@ export function ensureWranglerNodejsAlsFlag(root: string): boolean {
   return true;
 }
 
-/** A wrangler `queues.producers[]` entry (written verbatim). */
+/** A Wrangler `queues.producers[]` entry. */
 export type WranglerQueueProducer = {
   queue: string;
   binding: string;
 };
 
-/**
- * A wrangler `queues.consumers[]` entry (written verbatim, snake_case wrangler
- * keys). Mirrors exactly what Void's queue scanner / `mergeBindings` emit.
- */
+/** A Wrangler `queues.consumers[]` entry, as Void's queue scanner emits it. */
 export type WranglerQueueConsumer = {
   queue: string;
   max_batch_size?: number;
@@ -961,27 +846,10 @@ export type WranglerQueueConsumer = {
 };
 
 /**
- * Patch describing the root-config gaps that `wrangler <res> create
- * --update-config` does NOT fill. `writeProvisionedWranglerConfig` applies these
- * to the project's root `wrangler.jsonc`/`wrangler.json`.
- *
- * Queues — per-app-class behavior (verified against `index.ts`/`deploy.ts`):
+ * Root Wrangler config fields that Cloudflare's create commands do not write.
  *
- *   - NATIVE Void mode (no meta-framework; `detectFramework` → undefined):
- *     `mergeBindings` (`index.ts`) emits scanner-derived `queues.producers`/
- *     `consumers` into `dist/ssr/wrangler.json`, and `@cloudflare/vite-plugin`
- *     `defu`-merges the plugin config over the root config (arrays CONCATENATE).
- *     So the caller must NOT pass `queues` for a native app — it would DUPLICATE
- *     the scanner's entries. Leave `queues` undefined; the build binds them.
- *
- *   - FRAMEWORK mode (Class A: `index.ts:738` forces `queues = []`; Class B/C:
- *     the plugin returns before `mergeBindings` runs): the build emits NO queue
- *     bindings, yet the queue feature IS supported in production — the deploy
- *     wrapper (`cli/wrapper.ts`) adds a `queue: handleQueue` consumer to the
- *     framework worker. On self-host there is no Void platform to bind the
- *     queues, and `wrangler queues create` has no `--update-config`, so the
- *     deploy orchestrator passes the inferred producers/consumers here to
- *     bind them in the root config for framework self-host builds only.
+ * Pass `queues` for framework self-host builds only. A native Void build already emits
+ * scanner queues, and the Cloudflare plugin concatenates arrays, so they would duplicate.
  */
 export type ProvisionedWranglerPatch = {
   /** Cloudflare account id → top-level `account_id` (always overwritten). */
@@ -992,23 +860,12 @@ export type ProvisionedWranglerPatch = {
   compatibilityDate?: string;
   /** Compatibility flags to add without removing existing flags. */
   compatibilityFlags?: Array<string>;
-  /**
-   * Adds `migrations_dir` to the `d1_databases[]` entry whose `binding` matches.
-   * The D1 entry itself is created by `wrangler d1 create --update-config`; this
-   * only fills its `migrations_dir`.
-   */
+  /** Fills `migrations_dir` on the existing `d1_databases[]` entry with this binding. */
   d1MigrationsDir?: { binding: string; dir: string };
   /**
-   * ADOPT an already-existing resource: write its REAL id/name into the config
-   * entry matched by `binding`, creating the entry (and its array) if absent.
-   *
-   * These exist because `wrangler <res> create --update-config` — which is what
-   * writes the id on the CREATE path — cannot run when the resource already
-   * exists in the account (create errors on a name collision). So on the adopt
-   * path the provisioner captures the id via `wrangler <res> list/info --json`
-   * and routes it through here, keeping every comment-preserving jsonc write in
-   * this one writer. Each is an idempotent, comment-preserving property upsert
-   * (byte-identical on re-run) that never touches sibling fields.
+   * Adopt an existing resource: upsert its id/name into the entry keyed by `binding`,
+   * creating the entry when absent. Create commands cannot write the id of a resource
+   * that already exists.
    */
   d1?: { binding: string; databaseName: string; databaseId: string };
   kv?: { binding: string; id: string };
@@ -1017,24 +874,8 @@ export type ProvisionedWranglerPatch = {
   /** Persist WebSocket bindings and append-only Durable Object migration history. */
   webSockets?: Array<Pick<WebSocketRouteDefinition, 'bindingName' | 'className' | 'filePath'>>;
   /**
-   * Queue producer/consumer bindings, upserted into `queues.producers[]` /
-   * `queues.consumers[]` idempotently, keyed by each section's wrangler identity
-   * so re-runs never duplicate:
-   *
-   *   - Producers are matched by `binding`. wrangler requires producer binding
-   *     names to be UNIQUE across the worker (multiple producers may legally
-   *     target one queue), so the binding — not the queue — is the identity.
-   *     Void's binding is the deterministic `QUEUE_<NAME>`. A missing binding is
-   *     APPENDED (never rewriting a user's own same-queue producer); a binding
-   *     already bound to a DIFFERENT queue fails closed (a binding must map to
-   *     exactly one queue, else wrangler rejects the deploy).
-   *   - Consumers are matched by `queue`. wrangler allows exactly one consumer
-   *     per queue, so the queue name is the identity; matched entries are
-   *     property-upserted (user-tuned fields preserved).
-   *
-   * FRAMEWORK self-host ONLY. See the per-app-class note on this type: a native
-   * Void app already emits scanner queues from the build, so passing `queues`
-   * for one would duplicate them via the `defu` array concat.
+   * Producers are keyed by `binding` (several producers may target one queue); consumers
+   * by `queue` (one consumer per queue). Framework self-host only; see above.
    */
   queues?: {
     producers?: Array<WranglerQueueProducer>;
@@ -1042,31 +883,14 @@ export type ProvisionedWranglerPatch = {
     /** Remove only stale entries carrying explicit Void-managed provenance. */
     reconcileVoidOwned?: boolean;
   };
-  /**
-   * Email (Mode B — the developer's own Cloudflare account; design doc 0078).
-   *
-   * `sendEmail` upserts `{ name }` into the top-level `send_email[]` array, keyed by
-   * `name` (wrangler's identity for that field — it has no `.binding`). A matched
-   * entry is left exactly as it is (its `destination_address` /
-   * `allowed_destination_addresses` are user-owned); a missing one is appended and
-   * the array is created when absent. Other entries are never touched.
-   */
+  /** Upserts `{ name }` into `send_email[]`; an existing entry's destinations are user-owned. */
   sendEmail?: { name: string };
   /**
-   * The top-level `addresses` string array wrangler ≥ 4.113 reconciles Email
-   * Routing rules from on `wrangler deploy`. Void OWNS the whole array in Mode B
-   * (decision 13), so this is a whole-array write, not a merge:
-   *   - `string[]` → set the array to exactly this value (rewritten every run);
-   *   - `null`     → delete the key (routing is not ready — an EMPTY array would
-   *                  delete every rule wrangler owns, so the key must go instead);
-   *   - `undefined`→ untouched.
+   * Email Routing `addresses`, owned by Void as a whole array. `null` deletes the key:
+   * an empty array would delete every routing rule.
    */
   addresses?: Array<string> | null;
-  /**
-   * Top-level `vars` to upsert by key (e.g. `__VOID_EMAIL_FROM`). Existing keys
-   * with a different value are overwritten; other keys are untouched; the `vars`
-   * object is created when absent.
-   */
+  /** `vars` to upsert by key; other keys are left as they are. */
   vars?: Record<string, string>;
 };
 
@@ -1134,11 +958,8 @@ function writeManagedQueueProvenance(text: string, provenance: ManagedQueueProve
 }
 
 /**
- * Return explicitly Void-owned consumer names that may need remote cleanup.
- *
- * Current managed consumers are included for schema-1 upgrades; the activation layer subtracts
- * consumers still present in the desired config. Pending removals survive failed deploys so a
- * later retry can finish cleanup without inferring ownership from queue naming conventions.
+ * Void-owned consumer queues that may need remote cleanup: current managed consumers (the
+ * caller subtracts desired ones) and pending removals, which survive failed deploys.
  */
 export function readWranglerManagedQueueCleanupCandidates(configPath: string): Array<string> {
   if (!existsSync(configPath)) {
@@ -1180,40 +1001,22 @@ export type WriteProvisionedWranglerResult = {
   configPath: string;
   /** True when the file content changed (or a new file was created). */
   modified: boolean;
-  /**
-   * True when `d1MigrationsDir` was requested but no `d1_databases[]` entry with
-   * the given binding existed. The orchestrator controls ordering — the D1
-   * entry is created by `wrangler d1 create --update-config` first, so a skip
-   * signals the writer ran before provisioning that binding.
-   */
+  /** True when `d1MigrationsDir` named a binding with no `d1_databases[]` entry yet. */
   d1MigrationsDirSkipped: boolean;
 };
 
 /**
- * Fill root Wrangler config fields required by generated/provisioned resources, including
- * append-only WebSocket Durable Object bindings and migrations, and Mode B email fields
- * (`send_email`, `addresses`, `vars`) that have no Wrangler command.
- *
- * Comment-preserving: uses `jsonc-parser` `modify()` + `applyEdits()` so
- * comments and unrelated content survive (unlike `syncWranglerBindings`, which
- * round-trips through `JSON.stringify` and strips comments). Every edit is an
- * idempotent upsert — running twice produces byte-identical output.
+ * Apply a {@link ProvisionedWranglerPatch} to the root Wrangler config. Edits keep comments
+ * and unrelated content, and a second run produces the same bytes.
  */
 export function writeProvisionedWranglerConfig(
   root: string,
   patch: ProvisionedWranglerPatch,
   options?: { configPath?: string },
 ): WriteProvisionedWranglerResult {
-  // Resolve the root config file. When the caller pins an EXACT `configPath`
-  // (the provisioner does, so its read-first parse, wrangler `-c`, and this
-  // write all operate on the SAME file — no split-brain), honor it verbatim.
-  // Otherwise fall back to the same discovery idiom as the rest of this file:
-  // prefer wrangler.jsonc, fall back to wrangler.json, else create wrangler.jsonc.
   const configPath = options?.configPath ?? discoverWranglerConfigPath(root);
 
-  // Node's utf-8 read preserves a leading BOM; wrangler itself strips the BOM
-  // before parsing. Match that: strip it for parsing/editing, then re-add it on
-  // write so the file's bytes round-trip unchanged.
+  // Wrangler strips a leading BOM before parsing. Strip it for editing and restore it on write.
   const rawContent = existsSync(configPath) ? readFileSync(configPath, 'utf-8') : '{}';
   const hasBom = rawContent.startsWith(UTF8_BOM);
   const original = hasBom ? rawContent.slice(UTF8_BOM.length) : rawContent;
@@ -1222,50 +1025,32 @@ export function writeProvisionedWranglerConfig(
   try {
     parsed = parseJsonc(original);
   } catch (error) {
-    // Fail closed. Never treat an unparseable config as `{}`: that would let the
-    // only-if-absent logic clobber an existing `name`/`compatibility_date`, miss
-    // real `d1_databases[]` entries, and rewrite a malformed file. Throw without
-    // writing so the caller surfaces the problem instead of corrupting the file.
+    // Never treat an unparseable config as `{}`: the only-if-absent upserts would clobber it.
     throw new Error(
       `deploy: cannot update "${configPath}" — it is not valid JSON/JSONC. ` +
         `Fix the file and retry. (${(error as Error).message})`,
     );
   }
 
-  // Fail closed on duplicate member names BEFORE any edit. jsonc-parser's
-  // `parse()` resolves a duplicate key to the LAST member (the value wrangler
-  // itself reads), but `modify()` edits the FIRST. So an upsert would compare
-  // against the effective (last) value, patch the shadowed (first) member, and
-  // leave wrangler reading the stale value — while a re-run finds the effective
-  // value still unchanged, re-patches the already-correct first member, and
-  // returns `modified: false`, looking byte-idempotent even though the requested
-  // production setting was NEVER applied. This is config-wide (a duplicate
-  // `account_id`, `compatibility_date`, a queue consumer's `max_batch_size`,
-  // etc.). Throwing without writing surfaces the problem instead of silently
-  // mis-editing (matches the malformed-config guard above). We do not "target
-  // the last member": that would leave a malformed, still-duplicated file.
+  // With a duplicate key, `parse()` reads the last member (as Wrangler does) but `modify()`
+  // edits the first, so an upsert would silently not apply.
   assertNoDuplicateMembers(original, configPath);
 
   const formattingOptions = detectFormattingOptions(original);
   let text = original;
-  // Paths this call overwrites with a scalar. When a scalar-expected field
-  // (account_id, migrations_dir, a queue option) already holds a COMPOSITE
-  // object/array value, `jsonc-parser.modify()` replaces the whole node —
-  // deleting any comment nested inside it while still reporting the edit as
-  // applied. The final comment-preservation gate below uses these paths to name
-  // the offending field when it detects such a drop.
+  // Paths overwritten with a scalar. If one held an object/array, `modify()` dropped its
+  // nested comments; the final comment gate uses these paths to name the field.
   const scalarSetPaths: Array<Array<string | number>> = [];
   const set = (path: Array<string | number>, value: unknown): void => {
     scalarSetPaths.push(path);
     text = applyMemberEdit(text, path, value, { formattingOptions });
   };
 
-  // account_id — always overwrite so a re-resolve can correct a stale value.
+  // Always overwrite account_id so a re-resolve can correct a stale value.
   if (patch.accountId !== undefined) {
     set(['account_id'], patch.accountId);
   }
 
-  // name / compatibility_date — only when absent (never clobber the user's).
   if (patch.name !== undefined && parsed.name === undefined) {
     set(['name'], patch.name);
   }
@@ -1295,12 +1080,7 @@ export function writeProvisionedWranglerConfig(
     }
   }
 
-  // Lazily-built map of EVERY binding name already used anywhere in the config
-  // (keyed name → wrangler's friendly owner label). Used by the queue-producer
-  // append guard further down; built from the CURRENT `text` at first use so it
-  // reflects any adopt appended earlier in this call (not the stale initial
-  // `parsed`). The adopt guard below rebuilds its own view per adopt (it must
-  // include queues.producers, which this collector deliberately omits).
+  // Binding name -> owner label for the producer guard, built from the current text on first use.
   let workerBindingOwners: Map<string, string> | undefined;
 
   if (patch.webSockets && patch.webSockets.length > 0) {
@@ -1392,42 +1172,18 @@ export function writeProvisionedWranglerConfig(
     }
   }
 
-  // Adopt fields — write the REAL id/name of an already-existing resource into
-  // the binding's config entry (create the array + entry if absent), keyed by
-  // `binding`. Runs BEFORE `migrations_dir` so an adopt that CREATES a D1 entry
-  // is visible to the `migrations_dir` upsert below (which re-parses `text`).
-  // Each is an idempotent property upsert: a matched entry has only the supplied
-  // props set (siblings + comments preserved), a missing one is appended.
-  //
-  // The upsert upholds the SAME worker-wide binding invariants the producer path
-  // enforces (see `validateBindingsHaveUniqueNames` mirror below):
-  //   - >1 entry in the target array sharing `binding` → fail closed (ambiguous:
-  //     adoption cannot pick which to write, and wrangler rejects the duplicate).
-  //   - The binding is already used by ANOTHER binding type — a KV bound `DB`, a
-  //     var, a secret, a QUEUE PRODUCER, … — whether we are APPENDING a new entry
-  //     OR UPDATING an existing matched one → fail closed (a cross-type duplicate
-  //     binding name wrangler rejects at deploy).
-  //
-  // `identityKey` is the member property wrangler keys the field on: `binding` for
-  // the id-bearing resources, `name` for `send_email` (which has no `.binding` —
-  // see `nameKeyedBindingEntries`).
+  // Upsert the supplied properties into the entry keyed by `identityKey`, or append one.
+  // Runs before migrations_dir so a D1 entry created here is matched there.
   const upsertAdoptedBinding = (
     field: string,
     binding: string,
     properties: Record<string, string>,
     identityKey: 'binding' | 'name' = 'binding',
   ): void => {
-    // Re-parse the CURRENT text (not the initial `parsed`) so this sees any adopt
-    // appended earlier in THIS call — a stale map would let a multi-field patch
-    // adopt the same binding into two arrays without noticing the collision.
+    // Re-parse so an adopt earlier in this call is seen.
     const currentConfig = parseJsonc(text);
     const rawList = currentConfig[field];
-    // Strictly validate the TARGET field's own shape too. The owner collector
-    // below EXCLUDES this field (so the matched entry does not self-collide), so
-    // without this a malformed member in the target array (e.g. a `null` beside a
-    // valid `{binding}`) would be silently skipped by the match loop and could hide a
-    // real duplicate binding. Reuse the ONE field-aware validator; it throws on any
-    // malformed member (fail closed) before we mutate the array.
+    // The owner collector below excludes this field, so validate its shape here.
     bindingNamesForField(field, rawList);
     const currentList = Array.isArray(rawList) ? [...rawList] : [];
     const matches: Array<{ index: number; entry: Record<string, unknown> }> = [];
@@ -1444,14 +1200,7 @@ export function writeProvisionedWranglerConfig(
           `wrangler rejects duplicate binding names. Remove the duplicate and retry.`,
       );
     }
-    // Worker-wide cross-type uniqueness — checked for BOTH the matched (existing
-    // target) and the append case: a binding shared with any OTHER binding type is
-    // undeployable regardless of whether we create or update this entry. Build the
-    // owner map from the CURRENT config, EXCLUDING the target field (its own
-    // matched entry must not self-collide) and INCLUDING queues.producers (the base
-    // collector omits producers so the producer path does not self-collide, but for
-    // an adopt a producer sharing the binding IS a real cross-type collision).
-    // Reuse the shared collector — do NOT fork it.
+    // A name shared with another binding type is undeployable, whether this entry is new or not.
     const owners = collectWorkerBindingNames(configWithoutField(currentConfig, field));
     addQueueProducerOwners(owners, currentConfig);
     const owner = owners.get(binding);
@@ -1466,7 +1215,7 @@ export function writeProvisionedWranglerConfig(
     if (matches.length === 1) {
       const { index, entry: existing } = matches[0];
       for (const [key, value] of Object.entries(properties)) {
-        if (!jsonEqual(existing[key], value)) {
+        if (!isDeepStrictEqual(existing[key], value)) {
           set([field, index, key], value);
         }
       }
@@ -1497,17 +1246,10 @@ export function writeProvisionedWranglerConfig(
   if (patch.hyperdrive) {
     upsertAdoptedBinding('hyperdrive', patch.hyperdrive.binding, { id: patch.hyperdrive.id });
   }
-  // send_email — the same name-keyed upsert: `{ name }` only, so a matched entry
-  // keeps whatever destination restrictions the user put on it, and the worker-wide
-  // uniqueness guard rejects a `SEND_EMAIL` name already held by another binding.
   if (patch.sendEmail) {
     upsertAdoptedBinding('send_email', patch.sendEmail.name, {}, 'name');
   }
 
-  // migrations_dir — upsert onto the D1 entry matched by binding. Indices are
-  // stable because we only set a property (never insert/reorder array entries).
-  // Re-parse `text` (not the initial `parsed`) so a D1 entry an adopt just
-  // created above is matched here too.
   let d1MigrationsDirSkipped = false;
   if (patch.d1MigrationsDir) {
     const currentD1 = parseJsonc(text).d1_databases;
@@ -1518,9 +1260,6 @@ export function writeProvisionedWranglerConfig(
           migrations_pattern?: unknown;
         }>)
       : [];
-    // Require EXACTLY ONE D1 entry with the binding. `findIndex` (first match)
-    // would silently accept DUPLICATE D1 bindings — a config wrangler rejects —
-    // and attach migrations_dir to only the first. Fail closed on duplicates.
     const matchIndices: Array<number> = [];
     d1Entries.forEach((entry, i) => {
       if (entry.binding === patch.d1MigrationsDir!.binding) {
@@ -1538,13 +1277,6 @@ export function writeProvisionedWranglerConfig(
     }
     const index = matchIndices.length === 1 ? matchIndices[0] : -1;
     if (index >= 0) {
-      // When this patch manages the D1 migrations dir, a DEFINED
-      // non-string `migrations_pattern` (object/array/number/null) is rejected BEFORE
-      // any keep-equivalent/fill branch runs. Wrangler's `resolveMigrationsConfig`
-      // treats the pattern as a string, so committing `migrations_dir` beside a
-      // malformed pattern would report provisioning success on a config that later
-      // `wrangler d1 migrations` commands reject. Fail closed; the file stays
-      // byte-identical (the write happens only after every gate passes).
       const existingPattern = d1Entries[index].migrations_pattern;
       if (existingPattern !== undefined && typeof existingPattern !== 'string') {
         throw new Error(
@@ -1555,14 +1287,9 @@ export function writeProvisionedWranglerConfig(
             `and retry.`,
         );
       }
-      // Fill-if-absent / keep-equivalent /
-      // fail-closed-on-differ. `migrations_dir` is USER-OWNED once set — a reused D1
-      // configured with e.g. `./legacy-migrations` must never be silently rewritten to
-      // Void's default, which would strand the user's migration files.
+      // Once set, `migrations_dir` is user-owned: rewriting it would strand their migrations.
       const existingDir = d1Entries[index].migrations_dir;
       if (existingDir !== undefined && typeof existingDir !== 'string') {
-        // Malformed (object/array/number/…) — wrangler expects a string. Fail closed
-        // without writing (matches the writer's composite-scalar philosophy).
         throw new Error(
           `deploy: cannot update "${configPath}" — the D1 entry for binding ` +
             `${JSON.stringify(patch.d1MigrationsDir.binding)} has a non-string ` +
@@ -1574,7 +1301,6 @@ export function writeProvisionedWranglerConfig(
           normalizeMigrationsPath(existingDir) !==
           normalizeMigrationsPath(patch.d1MigrationsDir.dir)
         ) {
-          // An explicit DIFFERENT directory — fail closed with both paths named.
           throw new Error(
             `deploy: cannot update "${configPath}" — the D1 entry for binding ` +
               `${JSON.stringify(patch.d1MigrationsDir.binding)} already sets "migrations_dir": ` +
@@ -1585,16 +1311,8 @@ export function writeProvisionedWranglerConfig(
               `move the migrations and keep your directory, then retry.`,
           );
         }
-        // keep-equivalent: `db/migrations` vs `./db/migrations` vs a trailing slash all
-        // normalize equal (wrangler's own `normalizeRelativePath` rule) — leave the user's
-        // spelling untouched so the file stays byte-identical.
+        // An equivalent spelling (`./db/migrations`, a trailing slash) is kept as written.
       } else {
-        // Absent → fill. A companion `migrations_pattern` (if the user set one) must stay
-        // valid under the dir being written: wrangler requires the normalized pattern to
-        // start with `${migrations_dir}/` (unless the dir normalizes to "."), so filling
-        // the dir under an incompatible pattern would break `wrangler d1 migrations`.
-        // Validate before editing; fail closed and NEVER rewrite the user-owned pattern.
-        // (A defined pattern is narrowed to a STRING by the gate above.)
         if (
           existingPattern !== undefined &&
           !migrationsPatternMatchesDir(existingPattern, patch.d1MigrationsDir.dir)
@@ -1615,19 +1333,6 @@ export function writeProvisionedWranglerConfig(
     }
   }
 
-  // queues — idempotent upsert into `queues.producers[]` / `queues.consumers[]`.
-  // Each section keys on its wrangler identity:
-  //   - PRODUCERS key on `binding`. wrangler requires producer binding names to
-  //     be unique across the worker (multiple producers may target one queue),
-  //     so the binding — not the queue — is the identity. Void's binding is the
-  //     deterministic `QUEUE_<NAME>` (see `queues/scan.ts` + `runtime/queues.ts`).
-  //     A missing binding is appended (a user's own same-queue producer with a
-  //     different binding is left alone — Void must not hijack it); a binding
-  //     already bound to a DIFFERENT queue fails closed.
-  //   - CONSUMERS key on `queue`. wrangler allows exactly one consumer per queue,
-  //     so the queue name is the identity.
-  // Framework self-host only (see the note on ProvisionedWranglerPatch); a native
-  // app would duplicate the build's scanner queues.
   const reconcileManagedQueues = patch.queues?.reconcileVoidOwned === true;
   const managedQueueProvenance = readManagedQueueProvenance(text);
   const managedProducerBindings = new Set(managedQueueProvenance.producerBindings);
@@ -1640,13 +1345,8 @@ export function writeProvisionedWranglerConfig(
     if (!entries || entries.length === 0) {
       return;
     }
-    // Re-parse `text` (not the initial `parsed`) so earlier edits in this call
-    // are reflected; track appends locally to keep indices valid.
+    // Re-parse so earlier edits are seen; appends are tracked locally to keep indices valid.
     const currentQueues = assertObjectContainer(parseJsonc(text).queues, 'queues');
-    // Before mutating producers, route the EXISTING `queues.producers` list
-    // through the SAME strict validator the adopt guard uses. Without this, a corrupt
-    // list (e.g. `[null]`) would be cloned, its non-record members silently skipped by
-    // the match loop below, and a new producer committed beside the corruption.
     const currentList =
       section === 'producers'
         ? assertValidQueueProducers(currentQueues?.producers)
@@ -1654,22 +1354,8 @@ export function writeProvisionedWranglerConfig(
           ? [...(currentQueues.consumers as Array<Record<string, unknown>>)]
           : [];
     for (const entry of entries) {
-      // Match on the section's identity: producers by `binding`, consumers by
-      // `queue`. Keying producers on the queue would rewrite the FIRST of several
-      // legal same-queue producers, so a `{queue,CUSTOM}` + `{queue,QUEUE_JOBS}`
-      // pair collapses into two identical `QUEUE_JOBS` bindings — a config
-      // wrangler rejects.
-      //
-      // A producer `binding` must map to exactly ONE queue, so the fail-closed
-      // guard must inspect EVERY producer sharing the desired binding — not just
-      // the first `findIndex` hit — to stay deterministic regardless of array
-      // order:
-      //   - 0 matches                → append the new producer (`index = -1`).
-      //   - 1 match, same queue      → no-op upsert (idempotent).
-      //   - 1 match, different queue → fail closed (binding bound elsewhere).
-      //   - >1 match (duplicate binding across entries) → fail closed; the
-      //     registry is already undeployable, so never silently "converge" on it
-      //     (an order-dependent first-match check would falsely report success).
+      // A producer binding maps to exactly one queue, so every producer with the binding is
+      // checked: none appends, one must name the same queue, more than one fails closed.
       let index: number;
       if (section === 'producers') {
         const matches: Array<number> = [];
@@ -1700,20 +1386,7 @@ export function writeProvisionedWranglerConfig(
           }
         }
         index = matches.length === 1 ? matches[0] : -1;
-        // Run the canonical worker-wide binding-name collision check for EVERY
-        // producer upsert (matched/idempotent AND append), not only the `index === -1`
-        // append path. wrangler requires every binding NAME to be unique across the
-        // ENTIRE worker — not just within `queues.producers` — so a producer binding
-        // (`QUEUE_<NAME>`) that ALSO names any OTHER binding (D1/KV/R2/DO/service/var/
-        // secret/AI/hyperdrive/vectorize/…) is a cross-type collision wrangler rejects
-        // at deploy. That config is undeployable whether we APPEND the producer or leave
-        // a same-queue one already in place, so BOTH must fail closed: skipping the
-        // check on the idempotent path would silently accept an already-broken config
-        // with `modified:false`, and would also miss a malformed OTHER binding field the
-        // collector fails closed on. The collector deliberately OMITS `queues` (see
-        // FRIENDLY_BINDING_NAMES), so a producer never self-collides. Build from the
-        // CURRENT text so an adopt appended earlier in this call is seen too (not the
-        // stale initial `parsed`).
+        // Check matched producers too: a cross-type collision is undeployable either way.
         workerBindingOwners ??= collectWorkerBindingNames(parseJsonc(text));
         const bindingName = String(entry.binding);
         const owner = workerBindingOwners.get(bindingName);
@@ -1733,31 +1406,19 @@ export function writeProvisionedWranglerConfig(
       }
 
       if (index >= 0) {
-        // Update ONLY the properties this patch supplies — never replace the
-        // whole array element. A whole-object `modify()` at the element index
-        // would drop inline comments AND any sibling fields the narrower
-        // inferred patch omits (producer `delivery_delay`; consumer
-        // `dead_letter_queue`, `max_concurrency`, …), silently changing
-        // production delivery/retry/concurrency/failure-routing. Per-property
-        // edits preserve unmentioned fields and comments, and stay idempotent
-        // (a re-run finds each value already equal and writes nothing). For a
-        // producer matched by binding the queue already equals (a mismatch threw
-        // above), so this loop is a no-op that preserves the user's entry.
+        // Set only the supplied properties: replacing the element would drop comments and
+        // user-tuned fields such as `dead_letter_queue`.
         const existing = currentList[index];
         for (const [key, value] of Object.entries(entry)) {
           if (value === undefined) {
             continue;
           }
-          if (!jsonEqual(existing[key], value)) {
+          if (!isDeepStrictEqual(existing[key], value)) {
             set(['queues', section, index, key], value);
           }
         }
         currentList[index] = { ...existing, ...entry };
       } else {
-        // Append at `currentList.length`; `applyMemberEdit` also creates the
-        // `queues` object and the section array when they don't exist yet, and
-        // keeps a trailing inline comment attached to the preceding entry it
-        // documented (see the comment-relocation logic there).
         text = applyMemberEdit(text, ['queues', section, currentList.length], entry, {
           formattingOptions,
           isArrayInsertion: true,
@@ -1828,15 +1489,9 @@ export function writeProvisionedWranglerConfig(
     }
   }
 
-  // vars — per-key upsert into the top-level `vars` object (created when absent).
-  // Only the keys this patch names are written, and only when their value differs,
-  // so sibling vars and their comments stay byte-identical. A var name is a worker
-  // binding name too (wrangler folds `vars` into `validateBindingsHaveUniqueNames`),
-  // so a key already held by ANOTHER binding type fails closed like the adopt path.
+  // A var name is also a binding name, so it must not collide with another binding type.
   if (patch.vars) {
     const currentConfig = parseJsonc(text);
-    // Validates the outer shape: a present-but-non-object `vars` throws (fail closed)
-    // rather than being replaced wholesale.
     bindingNamesForField('vars', currentConfig.vars);
     const currentVars = isRecord(currentConfig.vars) ? currentConfig.vars : {};
     const owners = collectWorkerBindingNames(configWithoutField(currentConfig, 'vars'));
@@ -1851,44 +1506,29 @@ export function writeProvisionedWranglerConfig(
             `undeployable. Rename the conflicting binding and retry.`,
         );
       }
-      if (!jsonEqual(currentVars[key], value)) {
+      if (!isDeepStrictEqual(currentVars[key], value)) {
         set(['vars', key], value);
       }
     }
   }
 
-  // addresses — Void owns the WHOLE top-level array in Mode B, so a `string[]`
-  // replaces the value outright (skipped when already equal, so a re-run is
-  // byte-identical) and `null` removes the key. Neither goes through `set()`:
-  // the array is composite by design, so the final gate's "expected a string"
-  // diagnosis would be wrong for it — a comment nested inside a user-edited
-  // `addresses` still trips the generic drop check below and fails closed.
+  // `addresses` skips `set()`: it is composite by design, so the final gate's "expected a
+  // string" diagnosis would be wrong. A dropped nested comment still fails that gate.
   if (patch.addresses !== undefined) {
     const currentAddresses = parseJsonc(text).addresses;
     if (patch.addresses === null) {
       text = removeMember(text, ['addresses'], { formattingOptions });
-    } else if (!jsonEqual(currentAddresses, patch.addresses)) {
+    } else if (!isDeepStrictEqual(currentAddresses, patch.addresses)) {
       text = applyMemberEdit(text, ['addresses'], patch.addresses, { formattingOptions });
     }
   }
 
-  // FINAL GATE — global comment-text-preservation invariant. The writer's
-  // contract is that every comment's TEXT survives a write. Relocation only
-  // MOVES a comment (identical text, new position), so the multiset of comment
-  // TOKENS is preserved and this gate passes. A DROPPED comment — the
-  // composite-overwrite case above, or any other pathological path — makes the
-  // output multiset miss a token. Assert the final output is a SUPERSET of the
-  // original's comment tokens BEFORE writing; on any drop, throw WITHOUT writing
-  // so the file is never corrupted (the BOM re-add + write happen only past this
-  // gate). O(n): one scanner pass over each string.
+  // Every comment's text must survive (relocation only moves it). Refuse to write otherwise.
   const droppedComment = findDroppedComment(
     extractCommentTokens(original),
     extractCommentTokens(text),
   );
   if (droppedComment !== undefined) {
-    // Prefer a specific diagnosis when the cause is a scalar-expected field that
-    // held a composite (object/array) value in the ORIGINAL — `modify()` would
-    // have replaced the whole node, dropping the nested comment.
     const originalRoot = parseTree(original, undefined, { allowTrailingComma: true });
     const compositeField = originalRoot
       ? scalarSetPaths.find((path) => {
@@ -2085,12 +1725,7 @@ function parseCustomDomains(value: unknown, configPath: string): Array<WranglerC
   return domains;
 }
 
-/**
- * Extract the multiset of comment TOKENS (line + block) from JSONC source using
- * jsonc-parser's scanner — exact by construction, no regex. Each token is its
- * verbatim source slice, so a relocated comment keeps identical text (its
- * multiset entry is unchanged) while a dropped comment removes one.
- */
+/** Every line and block comment in JSONC source, verbatim, in order. */
 function extractCommentTokens(text: string): Array<string> {
   const scanner = createScanner(text, false);
   const tokens: Array<string> = [];
@@ -2105,12 +1740,7 @@ function extractCommentTokens(text: string): Array<string> {
   return tokens;
 }
 
-/**
- * Multiset-subset check: return the first comment token present in `before` but
- * missing (accounting for repeats) from `after`, or `undefined` when `after` is
- * a superset of `before`. The final gate uses this to prove no comment TEXT was
- * dropped by the edits.
- */
+/** The first comment in `before` missing from `after`, counting repeats, if any. */
 function findDroppedComment(before: Array<string>, after: Array<string>): string | undefined {
   const counts = new Map<string, number>();
   for (const token of after) {
@@ -2126,10 +1756,7 @@ function findDroppedComment(before: Array<string>, after: Array<string>): string
   return undefined;
 }
 
-/**
- * Detect indentation from an existing config so `jsonc-parser` formats inserted
- * content to match. Falls back to two-space indentation (the repo default).
- */
+/** Match inserted content to the file's indentation; two spaces by default. */
 function detectFormattingOptions(text: string): FormattingOptions {
   const match = text.match(/^([ \t]+)\S/m);
   if (match) {
@@ -2152,22 +1779,9 @@ function parseJsonc(text: string): Record<string, unknown> {
 }
 
 /**
- * `modify()` + `applyEdits()`, but when the edit APPENDS a new member after a
- * sibling that carries a trailing inline comment, keep that comment attached to
- * the sibling it documented.
- *
- * jsonc-parser's formatting `modify()` reflows the whole enclosing member/entry
- * region and re-emits a trailing inline comment at the END of that region — so
- * inserting `migrations_dir` after `"database_id": "id" // production db` (or
- * appending a queue entry after `{ … } // jobs producer`) silently reassociates
- * the comment onto the NEWLY inserted member. That violates the writer's
- * comment-preservation contract. Here we detect that exact case, run the
- * (comment-free) formatting edit on a stripped copy, then splice the comment
- * back right after the sibling's separating comma so it stays put.
- *
- * Every other edit (value replacement, append after a comment-free sibling,
- * first insertion into a missing container) falls through to the plain path, so
- * behavior is byte-identical to before outside the trailing-comment case.
+ * `modify()` + `applyEdits()` that keeps a trailing inline comment on the sibling it
+ * documented. When a member is appended, `modify()` moves that comment after the new
+ * member, so edit a copy without it and splice it back after the sibling's comma.
  */
 function applyMemberEdit(
   text: string,
@@ -2182,22 +1796,13 @@ function applyMemberEdit(
     return plain();
   }
 
-  // Only an APPEND can split a sibling from its trailing comment. A value
-  // replacement (existing object key, not an array insertion) reformats just
-  // that member and keeps its own comment — nothing to relocate.
+  // Only an append can separate a sibling from its trailing comment.
   if (!options.isArrayInsertion && findNodeAtLocation(root, path) !== undefined) {
     return plain();
   }
 
-  // Find the container `modify()` will append the new member to. Usually the
-  // leaf container (`path` minus its final key/index). But when that container
-  // does not exist yet, `modify()` creates the first missing segment as a NEW
-  // member of the deepest ANCESTOR that DOES exist — so that ancestor is the
-  // receiver, and its current last member is the preceding sibling whose
-  // trailing comment must stay put (e.g. adding `queues.producers` next to a
-  // `queues.consumers` that carries a `// …` trailing comment). Anchoring the
-  // relocation on the real receiving container keeps the comment on the sibling
-  // in both cases.
+  // A missing container is created inside the deepest existing ancestor, which then
+  // receives the new member.
   let receivingPath = path.slice(0, -1);
   let container = findNodeAtLocation(root, receivingPath);
   while (!container && receivingPath.length > 0) {
@@ -2217,10 +1822,7 @@ function applyMemberEdit(
     return plain();
   }
 
-  // Strip the comment (and the optional separator comma `readTrailingComment`
-  // skipped to reach it), run the now-comment-free formatting edit, then
-  // re-attach the comment after the sibling's separating comma in the rewritten
-  // text.
+  // Strip the comment (and the comma before it), edit, then re-attach it after the new comma.
   const stripped = text.slice(0, last.offset + last.length) + text.slice(trailing.end);
   const rewritten = applyEdits(stripped, modify(stripped, path, value, options));
 
@@ -2239,13 +1841,8 @@ function applyMemberEdit(
   }
   const relocated = `${rewritten.slice(0, commaPos + 1)} ${trailing.text}${rewritten.slice(commaPos + 1)}`;
 
-  // Validate-before-write backstop. Comment relocation must ONLY ever change
-  // comment placement — never JSONC validity or data. Re-parse the relocated
-  // string; if it does not parse, or its data is not deeply equal to the plain
-  // formatting edit's data, discard it and return the plain (always-valid)
-  // result. This makes relocation safe by construction: the worst case is a
-  // comment reassociated by jsonc-parser onto the wrong sibling, but the file is
-  // always valid JSONC and always carries the correct data — never corruption.
+  // Relocation may only move a comment. If the result does not parse or its data differs
+  // from the plain edit, use the plain edit.
   const plainResult = plain();
   let relocatedParsed: Record<string, unknown>;
   try {
@@ -2253,29 +1850,18 @@ function applyMemberEdit(
   } catch {
     return plainResult;
   }
-  if (!jsonEqual(relocatedParsed, parseJsonc(plainResult))) {
+  if (!isDeepStrictEqual(relocatedParsed, parseJsonc(plainResult))) {
     return plainResult;
   }
   return relocated;
 }
 
 /**
- * Remove one object member (the property at `path`), keeping every comment.
- *
- * jsonc-parser's `modify(text, path, undefined)` deletes from the END of the
- * previous member to the end of the removed one — so the previous sibling's
- * trailing comment, a full-line comment above the member, and the member's own
- * trailing comment all vanish (measured on 4.x). The final comment gate would
- * then refuse the write for the common `"name": "app", // worker` shape. Here
- * the property node's exact source range is spliced out instead, plus ONE
- * separating comma (the following one when present, else the preceding one so
- * a strict `.json` file never gains a trailing comma) and the now-blank line it
- * sat on. Comments are never inside those ranges, so they all stay put; a
- * comment that was attached to the removed member is left orphaned on its line.
- *
- * Validate-before-return backstop: the spliced text must parse and equal the
- * plain `modify()` result's data; otherwise the plain edit is returned and the
- * final gate decides. An absent member is a no-op.
+ * Remove the object member at `path`, keeping every comment. `modify(…, undefined)` also
+ * deletes the comments between the previous member and this one, so splice out the
+ * property, one separating comma (the following one, else the preceding one, so strict
+ * JSON gains no trailing comma) and its blank line. Falls back to `modify()` when the
+ * result's data differs.
  */
 function removeMember(
   text: string,
@@ -2291,7 +1877,6 @@ function removeMember(
   const start = property.offset;
   const end = property.offset + property.length;
 
-  // Tokenize once so comments and whitespace are skipped by KIND, never by regex.
   const scanner = createScanner(text, false);
   const tokens: Array<{ kind: SyntaxKind; offset: number; length: number }> = [];
   for (let kind = scanner.scan(); kind !== SyntaxKind.EOF; kind = scanner.scan()) {
@@ -2324,10 +1909,8 @@ function removeMember(
     spliced = spliced.slice(0, range.offset) + spliced.slice(range.offset + range.length);
   }
 
-  // Drop the line the member sat on when nothing but whitespace is left of it
-  // (its trailing comment, if any, keeps the line alive). Handles LF, CRLF and
-  // CR-only endings. `cursor` is the member's start in the spliced text — shifted
-  // left when the removed comma sat before it.
+  // Drop the member's line when only whitespace is left (LF, CRLF or CR endings).
+  // `cursor` is the member's start in the spliced text.
   const cursor = comma && comma.offset < start ? start - comma.length : start;
   let lineStart = cursor;
   while (lineStart > 0 && spliced[lineStart - 1] !== '\n' && spliced[lineStart - 1] !== '\r') {
@@ -2349,23 +1932,15 @@ function removeMember(
   } catch {
     return plainResult;
   }
-  if (!jsonEqual(splicedParsed, parseJsonc(plainResult))) {
+  if (!isDeepStrictEqual(splicedParsed, parseJsonc(plainResult))) {
     return plainResult;
   }
   return spliced;
 }
 
 /**
- * If a trailing inline comment sits on the same line right after `offset`,
- * return its text and end offset. Only whitespace and an OPTIONAL single
- * separator comma may sit between the sibling's value and the comment — so both
- * `"id": "x" // c` and `"id": "x", // c` (a JSONC trailing comma, or the
- * separator once a sibling follows) are recognized. A `//` line comment or a
- * single-line `/* *\/` block comment counts; a newline or closing bracket first
- * means there is no trailing comment (returns undefined). `offset` points just
- * past the sibling's value, and the sibling is always its container's LAST
- * member, so any comma here is a trailing/separator comma — never a boundary to
- * an existing following member.
+ * The `//` or single-line block comment on the same line after `offset` (just past the
+ * last member's value), allowing one comma before it.
  */
 function readTrailingComment(
   text: string,
@@ -2375,10 +1950,6 @@ function readTrailingComment(
   while (i < text.length && (text[i] === ' ' || text[i] === '\t')) {
     i++;
   }
-  // Tolerate one optional separator/trailing comma between the value and its
-  // inline comment. `stripped` (at the call site) removes everything from
-  // `offset` through the comment's end, so the skipped comma is discarded and
-  // the re-attach step re-inserts the comment after the sibling's fresh comma.
   if (text[i] === ',') {
     i++;
     while (i < text.length && (text[i] === ' ' || text[i] === '\t')) {
@@ -2386,12 +1957,7 @@ function readTrailingComment(
     }
   }
   if (text[i] === '/' && text[i + 1] === '/') {
-    // A line comment ends at the first line terminator — CR or LF. Stopping at
-    // BOTH means a classic-Mac CR-only file terminates the comment here instead
-    // of swallowing the rest of the line (including the closing brace, which
-    // would relocate the new member outside the root object and corrupt the
-    // file); and a CRLF file's trailing `\r` is left out of the comment text and
-    // preserved on write.
+    // End at CR or LF, so a CR-only file cannot swallow the closing brace.
     let end = i;
     while (end < text.length && text[end] !== '\n' && text[end] !== '\r') {
       end++;
@@ -2404,8 +1970,7 @@ function readTrailingComment(
       return undefined;
     }
     const end = close + 2;
-    // Only a single-line block comment is safe to relocate onto one line. A CR
-    // or LF inside makes it multi-line → decline (accepted best-effort path).
+    // Only a single-line block comment can be relocated.
     const slice = text.slice(i, end);
     if (slice.includes('\n') || slice.includes('\r')) {
       return undefined;
@@ -2415,12 +1980,7 @@ function readTrailingComment(
   return undefined;
 }
 
-/**
- * Throw (without writing) if any object in the config declares the same member
- * name twice. See the call site for why a duplicate makes property-level upserts
- * silently ineffective. Walks the jsonc AST so nested objects (queue consumers,
- * D1 entries, …) are covered, not just the top level.
- */
+/** Throw if any object in the config, at any depth, declares the same key twice. */
 export function assertNoDuplicateMembers(text: string, configPath: string): void {
   const root = parseTree(text, undefined, { allowTrailingComma: true });
   if (!root) {
@@ -2456,7 +2016,7 @@ export function assertNoDuplicateMembers(text: string, configPath: string): void
   walk(root);
 }
 
-/** 1-based line/column for a byte offset — used in duplicate-key error messages. */
+/** 1-based line and column of an offset. */
 function offsetToLineColumn(text: string, offset: number): { line: number; column: number } {
   let line = 1;
   let column = 1;
@@ -2542,19 +2102,9 @@ function validateDurableObjectMigrations(
 }
 
 /**
- * wrangler's friendly label for each binding namespace. Mirrors
- * `friendlyBindingNames` in `wrangler-dist/cli.js` — the map
- * `validateBindingsHaveUniqueNames` iterates to gather every worker-wide binding
- * name. Drives the owner name in the worker-wide producer-collision error.
- *
- * This is a 1:1 copy of wrangler's `friendlyBindingNames` EXCEPT `queues`, which
- * is intentionally ABSENT: wrangler folds in `queues.producers`, but here producer
- * identity is handled by the upsert's own binding-match logic (and consumers carry
- * no binding), so including it would flag the very producer we are about to append
- * as a self-collision. Every OTHER field wrangler enumerates is present (including
- * `unsafe_hello_world`). `secrets.required` — which wrangler folds in separately
- * under the label "Secret", not via this map — is handled in
- * `collectWorkerBindingNames`.
+ * Wrangler's `friendlyBindingNames`: the fields `validateBindingsHaveUniqueNames` reads, with
+ * their labels. `queues` is left out because the producer upsert matches its own entries;
+ * including it would make a producer collide with itself.
  */
 export const FRIENDLY_BINDING_NAMES: Record<string, string> = {
   data_blobs: 'Data Blob',
@@ -2597,15 +2147,7 @@ export const FRIENDLY_BINDING_NAMES: Record<string, string> = {
   vpc_networks: 'VPC Network',
 };
 
-/**
- * Collect every binding NAME already used across the worker config, mapped to
- * wrangler's friendly owner label (first writer wins on ties). Mirrors the exact
- * name set `validateBindingsHaveUniqueNames` builds in `wrangler-dist/cli.js`:
- * `getBindingNames(config[field])` for every `friendlyBindingNames` field, PLUS
- * `config.secrets.required` under the label "Secret" — minus `queues` (see
- * FRIENDLY_BINDING_NAMES for why). Used to fail closed before appending a queue
- * producer whose binding collides with any other worker-wide binding.
- */
+/** Every binding name in the config, mapped to its owner's label (first one wins). */
 function collectWorkerBindingNames(config: Record<string, unknown>): Map<string, string> {
   const owners = new Map<string, string>();
   const claim = (name: string, friendly: string): void => {
@@ -2618,18 +2160,9 @@ function collectWorkerBindingNames(config: Record<string, unknown>): Map<string,
       claim(name, friendly);
     }
   }
-  // wrangler folds `secrets.required` into the uniqueness set OUTSIDE the
-  // `friendlyBindingNames` loop, under the friendly label "Secret" (see
-  // `validateBindingsHaveUniqueNames`:
-  // `bindingsGroupedByType["Secret"] = config2.secrets?.required ?? []`). These
-  // ARE worker binding names at deploy, so a queue producer must never silently
-  // collide with one.
+  // Wrangler also counts `secrets.required` as binding names, under "Secret".
   const secrets = assertObjectContainer(config.secrets, 'secrets');
   if (secrets && secrets.required !== undefined) {
-    // `secrets.required` is a string[] folded into wrangler's uniqueness set
-    // under "Secret". Validate it STRICTLY: a non-array, or any non-empty-string
-    // member, throws (fail closed) rather than being silently skipped, which would
-    // let a queue producer collide with a real secret binding name unnoticed.
     if (!Array.isArray(secrets.required)) {
       throw new Error(
         `deploy: cannot verify binding-name uniqueness — "secrets.required" must be an array of ` +
@@ -2638,11 +2171,9 @@ function collectWorkerBindingNames(config: Record<string, unknown>): Map<string,
     }
     secrets.required.forEach((name, index) => {
       if (typeof name !== 'string' || name.length === 0) {
-        throw new Error(
-          `deploy: cannot verify binding-name uniqueness — "secrets.required" contains a malformed ` +
-            `entry at index ${index} (expected a non-empty string). Refusing to proceed on a ` +
-            `partially-readable binding set (a dropped entry could hide a real collision). Fix the ` +
-            `wrangler config and retry.`,
+        throw bindingSetError(
+          `"secrets.required" contains a malformed entry at index ${index} (expected a non-empty string)`,
+          'dropped entry',
         );
       }
       claim(name, 'Secret');
@@ -2651,7 +2182,7 @@ function collectWorkerBindingNames(config: Record<string, unknown>): Map<string,
   return owners;
 }
 
-/** A shallow copy of `config` with one field omitted (never mutates the input). */
+/** A shallow copy of `config` without `field`. */
 function configWithoutField(
   config: Record<string, unknown>,
   field: string,
@@ -2660,15 +2191,7 @@ function configWithoutField(
   return rest;
 }
 
-/**
- * Add every `queues.producers[].binding` to an existing worker-binding owner map,
- * under the friendly label "Queue" (first-writer-wins). The base
- * `collectWorkerBindingNames` deliberately OMITS queues so the producer-append
- * path does not flag the producer it is adding as a self-collision — but for the
- * ADOPT path a producer binding sharing the adopted binding IS a real cross-type
- * collision wrangler rejects at deploy, so the adopt guard layers producers on
- * top of the reused collector.
- */
+/** Add queue producer bindings (label "Queue"), which the base collector leaves out. */
 function addQueueProducerOwners(
   owners: Map<string, string>,
   config: Record<string, unknown>,
@@ -2677,10 +2200,6 @@ function addQueueProducerOwners(
   if (!queues || queues.producers === undefined) {
     return;
   }
-  // Validate `queues.producers` STRICTLY (the ONE shared validator, also used
-  // by the producer-upsert path) so a non-array or a malformed member fails closed
-  // rather than being silently skipped, which would let the adopt guard miss a real
-  // producer-binding collision.
   for (const producer of assertValidQueueProducers(queues.producers)) {
     const binding = producer.binding as string;
     if (!owners.has(binding)) {
@@ -2690,13 +2209,8 @@ function addQueueProducerOwners(
 }
 
 /**
- * The ONE strict `queues.producers` validator, shared by BOTH the adopt-guard's
- * owner collection ({@link addQueueProducerOwners}) and the producer-upsert path (which
- * otherwise clones the list and silently skips non-record members, committing a new
- * producer beside a corrupt list). A non-array, or any member that is not a record with
- * a non-empty string `binding`, THROWS (fail closed) rather than being dropped — a
- * dropped/hidden producer could mask a real binding collision. Returns the validated
- * producer records (each guaranteed to carry a non-empty string `binding`).
+ * Validate `queues.producers`: every member needs a non-empty string `binding`. A skipped
+ * member could hide a binding collision, so a malformed one throws.
  */
 function assertValidQueueProducers(producers: unknown): Array<Record<string, unknown>> {
   if (producers === undefined) {
@@ -2714,51 +2228,29 @@ function assertValidQueueProducers(producers: unknown): Array<Record<string, unk
       typeof producer.binding !== 'string' ||
       producer.binding.length === 0
     ) {
-      throw new Error(
-        `deploy: cannot verify binding-name uniqueness — "queues.producers" contains a malformed ` +
-          `entry at index ${index} (missing a non-empty string "binding"). Refusing to proceed on a ` +
-          `partially-readable binding set (a dropped producer could hide a real collision). Fix the ` +
-          `wrangler config and retry.`,
+      throw bindingSetError(
+        `"queues.producers" contains a malformed entry at index ${index} (missing a non-empty string "binding")`,
+        'dropped producer',
       );
     }
     return producer;
   });
 }
 
-/**
- * Validate the OUTER shape of a wrangler container field that wrangler 4.131
- * requires to be an OBJECT (`queues`, `secrets`). A PRESENT-but-non-object container
- * (array/string/number/null) is malformed for wrangler AND would bypass the binding
- * collectors, HIDING a real cross-type binding collision — so it THROWS (fail closed).
- * An ABSENT container (undefined) returns undefined (a no-op, NOT an error).
- * Returns the container as a record when present-and-object.
- *
- * NOTE: `null` is `typeof 'object'` but `isRecord(null)` is false, so `secrets: null` /
- * `queues: null` (present but null) THROWS — correct (wrangler requires an object).
- * Absent (`undefined`) is the only no-op.
- */
+/** An object-valued container field (`queues`, `secrets`); any other present value throws. */
 function assertObjectContainer(value: unknown, field: string): Record<string, unknown> | undefined {
   if (value === undefined) {
     return undefined;
   }
   if (!isRecord(value)) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" must be an object. Refusing to ` +
-        `proceed on a partially-readable binding set (a wrong-shaped container could hide a real ` +
-        `collision). Fix the wrangler config and retry.`,
-    );
+    throw bindingSetError(`"${field}" must be an object`, 'wrong-shaped container');
   }
   return value;
 }
 
 /**
- * The worker-wide OWNER of a binding name as the writer's adopt / `vars` guards see it:
- * validates `field`'s own outer shape (throws on a malformed target, fail closed), then
- * looks `name` up among every OTHER binding type — `queues.producers` included — and
- * returns wrangler's friendly label for the owner, or `undefined` when the name is free
- * (or held only by `field` itself). Lets a caller refuse a doomed write BEFORE side
- * effects the write would otherwise follow (the Mode B email step). Reuses the ONE
- * collector — never fork it.
+ * The label of another binding type that already uses `name`, or undefined when only
+ * `field` (or nothing) does. Lets a caller refuse a write before its side effects.
  */
 export function findBindingNameOwner(
   config: Record<string, unknown>,
@@ -2772,20 +2264,9 @@ export function findBindingNameOwner(
 }
 
 /**
- * The STRICT canonical reader for a single provisioned binding entry in a wrangler
- * config field (`d1_databases` / `kv_namespaces` / `r2_buckets` / `hyperdrive`). Replaces
- * the provisioner's loose first-match `.find()` — which validated no outer shape,
- * silently picked among duplicates, and bypassed the worker-wide collision check, so a
- * duplicate/cross-type-collision config could be reported `reused` or pass a create
- * postcondition though it is undeployable. Fails closed on:
- *   1. a malformed TARGET field (reuses {@link bindingNamesForField}: a non-array outer
- *      shape, or any member without a non-empty string `binding`, throws);
- *   2. MORE THAN ONE entry in the target field sharing `binding` (ambiguous identity —
- *      wrangler also rejects duplicate binding names);
- *   3. a worker-wide CROSS-TYPE collision — `binding` is ALSO owned by any OTHER binding
- *      type (reuses the {@link collectWorkerBindingNames} collector, EXCLUDING the
- *      target field so the entry never self-collides, and INCLUDING `queues.producers`).
- * Returns the single matching entry, or `undefined` when the binding is absent.
+ * The one entry in `field` (`d1_databases`, `kv_namespaces`, …) with this binding, or
+ * undefined. Throws on a malformed field, a duplicate entry, or a name another binding
+ * type also uses.
  */
 export function readProvisionedBindingEntry(
   config: Record<string, unknown>,
@@ -2793,10 +2274,7 @@ export function readProvisionedBindingEntry(
   binding: string,
   configPath: string,
 ): Record<string, unknown> | undefined {
-  // 1. Outer-shape validation of the TARGET field (throws on a non-array / malformed
-  //    member — a member without a valid `binding` could hide a duplicate/collision).
   bindingNamesForField(field, config[field]);
-  // 2. EXACTLY zero-or-one entry in the target field carries this binding.
   const rawList = config[field];
   const list = Array.isArray(rawList) ? rawList : [];
   const matches = list.filter(
@@ -2809,10 +2287,6 @@ export function readProvisionedBindingEntry(
         `duplicate binding names. Remove the duplicate and retry.`,
     );
   }
-  // 3. Worker-wide CROSS-TYPE uniqueness — the binding must not be owned by any OTHER
-  //    field. Build the owner map from the config EXCLUDING the target field (so the
-  //    entry does not self-collide) and INCLUDING queues.producers. Reuse the ONE
-  //    collector — never fork it.
   const owners = collectWorkerBindingNames(configWithoutField(config, field));
   addQueueProducerOwners(owners, config);
   const owner = owners.get(binding);
@@ -2827,33 +2301,13 @@ export function readProvisionedBindingEntry(
 }
 
 /**
- * The OUTER binding-name SHAPE of a wrangler config field, so the collector reads
- * binding NAMES by KNOWN structure instead of GUESSING from a value's content (which
- * misreads a `vars` value that happens to look like a binding list/object, and lets a
- * required-but-missing binding pass). Each variant + its required-ness is derived
- * DIRECTLY from wrangler 4.131's config-schema.json (`RawConfig.properties`):
- *
- *   | shape            | schema example                         | binding name is | required        |
- *   | ---------------- | -------------------------------------- | --------------- | --------------- |
- *   | key-map          | vars/wasm_modules/text_blobs/data_blobs| the KEYS        | —               |
- *   | name-keyed-array | send_email/ratelimits `[{ name }]`     | member `.name`  | `.name` req     |
- *   | namespace-array  | kv_namespaces/d1_databases/… `[{ binding }]` | member `.binding` | `.binding` req |
- *   | singleton        | ai/browser/…/version_metadata `{ binding }`  | `.binding`   | req (assets: optional) |
- *   | binding-list     | durable_objects/logfwdr/unsafe `{ bindings: [{ name }] }` | member `.name` | `bindings` req (unsafe: optional) |
- *   | whole-object     | addresses `string[]`                   | none            | —               |
- *
- * `whole-object` is a top-level field Void WRITES (`writeProvisionedWranglerConfig`)
- * that is NOT a binding — it declares no name wrangler folds into
- * `validateBindingsHaveUniqueNames`, so it is absent from `FRIENDLY_BINDING_NAMES`
- * and contributes nothing here. `addresses` reconciles Email Routing rules on
- * `wrangler deploy` (≥ 4.113), so the deploy verifier pins it WHOLE against the
- * pre-build root (`DEPLOY_WHOLE_OBJECT_PINNED_FIELDS` in `deploy.ts`) instead of
- * per entry: a build that injects one redirects the account's inbound mail.
- *
- * `namespace-array` is the DEFAULT for every `FRIENDLY_BINDING_NAMES` field not listed
- * in {@link BINDING_FIELD_SHAPES}. `secrets.required` (a `string[]`) is folded in
- * separately by {@link collectWorkerBindingNames}, and `queues.producers` by
- * {@link addQueueProducerOwners} / the producer-upsert path — neither uses this table.
+ * Where a field keeps its binding names, per Wrangler's config schema:
+ * - key-map (`vars`, …): the object's keys.
+ * - name-keyed-array (`send_email`, `ratelimits`): `[{ name }]`.
+ * - namespace-array (the default): `[{ binding }]`.
+ * - singleton (`ai`, `browser`, …): `{ binding }`.
+ * - binding-list (`durable_objects`, `logfwdr`, `unsafe`): `{ bindings: [{ name }] }`.
+ * - whole-object (`addresses`): not a binding; the deploy check compares the whole value.
  */
 type BindingFieldShape =
   | { kind: 'key-map' }
@@ -2863,28 +2317,15 @@ type BindingFieldShape =
   | { kind: 'binding-list'; bindingsRequired: boolean }
   | { kind: 'whole-object' };
 
-/**
- * Explicit per-field shape metadata (see {@link BindingFieldShape}), transcribed
- * from wrangler 4.131's config schema. Any `FRIENDLY_BINDING_NAMES` field absent here is
- * a `namespace-array` (`[{ binding }]`) — the shape wrangler's `getBindingNames` reads
- * via its `isNamespaceList` branch.
- */
+/** Fields that are not a `namespace-array`. */
 const BINDING_FIELD_SHAPES: Record<string, BindingFieldShape> = {
-  // Key-maps — the KEYS are the binding names (env var / module / blob names). Never
-  // read the VALUES, so a value that looks like a binding list/object is not misread.
   vars: { kind: 'key-map' },
   wasm_modules: { kind: 'key-map' },
   text_blobs: { kind: 'key-map' },
   data_blobs: { kind: 'key-map' },
-  // Name-keyed arrays — identity on `.name` (wrangler's `getBindingNames` overlooks
-  // these; `validateSendEmailBinding`/`validateRateLimitBinding` require `.name`).
   send_email: { kind: 'name-keyed-array' },
   ratelimits: { kind: 'name-keyed-array' },
-  // Whole-object — no per-entry binding identity; the deploy verifier compares the
-  // whole value against the pre-build root (see the shape table).
   addresses: { kind: 'whole-object' },
-  // Singletons `{ binding }` — `binding` REQUIRED per schema for all except `assets`
-  // (`validateAssetsConfig`, where a binding-less assets-only-directory is legal).
   ai: { kind: 'singleton', bindingRequired: true },
   browser: { kind: 'singleton', bindingRequired: true },
   images: { kind: 'singleton', bindingRequired: true },
@@ -2892,24 +2333,17 @@ const BINDING_FIELD_SHAPES: Record<string, BindingFieldShape> = {
   media: { kind: 'singleton', bindingRequired: true },
   websearch: { kind: 'singleton', bindingRequired: true },
   version_metadata: { kind: 'singleton', bindingRequired: true },
+  // An assets directory without a binding is valid.
   assets: { kind: 'singleton', bindingRequired: false },
-  // Binding lists `{ bindings: [{ name }] }` — `bindings` REQUIRED for durable_objects
-  // and logfwdr; OPTIONAL for `unsafe` (which may carry only `metadata`).
   durable_objects: { kind: 'binding-list', bindingsRequired: true },
   logfwdr: { kind: 'binding-list', bindingsRequired: true },
+  // `unsafe` may carry only `metadata`.
   unsafe: { kind: 'binding-list', bindingsRequired: false },
 };
 
 /**
- * The ONE field-aware strict binding-name reader for a single config field. Routes
- * each field to its KNOWN shape (see {@link BINDING_FIELD_SHAPES}) and FAILS CLOSED on
- * any malformed/missing REQUIRED identity or wrong outer shape — never content-guessing.
- * wrangler is lenient and would silently drop such a member, letting the worker-wide
- * uniqueness guard miss (or invent) a collision.
- *
- * Exported so the deploy orchestrator's pass-through assert-set check reads a resource field's
- * per-entry identity keys through the SAME wrangler-schema shapes (handling `send_email` /
- * `ratelimits` name-keying and `logfwdr`'s nested `.bindings`, among others).
+ * Binding names in one config field, read by the field's known shape. Throws on a wrong
+ * shape or a missing required name, which Wrangler would drop silently.
  */
 export function bindingNamesForField(field: string, value: unknown): Array<string> {
   if (BINDING_FIELD_SHAPES[field]?.kind === 'key-map') {
@@ -2919,17 +2353,8 @@ export function bindingNamesForField(field: string, value: unknown): Array<strin
 }
 
 /**
- * The entry-shaped sibling of {@link bindingNamesForField}: routes each field to its KNOWN
- * shape and returns every binding's NAME **paired with its full config ENTRY object**, so a
- * caller can compare not just WHICH bindings a field declares but the TARGET each one points
- * at (a `services` binding's `service`, an `unsafe` binding's `type`, …). Same fail-closed
- * philosophy as {@link bindingNamesForField} — a malformed/missing REQUIRED identity or wrong
- * outer shape THROWS. {@link bindingNamesForField} is this reader's `.name` projection for every
- * non-key-map field.
- *
- * Exported so the deploy orchestrator's pass-through assert-set check can pin a legitimately
- * hand-declared binding's ENTRY pre-build and reject a build that KEEPS the name but REWRITES
- * the target.
+ * Like {@link bindingNamesForField}, but pairs each name with its config entry so a caller
+ * can also compare what the binding points at.
  */
 export function bindingEntriesForField(
   field: string,
@@ -2952,28 +2377,14 @@ export function bindingEntriesForField(
   }
 }
 
-/**
- * Entry-shaped reader for a KEY-MAP field. Key-map fields (vars/wasm_modules/text_blobs/
- * data_blobs) carry no per-binding config ENTRY object — the binding name is the KEY and the
- * VALUE is arbitrary content — and all four are excluded from the pass-through assert-set, so
- * this branch is never reached in the normal flow. It THROWS the same wrong-shape message the
- * name reader raises, so a FUTURE misclassification that routed a key-map field here fails
- * CLOSED rather than silently reading no entries.
- */
+/** Key-map fields have no entry objects; callers never route them here. */
 function keyMapBindingEntries(field: string): never {
-  throw new Error(
-    `deploy: cannot verify binding-name uniqueness — "${field}" must be an object mapping names ` +
-      `to values. Refusing to proceed on a partially-readable binding set (a wrong-shaped field ` +
-      `could hide a real collision). Fix the wrangler config and retry.`,
+  throw bindingSetError(
+    `"${field}" must be an object mapping names to values`,
+    'wrong-shaped field',
   );
 }
 
-/**
- * Entry-shaped reader for a NAMESPACE-array field (`[{ binding }]`: kv_namespaces, d1_databases,
- * r2_buckets, hyperdrive, services, vectorize, …). A PRESENT value that is not an array THROWS
- * rather than being re-read as a key-map (which could under-collect and hide a real collision);
- * every member is strictly validated for a non-empty string `.binding`.
- */
 function namespaceArrayBindingEntries(
   field: string,
   value: unknown,
@@ -2982,25 +2393,14 @@ function namespaceArrayBindingEntries(
     return [];
   }
   if (!Array.isArray(value)) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" must be an array of binding ` +
-        `entries. Refusing to proceed on a partially-readable binding set (a wrong-shaped field ` +
-        `could hide a real collision). Fix the wrangler config and retry.`,
-    );
+    throw bindingSetError(`"${field}" must be an array of binding entries`, 'wrong-shaped field');
   }
   return strictBindingEntries(value, 'binding', field);
 }
 
 /**
- * Entry-shaped reader for a NAME-keyed array field (`send_email` / `ratelimits`: an array of
- * `{ name }`). A PRESENT non-array THROWS; every member is strictly validated.
- *
- * Identity is the `.name` ONLY. Verified against wrangler 4.131's bundle +
- * `config-schema.json`: NEITHER `send_email` NOR `ratelimits` has a `.binding` property in
- * the schema, and on UPLOAD wrangler keys them by `.name`. An optional `.binding` that happens
- * to sit on such an entry is NOT a binding identity wrangler recognizes, so unioning it would
- * invent a PHANTOM collision (e.g. `send_email:[{name:"EMAIL_A",binding:"QUEUE_JOBS"}]` would
- * falsely block a legitimate `QUEUE_JOBS` queue producer).
+ * `send_email` and `ratelimits` are keyed by `.name` only. A `.binding` on such an entry is
+ * not an identity Wrangler uses, so reading it would invent a collision.
  */
 function nameKeyedBindingEntries(
   field: string,
@@ -3010,21 +2410,11 @@ function nameKeyedBindingEntries(
     return [];
   }
   if (!Array.isArray(value)) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" must be an array of binding ` +
-        `entries. Refusing to proceed on a partially-readable binding set (a wrong-shaped field ` +
-        `could hide a real collision). Fix the wrangler config and retry.`,
-    );
+    throw bindingSetError(`"${field}" must be an array of binding entries`, 'wrong-shaped field');
   }
   return strictBindingEntries(value, 'name', field);
 }
 
-/**
- * Entry-shaped reader for a binding-LIST field (`{ bindings: [{ name }] }`: durable_objects /
- * logfwdr / unsafe): the entry of each member is the member itself, keyed on `.name`. A wrong
- * outer shape, or a missing `bindings` when required (durable_objects / logfwdr per schema),
- * THROWS; a `bindings`-less `unsafe` (optional) contributes nothing.
- */
 function bindingListEntries(
   field: string,
   value: unknown,
@@ -3034,39 +2424,23 @@ function bindingListEntries(
     return [];
   }
   if (!isRecord(value)) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" must be an object with a ` +
-        `"bindings" array. Refusing to proceed on a partially-readable binding set (a wrong-shaped ` +
-        `field could hide a real collision). Fix the wrangler config and retry.`,
+    throw bindingSetError(
+      `"${field}" must be an object with a "bindings" array`,
+      'wrong-shaped field',
     );
   }
   if (value.bindings === undefined) {
     if (bindingsRequired) {
-      throw new Error(
-        `deploy: cannot verify binding-name uniqueness — "${field}" requires a "bindings" array. ` +
-          `Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide ` +
-          `a real collision). Fix the wrangler config and retry.`,
-      );
+      throw bindingSetError(`"${field}" requires a "bindings" array`, 'wrong-shaped field');
     }
     return [];
   }
   if (!Array.isArray(value.bindings)) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}.bindings" must be an array. ` +
-        `Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide ` +
-        `a real collision). Fix the wrangler config and retry.`,
-    );
+    throw bindingSetError(`"${field}.bindings" must be an array`, 'wrong-shaped field');
   }
   return strictBindingEntries(value.bindings, 'name', `${field}.bindings`);
 }
 
-/**
- * Entry-shaped reader for a SINGLETON field (`{ binding }`: ai / browser / images / stream /
- * media / websearch / version_metadata / assets): the entry is the singleton value itself. A
- * PRESENT non-object THROWS; a present-but-malformed `binding` THROWS; a required-but-absent
- * `binding` THROWS (never a fall-through that would mis-collect the object's OTHER keys); a
- * binding-optional `assets` with no binding contributes nothing.
- */
 function singletonBindingEntry(
   field: string,
   value: unknown,
@@ -3076,60 +2450,43 @@ function singletonBindingEntry(
     return [];
   }
   if (!isRecord(value)) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" must be an object with a ` +
-        `"binding". Refusing to proceed on a partially-readable binding set (a wrong-shaped field ` +
-        `could hide a real collision). Fix the wrangler config and retry.`,
-    );
+    throw bindingSetError(`"${field}" must be an object with a "binding"`, 'wrong-shaped field');
   }
   if (typeof value.binding === 'string' && value.binding.length > 0) {
     return [{ name: value.binding, entry: value }];
   }
   if (value.binding !== undefined) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" has a malformed "binding" ` +
-        `(expected a non-empty string). Refusing to proceed on a partially-readable binding set (a ` +
-        `dropped binding could hide a real collision). Fix the wrangler config and retry.`,
+    throw bindingSetError(
+      `"${field}" has a malformed "binding" (expected a non-empty string)`,
+      'dropped binding',
     );
   }
   if (bindingRequired) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" requires a "binding" (a ` +
-        `non-empty string). Refusing to proceed on a partially-readable binding set (a dropped ` +
-        `binding could hide a real collision). Fix the wrangler config and retry.`,
+    throw bindingSetError(
+      `"${field}" requires a "binding" (a non-empty string)`,
+      'dropped binding',
     );
   }
   return [];
 }
 
-/**
- * Read binding names from a KEY-MAP field (`vars`/`wasm_modules`/`text_blobs`/
- * `data_blobs`): the object's KEYS are the binding names. Reads ONLY the keys — never
- * the values — so a value that happens to look like a binding list (`{bindings:[…]}`)
- * or a singleton (`{binding:'x'}`) is NOT misread. A PRESENT value that is not a
- * plain object is the wrong outer shape and THROWS (fail closed). An explicitly
- * `undefined`-valued key is not a real binding and is skipped.
- */
+/** The keys of a key-map field are its binding names; the values are never read. */
 function keyMapBindingNames(field: string, value: unknown): Array<string> {
   if (value === undefined) {
     return [];
   }
   if (!isRecord(value)) {
-    throw new Error(
-      `deploy: cannot verify binding-name uniqueness — "${field}" must be an object mapping names ` +
-        `to values. Refusing to proceed on a partially-readable binding set (a wrong-shaped field ` +
-        `could hide a real collision). Fix the wrangler config and retry.`,
+    throw bindingSetError(
+      `"${field}" must be an object mapping names to values`,
+      'wrong-shaped field',
     );
   }
   return Object.keys(value).filter((key) => value[key] !== undefined);
 }
 
 /**
- * Strictly read `keyField` (a non-empty string) from EVERY member of a binding-bearing array and
- * return it PAIRED with the member's full entry object. THROWS (fail closed) on ANY malformed
- * member — never silently drops one. Dropping a malformed member could convert a mixed-validity
- * array (e.g. `[null, { binding: 'DB', id: '…' }]`) into an empty/partial binding set, so the
- * worker-wide uniqueness guard would MISS the existing `DB` and commit a conflicting binding.
+ * Read `keyField` from every member, paired with the member. A malformed member throws:
+ * dropping it could hide an existing binding from the uniqueness check.
  */
 function strictBindingEntries(
   members: Array<unknown>,
@@ -3142,23 +2499,25 @@ function strictBindingEntries(
       typeof member[keyField] !== 'string' ||
       (member[keyField] as string).length === 0
     ) {
-      throw new Error(
-        `deploy: cannot verify binding-name uniqueness — "${field}" contains a malformed entry at ` +
-          `index ${index} (missing a non-empty string "${keyField}"). Refusing to proceed on a ` +
-          `partially-readable binding set (a dropped entry could hide a real collision). Fix the ` +
-          `wrangler config and retry.`,
+      throw bindingSetError(
+        `"${field}" contains a malformed entry at index ${index} (missing a non-empty string "${keyField}")`,
+        'dropped entry',
       );
     }
     return { name: member[keyField] as string, entry: member };
   });
 }
 
-/**
- * True when a D1 `migrations_pattern` is valid under `dir` per wrangler's rule:
- * the normalized pattern must start with `${normalized dir}/` (or the dir
- * normalizes to "."). Mirrors wrangler's `resolveMigrationsConfig` /
- * `stripDirPrefix`.
- */
+/** A binding field that cannot be read completely; a missed name could hide a collision. */
+function bindingSetError(problem: string, hidden: string): Error {
+  return new Error(
+    `deploy: cannot verify binding-name uniqueness — ${problem}. Refusing to proceed on a ` +
+      `partially-readable binding set (a ${hidden} could hide a real collision). Fix the ` +
+      `wrangler config and retry.`,
+  );
+}
+
+/** Wrangler's rule: the normalized pattern starts with `<dir>/`, unless the dir is ".". */
 function migrationsPatternMatchesDir(pattern: string, dir: string): boolean {
   const normalizedDir = normalizeMigrationsPath(dir);
   if (normalizedDir === '.') {
@@ -3167,32 +2526,8 @@ function migrationsPatternMatchesDir(pattern: string, dir: string): boolean {
   return normalizeMigrationsPath(pattern).startsWith(`${normalizedDir}/`);
 }
 
-/**
- * Mirror wrangler's `normalizeRelativePath`: forward-slash, posix-normalize, then
- * drop a trailing slash. Keeps the migrations validity check byte-identical with
- * wrangler's own.
- */
+/** Wrangler's `normalizeRelativePath`: forward slashes, normalized, no trailing slash. */
 function normalizeMigrationsPath(p: string): string {
   const normalized = normalize(p.replace(/\\/g, '/'));
   return normalized.endsWith('/') ? normalized.slice(0, -1) : normalized;
 }
-
-/** Order-insensitive structural equality — avoids rewriting an entry that only
- * differs in key order (preserves the file's bytes/comments on that entry). */
-function jsonEqual(a: unknown, b: unknown): boolean {
-  return JSON.stringify(canonicalize(a)) === JSON.stringify(canonicalize(b));
-}
-
-function canonicalize(value: unknown): unknown {
-  if (Array.isArray(value)) {
-    return value.map(canonicalize);
-  }
-  if (isRecord(value)) {
-    return Object.fromEntries(
-      Object.keys(value)
-        .sort()
-        .map((key) => [key, canonicalize(value[key])]),
-    );
-  }
-  return value;
-}
diff --git a/packages/void/src/cli/wrapper.ts b/packages/void/src/cli/wrapper.ts
index 537850b0c..87c9cce71 100644
--- a/packages/void/src/cli/wrapper.ts
+++ b/packages/void/src/cli/wrapper.ts
@@ -179,10 +179,6 @@ export async function generateWrapper(
     if (!existsSync(handlerPath)) {
       handlerPath = join(import.meta.dirname, '..', 'runtime', handlerFilename_);
     }
-    if (!existsSync(handlerPath)) {
-      // Fallback for running from source (src/cli/) in tests — dist/runtime/ is two levels up.
-      handlerPath = join(import.meta.dirname, '..', '..', 'dist', 'runtime', handlerFilename_);
-    }
     if (!existsSync(handlerPath)) {
       throw new Error(
         `Migration handler not found: ${handlerFilename_}. Run "pnpm -C packages/void build" first.`,
@@ -458,9 +454,6 @@ function generateWrapperSource(
     lines.push(`import { createMigrationHandler } from "./__void_migration_handler.mjs";`);
     lines.push(`const __migrations = ${JSON.stringify(migrations)};`);
     lines.push(`const __migrationPlanBundle = ${JSON.stringify(migrationPlanBundle)};`);
-    lines.push(
-      `const __migrationDialect = ${JSON.stringify(features.migrationDialect ?? 'sqlite')};`,
-    );
   }
 
   lines.push('');
@@ -528,22 +521,20 @@ function generateWrapperSource(
     // Migration handler
     if (migrations && migrations.length > 0) {
       lines.push('  if (request.method === "POST" && url.pathname === "/__void/migrate") {');
-      lines.push(
-        '    const handler = createMigrationHandler(env, __migrations, __migrationDialect);',
-      );
+      lines.push('    const handler = createMigrationHandler(env, __migrations);');
       lines.push('    return handler(request);');
       lines.push('  }');
       lines.push(
         '  if (request.method === "GET" && url.pathname === "/__void/migrate/capabilities") {',
       );
       lines.push(
-        '    const handler = createMigrationHandler(env, __migrations, __migrationDialect, undefined, __migrationPlanBundle);',
+        '    const handler = createMigrationHandler(env, __migrations, undefined, __migrationPlanBundle);',
       );
       lines.push('    return handler(request);');
       lines.push('  }');
       lines.push('  if (request.method === "POST" && url.pathname === "/__void/migrate/app") {');
       lines.push(
-        '    const handler = createMigrationHandler(env, __migrations, __migrationDialect, undefined, __migrationPlanBundle);',
+        '    const handler = createMigrationHandler(env, __migrations, undefined, __migrationPlanBundle);',
       );
       lines.push('    return handler(request);');
       lines.push('  }');
@@ -551,7 +542,7 @@ function generateWrapperSource(
         '  if (request.method === "GET" && url.pathname.startsWith("/__void/migrate/app/attempt/")) {',
       );
       lines.push(
-        '    const handler = createMigrationHandler(env, __migrations, __migrationDialect, undefined, __migrationPlanBundle);',
+        '    const handler = createMigrationHandler(env, __migrations, undefined, __migrationPlanBundle);',
       );
       lines.push('    return handler(request);');
       lines.push('  }');
diff --git a/packages/void/src/cli/yarn-pnp.ts b/packages/void/src/cli/yarn-pnp.ts
index 8ccbca92e..a1b27872b 100644
--- a/packages/void/src/cli/yarn-pnp.ts
+++ b/packages/void/src/cli/yarn-pnp.ts
@@ -1,12 +1,14 @@
 import { existsSync, readdirSync } from 'node:fs';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { dirname, join } from 'pathslash';
 
-/**
- * Read PnP runtime files at a single directory without walking
- * ancestors. Returns a descriptor with the files that exist, or
- * `undefined` when neither is present.
- */
+export const drizzleKitBin: string = join(
+  fileURLToPath(import.meta.resolve('drizzle-kit')),
+  '..',
+  'bin.cjs',
+);
+
+/** Read the PnP runtime files in `dir` only, or `undefined` when neither exists. */
 function readPnpRuntimeAt(dir: string): { pnpCjs?: string; pnpLoader?: string } | undefined {
   const cjs = join(dir, '.pnp.cjs');
   const loader = join(dir, '.pnp.loader.mjs');
@@ -22,43 +24,10 @@ function readPnpRuntimeAt(dir: string): { pnpCjs?: string; pnpLoader?: string }
 }
 
 /**
- * Returns true when `dir` contains a local package-manager lockfile
- * (`pnpm-lock.yaml`, `package-lock.json`, `yarn.lock`, `bun.lock`,
- * `bun.lockb`). A lockfile at `dir` is definitive proof that a package
- * manager runs install from this directory: Yarn / pnpm / npm / bun
- * all write the lockfile at the install root, and workspace members
- * SHARE the root lockfile rather than carrying their own.
- *
- * Two independent call sites depend on this signal:
- *
- *   1. `findYarnPnpRuntime` / `findInstalledYarnPnpRuntime` below use
- *      it as the "leaf-managed install ownership" gate: a nested
- *      project with its own lockfile must NOT inherit an outer Yarn
- *      PnP runtime into `NODE_OPTIONS`, because the outer `.pnp.cjs`
- *      patches `Module._resolveFilename` to consult a graph that
- *      doesn't contain the leaf's dependencies — drizzle-kit then
- *      fails to resolve `drizzle-orm/...`.
- *   2. `resolveWorkspaceDeferral` in `init.ts` uses it as the
- *      "workspace-skip boundary": a subpackage with its own lockfile
- *      is not governed by the workspace install and must run install
- *      + starter migration locally.
- *
- * Both call sites must check the same set of lockfile paths — if one
- * drifts (for example, adding a new package manager's lockfile to
- * only one helper), the two paths will silently disagree on the same
- * directory. Exported as the single source of truth to lock the
- * invariant in one place.
- *
- * Note: `package.json#packageManager` (Corepack pin) is deliberately
- * NOT a signal here. A Yarn Berry workspace member can legitimately
- * declare its own `packageManager: "yarn@..."` while still resolving
- * through the workspace root's `.pnp.cjs`; treating the pin as
- * leaf-managed would stop the ancestor walk before reaching the real
- * PnP root and break `void db generate` / starter migration
- * generation in valid Yarn PnP monorepos. The lockfile check is
- * sufficient: a fresh-cloned leaf project with only a Corepack pin
- * will still trigger install, which writes the lockfile before
- * `generateStarterMigration()` fires, at which point the gate engages.
+ * Whether `dir` has its own package-manager lockfile, i.e. it is an install
+ * root: workspace members share the root lockfile. `packageManager` is not a
+ * signal, because a Yarn workspace member may pin it and still resolve through
+ * the root's `.pnp.cjs`.
  */
 export function hasLocalLockfile(dir: string): boolean {
   return (
@@ -71,20 +40,9 @@ export function hasLocalLockfile(dir: string): boolean {
 }
 
 /**
- * Walk ancestors from `start` (inclusive) looking for Yarn Berry PnP
- * runtime files. Returns the directory containing them (with both
- * possibly-existing paths) if found, or `undefined` otherwise.
- *
- * Walking ancestors is important for workspace subpackages — in a Yarn
- * PnP monorepo, `.pnp.cjs` lives at the workspace root, not in each
- * subpackage. Checking only `start` would miss the common shape.
- *
- * Local PnP files at `start` are always authoritative and take
- * precedence over the leaf-managed guard below. When `start` has no
- * local PnP files but DOES have a local lockfile, stop here — ancestor
- * PnP data belongs to a different install graph and injecting it will
- * break resolution for the local one. Only walk past `start` when
- * neither condition holds.
+ * Find Yarn Berry PnP runtime files at `start` or its nearest ancestor, since a
+ * monorepo keeps `.pnp.cjs` at the workspace root. A lockfile at `start` stops
+ * the walk: an outer PnP graph lacks the local install's dependencies.
  */
 function findYarnPnpRuntime(
   start: string,
@@ -114,44 +72,9 @@ function findYarnPnpRuntime(
 }
 
 /**
- * Stricter variant of {@link findYarnPnpRuntime}: only returns a result
- * when the PnP runtime files AND a post-install marker live in the
- * SAME ancestor directory.
- *
- * Yarn Berry repos commonly commit `.pnp.cjs` to
- * version control but NOT `.yarn/cache/*.zip` (zero-install is an
- * opt-in, not the default). A fresh `git clone` before `yarn install`
- * therefore has `.pnp.cjs` on disk while the PnP data points at ZIP
- * archives that haven't been fetched yet. Trusting `.pnp.cjs` existence
- * alone as proof that "yarn install has run" leads `init` to skip the
- * install step, and the subsequent `drizzle-kit generate` spawn crashes
- * because PnP tries to load `void/schema-d1` from a missing ZIP.
- *
- * Accept EITHER of two markers, to cover both non-zero-install
- * and zero-install shapes:
- *
- *   1. `.yarn/install-state.gz` in the same dir. Yarn Berry (3.x and
- *      4.x) writes this on every successful `yarn install` and it is
- *      gitignored by convention, so its presence strictly implies
- *      "yarn install has populated this checkout at least once". This
- *      is the only marker present in a classic (non-zero-install) repo.
- *   2. `.yarn/cache/` containing at least one `.zip` entry in the same
- *      dir. In zero-install repos (`nodeLinker: pnp`, cache committed
- *      to git), `install-state.gz` is commonly gitignored or absent,
- *      but the populated cache IS on disk — that's the whole point of
- *      zero-install. A populated cache is therefore sufficient proof
- *      that the checkout is ready to resolve dependencies.
- *
- * The same-directory requirement locks the invariant — a committed
- * `.pnp.cjs` in a subdirectory must not be covered by markers sitting
- * at an unrelated ancestor.
- *
- * NOTE: `findYarnPnpRuntime` intentionally does NOT apply this stricter
- * check. NODE_OPTIONS injection for drizzle-kit spawns should still
- * happen whenever PnP runtime files are present: if install hasn't run,
- * drizzle-kit will crash with or without the injected env, so the
- * inject is harmless; if the user is about to run install and then hits
- * a spawn, the env needs to be prepared.
+ * Like {@link findYarnPnpRuntime}, but only when Yarn has installed into that
+ * same directory. A committed `.pnp.cjs` alone does not prove an install: its
+ * ZIP archives may not be fetched yet.
  */
 export function findInstalledYarnPnpRuntime(
   start: string,
@@ -161,23 +84,13 @@ export function findInstalledYarnPnpRuntime(
 }
 
 /**
- * Return true when `dir` looks like a post-install Yarn Berry PnP
- * checkout. Two valid markers (see `findInstalledYarnPnpRuntime`):
- *
- *   - `.yarn/install-state.gz` — written by every successful
- *     `yarn install` in a classic (non-zero-install) repo.
- *   - `.yarn/cache/*.zip` — present in a zero-install checkout, where
- *     archives are committed to git and `install-state.gz` is often
- *     gitignored or absent.
+ * Yarn writes `.yarn/install-state.gz` on every install; a zero-install
+ * checkout instead commits a populated `.yarn/cache`.
  */
 function isYarnPnpInstalled(dir: string): boolean {
-  // Non-zero-install: Yarn writes this on every successful
-  // `yarn install`.
   if (existsSync(join(dir, '.yarn', 'install-state.gz'))) {
     return true;
   }
-  // Zero-install: archives are committed to git. A populated cache is
-  // the post-install proof.
   const cacheDir = join(dir, '.yarn', 'cache');
   if (!existsSync(cacheDir)) {
     return false;
@@ -191,17 +104,9 @@ function isYarnPnpInstalled(dir: string): boolean {
 }
 
 /**
- * Build a child-process env that injects Yarn Berry PnP loaders into
- * `NODE_OPTIONS` when a PnP runtime is found at or above `root`. This
- * mirrors what `yarn node` does under the hood: `--require` the PnP
- * CJS shim (patches `fs` + `Module._resolveFilename` to understand ZIP
- * virtual paths) and, when present, `--experimental-loader` the PnP
- * ESM loader.
- *
- * Any pre-existing `NODE_OPTIONS` from the parent process (for example
- * when the command is invoked as `yarn void ...` and yarn already set
- * it) is appended AFTER our injected flags so our PnP `--require` runs
- * first. Non-PnP projects inherit `process.env` unchanged.
+ * Build a child env that loads the Yarn PnP runtime found at or above `root`,
+ * like `yarn node` does. Existing `NODE_OPTIONS` go after our flags so the PnP
+ * `--require` patches resolution first.
  */
 export function buildDrizzleKitSpawnEnv(root: string): NodeJS.ProcessEnv {
   const env: NodeJS.ProcessEnv = { ...process.env };
@@ -221,9 +126,6 @@ export function buildDrizzleKitSpawnEnv(root: string): NodeJS.ProcessEnv {
     flags.push(`--experimental-loader ${pathToFileURL(pnp.pnpLoader).href}`);
   }
   const injected = flags.join(' ');
-  // Preserve any pre-existing NODE_OPTIONS by prepending ours — order
-  // matters for `--require` so the PnP loader patches `fs` /
-  // `Module._resolveFilename` before anything the user registered.
   env.NODE_OPTIONS = process.env.NODE_OPTIONS
     ? `${injected} ${process.env.NODE_OPTIONS}`
     : injected;
diff --git a/packages/void/src/client-asset-manifest.ts b/packages/void/src/client-asset-manifest.ts
index bf5d5b1f4..9a10add2a 100644
--- a/packages/void/src/client-asset-manifest.ts
+++ b/packages/void/src/client-asset-manifest.ts
@@ -1,4 +1,4 @@
-import { compilePattern } from '@void/edge';
+import { compilePattern, matchPattern } from '@void/edge';
 import type { Rolldown } from 'vite';
 import type { ClientManifest } from './runtime/routing-assets.ts';
 import type { RoutingHeaderRule } from './runtime/routing.ts';
@@ -16,7 +16,11 @@ export function stampClientAssetCachePolicy(
   const fingerprinted = new Set<string>();
   const authoredCachePatterns = headerRules
     .filter((rule) => rule.headers.some(([name]) => name.toLowerCase() === 'cache-control'))
-    .map((rule) => compilePattern(rule.pattern).regex);
+    .map((rule) => rule.pattern);
+  // A malformed pattern still fails the build.
+  for (const pattern of authoredCachePatterns) {
+    compilePattern(pattern);
+  }
   for (const item of Object.values(bundle)) {
     // Chunks expose hash substitution provenance. Output assets (including CSS)
     // do not: an explicit stable fileName can match a configured [hash] template.
@@ -26,7 +30,7 @@ export function stampClientAssetCachePolicy(
       typeof item.preliminaryFileName === 'string' &&
       item.preliminaryFileName !== item.fileName
     ) {
-      if (!authoredCachePatterns.some((pattern) => pattern.test('/' + item.fileName))) {
+      if (!authoredCachePatterns.some((pattern) => matchPattern(pattern, '/' + item.fileName))) {
         fingerprinted.add(item.fileName);
       }
     }
diff --git a/packages/void/src/cloudflare-config.ts b/packages/void/src/cloudflare-config.ts
index a482fb727..fea602209 100644
--- a/packages/void/src/cloudflare-config.ts
+++ b/packages/void/src/cloudflare-config.ts
@@ -1,10 +1,11 @@
-import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
 import { isDeepStrictEqual } from 'node:util';
-import { parse, type ParseError } from 'jsonc-parser';
+import { isRecord } from '@void/deploy-core';
 import { join } from 'pathslash';
+import { parseJsoncObject } from './cli/generated-wrangler-config.ts';
 import { TYPED_CONFIG_FILE } from './config-loader.ts';
 import { readConfig } from './config.ts';
+import { writeFileAtomic } from './shared/atomic-write.ts';
 
 export const MATERIALIZED_CLOUDFLARE_FILE = '.void-wrangler.jsonc';
 export const VOID_LOCK_FILE = 'void.lock.json';
@@ -18,12 +19,8 @@ type CloudflareState = {
   text: string;
 };
 
-function isObject(value: unknown): value is JsonObject {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 function arrayIdentity(value: unknown): string {
-  if (isObject(value)) {
+  if (isRecord(value)) {
     for (const key of ['binding', 'name', 'tag', 'class_name', 'pattern', 'route']) {
       if (typeof value[key] === 'string') {
         return `${key}:${value[key]}`;
@@ -55,7 +52,7 @@ function mergeConfig(previous: unknown, resolved: unknown, authored: unknown): u
       }),
     ];
   }
-  if (isObject(previous) && isObject(resolved) && isObject(authored)) {
+  if (isRecord(previous) && isRecord(resolved) && isRecord(authored)) {
     const result: JsonObject = {};
     for (const key of new Set([
       ...Object.keys(previous),
@@ -87,9 +84,8 @@ function mergeConfig(previous: unknown, resolved: unknown, authored: unknown): u
 }
 
 function parseCloudflareText(text: string, path: string): JsonObject {
-  const errors: Array<ParseError> = [];
-  const value: unknown = parse(text.replace(/^\uFEFF/, ''), errors, { allowTrailingComma: true });
-  if (errors.length > 0 || !isObject(value)) {
+  const value = parseJsoncObject(text);
+  if (!value) {
     throw new Error(`config: ${path} must contain a valid JSON/JSONC object.`);
   }
   return value;
@@ -107,10 +103,10 @@ function readState(root: string): CloudflareState | undefined {
     throw new Error(`config: Invalid ${VOID_LOCK_FILE}. Fix or restore it before continuing.`);
   }
   if (
-    !isObject(value) ||
+    !isRecord(value) ||
     value.version !== 1 ||
-    !isObject(value.source) ||
-    !isObject(value.resolved) ||
+    !isRecord(value.source) ||
+    !isRecord(value.resolved) ||
     typeof value.text !== 'string'
   ) {
     throw new Error(`config: Invalid ${VOID_LOCK_FILE}. Fix or restore it before continuing.`);
@@ -123,16 +119,6 @@ function readState(root: string): CloudflareState | undefined {
   return state;
 }
 
-function writeAtomic(path: string, content: string): void {
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, content, { flag: 'wx' });
-  try {
-    renameSync(temporary, path);
-  } finally {
-    rmSync(temporary, { force: true });
-  }
-}
-
 function writeState(root: string, state: CloudflareState): void {
   const path = join(root, VOID_LOCK_FILE);
   const content = `${JSON.stringify(state, null, 2)}\n`;
@@ -145,7 +131,7 @@ function writeState(root: string, state: CloudflareState): void {
       // Replace an invalid lock only after the caller has validated its state.
     }
   }
-  writeAtomic(path, content);
+  writeFileAtomic(path, content);
 }
 
 /** Keep Vite preview usable without leaving Wrangler's implicit deploy pointer after a build. */
@@ -156,7 +142,7 @@ export function stashCloudflareDeployPointer(root: string): void {
   }
   const directory = join(root, '.void');
   mkdirSync(directory, { recursive: true });
-  writeAtomic(join(directory, PREVIEW_POINTER_FILE), readFileSync(pointer, 'utf8'));
+  writeFileAtomic(join(directory, PREVIEW_POINTER_FILE), readFileSync(pointer, 'utf8'));
   rmSync(pointer, { force: true });
 }
 
@@ -167,7 +153,7 @@ export function restoreCloudflarePreviewPointer(root: string): boolean {
   }
   const directory = join(root, '.wrangler', 'deploy');
   mkdirSync(directory, { recursive: true });
-  writeAtomic(join(directory, 'config.json'), readFileSync(saved, 'utf8'));
+  writeFileAtomic(join(directory, 'config.json'), readFileSync(saved, 'utf8'));
   return true;
 }
 
@@ -208,7 +194,7 @@ export function materializeCloudflareConfig(root: string): string {
       : `${provenance(state?.text ?? '')}${JSON.stringify(resolved, null, 2)}\n`;
   const path = join(root, MATERIALIZED_CLOUDFLARE_FILE);
   if (!existsSync(path) || readFileSync(path, 'utf8') !== text) {
-    writeAtomic(path, text);
+    writeFileAtomic(path, text);
   }
   if (state) {
     writeState(root, { version: 1, source: authored, resolved, text });
diff --git a/packages/void/src/codegen/db-types.ts b/packages/void/src/codegen/db-types.ts
index 67a0ac1c4..8af7475d7 100644
--- a/packages/void/src/codegen/db-types.ts
+++ b/packages/void/src/codegen/db-types.ts
@@ -1,4 +1,3 @@
-import { mkdirSync } from 'node:fs';
 import { join } from 'pathslash';
 import type { SchemaLocation } from '../drizzle/discover.ts';
 import { writeFileIfChanged } from './write-if-changed.ts';
@@ -6,6 +5,12 @@ import { writeFileIfChanged } from './write-if-changed.ts';
 export const DRIZZLE_OPERATORS =
   'sql, eq, ne, gt, gte, lt, lte, and, or, not, desc, asc, like, ilike, notLike, inArray, notInArray, isNull, isNotNull, between, notBetween, exists, notExists, count, sum, avg, min, max';
 
+const DIALECT_DB_TYPES = {
+  sqlite: { type: 'DrizzleD1Database', from: 'void/_db', arg: 'd1: D1Database' },
+  postgresql: { type: 'NodePgDatabase', from: 'void/_db-pg', arg: 'connectionString: string' },
+  mysql: { type: 'MySql2Database', from: 'void/_db-mysql', arg: 'connectionString: string' },
+} as const;
+
 /**
  * Generate `.void/db.d.ts` with Drizzle types referencing the user's schema.
  *
@@ -21,76 +26,20 @@ export function generateDbDts(
   schema: SchemaLocation | null,
   dialect: 'sqlite' | 'postgresql' | 'mysql',
 ): boolean {
-  mkdirSync(outDir, { recursive: true });
+  const { type, from, arg } = DIALECT_DB_TYPES[dialect];
+  const schemaType = schema ? 'Schema' : 'Record<string, never>';
 
-  const lines =
-    dialect === 'mysql'
-      ? schema
-        ? [
-            '// Auto-generated by void — do not edit',
-            'import type { MySql2Database } from "void/_db-mysql";',
-            'import type * as schema from "@schema";',
-            'type Schema = typeof schema;',
-            'export declare const db: MySql2Database<Schema>;',
-            'export declare function createDb(connectionString: string): MySql2Database<Schema>;',
-            `export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
-            'export type { MySql2Database } from "void/_db-mysql";',
-            '',
-          ]
-        : [
-            '// Auto-generated by void — do not edit',
-            'import type { MySql2Database } from "void/_db-mysql";',
-            'export declare const db: MySql2Database<Record<string, never>>;',
-            'export declare function createDb(connectionString: string): MySql2Database<Record<string, never>>;',
-            `export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
-            'export type { MySql2Database } from "void/_db-mysql";',
-            '',
-          ]
-      : dialect === 'postgresql'
-        ? schema
-          ? [
-              '// Auto-generated by void — do not edit',
-              'import type { NodePgDatabase } from "void/_db-pg";',
-              'import type * as schema from "@schema";',
-              'type Schema = typeof schema;',
-              'export declare const db: NodePgDatabase<Schema>;',
-              'export declare function createDb(connectionString: string): NodePgDatabase<Schema>;',
-              `export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
-              'export type { NodePgDatabase } from "void/_db-pg";',
-              '',
-            ]
-          : [
-              '// Auto-generated by void — do not edit',
-              'import type { NodePgDatabase } from "void/_db-pg";',
-              'export declare const db: NodePgDatabase<Record<string, never>>;',
-              'export declare function createDb(connectionString: string): NodePgDatabase<Record<string, never>>;',
-              `export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
-              'export type { NodePgDatabase } from "void/_db-pg";',
-              '',
-            ]
-        : schema
-          ? [
-              '// Auto-generated by void — do not edit',
-              '/// <reference types="@cloudflare/workers-types" />',
-              'import type { DrizzleD1Database } from "void/_db";',
-              'import type * as schema from "@schema";',
-              'type Schema = typeof schema;',
-              'export declare const db: DrizzleD1Database<Schema>;',
-              'export declare function createDb(d1: D1Database): DrizzleD1Database<Schema>;',
-              `export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
-              'export type { DrizzleD1Database } from "void/_db";',
-              '',
-            ]
-          : [
-              '// Auto-generated by void — do not edit',
-              '/// <reference types="@cloudflare/workers-types" />',
-              'import type { DrizzleD1Database } from "void/_db";',
-              'export declare const db: DrizzleD1Database<Record<string, never>>;',
-              'export declare function createDb(d1: D1Database): DrizzleD1Database<Record<string, never>>;',
-              `export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
-              'export type { DrizzleD1Database } from "void/_db";',
-              '',
-            ];
+  const lines = [
+    '// Auto-generated by void — do not edit',
+    ...(dialect === 'sqlite' ? ['/// <reference types="@cloudflare/workers-types" />'] : []),
+    `import type { ${type} } from "${from}";`,
+    ...(schema ? ['import type * as schema from "@schema";', 'type Schema = typeof schema;'] : []),
+    `export declare const db: ${type}<${schemaType}>;`,
+    `export declare function createDb(${arg}): ${type}<${schemaType}>;`,
+    `export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
+    `export type { ${type} } from "${from}";`,
+    '',
+  ];
 
   return writeFileIfChanged(join(outDir, 'db.d.ts'), lines.join('\n'));
 }
diff --git a/packages/void/src/codegen/prepare.ts b/packages/void/src/codegen/prepare.ts
index 31789326f..0fb4aa7f0 100644
--- a/packages/void/src/codegen/prepare.ts
+++ b/packages/void/src/codegen/prepare.ts
@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, rmSync } from 'node:fs';
+import { existsSync, rmSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { join } from 'pathslash';
 import { analyzeApplication } from '../application-routing.ts';
@@ -8,7 +8,7 @@ import { readConfig } from '../config.ts';
 import { discoverSchema } from '../drizzle/discover.ts';
 import { loadLocalEnv } from '../shared/env.ts';
 import { generateDbDts } from './db-types.ts';
-import { findEnvFile, generateEnvTypes } from './env-types.ts';
+import { findEnvFileForPaths, generateEnvTypes } from './env-types.ts';
 import { ensureProjectTsconfig } from './project-tsconfig.ts';
 import { generateQueueTypes } from './queue-types.ts';
 import { generateRouteTypes } from './route-types.ts';
@@ -25,7 +25,6 @@ function writeGeneratedFile(
   content: string,
   written: Array<string>,
 ): void {
-  mkdirSync(outDir, { recursive: true });
   if (writeFileIfChanged(join(outDir, fileName), content)) {
     written.push(join('.void', fileName));
   }
@@ -48,9 +47,7 @@ export async function prepareProject(root: string): Promise<PrepareProjectResult
   const written: Array<string> = [];
   const removed: Array<string> = [];
 
-  mkdirSync(outDir, { recursive: true });
-
-  const envFile = findEnvFile(root);
+  const envFile = findEnvFileForPaths(root, paths);
   if (envFile) {
     const { dts } = generateEnvTypes(envFile, outDir);
     writeGeneratedFile(outDir, 'env.d.ts', dts, written);
diff --git a/packages/void/src/codegen/project-tsconfig.ts b/packages/void/src/codegen/project-tsconfig.ts
index b11ccfccc..7d602a9ab 100644
--- a/packages/void/src/codegen/project-tsconfig.ts
+++ b/packages/void/src/codegen/project-tsconfig.ts
@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { join, relative } from 'pathslash';
 import { readProjectPaths, type ProjectPaths } from '../project-paths.ts';
 import { writeFileIfChanged } from './write-if-changed.ts';
@@ -53,15 +53,12 @@ export function createProjectTsconfig(
     const paths: Record<string, Array<string>> = {};
 
     if (options.redirectDbModule !== false) {
-      // Redirect void/db to the generated db.d.ts so TypeScript uses
-      // schema-aware types instead of the generic base module.
-      // (moduleResolution: "bundler" ignores ambient `declare module`
-      // when the module resolves to a real file — paths is the fix.)
+      // moduleResolution "bundler" ignores ambient declarations when a specifier resolves to a
+      // package file, so void/db, void/routes, void/queues and @void/md/pages map to .void/*.d.ts.
       paths['void/db'] = ['./db.d.ts'];
     }
 
     if (hasSchema) {
-      // Determine whether schema is a file or directory
       const isDir = existsSync(pathsConfig.schemaDir) && !existsSync(pathsConfig.schemaFile);
 
       // Paths are relative to .void/ (where this tsconfig lives), so use ../
@@ -77,28 +74,18 @@ export function createProjectTsconfig(
   if (includeRoutes) {
     const compilerOptions = (tsconfig.compilerOptions ??= {});
     const paths = (compilerOptions.paths ??= {});
-
-    // moduleResolution: "bundler" prefers the resolved package file for
-    // void/routes, so point it at the generated declaration module directly.
     paths['void/routes'] = ['./routes.d.ts'];
   }
 
   if (includeQueues) {
     const compilerOptions = (tsconfig.compilerOptions ??= {});
     const paths = (compilerOptions.paths ??= {});
-
-    // Same issue as void/routes: with moduleResolution "bundler", TypeScript
-    // prefers the package export file unless we point it at the generated
-    // project-local declaration module.
     paths['void/queues'] = ['./queues.d.ts'];
   }
 
   if (includeMd) {
     const compilerOptions = (tsconfig.compilerOptions ??= {});
     const paths = (compilerOptions.paths ??= {});
-
-    // Override the package export stub with the generated project-local
-    // declaration so TypeScript uses project-specific page types.
     paths['@void/md/pages'] = ['./md.d.ts'];
   }
 
@@ -115,11 +102,9 @@ export function ensureProjectTsconfig(
   hasSchema?: boolean,
   options: ProjectTsconfigOptions = {},
 ): boolean {
-  const outDir = join(root, '.void');
-  mkdirSync(outDir, { recursive: true });
   const tsconfig = createProjectTsconfig(root, hasRouteTypes, hasDb, hasSchema, options);
   return writeFileIfChanged(
-    join(outDir, 'tsconfig.json'),
+    join(root, '.void', 'tsconfig.json'),
     JSON.stringify(tsconfig, null, 2) + '\n',
   );
 }
diff --git a/packages/void/src/codegen/route-types.ts b/packages/void/src/codegen/route-types.ts
index 5980babc1..e6a909510 100644
--- a/packages/void/src/codegen/route-types.ts
+++ b/packages/void/src/codegen/route-types.ts
@@ -232,30 +232,20 @@ export function generateRouteTypes(
 
       lines.push(`    ${JSON.stringify(page.pattern)}: {`);
 
-      let importPath: string | null = null;
-
-      if (page.serverPath) {
-        // Companion .server.ts — resolve directly
-        const absPath = `${pagesDir}/${page.serverPath}`;
-        importPath = relative(outDir, absPath);
-      }
-
+      // Page actions are only detected in a companion .server file.
+      const importPath = relative(outDir, `${pagesDir}/${page.serverPath!}`);
       if (hasActions) {
-        if (importPath) {
-          const actionsImport = `(typeof import(${JSON.stringify(importPath)}))["actions"]`;
-          lines.push(`      actions: { [K in keyof ${actionsImport}]: {`);
-          lines.push(
-            `        body: ExtractInput<${actionsImport}[K]["__validators"]> extends { body: infer B } ? B : Record<string, unknown>;`,
-          );
-          lines.push('      } };');
-        }
-      } else if (importPath) {
+        const actionsImport = `(typeof import(${JSON.stringify(importPath)}))["actions"]`;
+        lines.push(`      actions: { [K in keyof ${actionsImport}]: {`);
+        lines.push(
+          `        body: ExtractInput<${actionsImport}[K]["__validators"]> extends { body: infer B } ? B : Record<string, unknown>;`,
+        );
+        lines.push('      } };');
+      } else {
         const importExpr = `(typeof import(${JSON.stringify(importPath)}))["action"]`;
         lines.push(
           `      body: ExtractInput<${importExpr}["__validators"]> extends { body: infer B } ? B : Record<string, unknown>;`,
         );
-      } else {
-        lines.push('      body: Record<string, unknown>;');
       }
 
       if (page.params.length > 0) {
diff --git a/packages/void/src/config-loader.ts b/packages/void/src/config-loader.ts
index 654e32cd9..cbf730861 100644
--- a/packages/void/src/config-loader.ts
+++ b/packages/void/src/config-loader.ts
@@ -55,7 +55,7 @@ export function loadVoidConfig(root: string): LoadedVoidConfig | null {
 
   try {
     return { source: LEGACY_CONFIG_FILE, value: JSON.parse(readFileSync(jsonPath, 'utf-8')) };
-  } catch {
-    throw new Error(`config: Invalid JSON in ${LEGACY_CONFIG_FILE}.`);
+  } catch (error) {
+    throw new Error(`config: Invalid JSON in ${LEGACY_CONFIG_FILE}.`, { cause: error });
   }
 }
diff --git a/packages/void/src/config-write.ts b/packages/void/src/config-write.ts
index 6ab08760b..88b723b94 100644
--- a/packages/void/src/config-write.ts
+++ b/packages/void/src/config-write.ts
@@ -4,7 +4,7 @@ import { parseSync } from 'vite';
 import { loadTypedVoidConfigFile, TYPED_CONFIG_FILE } from './config-loader.ts';
 import { validateConfig, type VoidConfig } from './config.ts';
 
-const GENERATED_MARKERS = [
+export const GENERATED_MARKERS: ReadonlyArray<string> = [
   '// Generated by void migrate.',
   '// Generated from void.json by void migrate.',
   '// Generated by void init.',
diff --git a/packages/void/src/config.ts b/packages/void/src/config.ts
index 447e41dab..3490cfc42 100644
--- a/packages/void/src/config.ts
+++ b/packages/void/src/config.ts
@@ -1,11 +1,11 @@
+import { isRecord } from '@void/deploy-core';
 import type { RewriteDestination } from 'void/routes';
-import type { DevRedirectRule, HeaderRule, RedirectRule } from './cli/types.ts';
-export type { RedirectRule };
 import {
   VOID_AUTH_PROVIDERS,
   isVoidAuthProvider,
   type VoidAuthProvider,
 } from './auth/providers.ts';
+import type { DevRedirectRule, HeaderRule } from './cli/types.ts';
 import { loadVoidConfig } from './config-loader.ts';
 import type { HeadConfig } from './pages/head.ts';
 import { validateSourceDir } from './project-paths.ts';
@@ -18,7 +18,7 @@ export type RedirectDestination = string | { to: string; status?: 301 | 302 | 30
 /** Supported database dialects (internal representation). */
 export type DatabaseDialect = 'sqlite' | 'postgresql' | 'mysql';
 
-/** Curated Worker fields accepted in the legacy void.json config. */
+/** Curated Worker fields accepted by the `worker` config field. */
 export type WranglerConfig = {
   compatibility_date?: string;
   compatibility_flags?: Array<string>;
@@ -144,7 +144,7 @@ export type CloudflareConfig = Record<string, unknown> & {
   assets?: CloudflareField<{
     directory?: string;
     binding?: string;
-    not_found_handling?: 'single-page-application' | '404-page' | 'none';
+    not_found_handling?: NotFoundHandling;
     run_worker_first?: boolean | Array<string>;
   }>;
   triggers?: CloudflareField<{ crons?: Array<string> }>;
@@ -187,7 +187,7 @@ const VALID_OUTPUTS = new Set(['server', 'static']);
  * Accepted `routing.notFound` values. Keep in sync with the schema.json enum
  * and `AssetConfig.not_found_handling` in `@void/deploy-core`.
  */
-export const VALID_NOT_FOUND_HANDLING: Set<string> = new Set([
+const VALID_NOT_FOUND_HANDLING: Set<string> = new Set([
   'single-page-application',
   '404-page',
   'none',
@@ -209,18 +209,19 @@ const VALID_SANDBOX_INSTANCE_TYPES = new Set<SandboxInstanceType>([
   'standard-3',
   'standard-4',
 ]);
+const SANDBOX_STRING_KEYS = [
+  'binding',
+  'className',
+  'containerName',
+  'image',
+  'imageBuildContext',
+  'platformImage',
+];
+const SANDBOX_KEYS = [...SANDBOX_STRING_KEYS, 'instanceType'];
 
 /**
- * Count anonymous `*` wildcards in a pattern, ignoring the `*` that
- * terminates a `:name*` multi-segment named capture.
- *
- * The shared `compilePattern` (`@void/edge`) emits a distinct `(?<name>.*)`
- * group for `:name*` and a `(?<splat>.*)` group for the first bare `*` —
- * those don't clash, so a pattern with both a named multi-segment capture and
- * a bare splat is legitimate and must validate. Walking raw chars would
- * over-count and cause `assertSingleSplat` to reject such patterns.
- *
- * The identifier character class matches `compilePattern`'s `[A-Za-z0-9_]+`.
+ * Count anonymous `*` wildcards, ignoring the `*` that ends a `:name*` capture:
+ * `compilePattern` (`@void/edge`) gives `:name*` its own group, so it never clashes with a splat.
  */
 export function countSplats(source: string): number {
   return source.replace(/:[A-Za-z0-9_]+\*/g, '').match(/\*/g)?.length ?? 0;
@@ -232,7 +233,7 @@ export function countSplats(source: string): number {
  * `kind` is a capitalised noun (e.g. "Redirect", "Rewrite") used in the error
  * text.
  */
-export function assertSingleSplat(source: string, kind: string): void {
+function assertSingleSplat(source: string, kind: string): void {
   const count = countSplats(source);
   if (count > 1) {
     throw new Error(
@@ -242,21 +243,10 @@ export function assertSingleSplat(source: string, kind: string): void {
 }
 
 /**
- * Reject patterns whose compilation would produce duplicate named-capture
- * groups, which makes `new RegExp()` throw `SyntaxError: Duplicate capture
- * group name` at request time. Two cases:
- *
- *   1. Two `:name` (or `:name` + trailing `*`) tokens with the same
- *      identifier — e.g. `/:id/:id`, or two named-multi-segment captures
- *      sharing a name.
- *   2. A `:splat` (named) token alongside a bare `*` — both compile to a
- *      `(?<splat>...)` group.
- *
- * The runtime skips a rule whose pattern fails to compile
- * (`runtime/routing.ts`), but failing at config-read with a precise message
- * is friendlier than a log warning.
+ * Reject patterns that compile to duplicate named groups (`/:id/:id`, or `:splat`
+ * with a bare `*`). The runtime would only skip such a rule with a log warning.
  */
-export function assertUniqueCaptureNames(source: string, kind: string): void {
+function assertUniqueCaptureNames(source: string, kind: string): void {
   const seen = new Set<string>();
   const dups = new Set<string>();
   // Same identifier class as `compilePattern`. Trailing `*` is optional —
@@ -283,15 +273,7 @@ export function assertUniqueCaptureNames(source: string, kind: string): void {
   }
 }
 
-/**
- * Predicate for the "protocol-relative" shape: a leading `//` parses as
- * `//host/path` → `https://host/path`, which silently turns an intended
- * in-worker rewrite/redirect into a cross-origin proxy.
- *
- * Shared by the config validators below and the `_redirects` parser
- * (`cli/headers.ts`). `c.rewrite()` in `runtime/routing.ts` has an equivalent
- * check for runtime input; it runs in the Worker and cannot import this module.
- */
+/** A leading `//` parses as `https://host/path`, so an internal rule would proxy cross-origin. */
 export function isProtocolRelative(dest: string): boolean {
   return dest.startsWith('//');
 }
@@ -313,41 +295,19 @@ function assertNotProtocolRelative(
   );
 }
 
-/**
- * Strict literal-hostname regex used by `parseHostPrefixedSource` to validate
- * the host portion of an `https://host/path` rule source. Mirrors
- * `LITERAL_HOSTNAME_REGEX` in `packages/deploy-core/src/validate.ts` and the
- * regex in `platform/packages/api/src/routes/domains.ts`. Rejects scheme
- * prefixes, ports, paths, whitespace, control chars, wildcards, single-label
- * hosts, IPv4 literals, and userinfo. The host is lowercased before testing so the
- * same byte-exact form reaches dispatch (which compares against the
- * lowercase `url.hostname`).
- */
+// Mirrors LITERAL_HOSTNAME_REGEX in @void/deploy-core and the platform domains route.
 const LITERAL_HOSTNAME_REGEX = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 
-export type ParsedRuleSource = {
+type ParsedRuleSource = {
   host: string | undefined;
   path: string;
 };
 
 /**
- * Split an optional `https://host/path` prefix from a rule source.
- *
- * Path-only sources (no scheme) are returned as `{ host: undefined, path }`.
- * Sources starting with `https://` have the host portion extracted and
- * lowercase-normalized; the remaining path becomes `path` (including the
- * leading `/`, which the caller may further validate).
- *
- * Rejected (returns `{ error }`):
- * - `http://...` — TLS terminates upstream of the dispatch worker; only
- *   `https://` requests ever reach the runtime, so an `http://`-scoped rule
- *   physically cannot fire.
- * - `//host/path` — protocol-relative; ambiguous and rejected by the same
- *   reasoning.
- * - `https://` with a wildcarded, ported, or otherwise non-literal host
- *   (v1 only supports literal hosts).
- * - `https://` with no path (`https://host`) — accepted and normalized to
- *   `https://host/` so the path is always non-empty.
+ * Split an optional `https://host` prefix from a rule source. The host is
+ * lowercased (dispatch compares `url.hostname`), and a bare `https://host` gets
+ * path `/`. Returns `{ error }` for `//` and `http://` sources (only HTTPS
+ * requests reach the runtime) and for non-literal hosts.
  */
 export function parseHostPrefixedSource(raw: string): ParsedRuleSource | { error: string } {
   if (raw.startsWith('//')) {
@@ -392,6 +352,35 @@ function assertNoQueryString(dest: string, source: string, kind: 'Rewrite' | 'Fa
   );
 }
 
+function validateRewriteMap(value: unknown, kind: 'Rewrite' | 'Fallback'): void {
+  if (!isRecord(value)) {
+    throw new Error(`"routing.${kind.toLowerCase()}s" in ${CONFIG_FILE} must be an object`);
+  }
+  for (const [source, dest] of Object.entries(value)) {
+    const parsed = parseHostPrefixedSource(source);
+    if ('error' in parsed) {
+      throw new Error(`${kind} source "${source}" in ${CONFIG_FILE}: ${parsed.error}`);
+    }
+    if (!parsed.path.startsWith('/')) {
+      throw new Error(
+        `${kind} source "${source}" in ${CONFIG_FILE} must start with "/" (or be "https://host/path" with a path-absolute path)`,
+      );
+    }
+    assertSingleSplat(parsed.path, kind);
+    assertUniqueCaptureNames(parsed.path, kind);
+    if (typeof dest !== 'string') {
+      throw new Error(`${kind} destination for "${source}" in ${CONFIG_FILE} must be a string`);
+    }
+    if (!dest.startsWith('/')) {
+      throw new Error(
+        `${kind} destination for "${source}" in ${CONFIG_FILE} must start with "/" (only internal paths are supported)`,
+      );
+    }
+    assertNotProtocolRelative(dest, source, kind);
+    assertNoQueryString(dest, source, kind);
+  }
+}
+
 /** Old flat keys that have moved into namespaces. */
 const MIGRATION_ERRORS: Record<string, string> = {
   bindings: '"bindings" has moved to "inference.bindings"',
@@ -426,13 +415,11 @@ export function validateConfig(config: unknown, source: string = CONFIG_FILE): V
   }
 }
 
-function validateConfigObject(config: unknown): VoidConfig {
-  if (typeof config !== 'object' || config === null || Array.isArray(config)) {
+function validateConfigObject(obj: unknown): VoidConfig {
+  if (!isRecord(obj)) {
     throw new Error(`config: ${CONFIG_FILE} must be a JSON object.`);
   }
 
-  const obj = config as Record<string, unknown>;
-
   // Check for old flat keys that have moved
   for (const [key, message] of Object.entries(MIGRATION_ERRORS)) {
     if (obj[key] !== undefined) {
@@ -466,11 +453,11 @@ function validateConfigObject(config: unknown): VoidConfig {
 
   // Validate auth
   if (obj.auth !== undefined) {
-    if (typeof obj.auth !== 'object' || obj.auth === null || Array.isArray(obj.auth)) {
+    if (!isRecord(obj.auth)) {
       throw new Error(`config: "auth" in ${CONFIG_FILE} must be an object.`);
     }
 
-    const auth = obj.auth as Record<string, unknown>;
+    const auth = obj.auth;
     for (const key of Object.keys(auth)) {
       if (key !== 'providers') {
         throw new Error(`config: Unknown key 'auth.${key}' in ${CONFIG_FILE}. Valid: providers.`);
@@ -509,10 +496,10 @@ function validateConfigObject(config: unknown): VoidConfig {
 
   // Validate head
   if (obj.head !== undefined) {
-    if (typeof obj.head !== 'object' || obj.head === null || Array.isArray(obj.head)) {
+    if (!isRecord(obj.head)) {
       throw new Error(`config: "head" in ${CONFIG_FILE} must be an object.`);
     }
-    const h = obj.head as Record<string, unknown>;
+    const h = obj.head;
     if (h.title !== undefined && typeof h.title !== 'string') {
       throw new Error(`config: "head.title" in ${CONFIG_FILE} must be a string.`);
     }
@@ -524,7 +511,7 @@ function validateConfigObject(config: unknown): VoidConfig {
         throw new Error(`config: "head.meta" in ${CONFIG_FILE} must be an array.`);
       }
       for (const entry of h.meta) {
-        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+        if (!isRecord(entry)) {
           throw new Error(`config: "head.meta" entries in ${CONFIG_FILE} must be objects.`);
         }
       }
@@ -540,12 +527,12 @@ function validateConfigObject(config: unknown): VoidConfig {
       }
     }
     if (h.htmlAttrs !== undefined) {
-      if (typeof h.htmlAttrs !== 'object' || h.htmlAttrs === null || Array.isArray(h.htmlAttrs)) {
+      if (!isRecord(h.htmlAttrs)) {
         throw new Error(`config: "head.htmlAttrs" in ${CONFIG_FILE} must be an object.`);
       }
     }
     if (h.bodyAttrs !== undefined) {
-      if (typeof h.bodyAttrs !== 'object' || h.bodyAttrs === null || Array.isArray(h.bodyAttrs)) {
+      if (!isRecord(h.bodyAttrs)) {
         throw new Error(`config: "head.bodyAttrs" in ${CONFIG_FILE} must be an object.`);
       }
     }
@@ -553,10 +540,10 @@ function validateConfigObject(config: unknown): VoidConfig {
 
   // Validate routing
   if (obj.routing !== undefined) {
-    if (typeof obj.routing !== 'object' || obj.routing === null || Array.isArray(obj.routing)) {
+    if (!isRecord(obj.routing)) {
       throw new Error(`config: "routing" in ${CONFIG_FILE} must be an object.`);
     }
-    const routing = obj.routing as Record<string, unknown>;
+    const routing = obj.routing;
 
     // Validate routing.notFound
     if (routing.notFound !== undefined) {
@@ -579,13 +566,8 @@ function validateConfigObject(config: unknown): VoidConfig {
             `config: "routing.revalidate" in ${CONFIG_FILE} must be a non-negative finite number.`,
           );
         }
-      } else if (
-        typeof routing.revalidate === 'object' &&
-        routing.revalidate !== null &&
-        !Array.isArray(routing.revalidate)
-      ) {
-        const r = routing.revalidate as Record<string, unknown>;
-        for (const [pattern, value] of Object.entries(r)) {
+      } else if (isRecord(routing.revalidate)) {
+        for (const [pattern, value] of Object.entries(routing.revalidate)) {
           if (pattern !== '*' && !pattern.startsWith('/')) {
             throw new Error(
               `config: "routing.revalidate" key '${pattern}' in ${CONFIG_FILE} must start with "/" or be "*".`,
@@ -625,15 +607,10 @@ function validateConfigObject(config: unknown): VoidConfig {
 
     // Validate routing.headers
     if (routing.headers !== undefined) {
-      if (
-        typeof routing.headers !== 'object' ||
-        routing.headers === null ||
-        Array.isArray(routing.headers)
-      ) {
+      if (!isRecord(routing.headers)) {
         throw new Error(`config: "routing.headers" in ${CONFIG_FILE} must be an object.`);
       }
-      const h = routing.headers as Record<string, unknown>;
-      for (const [pattern, values] of Object.entries(h)) {
+      for (const [pattern, values] of Object.entries(routing.headers)) {
         if (!pattern.startsWith('/')) {
           throw new Error(
             `config: Header pattern '${pattern}' in ${CONFIG_FILE} must start with "/".`,
@@ -650,15 +627,10 @@ function validateConfigObject(config: unknown): VoidConfig {
 
     // Validate routing.redirects
     if (routing.redirects !== undefined) {
-      if (
-        typeof routing.redirects !== 'object' ||
-        routing.redirects === null ||
-        Array.isArray(routing.redirects)
-      ) {
+      if (!isRecord(routing.redirects)) {
         throw new Error(`config: "routing.redirects" in ${CONFIG_FILE} must be an object.`);
       }
-      const r = routing.redirects as Record<string, unknown>;
-      for (const [source, dest] of Object.entries(r)) {
+      for (const [source, dest] of Object.entries(routing.redirects)) {
         const parsed = parseHostPrefixedSource(source);
         if ('error' in parsed) {
           throw new Error(
@@ -673,20 +645,15 @@ function validateConfigObject(config: unknown): VoidConfig {
         assertSingleSplat(parsed.path, 'Redirect');
         assertUniqueCaptureNames(parsed.path, 'Redirect');
         if (typeof dest === 'string') {
-          if (dest.startsWith('/')) {
-            assertNotProtocolRelative(dest, source, 'Redirect');
-          }
-        } else if (typeof dest === 'object' && dest !== null && !Array.isArray(dest)) {
-          const d = dest as Record<string, unknown>;
-          if (typeof d.to !== 'string') {
+          assertNotProtocolRelative(dest, source, 'Redirect');
+        } else if (isRecord(dest)) {
+          if (typeof dest.to !== 'string') {
             throw new Error(
               `config: Redirect for '${source}' in ${CONFIG_FILE} must have a "to" string.`,
             );
           }
-          if ((d.to as string).startsWith('/')) {
-            assertNotProtocolRelative(d.to as string, source, 'Redirect');
-          }
-          if (d.status !== undefined && !VALID_REDIRECT_STATUSES.has(d.status as number)) {
+          assertNotProtocolRelative(dest.to, source, 'Redirect');
+          if (dest.status !== undefined && !VALID_REDIRECT_STATUSES.has(dest.status as number)) {
             throw new Error(
               `config: Redirect status for '${source}' in ${CONFIG_FILE} must be 301, 302, 303, 307, or 308.`,
             );
@@ -701,11 +668,7 @@ function validateConfigObject(config: unknown): VoidConfig {
 
     // Validate routing.revalidateQueryAllowlist
     if (routing.revalidateQueryAllowlist !== undefined) {
-      if (
-        typeof routing.revalidateQueryAllowlist !== 'object' ||
-        routing.revalidateQueryAllowlist === null ||
-        Array.isArray(routing.revalidateQueryAllowlist)
-      ) {
+      if (!isRecord(routing.revalidateQueryAllowlist)) {
         throw new Error(`"routing.revalidateQueryAllowlist" in ${CONFIG_FILE} must be an object`);
       }
       for (const [pattern, params] of Object.entries(routing.revalidateQueryAllowlist)) {
@@ -725,89 +688,20 @@ function validateConfigObject(config: unknown): VoidConfig {
       }
     }
 
-    // Validate routing.rewrites
     if (routing.rewrites !== undefined) {
-      if (
-        typeof routing.rewrites !== 'object' ||
-        routing.rewrites === null ||
-        Array.isArray(routing.rewrites)
-      ) {
-        throw new Error(`"routing.rewrites" in ${CONFIG_FILE} must be an object`);
-      }
-      const rw = routing.rewrites as Record<string, unknown>;
-      for (const [source, dest] of Object.entries(rw)) {
-        const parsed = parseHostPrefixedSource(source);
-        if ('error' in parsed) {
-          throw new Error(`Rewrite source "${source}" in ${CONFIG_FILE}: ${parsed.error}`);
-        }
-        if (!parsed.path.startsWith('/')) {
-          throw new Error(
-            `Rewrite source "${source}" in ${CONFIG_FILE} must start with "/" (or be "https://host/path" with a path-absolute path)`,
-          );
-        }
-        assertSingleSplat(parsed.path, 'Rewrite');
-        assertUniqueCaptureNames(parsed.path, 'Rewrite');
-        if (typeof dest !== 'string') {
-          throw new Error(`Rewrite destination for "${source}" in ${CONFIG_FILE} must be a string`);
-        }
-        if (!dest.startsWith('/')) {
-          throw new Error(
-            `Rewrite destination for "${source}" in ${CONFIG_FILE} must start with "/" (only internal paths are supported)`,
-          );
-        }
-        assertNotProtocolRelative(dest, source, 'Rewrite');
-        assertNoQueryString(dest, source, 'Rewrite');
-      }
+      validateRewriteMap(routing.rewrites, 'Rewrite');
     }
-
-    // Validate routing.fallbacks
     if (routing.fallbacks !== undefined) {
-      if (
-        typeof routing.fallbacks !== 'object' ||
-        routing.fallbacks === null ||
-        Array.isArray(routing.fallbacks)
-      ) {
-        throw new Error(`"routing.fallbacks" in ${CONFIG_FILE} must be an object`);
-      }
-      const fb = routing.fallbacks as Record<string, unknown>;
-      for (const [source, dest] of Object.entries(fb)) {
-        const parsed = parseHostPrefixedSource(source);
-        if ('error' in parsed) {
-          throw new Error(`Fallback source "${source}" in ${CONFIG_FILE}: ${parsed.error}`);
-        }
-        if (!parsed.path.startsWith('/')) {
-          throw new Error(
-            `Fallback source "${source}" in ${CONFIG_FILE} must start with "/" (or be "https://host/path" with a path-absolute path)`,
-          );
-        }
-        assertSingleSplat(parsed.path, 'Fallback');
-        assertUniqueCaptureNames(parsed.path, 'Fallback');
-        if (typeof dest !== 'string') {
-          throw new Error(
-            `Fallback destination for "${source}" in ${CONFIG_FILE} must be a string`,
-          );
-        }
-        if (!dest.startsWith('/')) {
-          throw new Error(
-            `Fallback destination for "${source}" in ${CONFIG_FILE} must start with "/" (only internal paths are supported)`,
-          );
-        }
-        assertNotProtocolRelative(dest, source, 'Fallback');
-        assertNoQueryString(dest, source, 'Fallback');
-      }
+      validateRewriteMap(routing.fallbacks, 'Fallback');
     }
   }
 
   // Validate inference
   if (obj.inference !== undefined) {
-    if (
-      typeof obj.inference !== 'object' ||
-      obj.inference === null ||
-      Array.isArray(obj.inference)
-    ) {
+    if (!isRecord(obj.inference)) {
       throw new Error(`config: "inference" in ${CONFIG_FILE} must be an object.`);
     }
-    const inf = obj.inference as Record<string, unknown>;
+    const inf = obj.inference;
 
     if (inf.auth !== undefined) {
       throw new Error(
@@ -817,14 +711,10 @@ function validateConfigObject(config: unknown): VoidConfig {
 
     // Validate inference.bindings
     if (inf.bindings !== undefined) {
-      if (
-        typeof inf.bindings !== 'object' ||
-        inf.bindings === null ||
-        Array.isArray(inf.bindings)
-      ) {
+      if (!isRecord(inf.bindings)) {
         throw new Error(`config: "inference.bindings" in ${CONFIG_FILE} must be an object.`);
       }
-      const b = inf.bindings as Record<string, unknown>;
+      const b = inf.bindings;
       for (const key of Object.keys(b)) {
         if (!['db', 'kv', 'storage', 'ai', 'email'].includes(key)) {
           throw new Error(
@@ -889,64 +779,40 @@ function validateConfigObject(config: unknown): VoidConfig {
   }
 
   // Validate sandbox
-  if (obj.sandbox !== undefined) {
-    if (typeof obj.sandbox === 'boolean') {
-      // ok
-    } else if (
-      typeof obj.sandbox === 'object' &&
-      obj.sandbox !== null &&
-      !Array.isArray(obj.sandbox)
-    ) {
-      const sandbox = obj.sandbox as Record<string, unknown>;
-      for (const key of Object.keys(sandbox)) {
-        if (
-          ![
-            'binding',
-            'className',
-            'containerName',
-            'image',
-            'imageBuildContext',
-            'platformImage',
-            'instanceType',
-          ].includes(key)
-        ) {
-          throw new Error(
-            `config: Unknown key 'sandbox.${key}' in ${CONFIG_FILE}. Valid: binding, className, containerName, image, imageBuildContext, platformImage, instanceType.`,
-          );
-        }
-      }
-      for (const key of [
-        'binding',
-        'className',
-        'containerName',
-        'image',
-        'imageBuildContext',
-        'platformImage',
-      ]) {
-        if (sandbox[key] !== undefined && typeof sandbox[key] !== 'string') {
-          throw new Error(`config: "sandbox.${key}" in ${CONFIG_FILE} must be a string.`);
-        }
-      }
-      if (
-        sandbox.instanceType !== undefined &&
-        (typeof sandbox.instanceType !== 'string' ||
-          !VALID_SANDBOX_INSTANCE_TYPES.has(sandbox.instanceType as SandboxInstanceType))
-      ) {
+  if (obj.sandbox !== undefined && typeof obj.sandbox !== 'boolean') {
+    if (!isRecord(obj.sandbox)) {
+      throw new Error(`config: "sandbox" in ${CONFIG_FILE} must be a boolean or an object.`);
+    }
+    const sandbox = obj.sandbox;
+    for (const key of Object.keys(sandbox)) {
+      if (!SANDBOX_KEYS.includes(key)) {
         throw new Error(
-          `config: "sandbox.instanceType" in ${CONFIG_FILE} must be one of: ${[...VALID_SANDBOX_INSTANCE_TYPES].join(', ')}.`,
+          `config: Unknown key 'sandbox.${key}' in ${CONFIG_FILE}. Valid: ${SANDBOX_KEYS.join(', ')}.`,
         );
       }
-    } else {
-      throw new Error(`config: "sandbox" in ${CONFIG_FILE} must be a boolean or an object.`);
+    }
+    for (const key of SANDBOX_STRING_KEYS) {
+      if (sandbox[key] !== undefined && typeof sandbox[key] !== 'string') {
+        throw new Error(`config: "sandbox.${key}" in ${CONFIG_FILE} must be a string.`);
+      }
+    }
+    if (
+      sandbox.instanceType !== undefined &&
+      (typeof sandbox.instanceType !== 'string' ||
+        !VALID_SANDBOX_INSTANCE_TYPES.has(sandbox.instanceType as SandboxInstanceType))
+    ) {
+      throw new Error(
+        `config: "sandbox.instanceType" in ${CONFIG_FILE} must be one of: ${[...VALID_SANDBOX_INSTANCE_TYPES].join(', ')}.`,
+      );
     }
   }
 
   // Validate worker
   if (obj.worker !== undefined) {
-    if (typeof obj.worker !== 'object' || obj.worker === null || Array.isArray(obj.worker)) {
+    if (!isRecord(obj.worker)) {
       throw new Error(`config: "worker" in ${CONFIG_FILE} must be an object.`);
     }
-    const w = obj.worker as Record<string, unknown>;
+    const w = obj.worker;
     if (w.compatibility_date !== undefined) {
       if (typeof w.compatibility_date !== 'string') {
         throw new Error(`config: "worker.compatibility_date" in ${CONFIG_FILE} must be a string.`);
@@ -968,7 +834,7 @@ function validateConfigObject(config: unknown): VoidConfig {
       }
     }
     if (w.vars !== undefined) {
-      if (typeof w.vars !== 'object' || w.vars === null || Array.isArray(w.vars)) {
+      if (!isRecord(w.vars)) {
         throw new Error(`config: "worker.vars" in ${CONFIG_FILE} must be an object.`);
       }
       for (const [key, value] of Object.entries(w.vars)) {
@@ -978,10 +844,10 @@ function validateConfigObject(config: unknown): VoidConfig {
       }
     }
     if (w.limits !== undefined) {
-      if (typeof w.limits !== 'object' || w.limits === null || Array.isArray(w.limits)) {
+      if (!isRecord(w.limits)) {
         throw new Error(`config: "worker.limits" in ${CONFIG_FILE} must be an object.`);
       }
-      const limits = w.limits as Record<string, unknown>;
+      const limits = w.limits;
       for (const key of Object.keys(limits)) {
         if (key !== 'cpu_ms') {
           throw new Error(
@@ -1006,20 +872,16 @@ function validateConfigObject(config: unknown): VoidConfig {
 
   // Cloudflare's complete Worker config is passed through to its build tooling.
   if (obj.cloudflare !== undefined) {
-    if (
-      typeof obj.cloudflare !== 'object' ||
-      obj.cloudflare === null ||
-      Array.isArray(obj.cloudflare)
-    ) {
+    if (!isRecord(obj.cloudflare)) {
       throw new Error(`config: "cloudflare" in ${CONFIG_FILE} must be an object.`);
     }
   }
 
   if (obj.deploy !== undefined) {
-    if (typeof obj.deploy !== 'object' || obj.deploy === null || Array.isArray(obj.deploy)) {
+    if (!isRecord(obj.deploy)) {
       throw new Error(`config: "deploy" in ${CONFIG_FILE} must be an object.`);
     }
-    const deploy = obj.deploy as Record<string, unknown>;
+    const deploy = obj.deploy;
     for (const key of Object.keys(deploy)) {
       if (key !== 'cloudflare') {
         throw new Error(
@@ -1028,14 +890,10 @@ function validateConfigObject(config: unknown): VoidConfig {
       }
     }
     if (deploy.cloudflare !== undefined) {
-      if (
-        typeof deploy.cloudflare !== 'object' ||
-        deploy.cloudflare === null ||
-        Array.isArray(deploy.cloudflare)
-      ) {
+      if (!isRecord(deploy.cloudflare)) {
         throw new Error(`config: "deploy.cloudflare" in ${CONFIG_FILE} must be an object.`);
       }
-      const cloudflareDeploy = deploy.cloudflare as Record<string, unknown>;
+      const cloudflareDeploy = deploy.cloudflare;
       for (const key of Object.keys(cloudflareDeploy)) {
         if (key !== 'mode') {
           throw new Error(
@@ -1064,11 +922,11 @@ function validateConfigObject(config: unknown): VoidConfig {
 
   // Validate ai
   if (obj.ai !== undefined) {
-    if (typeof obj.ai !== 'object' || obj.ai === null || Array.isArray(obj.ai)) {
+    if (!isRecord(obj.ai)) {
       throw new Error(`config: "ai" in ${CONFIG_FILE} must be an object.`);
     }
 
-    const aiCfg = obj.ai as Record<string, unknown>;
+    const aiCfg = obj.ai;
     for (const key of Object.keys(aiCfg)) {
       if (key !== 'gateway') {
         throw new Error(`config: Unknown key 'ai.${key}' in ${CONFIG_FILE}. Valid: gateway.`);
@@ -1085,11 +943,11 @@ function validateConfigObject(config: unknown): VoidConfig {
 
   // Validate email
   if (obj.email !== undefined) {
-    if (typeof obj.email !== 'object' || obj.email === null || Array.isArray(obj.email)) {
+    if (!isRecord(obj.email)) {
       throw new Error(`config: "email" in ${CONFIG_FILE} must be an object.`);
     }
 
-    const emailCfg = obj.email as Record<string, unknown>;
+    const emailCfg = obj.email;
     for (const key of Object.keys(emailCfg)) {
       if (key !== 'from') {
         throw new Error(`config: Unknown key 'email.${key}' in ${CONFIG_FILE}. Valid: from.`);
@@ -1117,12 +975,12 @@ function validateConfigObject(config: unknown): VoidConfig {
  * display name, and nothing that could split into two recipients or smuggle a
  * header. A sender that passes here cannot later fail `INVALID_FROM` on shape.
  */
-function parseEmailFrom(value: unknown): { email: string; name?: string } {
+function parseEmailFrom(value: unknown): void {
   if (typeof value !== 'string' || value.length === 0) {
     throw new Error(`config: "email.from" in ${CONFIG_FILE} must be a non-empty string.`);
   }
   try {
-    return parseAddress(value, 'email.from');
+    parseAddress(value, 'email.from');
   } catch (error) {
     const detail = error instanceof MimeError ? ` ${error.message}` : '';
     throw new Error(
@@ -1233,7 +1091,6 @@ export function convertRedirectsConfig(
   const origin = 'void.json#routing.redirects';
   const rules: Array<DevRedirectRule> = [];
   for (const [rawSource, dest] of Object.entries(redirects)) {
-    // Re-parse so callers that bypass `readConfig` get the same validation.
     const parsed = parseHostPrefixedSource(rawSource);
     if ('error' in parsed) {
       throw new Error(`convertRedirectsConfig: source "${rawSource}": ${parsed.error}`);
@@ -1262,29 +1119,7 @@ export function convertRedirectsConfig(
 export function convertRewritesConfig(
   rewrites: Record<string, RewriteDestination> | undefined,
 ): Array<DevRedirectRule> | undefined {
-  if (!rewrites) {
-    return undefined;
-  }
-
-  const origin = 'void.json#routing.rewrites';
-  const rules: Array<DevRedirectRule> = [];
-  for (const [rawSource, destination] of Object.entries(rewrites)) {
-    const parsed = parseHostPrefixedSource(rawSource);
-    if ('error' in parsed) {
-      throw new Error(`convertRewritesConfig: source "${rawSource}": ${parsed.error}`);
-    }
-    const { host, path } = parsed;
-    rules.push({
-      source: path,
-      destination,
-      status: 200,
-      force: true,
-      origin,
-      ...(host && { host }),
-    });
-  }
-
-  return rules.length > 0 ? rules : undefined;
+  return convertRewriteRules('convertRewritesConfig', rewrites, 'rewrites', true);
 }
 
 /**
@@ -1299,23 +1134,32 @@ export function convertRewritesConfig(
 export function convertFallbacksConfig(
   fallbacks: Record<string, RewriteDestination> | undefined,
 ): Array<DevRedirectRule> | undefined {
-  if (!fallbacks) {
+  return convertRewriteRules('convertFallbacksConfig', fallbacks, 'fallbacks', false);
+}
+
+function convertRewriteRules(
+  caller: string,
+  entries: Record<string, RewriteDestination> | undefined,
+  field: 'rewrites' | 'fallbacks',
+  force: boolean,
+): Array<DevRedirectRule> | undefined {
+  if (!entries) {
     return undefined;
   }
 
-  const origin = 'void.json#routing.fallbacks';
+  const origin = `void.json#routing.${field}`;
   const rules: Array<DevRedirectRule> = [];
-  for (const [rawSource, destination] of Object.entries(fallbacks)) {
+  for (const [rawSource, destination] of Object.entries(entries)) {
     const parsed = parseHostPrefixedSource(rawSource);
     if ('error' in parsed) {
-      throw new Error(`convertFallbacksConfig: source "${rawSource}": ${parsed.error}`);
+      throw new Error(`${caller}: source "${rawSource}": ${parsed.error}`);
     }
     const { host, path } = parsed;
     rules.push({
       source: path,
       destination,
       status: 200,
-      force: false,
+      force,
       origin,
       ...(host && { host }),
     });
diff --git a/packages/void/src/crons/scan.ts b/packages/void/src/crons/scan.ts
index 41b68595f..86e1aeade 100644
--- a/packages/void/src/crons/scan.ts
+++ b/packages/void/src/crons/scan.ts
@@ -1,14 +1,13 @@
 import { readFileSync } from 'node:fs';
-import { isAbsolute, join } from 'pathslash';
-import { glob, globSync } from 'tinyglobby';
+import { join } from 'pathslash';
+import type { AstNode } from '../shared/ast.ts';
+import { listConventionFiles } from '../shared/convention-files.ts';
 import {
   staticExportInitializers,
   staticLiteral,
   unwrapStaticExpression,
 } from '../shared/static-exports.ts';
 
-const JOB_PATTERN = '**/*.{ts,mts,js,mjs}';
-
 export type JobDefinition = {
   /** Relative file path from jobs/ */
   filePath: string;
@@ -33,8 +32,7 @@ function extractCronExpressions(source: string, filePath: string): Array<string>
   }
   const values =
     initializer.type === 'ArrayExpression'
-      ? ((initializer.elements as Array<import('../shared/ast.ts').AstNode | null> | undefined) ??
-        [])
+      ? ((initializer.elements as Array<AstNode | null> | undefined) ?? [])
       : [initializer];
   if (values.length === 0) {
     throw new Error(`cron: Invalid job file '${filePath}'. Cron array cannot be empty.`);
@@ -50,18 +48,11 @@ function extractCronExpressions(source: string, filePath: string): Array<string>
   });
 }
 
-function resolveDir(root: string, dir: string): string {
-  return isAbsolute(dir) ? dir : join(root, dir);
-}
-
-function parseJobFiles(root: string, jobsDir: string, files: Array<string>): Array<JobDefinition> {
-  const jobsDirPath = resolveDir(root, jobsDir);
-  return files
-    .filter((filePath) => !filePath.split('/').some((segment) => segment.startsWith('_')))
+export function scanJobsSync(cronsDir: string): Array<JobDefinition> {
+  return listConventionFiles(cronsDir)
     .sort((leftFilePath, rightFilePath) => leftFilePath.localeCompare(rightFilePath))
     .map((filePath) => {
-      const absPath = join(jobsDirPath, filePath);
-      const source = readFileSync(absPath, 'utf-8');
+      const source = readFileSync(join(cronsDir, filePath), 'utf-8');
       return {
         filePath,
         name: extractJobName(filePath),
@@ -69,20 +60,3 @@ function parseJobFiles(root: string, jobsDir: string, files: Array<string>): Arr
       };
     });
 }
-
-export async function scanJobs(root: string, jobsDir = 'crons'): Promise<Array<JobDefinition>> {
-  const files = await glob(JOB_PATTERN, { cwd: resolveDir(root, jobsDir), absolute: false }).catch(
-    () => [] as Array<string>,
-  );
-  return parseJobFiles(root, jobsDir, files);
-}
-
-export function scanJobsSync(root: string, jobsDir = 'crons'): Array<JobDefinition> {
-  let files: Array<string>;
-  try {
-    files = globSync(JOB_PATTERN, { cwd: resolveDir(root, jobsDir), absolute: false });
-  } catch {
-    files = [];
-  }
-  return parseJobFiles(root, jobsDir, files);
-}
diff --git a/packages/void/src/drizzle/config.ts b/packages/void/src/drizzle/config.ts
index 02f773639..fb1cdb584 100644
--- a/packages/void/src/drizzle/config.ts
+++ b/packages/void/src/drizzle/config.ts
@@ -6,6 +6,13 @@ import { discoverSchema, schemaSpecifier } from './discover.ts';
 
 type DrizzleDialect = 'sqlite' | 'postgresql' | 'mysql';
 
+/** drizzle-kit `generate` needs a URL but never connects. */
+export const PLACEHOLDER_DB_URL: Record<DrizzleDialect, string> = {
+  sqlite: ':memory:',
+  postgresql: 'postgresql://dummy',
+  mysql: 'mysql://dummy',
+};
+
 /**
  * Write a temporary drizzle-kit config, by default to `.void/drizzle.config.json`.
  * Schema and migration paths are relative to the project root: drizzle-kit
@@ -101,8 +108,7 @@ function removeProjectDrizzleConfigWithUrl(root: string): void {
   if (
     typeof url === 'string' &&
     url.includes('://') &&
-    url !== 'postgresql://dummy' &&
-    url !== 'mysql://dummy'
+    !Object.values(PLACEHOLDER_DB_URL).includes(url)
   ) {
     rmSync(configPath, { force: true });
   }
diff --git a/packages/void/src/drizzle/generate.ts b/packages/void/src/drizzle/generate.ts
index b48af7a99..d0fbd7810 100644
--- a/packages/void/src/drizzle/generate.ts
+++ b/packages/void/src/drizzle/generate.ts
@@ -1,4 +1,12 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
 import { dirname, join } from 'pathslash';
 import { collectMigrations } from '../migrations/collect.ts';
 import { openMigrationValidationDatabase } from '../migrations/sqlite-validation.ts';
@@ -16,6 +24,52 @@ function snapshotFiles(root: string): Map<string, Buffer> {
   return files;
 }
 
+function listFiles(dir: string, suffix: string): Set<string> {
+  return new Set(existsSync(dir) ? readdirSync(dir).filter((file) => file.endsWith(suffix)) : []);
+}
+
+/**
+ * Record the Drizzle outputs under `migrationsDir` and return a rollback for a
+ * failed `drizzle-kit generate`, so partial files cannot fail the journal check
+ * of later `void db` commands.
+ */
+export function snapshotDrizzleOutputs(migrationsDir: string): () => void {
+  const metaDir = join(migrationsDir, 'meta');
+  const journalPath = join(metaDir, '_journal.json');
+  const metaDirExisted = existsSync(metaDir);
+  const journal = existsSync(journalPath) ? readFileSync(journalPath) : null;
+  const snapshots = listFiles(metaDir, '_snapshot.json');
+  const sqlFiles = listFiles(migrationsDir, '.sql');
+
+  const bestEffort = (step: () => void): void => {
+    try {
+      step();
+    } catch {
+      // The drizzle-kit failure is the error worth reporting.
+    }
+  };
+  const removeNewFiles = (dir: string, suffix: string, before: Set<string>): void => {
+    for (const file of listFiles(dir, suffix)) {
+      if (!before.has(file)) {
+        bestEffort(() => unlinkSync(join(dir, file)));
+      }
+    }
+  };
+
+  return () => {
+    if (metaDirExisted) {
+      if (journal !== null) {
+        bestEffort(() => writeFileSync(journalPath, journal));
+      }
+      bestEffort(() => removeNewFiles(metaDir, '_snapshot.json', snapshots));
+    } else {
+      bestEffort(() => rmSync(metaDir, { recursive: true, force: true }));
+    }
+    // Keep a new migrations directory so a retry can reuse it.
+    bestEffort(() => removeNewFiles(migrationsDir, '.sql', sqlFiles));
+  };
+}
+
 /** Keep SQL and Drizzle's snapshot/journal together when generation fails validation. */
 export async function generateValidatedSqliteMigrations(
   migrationsDir: string,
diff --git a/packages/void/src/host/load-user-env.ts b/packages/void/src/host/load-user-env.ts
index 72478c2f5..ec2f87953 100644
--- a/packages/void/src/host/load-user-env.ts
+++ b/packages/void/src/host/load-user-env.ts
@@ -7,10 +7,6 @@
  * supported — if the user writes one, we detect the resulting resolution
  * error and re-throw with guidance pointing at the offending specifier.
  *
- * Used by:
- *   - `plugin-env-schema.ts` (dev plugin, HMR re-imports)
- *   - `cli/env-validation.ts` (deploy + `void env check`)
- *
  * Side-effect contract: loading the file evaluates the user's `defineEnv`
  * call, which registers the schema in the singleton state in
  * `runtime/env-public.ts`. Callers read the result from there.
@@ -58,14 +54,6 @@ function looksLikeAlias(specifier: string): boolean {
   return specifier.startsWith('~') || specifier.startsWith('#');
 }
 
-/**
- * Load the user's env.ts via native `import()`. The URL gets a cache-busting
- * query param so HMR re-imports re-evaluate the file.
- *
- * On resolution failures, wraps the error with the source file path, and if
- * the failed specifier looks like a tsconfig path alias, appends guidance
- * explaining that env.ts doesn't resolve aliases.
- */
 export async function loadUserEnvFile(envFile: string): Promise<void> {
   // Counter + timestamp so back-to-back HMR reloads in the same millisecond
   // still produce distinct URLs (Node's ESM loader caches by URL).
diff --git a/packages/void/src/index.ts b/packages/void/src/index.ts
index 5277dec3c..ae26ec0f9 100644
--- a/packages/void/src/index.ts
+++ b/packages/void/src/index.ts
@@ -36,6 +36,7 @@ import { readVoidDevCredentials, runAiSetupPrompt } from './plugin-ai-setup.ts';
 import { bindingRuntimePlugin } from './plugin-binding-runtime.ts';
 import { createClientStubsPlugin } from './plugin-client-stubs.ts';
 import {
+  afterServerReady,
   warnIfPackageJsonIsNotEsm,
   isViteBuildOrPreview,
   getOrCreateDevTriggerToken,
@@ -82,23 +83,7 @@ const scheduledPointerCleanups = new Set<string>();
 
 const scheduledPreviewPointerCleanups = new Set<string>();
 
-/**
- * Void plugin — the main entry point.
- *
- * Composes:
- * 1. Routing plugin (file-based routing from routes/ and middleware/)
- * 2. Migration plugin (auto-apply .sql migrations on dev startup)
- * 3. @cloudflare/vite-plugin (workerd runtime, HMR, builds)
- *
- * Binding inference runs synchronously here so results are available
- * before the Cloudflare plugin initializes.
- *
- * The Cloudflare plugin reads Void's generated config and provides it to our
- * config function. Bindings already defined there (with real IDs for
- * production deployment) are preserved — we only add inferred bindings
- * that are missing. This allows `vite build && wrangler deploy` to work
- * for deploying directly to Cloudflare without the Void platform.
- */
+/** Returns the Vite plugins that build and serve a Void app for its configured target. */
 export function voidPlugin(options?: {
   persistTo?: string;
   auxiliaryWorkers?: PluginConfig['auxiliaryWorkers'];
@@ -158,9 +143,7 @@ export function voidPlugin(options?: {
   };
   let application = analyzeApplicationSync(root, { config });
   const { paths, dialect, bindingNames, authConfigPath } = application;
-  const analyses = new Map<RouteEnvironment | undefined, ApplicationAnalysis>([
-    [undefined, application],
-  ]);
+  const analyses = new Map<RouteEnvironment, ApplicationAnalysis>();
   const getApplicationAnalysis = (environment: RouteEnvironment, refresh = false) => {
     let result = refresh ? undefined : analyses.get(environment);
     if (!result) {
@@ -175,7 +158,6 @@ export function voidPlugin(options?: {
   const detected = application.framework;
   const framework = detected?.class === 'a' ? (detected.name as Framework) : undefined;
 
-  // Infer bindings synchronously from source files
   const scanDirs = config.inference?.scanDirs ?? (detected ? FRAMEWORK_SCAN_DIRS : undefined);
   const frameworkOwnsCloudflareRuntime =
     detected !== undefined && (detected.class === 'b' || detected.class === 'c');
@@ -207,15 +189,8 @@ export function voidPlugin(options?: {
   if (detected && bindings.needsLive) {
     throw new Error('live: void/live is currently supported in Void apps only.');
   }
-  // Inbound handlers are compiled into the worker's `email()` export by
-  // `routingPlugin`, which no framework branch installs — the framework
-  // wrapper wires crons and queues only. Without this guard the build
-  // succeeds, every file in `email/` is dead code, and inbound mail bounces
-  // at the platform with a message telling the user to redeploy.
-  //
-  // Gated on the handler DIRECTORY, not on `bindings.needsEmail`. Outbound
-  // `sendEmail` is a binding rather than a compiled export, so it keeps
-  // working in every framework and must not be caught here.
+  // Inbound handlers compile into the worker's `email()` export via `routingPlugin`, which
+  // framework mode never installs. Outbound `sendEmail` is a binding and works everywhere.
   const hasInboundEmail = hasEmailHandlers(application.email);
   if (detected && hasInboundEmail) {
     throw new Error(
@@ -311,12 +286,10 @@ export function voidPlugin(options?: {
       application,
       bindingNames,
       websocketRoutes,
-      sandboxConfig,
       liveConfig,
       detected,
       clientStubsPlugin,
       serverRuntimeOptimizerPlugin,
-      authEnabled,
       devTriggerToken,
       implicitDeployGuard,
     });
@@ -353,11 +326,6 @@ export function voidPlugin(options?: {
       workerConfig.compatibility_flags = wranglerCompat.compatibilityFlags;
     }
   }
-  // CPU cap from void.config.ts `worker.limits.cpu_ms` (validated in config.ts as an
-  // integer 1..300000). The CF plugin passes `limits` through into the generated
-  // `dist/ssr/wrangler.json`, so a self-host `wrangler deploy` / `void deploy
-  // --platform cloudflare` enforces it directly. Managed `void deploy` ignores
-  // the generated wrangler config and carries the cap in the deploy manifest.
   if (config.worker?.limits?.cpu_ms) {
     workerConfig.limits = { cpu_ms: config.worker.limits.cpu_ms };
   }
@@ -383,7 +351,7 @@ export function voidPlugin(options?: {
   // config. Bindings already declared there (with real IDs) take precedence;
   // placeholders are added only for inferred bindings that are missing.
   function mergeBindings(resolved: WorkerConfig): Partial<WorkerConfig> {
-    return mergeWorkerBindings(resolved, {
+    const merged = mergeWorkerBindings(resolved, {
       websocketRoutes,
       routeEnvironment,
       workerConfig,
@@ -404,13 +372,9 @@ export function voidPlugin(options?: {
       liveConfig,
       root,
       remoteMode,
-      get versionMetadataBinding() {
-        return versionMetadataBinding;
-      },
-      set versionMetadataBinding(value: string | undefined) {
-        versionMetadataBinding = value;
-      },
     });
+    versionMetadataBinding = merged.versionMetadataBinding;
+    return merged.patch;
   }
 
   function applyEnvSchema(facts: EnvSchemaFacts): void {
@@ -437,16 +401,8 @@ export function voidPlugin(options?: {
       if (command === 'serve' && directCloudflareDestination && bindings.needsAI) {
         process.env.CLOUDFLARE_AUTH_USE_KEYRING = 'true';
       }
-      // Re-resolve now that the environment is known — the construction-time
-      // value below always assumes `prod`.
-      //
-      // The guard is NOT an optimization. `envPlugin` is also returned by the
-      // framework and node-target branches, and both of those `return` before
-      // `ssrEntry` / `hasPages` / `hasMiddleware` are declared. Calling
-      // `resolveConfiguredAssetRoutingPolicy()` there throws a TDZ
-      // `ReferenceError`. Those branches also must not write
-      // `workerConfig.assets` at all — `mergeBindings` keys off it staying
-      // unset.
+      // Re-resolve for the real environment. Framework and node-target branches return before
+      // `ssrEntry` is declared (TDZ) and must leave `workerConfig.assets` unset.
       if (!framework && !isNodeTarget(config.target)) {
         managedCloudflareBuild = command === 'build' && Boolean(process.env.VOID_DEPLOY_PROJECT_ID);
         assetRoutingPublicDir =
@@ -518,35 +474,26 @@ export function voidPlugin(options?: {
       return watchConfig;
     },
     configureServer(server) {
-      // Defer status messages until after Vite prints "ready" so they're visible.
-      const afterReady = (fn: () => void) => {
-        if (server.httpServer) {
-          server.httpServer.once('listening', () => setTimeout(fn, 100));
-        } else {
-          fn();
-        }
-      };
-
       // Remote mode status — log which bindings are using the proxy
       if (remoteMode && (bindings.needsD1 || bindings.needsKV || bindings.needsR2)) {
         const credentials = readVoidDevCredentials(root);
         if (credentials.status === 'ok') {
           const lines = [pc.blue('Remote bindings active')];
           if (bindings.needsD1) {
-            lines.push('  DB      \x1b[2m→ remote D1\x1b[22m');
+            lines.push(`  DB      ${pc.dim('→ remote D1')}`);
           }
           if (bindings.needsKV) {
-            lines.push('  KV      \x1b[2m→ remote KV\x1b[22m');
+            lines.push(`  KV      ${pc.dim('→ remote KV')}`);
           }
           if (bindings.needsR2) {
-            lines.push('  STORAGE \x1b[2m→ remote R2\x1b[22m');
+            lines.push(`  STORAGE ${pc.dim('→ remote R2')}`);
           }
-          afterReady(() => {
+          afterServerReady(server, () => {
             console.log();
             voidLog(lines.join('\n         '));
           });
         } else if (credentials.status === 'no-token') {
-          afterReady(() => {
+          afterServerReady(server, () => {
             console.log();
             voidWarn(
               'Remote mode requires authentication. Run `void account login`, then restart.',
@@ -554,7 +501,7 @@ export function voidPlugin(options?: {
             voidWarn('Falling back to local bindings.');
           });
         } else {
-          afterReady(() => {
+          afterServerReady(server, () => {
             console.log();
             voidWarn('Remote mode requires a linked project. Run `void project link` first.');
             voidWarn('Falling back to local bindings.');
@@ -566,7 +513,7 @@ export function voidPlugin(options?: {
       if (bindings.needsAI && !directCloudflareDestination) {
         const credentials = readVoidDevCredentials(root);
         if (credentials.status === 'no-token') {
-          afterReady(() => {
+          afterServerReady(server, () => {
             console.log();
             voidWarn(
               'AI requires authentication. Run `void account login`, then restart the dev server.',
@@ -575,12 +522,12 @@ export function voidPlugin(options?: {
         } else if (credentials.status === 'no-project') {
           if (process.stdin.isTTY) {
             // Fire-and-forget interactive setup
-            afterReady(() => {
+            afterServerReady(server, () => {
               console.log();
               runAiSetupPrompt(root, credentials.token, credentials.apiUrl, server);
             });
           } else {
-            afterReady(() => {
+            afterServerReady(server, () => {
               console.log();
               voidWarn('AI requires a linked project. Run `void project link` to set one up.');
             });
@@ -672,24 +619,8 @@ export function voidPlugin(options?: {
       devTriggerToken,
       config.routing?.notFound,
     );
-    // `routing.notFound` only reaches a Class A worker through the DEPLOYED
-    // script's `assets` config, and Void writes none for these frameworks: the
-    // Class A branch returns long before `applyAssetRoutingPolicy`, and writing
-    // `not_found_handling` on its own is worse than nothing — Cloudflare's asset
-    // layer would then answer unmatched requests itself and the framework worker
-    // would never run (only `run_worker_first` sends them to the worker first,
-    // and Void does not own `assets.binding`/`directory` here to complete that
-    // policy). Managed `void deploy` supplies the policy out-of-band
-    // (`runFullDeploy` → `resolveAssetConfig` → `manifest.assetConfig`), so it
-    // IS honored there.
-    //
-    // On a self-hosted build it can still apply: the generated wrapper consumes
-    // `routing.notFound` and serves through `env.ASSETS`, and `mergeBindings`
-    // leaves an authored `assets` config untouched (its gate needs
-    // `workerConfig.assets`, which is never set here). So a user who declares a
-    // complete `assets` policy gets working behavior. Warn once per build, and
-    // only when this build is not a managed deploy (`void deploy` sets
-    // `VOID_DEPLOY_BUILD` on the build child env).
+    // Class A builds write no `assets` config, and `not_found_handling` alone would keep
+    // unmatched requests from the framework worker. Managed `void deploy` supplies the policy.
     let notFoundIgnoredWarned = false;
     const frameworkBuildWrapperPlugin: Plugin = {
       name: 'void:framework-build-wrapper',
@@ -821,7 +752,7 @@ export function voidPlugin(options?: {
       ...(vinextWorkerEntry ? [vinextWorkerEntry] : []),
       frameworkBuildWrapperPlugin,
       frameworkTriggersPlugin(root, { devTriggerToken }),
-      devTriggersHintPlugin(root, { framework: true, devTriggerToken }),
+      devTriggersHintPlugin(root, devTriggerToken),
       ...cloudflare({
         configPath: cloudflareConfigPath,
         ...inspectorPortOption,
@@ -897,12 +828,8 @@ export function voidPlugin(options?: {
         isAuthEnabled: () => false,
         devTriggerToken,
         headConfig: config.head,
-        output: config.output,
         prerenderPaths: config.routing?.prerender,
         target: config.target as 'node' | 'bun' | 'deno',
-        // Pass the full routing section so the plugin can merge
-        // `public/_redirects` / `public/_headers` with `void.config.ts` rules at
-        // `configResolved` time and again on HMR (parity with deploy).
         routing: config.routing,
         hasSandbox: false,
       }),
@@ -1032,13 +959,9 @@ export function voidPlugin(options?: {
       getVersionMetadataBinding: () => versionMetadataBinding,
       devTriggerToken,
       headConfig: config.head,
-      output: config.output,
       prerenderPaths: config.routing?.prerender,
       remoteMode,
-      // Pass the full routing section so the plugin can merge
-      // `public/_redirects` / `public/_headers` with `void.config.ts` rules for
-      // parity with the deployment runtime. Managed production builds omit
-      // the rules because dispatch owns them; native builds keep them.
+      // Merged with `public/_redirects` and `_headers`; managed builds omit them (dispatch owns them).
       routing: config.routing,
       bindingNames,
       get hasSandbox() {
@@ -1065,7 +988,7 @@ export function voidPlugin(options?: {
       configPath: authConfigPath,
     }),
     prerenderPlugin(root, config),
-    devTriggersHintPlugin(root, { framework: false, devTriggerToken }),
+    devTriggersHintPlugin(root, devTriggerToken),
     ...cloudflare({
       configPath: cloudflareConfigPath,
       ...inspectorPortOption,
diff --git a/packages/void/src/isr-config.ts b/packages/void/src/isr-config.ts
index d537d5de9..61129cbc7 100644
--- a/packages/void/src/isr-config.ts
+++ b/packages/void/src/isr-config.ts
@@ -20,25 +20,10 @@ export function hasRevalidate(r: unknown): boolean {
 }
 
 /**
- * Merge the app's `routing.revalidate` config with per-page
- * `export const revalidate` rules discovered by the page scan, producing the
- * final revalidate map that gets baked into the deploy manifest (managed
- * `void deploy`) or the self-hosted worker build.
- *
- * This is the single source of truth for the flat fallback map shared by
- * managed and native builds. Page requests also carry `collectPages()`'s
- * ordered three-state policy, which is authoritative at runtime:
- *
- * - Config value seeds the result (`number | Record<string, number> | undefined`).
- * - Per-page rules (page pattern → revalidate seconds) are collected from the
- *   already-computed page scan (`null` when the app has no pages dir).
- * - When there are per-page rules:
- *   - config is a plain number → path map with per-page entries first and the
- *     config number applied to `"*"` as a fallback unless that page key exists;
- *   - config is an object map → per-page entries first (higher precedence in
- *     first-match ordering), then non-duplicate config entries;
- *   - config is absent → the per-page rules alone.
- * - Empty results (no config, no per-page rules) return `undefined`.
+ * Merge `routing.revalidate` with per-page `export const revalidate` rules into
+ * the flat fallback map baked into managed and native builds. With page rules,
+ * page entries come first and a number config becomes the `*` fallback. At
+ * runtime, page requests use the `collectPages()` table instead.
  */
 export function collectRevalidate(
   config: VoidConfig,
@@ -52,32 +37,25 @@ export function collectRevalidate(
   if (vcRevalidate != null) {
     revalidate = vcRevalidate;
   }
-  // Merge per-page revalidate exports (pages mode)
   if (pageScan) {
     const perPageRules: Record<string, number> = {};
     for (const page of pageScan.pages) {
       if (page.revalidate != null) {
-        // Single-segment params (:slug) stay as :slug so the matcher can anchor
-        // them to ONE path segment; named catch-alls (:slug{.+}) and anonymous
-        // catch-alls (*) stay/become '*' (a splat that crosses '/'). See
-        // matchLiteralPattern. This applies ONLY to scanned page patterns — the
-        // user's own `routing.revalidate` keys below are authored literals and
-        // pass through untouched.
+        // Catch-alls become '*' (a splat across '/'); `:slug` stays one segment.
+        // Only scanned page patterns are rewritten; config keys pass through.
         const key = page.pattern.replace(/:[A-Za-z0-9_]+\{[^}]*\}/g, '*');
         perPageRules[key] = page.revalidate;
       }
     }
     if (Object.keys(perPageRules).length > 0) {
       if (typeof revalidate === 'number') {
-        // Global number → pathmap with "*" fallback, per-page entries first
         if (!Object.hasOwn(perPageRules, '*')) {
           perPageRules['*'] = revalidate;
         }
         revalidate = perPageRules;
       } else if (typeof revalidate === 'object') {
-        // Per-page entries first (higher precedence in first-match). Remove
-        // duplicate config keys so a later Object.fromEntries entry cannot
-        // overwrite an explicit page opt-out while retaining its earlier slot.
+        // Page entries first (first match wins). Drop duplicate config keys so
+        // Object.fromEntries cannot overwrite a page value, such as a 0 opt-out.
         revalidate = Object.fromEntries([
           ...Object.entries(perPageRules),
           ...Object.entries(revalidate).filter(
@@ -92,79 +70,32 @@ export function collectRevalidate(
   return revalidate;
 }
 
-/**
- * Resolve a single page's BUILD-time ISR TTL for the 3-STATE `pages` table.
- * Returns:
- *   - a number `> 0` — ISR ON with that baked TTL;
- *   - `0` — an EXPLICIT opt-out (a per-page `export const revalidate = 0`, or a
- *     global-number config of 0). Dispatch honors it verbatim and does NOT fall
- *     back to the per-path config;
- *   - `undefined` — INHERIT-eligible: the page bakes no TTL, and dispatch
- *     resolves the RAW per-path `routing.revalidate` OBJECT config (shipped as
- *     `manifest.pathRevalidate`) against the ACTUAL request path at the edge.
- *
- * Sources, in precedence order — SOURCE-SEPARATED, so a no-export page never
- * inherits a SIBLING page's per-page TTL (sibling exports never reach this
- * function):
- *   1. an explicit per-page `export const revalidate` is authoritative — a
- *      positive value turns ISR on; an explicit `0` opts the page OUT and is NOT
- *      overridden by the app-wide config;
- *   2. else a global-NUMBER `routing.revalidate` (applies to every
- *      page: `> 0` on, `0` off);
- *   3. else (an OBJECT config, or none) → `undefined` (inherit-eligible).
- *
- * Why an OBJECT config is resolved at the EDGE, not baked here: it is a per-PATH
- * rule set, and a single dynamic page pattern can straddle several of its entries
- * — INCLUDING a per-path `0` opt-out (e.g. page `/blog/:slug` under
- * `{ '/blog/private': 0, '/blog/*': 3600 }`). Collapsing that to one build-time
- * TTL cannot honor the `0` and would OVER-cache an opted-out path — a wrong-serve.
- * Dispatch has the concrete request path, so it resolves each rule per-path
- * correctly. Baking is only safe for the whole-site number config and per-page
- * exports (each maps to exactly one TTL). See plan 0077.
- */
+/** A page export wins, then a number config; an object config (or none) gives `undefined`. */
 function resolvePageBuildTtl(
   page: PageDefinition,
   revalidateConfig: number | Record<string, number> | undefined,
 ): number | undefined {
-  // 1. Explicit per-page export wins (0 = explicit opt-out, preserved verbatim).
   if (page.revalidate != null) {
     return page.revalidate > 0 ? page.revalidate : 0;
   }
-  // 2. App-wide `routing.revalidate` — global NUMBER only.
   if (typeof revalidateConfig === 'number') {
     return revalidateConfig > 0 ? revalidateConfig : 0;
   }
-  // 3. Object config (or none) → inherit-eligible; dispatch resolves per-path.
   return undefined;
 }
 
 /**
- * Build the ordered page-route table shipped in the deploy manifest as `pages`.
- * Emits EVERY page route in `pageScan.pages` order — already specificity-sorted
- * (static → dynamic → catch-all), the exact order the framework's own
- * `matchRoute` (pages/manifest.ts) resolves in. Patterns are emitted RAW
- * (`:slug`, `:path{.+}`, `*`); the edge matcher (`matchSegmentPattern`) handles
- * `:name{.+}` natively, so — unlike the flat `revalidate` map — catch-alls are
- * NOT collapsed to `*`.
+ * Build the ordered page table shipped in the deploy manifest as `pages`, in
+ * `pageScan.pages` order with raw patterns (catch-alls are not collapsed).
  *
- * Each entry carries a 3-STATE `revalidate` (see `resolvePageBuildTtl`):
- *   - `revalidate: N` (N > 0) — ISR on with baked TTL N;
- *   - `revalidate: 0` — EXPLICIT opt-out (per-page `= 0`, or global-0 config);
- *   - `revalidate` ABSENT — inherit-eligible; dispatch resolves the RAW per-path
- *     OBJECT config (`manifest.pathRevalidate`) against the real request path.
+ * Each entry's `revalidate` has three states: N > 0 turns ISR on, 0 is an
+ * explicit opt-out, and absent lets dispatch resolve the per-path object config
+ * (`manifest.pathRevalidate`) against the request path. Object configs are not
+ * baked because one dynamic page can span several entries, including a 0.
  *
- * The explicit-0 vs absent distinction is load-bearing: it lets dispatch tell a
- * deliberate opt-out (never cache) apart from "no baked TTL, ask the per-path
- * config" (which may cache), so a per-page `export const revalidate = 0` still
- * wins over any `routing.revalidate` rule for the same path.
+ * Built from pages only, so a catch-all page TTL can also cache a non-`/api`
+ * `routes/` handler at dispatch (bounded by `shouldBypassIsr` and `isApiPath`).
  */
-// Route-unaware by design: this table is built from `pageScan.pages` only, so a
-// broad catch-all page with a TTL can shadow a non-`/api` `routes/` handler at
-// dispatch and ISR-cache its response (the worker serves the route, but dispatch
-// resolves the page catch-all's TTL). A global-number `routing.revalidate` has
-// the same effect. Bounded by dispatch `shouldBypassIsr` (no cross-user auth
-// leak) and `isApiPath` (`/api/*` excluded). See design doc 0077 for this known
-// limitation and the planned fix (prepend `routes/` patterns as `revalidate: 0`).
 export function collectPages(
   pageScan: PageScanResult | null,
   revalidateConfig?: number | Record<string, number> | undefined,
@@ -175,8 +106,6 @@ export function collectPages(
   }
   return pageScan.pages.map((page) => {
     const ttl = isrEnabled ? resolvePageBuildTtl(page, revalidateConfig) : undefined;
-    // `undefined` → inherit-eligible (omit `revalidate`); a number (0 or N) is
-    // baked verbatim so dispatch can distinguish an explicit opt-out from inherit.
     return ttl === undefined
       ? { pattern: page.pattern }
       : { pattern: page.pattern, revalidate: ttl };
diff --git a/packages/void/src/local-d1.ts b/packages/void/src/local-d1.ts
index e053d957a..bbd0bb6fa 100644
--- a/packages/void/src/local-d1.ts
+++ b/packages/void/src/local-d1.ts
@@ -32,8 +32,10 @@ function readConfiguredDatabaseId(root: string, bindingName: string): string | u
   let rootConfig: ReturnType<typeof readRootWranglerConfig>;
   try {
     rootConfig = readRootWranglerConfig(root);
-  } catch {
-    throw new Error(`db: cannot read malformed Wrangler configuration in ${root}.`);
+  } catch (error) {
+    throw new Error(`db: cannot read malformed Wrangler configuration in ${root}.`, {
+      cause: error,
+    });
   }
   if (!rootConfig) {
     return undefined;
@@ -61,12 +63,8 @@ function readConfiguredDatabaseId(root: string, bindingName: string): string | u
     );
   }
 
-  const matches = rawDatabases.filter(
-    (entry): entry is Record<string, unknown> =>
-      entry !== null &&
-      typeof entry === 'object' &&
-      !Array.isArray(entry) &&
-      entry.binding === bindingName,
+  const matches = (rawDatabases as Array<Record<string, unknown>>).filter(
+    (entry) => entry.binding === bindingName,
   );
   if (matches.length > 1) {
     throw new Error(
diff --git a/packages/void/src/migrations/plan.ts b/packages/void/src/migrations/plan.ts
index 481cdc7f9..5df3a9f98 100644
--- a/packages/void/src/migrations/plan.ts
+++ b/packages/void/src/migrations/plan.ts
@@ -12,27 +12,10 @@ import {
 
 export const DESTRUCTIVE_PRAGMA = '-- void:allow-destructive';
 
-export type MigrationExecutionPlan = {
-  name: string;
-  dialect: 'sqlite';
-  classifierVersion: number;
-  sqlHash: string;
+export type MigrationExecutionPlan = MigrationPlanHashInput & {
   planHash: string;
-  stability: 'stable' | 'legacy';
   warnings?: Array<string>;
-} & (
-  | {
-      kind: 'single-statement';
-    }
-  | {
-      kind: 'breakpoint-framed';
-      statements: Array<string>;
-    }
-  | {
-      kind: 'legacy-unsplit-multi-statement';
-      allowLegacy: boolean;
-    }
-);
+};
 
 export type MigrationPlanBundle = {
   protocolVersion: 2;
diff --git a/packages/void/src/migrations/runner-mysql.ts b/packages/void/src/migrations/runner-mysql.ts
index 978ff959f..ab20c753a 100644
--- a/packages/void/src/migrations/runner-mysql.ts
+++ b/packages/void/src/migrations/runner-mysql.ts
@@ -24,7 +24,7 @@ export async function readMySqlAppliedMigrations(client: MySqlClient): Promise<A
   }
 }
 
-function toMySqlClient(connection: Connection): MySqlClient {
+export function toMySqlClient(connection: Connection): MySqlClient {
   return {
     async query<T extends Array<Record<string, unknown>> = Array<Record<string, unknown>>>(
       sql: string,
diff --git a/packages/void/src/migrations/runner.ts b/packages/void/src/migrations/runner.ts
index ffe7ff6eb..18a296a36 100644
--- a/packages/void/src/migrations/runner.ts
+++ b/packages/void/src/migrations/runner.ts
@@ -121,31 +121,17 @@ export async function getAppliedMigrations(dbPath: string): Promise<Array<Applie
  */
 export function getMiniflareDatabasePath(persistRoot: string, databaseId: string): string {
   const uniqueKey = 'miniflare-D1DatabaseObject';
-
-  // Step 1: SHA-256 of the unique key
   const key = createHash('sha256').update(uniqueKey).digest();
-
-  // Step 2: HMAC-SHA-256 of database_id, take first 16 bytes
   const nameHmac = createHmac('sha256', key).update(databaseId).digest().subarray(0, 16);
-
-  // Step 3: HMAC-SHA-256 of nameHmac, take first 16 bytes
   const hmac = createHmac('sha256', key).update(nameHmac).digest().subarray(0, 16);
-
-  // Step 4: Concatenate to get the filename hash
   const hash = Buffer.concat([nameHmac, hmac]).toString('hex');
 
   return join(persistRoot, 'v3', 'd1', uniqueKey, `${hash}.sqlite`);
 }
 
 /**
- * One-time migration: rename legacy `_migrations` table to `_void_migrations`.
- * Copies all rows from the old table to the new one, then drops the old table.
- *
- * Wrapped in an IMMEDIATE transaction + re-checked inside, so two concurrent
- * local runners (e.g. two `vite dev` processes against the same DB file)
- * don't race each other. Without the lock, both could observe `_migrations`
- * exists, both enter the body, and the loser crashes on `SELECT … FROM
- * _migrations` after the winner already dropped it.
+ * Move the legacy `_migrations` rows into `_void_migrations`. The check runs inside an
+ * IMMEDIATE transaction so two local runners cannot both copy and drop the old table.
  */
 function upgradeTrackingTable(db: SqliteDatabase): void {
   const tx = db.transaction(() => {
@@ -229,23 +215,8 @@ function assertLocalMigrationState(
 }
 
 /**
- * Apply unapplied SQL migrations from the migrations directory.
- * Tracks applied migrations in the `_void_migrations` table.
- *
- * Each .sql file is executed as a single `db.exec()` call — better-sqlite3's
- * `exec` natively handles multi-statement SQL and lets SQLite do the parsing,
- * so semicolons inside string literals, comments, or trigger bodies don't
- * fracture the migration. A naive `split(';')` pre-processor would misparse
- * a statement like `CREATE TABLE t (msg TEXT DEFAULT 'a;b')` into garbage
- * fragments.
- *
- * Concurrent-runner safety: two local `void` processes can race against the
- * same SQLite file. Both can snapshot the applied-set before either writes,
- * and if both decide a migration is pending, the loser would crash on a
- * `table already exists` error. Each per-migration apply therefore runs
- * inside an IMMEDIATE transaction that re-checks the tracking row under the
- * SQLite write lock — the loser sees the winner's insert and skips, instead
- * of re-running the DDL.
+ * Apply pending SQL migrations and record them in `_void_migrations`.
+ * Each file runs through one `exec` so SQLite parses multi-statement SQL itself.
  */
 export async function runMigrations(migrationsDir: string, dbPath: string): Promise<Array<string>> {
   const allMigrations = collectMigrations(migrationsDir);
@@ -290,9 +261,7 @@ export async function runMigrations(migrationsDir: string, dbPath: string): Prom
 
     for (const migration of pending) {
       const tx = db.transaction(() => {
-        // Re-check under the write lock. A concurrent runner may have
-        // applied this migration between our pending-filter snapshot and
-        // now; if so, skip instead of re-running the DDL.
+        // Re-check under the write lock: a concurrent local runner may have applied it already.
         if (checkStmt.get(migration.name)) {
           return false;
         }
diff --git a/packages/void/src/migrations/validate.ts b/packages/void/src/migrations/validate.ts
index 180043ef7..231fdd485 100644
--- a/packages/void/src/migrations/validate.ts
+++ b/packages/void/src/migrations/validate.ts
@@ -1,4 +1,5 @@
 import { existsSync, readdirSync } from 'node:fs';
+import { hasStandalonePragma } from '@void/deploy-core';
 import { join } from 'pathslash';
 import {
   readJournal,
@@ -24,8 +25,6 @@ const DESTRUCTIVE_PATTERNS = [
   /\bDROP\s+INDEX\b/i,
   /\bDROP\s+TRIGGER\b/i,
   /\bALTER\s+TABLE\b[\s\S]*\bDROP\s+COLUMN\b/i,
-  /\bALTER\s+TABLE\b[\s\S]*\bRENAME\s+TO\b/i,
-  /\bALTER\s+TABLE\b[\s\S]*\bRENAME\s+COLUMN\b/i,
   /\bALTER\s+TABLE\b[\s\S]*\bRENAME\b[\s\S]*\bTO\b/i,
   /\bTRUNCATE\b/i,
   /\bINSERT\s+OR\s+REPLACE\b/i,
@@ -92,13 +91,6 @@ export function isDestructive(sql: string): boolean {
   });
 }
 
-function hasDestructivePragma(sql: string): boolean {
-  return sql
-    .replace(/\r\n?/g, '\n')
-    .split('\n')
-    .some((line) => line.trim() === DESTRUCTIVE_PRAGMA);
-}
-
 /**
  * Validate migration files. Returns the validated list with destructive flags.
  * Throws if any destructive migration lacks the allow-destructive pragma.
@@ -111,7 +103,7 @@ export function validateMigrations(
 
   for (const file of files) {
     const destructive = isDestructive(file.sql);
-    if (destructive && !hasDestructivePragma(file.sql)) {
+    if (destructive && !hasStandalonePragma(file.sql, DESTRUCTIVE_PRAGMA)) {
       errors.push(file.name);
     }
     results.push({ name: file.name, sql: file.sql, destructive });
diff --git a/packages/void/src/pages/client.ts b/packages/void/src/pages/client.ts
index 57b011e87..070f04c1f 100644
--- a/packages/void/src/pages/client.ts
+++ b/packages/void/src/pages/client.ts
@@ -371,7 +371,7 @@ export async function createVoidRouter(config: VoidRouterConfig): Promise<{
     }
   }
 
-  const rawRouter: VoidRouter = {
+  const router: VoidRouter = {
     _hoverDelay: engine._hoverDelay,
 
     get url() {
@@ -396,7 +396,7 @@ export async function createVoidRouter(config: VoidRouterConfig): Promise<{
     },
 
     refresh(options = {}) {
-      return rawRouter.visit(window.location.pathname + window.location.search, {
+      return router.visit(window.location.pathname + window.location.search, {
         preserveState: true,
         preserveScroll: true,
         ...options,
@@ -415,11 +415,6 @@ export async function createVoidRouter(config: VoidRouterConfig): Promise<{
       engine.flushAll();
     },
   };
-  const router = createRouterFacade(
-    rawRouter,
-    () => routeUrl,
-    () => routeParams,
-  );
 
   engine.setPopStateHandler((url, options) => {
     router.visit(url, options);
diff --git a/packages/void/src/pages/dev-css-assets.ts b/packages/void/src/pages/dev-css-assets.ts
index e039fb63a..493e06999 100644
--- a/packages/void/src/pages/dev-css-assets.ts
+++ b/packages/void/src/pages/dev-css-assets.ts
@@ -22,7 +22,6 @@ type DevCssRequestBody = {
 type OrderedEdgeStore = {
   version: number;
   set(importer: string, edges: Array<string>): void;
-  deleteForId(id: string): void;
   getForNode(node: EnvironmentModuleNode): Array<string> | undefined;
 };
 
@@ -189,15 +188,6 @@ function createOrderedEdgeStore(root: string): OrderedEdgeStore {
         byKey.set(key, edges);
       }
     },
-    deleteForId(id) {
-      let deleted = false;
-      for (const key of aliasesForId(id)) {
-        deleted = byKey.delete(key) || deleted;
-      }
-      if (deleted) {
-        version++;
-      }
-    },
     getForNode(node) {
       const keys = [node.url, node.id].filter(
         (value): value is string => typeof value === 'string',
diff --git a/packages/void/src/pages/island-imports.ts b/packages/void/src/pages/island-imports.ts
index c2ed8d185..a468cc9b2 100644
--- a/packages/void/src/pages/island-imports.ts
+++ b/packages/void/src/pages/island-imports.ts
@@ -18,7 +18,7 @@ export type StaticCssImport = { statement: string; specifier: string };
 type ScriptBlock = { source: string; offset: number; filename: string };
 
 /** The whole JS/TS module, or each `<script>` block of a Vue/Svelte SFC with its offset in the file. */
-function scriptBlocks(code: string, filename: string): Array<ScriptBlock> {
+export function scriptBlocks(code: string, filename: string): Array<ScriptBlock> {
   if (!/\.(?:vue|svelte)$/.test(filename)) {
     return [{ source: code, offset: 0, filename }];
   }
diff --git a/packages/void/src/pages/navigation-engine.ts b/packages/void/src/pages/navigation-engine.ts
index 9275378b8..11700fc11 100644
--- a/packages/void/src/pages/navigation-engine.ts
+++ b/packages/void/src/pages/navigation-engine.ts
@@ -775,9 +775,6 @@ export async function createPageNavigationEngine(
               buffer += decoder.decode(value, { stream: true });
               processLines();
             }
-            if (buffer.trim()) {
-              processLines();
-            }
           } catch (e: unknown) {
             if (!(e instanceof Error) || e.name !== 'AbortError') {
               deferredRegistry.rejectPending('Stream closed before resolution');
diff --git a/packages/void/src/pages/protocol.ts b/packages/void/src/pages/protocol.ts
index ef3583090..1576e7771 100644
--- a/packages/void/src/pages/protocol.ts
+++ b/packages/void/src/pages/protocol.ts
@@ -9,6 +9,7 @@ import {
   type HeadDescriptor,
   type HeadConfig,
 } from './head.ts';
+import { escapeScriptJson } from './script-json.ts';
 import { serializePageData } from './serialize.ts';
 import type { DevCssAsset, PageRenderMode } from './types.ts';
 import { ValidationError } from './validation-error.ts';
@@ -20,13 +21,7 @@ const RENDER_ERROR_ASSET_TAGS_KEY = '__voidPageAssetTags';
 
 /** Escape characters that are unsafe inside inline <script> tags to prevent XSS. */
 export function safeJsonStringify(value: unknown): string {
-  const json = JSON.stringify(value) ?? 'null';
-  return json
-    .replaceAll('<', '\\u003c')
-    .replaceAll('>', '\\u003e')
-    .replaceAll('&', '\\u0026')
-    .replaceAll('\u2028', '\\u2028')
-    .replaceAll('\u2029', '\\u2029');
+  return escapeScriptJson(JSON.stringify(value) ?? 'null');
 }
 
 export type PageObject = {
@@ -533,10 +528,14 @@ export async function handlePageGet(
     c,
     'text/html; charset=utf-8',
     options?.dev === true,
-    (group, data) =>
-      `\n<script>window.__resolveDeferred?window.__resolveDeferred(${safeJsonStringify(group)},${safeJsonStringify(data)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},${safeJsonStringify(data)}])</script>`,
-    (group, error) =>
-      `\n<script>window.__rejectDeferred?window.__rejectDeferred(${safeJsonStringify(group)},${safeJsonStringify(error)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},0,${safeJsonStringify(error)}])</script>`,
+    (group, data) => {
+      const g = safeJsonStringify(group);
+      return `\n<script>(function(d){window.__resolveDeferred?window.__resolveDeferred(${g},d):(window.__deferredQueue??=[]).push([${g},d])})(${safeJsonStringify(data)})</script>`;
+    },
+    (group, error) => {
+      const g = safeJsonStringify(group);
+      return `\n<script>(function(e){window.__rejectDeferred?window.__rejectDeferred(${g},e):(window.__deferredQueue??=[]).push([${g},0,e])})(${safeJsonStringify(error)})</script>`;
+    },
     assetTags,
   );
 }
diff --git a/packages/void/src/pages/scan.ts b/packages/void/src/pages/scan.ts
index 47874edca..62a9ff0cd 100644
--- a/packages/void/src/pages/scan.ts
+++ b/packages/void/src/pages/scan.ts
@@ -14,6 +14,7 @@ import {
   type AstVariableDeclaration,
 } from '../shared/ast.ts';
 import { staticExportInitializers, staticLiteral } from '../shared/static-exports.ts';
+import { scriptBlocks } from './island-imports.ts';
 import { resolveNamedLayout } from './layout-resolution.ts';
 import type {
   ExplicitBoolean,
@@ -63,17 +64,13 @@ function componentLayout(source: string, filename: string): string | false | und
   if (!source.includes('layout')) {
     return undefined;
   }
-  const scripts =
-    filename.endsWith('.vue') || filename.endsWith('.svelte')
-      ? [...source.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script\s*>/gi)].map((match) => match[1]!)
-      : [source];
-  for (const script of scripts) {
-    if (!script.includes('layout')) {
+  for (const script of scriptBlocks(source, filename)) {
+    if (!script.source.includes('layout')) {
       continue;
     }
     const initializer = staticExportInitializers(
-      filename.replace(/\.(vue|svelte)$/, '.ts'),
-      script,
+      script.filename,
+      script.source,
       new Set(['layout']),
     ).get('layout');
     const value = staticLiteral(initializer);
diff --git a/packages/void/src/pages/script-json.ts b/packages/void/src/pages/script-json.ts
new file mode 100644
index 000000000..9a0340369
--- /dev/null
+++ b/packages/void/src/pages/script-json.ts
@@ -0,0 +1,7 @@
+const UNSAFE_SCRIPT_CHARS = /[<>&\u2028\u2029]/g;
+
+export function escapeScriptJson(json: string): string {
+  return json.replace(UNSAFE_SCRIPT_CHARS, (c) => {
+    return `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`;
+  });
+}
diff --git a/packages/void/src/pages/serialize.ts b/packages/void/src/pages/serialize.ts
index d490c38a3..ffdf0c6ff 100644
--- a/packages/void/src/pages/serialize.ts
+++ b/packages/void/src/pages/serialize.ts
@@ -1,3 +1,5 @@
+import { escapeScriptJson } from './script-json.ts';
+
 /**
  * Escape JSON for embedding inside an inline `<script type="application/json">`
  * tag. Replaces `<`, `>`, `&`, U+2028, U+2029 with their `\uXXXX` JSON escape
@@ -5,7 +7,5 @@
  * `JSON.parse` on hydration.
  */
 export function serializePageData(pageObj: unknown): string {
-  return JSON.stringify(pageObj).replace(/[<>&\u2028\u2029]/g, (c) => {
-    return `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`;
-  });
+  return escapeScriptJson(JSON.stringify(pageObj));
 }
diff --git a/packages/void/src/plugin-ai-setup.ts b/packages/void/src/plugin-ai-setup.ts
index ad2f1c792..e824170eb 100644
--- a/packages/void/src/plugin-ai-setup.ts
+++ b/packages/void/src/plugin-ai-setup.ts
@@ -98,7 +98,7 @@ export async function runAiSetupPrompt(
   const { attachSelectedPlatform, writeProjectConfig } = await import('./cli/project.ts');
   const { inferDefaultSlug } = await import('./cli/resolve-project.ts');
 
-  const client = new PlatformClient(token, apiUrl);
+  const client = new PlatformClient(token, { apiUrl });
 
   let projects: Array<import('./cli/client.ts').ProjectResponse>;
   try {
@@ -169,7 +169,7 @@ export async function runAiSetupPrompt(
     slug = project.slug;
   }
 
-  writeProjectConfig(root, attachSelectedPlatform(root, { projectId, slug }, client.apiUrl));
+  writeProjectConfig(root, attachSelectedPlatform({ projectId, slug }, client.apiUrl));
   // Restart the dev server so mergeBindings picks up fresh credentials
   await server.restart();
   printSuccess(`Linked to ${slug}.`);
diff --git a/packages/void/src/plugin-dev-triggers-hint.ts b/packages/void/src/plugin-dev-triggers-hint.ts
index fc2579931..e62f3320c 100644
--- a/packages/void/src/plugin-dev-triggers-hint.ts
+++ b/packages/void/src/plugin-dev-triggers-hint.ts
@@ -11,18 +11,14 @@ import { scanQueuesSync } from './queues/scan.ts';
  * and framework mode (SvelteKit, Nuxt, Analog, Astro, TanStack Start, React
  * Router, vinext) expose `/__void/scheduled` and `/__void/queue`.
  */
-export function devTriggersHintPlugin(
-  root: string,
-  options: { framework: boolean; devTriggerToken: string },
-): Plugin {
-  const { devTriggerToken } = options;
+export function devTriggersHintPlugin(root: string, devTriggerToken: string): Plugin {
   return {
     name: 'void:dev-triggers-hint',
     apply: 'serve',
     configureServer(server) {
       const paths = readProjectPaths(root);
-      const jobs = scanJobsSync(root, paths.cronsDir);
-      const queues = scanQueuesSync(root, paths.queuesDir);
+      const jobs = scanJobsSync(paths.cronsDir);
+      const queues = scanQueuesSync(paths.queuesDir);
       if (jobs.length === 0 && queues.length === 0) {
         return;
       }
diff --git a/packages/void/src/plugin-drizzle.ts b/packages/void/src/plugin-drizzle.ts
index 019fccf30..7d5c6ea51 100644
--- a/packages/void/src/plugin-drizzle.ts
+++ b/packages/void/src/plugin-drizzle.ts
@@ -267,7 +267,7 @@ function createPrimaryDb(d1) {
       },
     },
 
-    async configureServer(server) {
+    async configureServer() {
       if (!schema) {
         return;
       }
@@ -297,17 +297,6 @@ function createPrimaryDb(d1) {
             '         Run `void db generate` to create migration files for dev startup and deploy.',
         );
       }
-
-      // Watch schema files for changes → regenerate db.d.ts
-      const watchPath = schema.path;
-      const regenerate = (path: string) => {
-        if (path === watchPath || (schema.type === 'directory' && path.startsWith(watchPath))) {
-          generateDbDts(outDir, schema, dialect);
-        }
-      };
-      server.watcher.on('change', regenerate);
-      server.watcher.on('add', regenerate);
-      server.watcher.on('unlink', regenerate);
     },
   };
 }
diff --git a/packages/void/src/plugin-email-dev-inbox.ts b/packages/void/src/plugin-email-dev-inbox.ts
index 7cbe93972..e3b47c116 100644
--- a/packages/void/src/plugin-email-dev-inbox.ts
+++ b/packages/void/src/plugin-email-dev-inbox.ts
@@ -2,15 +2,9 @@
 // `/__void/inbox` routes for browsing captured messages. Activated when
 // binding inference detected `void/email` usage.
 //
-// Two ways a message lands in the buffer:
-//   * `POST /__void/inbox/_capture` — the real `void dev` path. `sendEmail`
-//     runs in workerd (a separate OS process), so it cannot reach this
-//     process's sink registry; it POSTs the captured message here through its
-//     dev assets binding, which @cloudflare/vite-plugin wires directly into
-//     this middleware stack.
-//   * the in-process sink — only fires for a `sendEmail` that happens to run
-//     inside this Node process (e.g. a prerender pass). Kept so that path is
-//     still captured; it is not the dev-server transport.
+// `sendEmail` runs in workerd, a separate OS process, so it POSTs each
+// captured message to `/__void/inbox/_capture` through its dev assets
+// binding, which @cloudflare/vite-plugin wires into this middleware stack.
 //
 // Every route requires the project's dev-trigger token — the same one
 // `/__void/scheduled` and `/__void/queue` check. Vite's own host validation
@@ -21,6 +15,7 @@
 import { timingSafeEqual } from 'node:crypto';
 import type { Plugin } from 'vite';
 import { voidLog } from './log.ts';
+import { afterServerReady } from './plugin-dev-config.ts';
 import {
   clearDevBuffer,
   DEV_INBOX_ACK_HEADER,
@@ -34,7 +29,6 @@ import {
   listDevMessages,
   parseCapturedMessage,
   pushToDevBuffer,
-  registerEmailSink,
   type CapturedMessage,
 } from './runtime/email/dev-inbox.ts';
 
@@ -60,7 +54,6 @@ export interface EmailDevInboxPluginOptions {
 
 export function emailDevInboxPlugin(options: EmailDevInboxPluginOptions): Plugin {
   const { devTriggerToken } = options;
-  let unregister: (() => void) | undefined;
 
   /** `href` for an inbox path that keeps the browser session authorized. */
   const inboxHref = (path: string): string =>
@@ -69,18 +62,6 @@ export function emailDevInboxPlugin(options: EmailDevInboxPluginOptions): Plugin
   return {
     name: 'void:email-dev-inbox',
     apply: 'serve',
-    buildStart() {
-      if (unregister) {
-        return;
-      }
-      unregister = registerEmailSink((m) => pushToDevBuffer(m));
-    },
-    buildEnd() {
-      if (unregister) {
-        unregister();
-        unregister = undefined;
-      }
-    },
     configureServer(server) {
       // The browser cannot add a header, so the inbox URL is printed with the
       // token in its query, the same way the cron/queue hint prints its curl.
@@ -92,9 +73,7 @@ export function emailDevInboxPlugin(options: EmailDevInboxPluginOptions): Plugin
         }
         voidLog(`Email inbox: http://localhost:${port}${inboxHref('')}`);
       };
-      if (server.httpServer) {
-        server.httpServer.once('listening', () => setTimeout(printInboxUrl, 100));
-      }
+      afterServerReady(server, printInboxUrl);
 
       server.middlewares.use(DEV_INBOX_PREFIX, (req, res) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
diff --git a/packages/void/src/plugin-env-client-fold.ts b/packages/void/src/plugin-env-client-fold.ts
index 51bb42a0b..142b122c8 100644
--- a/packages/void/src/plugin-env-client-fold.ts
+++ b/packages/void/src/plugin-env-client-fold.ts
@@ -3,7 +3,6 @@ import { parseSync, type Plugin, type ResolvedConfig } from 'vite';
 import {
   extractEnvBindings,
   isVoidEnvScriptCandidate,
-  loadEnvPublic,
   walkEnvReads,
   type ImportBindings,
 } from './plugin-env-client-guard.ts';
@@ -68,26 +67,14 @@ function pushHit(node: AstMemberExpression, hits: Array<FoldHit>): void {
  *   • Only folds static member access: `env.FOO` and `env["FOO"]`.
  *     Dynamic access, destructuring, and reassignment fall through to the
  *     runtime Proxy.
- *   • Only folds keys with a known build-time value (build shell or schema
- *     `.default(...)`). Unknown keys are left as-is
+ *   • Only folds keys with a known build-time value (build shell, or a schema
+ *     `.default(...)` that the env-schema plugin adds). Unknown keys are left as-is
  *     and the Proxy handles them at runtime — no "undefined" shoved in.
  *   • Build-only (`apply: 'build'`). Dev runs through the Proxy so local
  *     `.env` edits take effect without a full rebuild.
  */
 export function envClientFoldPlugin(): Plugin {
   let loadedEnv: Record<string, string> = {};
-  const schemaDefaults: Record<string, string> = {};
-
-  /** The merged view the transform consults for each key. */
-  function resolveValue(key: string): string | undefined {
-    if (key in loadedEnv) {
-      return loadedEnv[key];
-    }
-    if (key in schemaDefaults) {
-      return schemaDefaults[key];
-    }
-    return undefined;
-  }
 
   return {
     name: 'void:env-client-fold',
@@ -95,29 +82,11 @@ export function envClientFoldPlugin(): Plugin {
     // Run after SFC compilers (Svelte/Vue/Astro) so the `.svelte` / `.vue` /
     // `.astro` id arrives as compiled JS we can parse and fold.
     enforce: 'post',
-    async configResolved(config: ResolvedConfig) {
+    configResolved(config: ResolvedConfig) {
       // Vite runs configResolved hooks concurrently. Keep the shared env object
       // so transforms observe the schema plugin's completed removal of local
       // values and insertion of defaults, rather than an early snapshot.
       loadedEnv = (config.env ?? {}) as Record<string, string>;
-
-      // Schema `.default(...)` values back-fill missing client keys.
-      // We only surface client-exposed ones so server-only defaults never
-      // leak into the client bundle.
-      try {
-        const mod = await loadEnvPublic();
-        if (mod._hasRegisteredSchema()) {
-          const defaults = mod._getSchemaDefaults();
-          for (const [key, value] of Object.entries(defaults)) {
-            if (isClientEnvKey(key) && !(key in loadedEnv)) {
-              schemaDefaults[key] = value;
-            }
-          }
-        }
-      } catch {
-        // If the schema module can't load here, we simply fold less. The
-        // Proxy still handles unfoldable reads at runtime.
-      }
     },
     async transform(code, id) {
       if (this.environment?.name !== 'client') {
@@ -127,11 +96,6 @@ export function envClientFoldPlugin(): Plugin {
         return;
       }
 
-      // Nothing to fold against — bail out before parsing.
-      if (Object.keys(loadedEnv).length === 0 && Object.keys(schemaDefaults).length === 0) {
-        return;
-      }
-
       let parsed: ReturnType<typeof parseSync>;
       try {
         parsed = parseSync(id, code);
@@ -156,7 +120,7 @@ export function envClientFoldPlugin(): Plugin {
           // Server-only key — let the client-guard plugin handle it.
           continue;
         }
-        const value = resolveValue(hit.property);
+        const value = loadedEnv[hit.property];
         if (value === undefined) {
           // Client-exposed but no known build-time value — Proxy will
           // read it from `import.meta.env` at runtime.
diff --git a/packages/void/src/plugin-env-schema.ts b/packages/void/src/plugin-env-schema.ts
index 9a9393de8..7625d9702 100644
--- a/packages/void/src/plugin-env-schema.ts
+++ b/packages/void/src/plugin-env-schema.ts
@@ -329,7 +329,6 @@ export function envSchemaPlugin(root: string, options: EnvSchemaPluginOptions =
     },
     async configResolved(config) {
       command = config.command;
-      await emitSchemaFacts();
 
       // `.env` is local-only. Vite loads it during production builds by
       // default, so remove file-sourced client values before its replacement
@@ -370,7 +369,6 @@ export function envSchemaPlugin(root: string, options: EnvSchemaPluginOptions =
       if (!envFile) {
         return;
       }
-      await importUserEnv();
       afterServerReady(server, () => {
         void validateAndWarn();
       });
@@ -388,8 +386,8 @@ export function envSchemaPlugin(root: string, options: EnvSchemaPluginOptions =
       });
     },
     async buildStart() {
-      // For non-dev (build, prerender), still load the schema so it's
-      // available to subsequent plugins / codegen consumers.
+      // `config` runs once per `vite build --watch` session; re-import so
+      // each rebuild checks client code against the current env.ts.
       if (envFile) {
         await importUserEnv();
       }
diff --git a/packages/void/src/plugin-framework-triggers.ts b/packages/void/src/plugin-framework-triggers.ts
index 4e506958c..b7989deed 100644
--- a/packages/void/src/plugin-framework-triggers.ts
+++ b/packages/void/src/plugin-framework-triggers.ts
@@ -25,8 +25,8 @@ export function frameworkTriggersDispatchPath(root: string): string {
  */
 export function writeFrameworkTriggersDispatch(root: string, devTriggerToken: string): void {
   const paths = readProjectPaths(root);
-  const jobs = scanJobsSync(root, paths.cronsDir);
-  const queues = scanQueuesSync(root, paths.queuesDir);
+  const jobs = scanJobsSync(paths.cronsDir);
+  const queues = scanQueuesSync(paths.queuesDir);
   const target = frameworkTriggersDispatchPath(root);
   mkdirSync(dirname(target), { recursive: true });
   // Owner-only, like `.void/dev-trigger-token`: this module embeds the same
@@ -72,9 +72,7 @@ export function frameworkTriggersPlugin(root: string, options: FrameworkTriggers
       // generated `__jobs`/`__queues` table at codegen time) are picked up
       // without a full restart.
       //
-      // chokidar emits POSIX-style paths on every platform, so normalize the
-      // root prefixes to match — otherwise this comparison silently no-ops
-      // on Windows where `join(root, 'crons')` uses backslashes.
+      // Watcher paths are native (backslashes on Windows); normalize before comparing.
       const paths = readProjectPaths(root);
       const cronsPrefix = normalizePath(paths.cronsDir);
       const queuesPrefix = normalizePath(paths.queuesDir);
@@ -87,13 +85,8 @@ export function frameworkTriggersPlugin(root: string, options: FrameworkTriggers
           return;
         }
         writeDispatch();
-        // The dispatch file lives under `.void/`, which `envPlugin.config`
-        // adds to `server.watch.ignored` (to stop miniflare's SQLite writes
-        // from triggering infinite HMR). Without explicit invalidation the
-        // worker environment would keep returning the cached dispatch
-        // module on the next dynamic import, so a renamed/added cron would
-        // never route until the dev server restarts. Walk every Vite
-        // environment and drop the cached dispatch module.
+        // In the Class A composition, `envPlugin.config` ignores `.void/` in the
+        // watcher, so Vite never invalidates the cached dispatch module itself.
         for (const env of Object.values(server.environments)) {
           const mod = env.moduleGraph.getModuleById(dispatchPath);
           if (mod) {
diff --git a/packages/void/src/plugin-framework.ts b/packages/void/src/plugin-framework.ts
index 7b35340bb..fa9fba0c4 100644
--- a/packages/void/src/plugin-framework.ts
+++ b/packages/void/src/plugin-framework.ts
@@ -27,7 +27,6 @@ import {
 } from './plugin-framework-triggers.ts';
 import { migrationPlugin } from './plugin-migration.ts';
 import { createCloudflareBuiltinsExternalPlugin } from './plugin-worker-environment.ts';
-import { resolveSandboxConfig } from './sandbox/config.ts';
 import { injectSvelteKitHooks } from './sveltekit-hooks-transform.ts';
 
 export function createFrameworkPlugins(input: {
@@ -40,12 +39,10 @@ export function createFrameworkPlugins(input: {
   readonly application: ApplicationAnalysis;
   readonly bindingNames: ApplicationAnalysis['bindingNames'];
   readonly websocketRoutes: ApplicationAnalysis['allWebsockets'];
-  readonly sandboxConfig: ReturnType<typeof resolveSandboxConfig> | undefined;
   readonly liveConfig: ReturnType<typeof resolveLiveBindingConfig> | undefined;
   readonly detected: NonNullable<ApplicationAnalysis['framework']>;
   readonly clientStubsPlugin: Plugin;
   readonly serverRuntimeOptimizerPlugin: Plugin;
-  readonly authEnabled: boolean;
   readonly devTriggerToken: string;
   readonly implicitDeployGuard: Plugin;
 }): Array<Plugin> {
@@ -59,12 +56,10 @@ export function createFrameworkPlugins(input: {
     application,
     bindingNames,
     websocketRoutes,
-    sandboxConfig,
     liveConfig,
     detected,
     clientStubsPlugin,
     serverRuntimeOptimizerPlugin,
-    authEnabled,
     devTriggerToken,
     implicitDeployGuard,
   } = input;
@@ -120,7 +115,6 @@ export function createFrameworkPlugins(input: {
           ? { directCloudflareAi: { gateway: config.ai?.gateway } }
           : {}),
         websockets: websocketRoutes,
-        sandbox: sandboxConfig,
         live: liveConfig,
       },
     );
@@ -220,14 +214,14 @@ export function createFrameworkPlugins(input: {
     envClientFoldPlugin(),
     drizzlePlugin(root, false, dialect, {
       d1BindingName: bindingNames?.d1,
-      forceVirtualDb: authEnabled || bindingNames?.d1 !== undefined,
+      forceVirtualDb: bindingNames?.d1 !== undefined,
       localD1DatabaseId: localD1.databaseId,
       localD1PersistRoot: frameworkPersistRoot,
     }),
     migrationPlugin(root, dialect, localD1.databaseId, frameworkPersistRoot, {
       enabled: false,
     }),
-    devTriggersHintPlugin(root, { framework: true, devTriggerToken }),
+    devTriggersHintPlugin(root, devTriggerToken),
     frameworkTriggersPlugin(root, { devTriggerToken }),
     ...(detected.name === 'nuxt'
       ? [nitroDevTriggerInjectPlugin(root, { serverDir: 'server' })]
diff --git a/packages/void/src/plugin-prerender.ts b/packages/void/src/plugin-prerender.ts
index aec818295..dba2da003 100644
--- a/packages/void/src/plugin-prerender.ts
+++ b/packages/void/src/plugin-prerender.ts
@@ -1,6 +1,6 @@
 import { join } from 'pathslash';
 import type { Plugin } from 'vite';
-import { resolveDistDir, resolveWorkerDirName } from './cli/deploy.ts';
+import { resolveDistDir, resolveWorkerDirName } from './cli/build-output-dir.ts';
 import { isNodeTarget, type VoidConfig } from './config.ts';
 import { voidLog, voidWarn, setShowTimestamp } from './log.ts';
 import { prerenderPages, prerenderPagesNode } from './prerender.ts';
diff --git a/packages/void/src/plugin-routing.ts b/packages/void/src/plugin-routing.ts
index a374f1eb3..0d7a9f9cf 100644
--- a/packages/void/src/plugin-routing.ts
+++ b/packages/void/src/plugin-routing.ts
@@ -3,7 +3,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, relative } from 'pathslash';
 import { normalizePath, type Plugin } from 'vite';
-import { analyzeApplicationSync, type ApplicationAnalysis } from './application-analysis.ts';
+import type { ApplicationAnalysis } from './application-analysis.ts';
 import { completeApplicationAnalysis } from './application-routing.ts';
 import {
   hasApiRoutes,
@@ -13,13 +13,13 @@ import {
 } from './asset-routing.ts';
 import { loadVoidAuthConfig } from './auth/config.ts';
 import { generateVoidAuthDatabaseModule, generateVoidAuthDrizzleSchema } from './auth/drizzle.ts';
-import { lintDestinationSplats, lintDuplicateSources, mergeRoutingRules } from './cli/headers.ts';
+import { lintRoutingPhases, mergeRoutingRules } from './cli/headers.ts';
 import { stampClientAssetCachePolicy } from './client-asset-manifest.ts';
 import { findEnvFileForPaths } from './codegen/env-types.ts';
 import { generateQueueTypes } from './codegen/queue-types.ts';
 import { generateRouteTypes } from './codegen/route-types.ts';
 import { writeFileIfChanged } from './codegen/write-if-changed.ts';
-import { readConfig, getDatabaseDialect, type NotFoundHandling } from './config.ts';
+import { readConfig, getDatabaseDialect } from './config.ts';
 import { collectPages, collectRevalidate, hasRevalidate } from './isr-config.ts';
 import { readProjectPaths } from './project-paths.ts';
 import {
@@ -29,7 +29,6 @@ import {
   compileWorkerClient,
   compileNodeApp,
   compileNodeServer,
-  compileNodeClient,
   type CompileOptions,
   type SsrCompileOptions,
   type PagesCompileOptions,
@@ -65,32 +64,16 @@ const LOAD_ID_FILTER =
   /^virtual:void-(routes|client-worker(?::(react|vue|svelte|solid))?|client-browser(?::(react|vue|svelte|solid))?)$/;
 
 type RoutingPluginOptions = {
-  getApplicationAnalysis?: (
-    environment: RouteEnvironment,
-    refresh?: boolean,
-  ) => ApplicationAnalysis;
+  getApplicationAnalysis: (environment: RouteEnvironment, refresh?: boolean) => ApplicationAnalysis;
   isAuthEnabled: () => boolean;
   getVersionMetadataBinding?: () => string | undefined;
   devTriggerToken?: string;
   headConfig?: import('./pages/head.ts').HeadConfig;
-  output?: 'server' | 'static';
   prerenderPaths?: Array<string>;
   remoteMode?: boolean;
   bindingNames?: { d1?: string; kv?: string; r2?: string };
   target?: 'node' | 'bun' | 'deno';
-  /**
-   * Full `routing` section from `void.config.ts`. The plugin merges
-   * `_redirects` / `_headers` under Vite's `publicDir` with the config
-   * rules on every compile, matching the deploy-time merge order (file
-   * rules first, `void.config.ts` last — last match wins).
-   *
-   * The watcher also watches those two files during `vite dev` and
-   * re-runs the merge + invalidates the route module when either changes.
-   *
-   * The merged rules are emitted into every runtime that owns its routing.
-   * Managed Cloudflare builds omit them because platform dispatch owns the
-   * same pipeline.
-   */
+  /** Merged with `_redirects` / `_headers` under Vite's `publicDir`; config rules take precedence. */
   routing?: import('./config.ts').RoutingConfig;
   hasSandbox?: boolean;
   sandboxBindingName?: string;
@@ -136,7 +119,6 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
   const normalizedQueuesDir = normalizePath(queuesDir);
   const normalizedEmailDir = normalizePath(emailDir);
   const normalizedPagesDir = normalizePath(pagesDir);
-  const normalizedSsrDir = normalizePath(ssrDir);
   const ssrEntryAbsPaths = new Set(
     [...SSR_SERVER_ENTRY_RELATIVE_PATHS, ...SSR_CLIENT_ENTRY_RELATIVE_PATHS].map((path) =>
       normalizePath(join(ssrDir, path.split('/').pop()!)),
@@ -169,14 +151,7 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
   }
 
   async function rescan(refresh = false) {
-    let analysis = options.getApplicationAnalysis?.(routeEnvironment, refresh);
-    if (!analysis) {
-      const config = readConfig(root);
-      analysis = analyzeApplicationSync(root, {
-        config: { ...config, output: options.output ?? config.output },
-        environment: routeEnvironment,
-      });
-    }
+    const analysis = options.getApplicationAnalysis(routeEnvironment, refresh);
     scan = (await completeApplicationAnalysis(analysis)).scan;
     authConfigPath = analysis.authConfigPath;
     const entries = validateSsrEntries(root, paths);
@@ -212,7 +187,6 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
     ? {
         bindingNames: options.bindingNames,
         remotePath: resolveFile('#self/remote'),
-        envPath: resolveFile('#self/_env'),
       }
     : undefined;
   // If the project has env.ts, splice boot-time validation into the worker
@@ -228,10 +202,10 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
       helperPath: resolveFile('#self/env'),
     };
   }
+  const runtimeEmailPath = resolveFile('#self/email');
   const compileOptions: CompileOptions = {
     honoPath: resolveFile('hono'),
     runtimeEnvPath: resolveFile('#self/_env'),
-    runtimeEmailPath: resolveFile('#self/email'),
     emailDir,
     projectRoot: root,
     homeDir: homedir(),
@@ -250,26 +224,12 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
     bindingNames: options.bindingNames,
   };
 
-  // Static `_redirects` / `_headers` are always merged. The compiled Hono app
-  // emits them for native Cloudflare, local dev, and non-CF targets. Managed
-  // builds strip the duplicate pipeline because dispatch owns it.
-  //
-  // `publicDir` starts at `<root>/public` (Vite's default) and is
-  // re-resolved from the resolved config in `configResolved`. For
-  // framework-configured publicDir overrides, the re-resolve picks
-  // them up before the first route module load.
+  // Vite's default until `configResolved` reads the real value; null when `publicDir: false`.
   let publicDir: string | null = join(root, 'public');
   function reloadFileRules(): void {
-    // Always run through the merge — when `publicDir === null` (user set
-    // `publicDir: false` in Vite config) file rules are skipped, but
-    // config-based `routing.redirects`/`rewrites`/`headers`/`fallbacks` still
-    // apply. Re-running also clears stale file rules picked up from the
-    // default `<root>/public` preload before `configResolved`.
+    // Config rules still apply without a public dir, and stale preload rules are cleared.
     const merged = mergeRoutingRules({ dir: publicDir, routing: options.routing });
-    lintDuplicateSources(merged.redirectRules, 'redirects/rewrites (pre-asset)');
-    lintDuplicateSources(merged.fallbackRules, 'fallbacks (post-asset)');
-    lintDestinationSplats(merged.redirectRules, 'redirects/rewrites (pre-asset)');
-    lintDestinationSplats(merged.fallbackRules, 'fallbacks (post-asset)');
+    lintRoutingPhases(merged);
     compileOptions.headerRules = merged.headerRules.length > 0 ? merged.headerRules : undefined;
     compileOptions.redirectRules =
       merged.redirectRules.length > 0 ? merged.redirectRules : undefined;
@@ -294,8 +254,8 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
             ? join(runtimeDir, 'better-auth-mysql.mjs')
             : join(runtimeDir, 'better-auth.mjs'),
       authConfigPath,
-      authDatabasePath: null,
-      authSchemaPath: null,
+      authDatabasePath: join(outDir, 'better-auth-db.ts'),
+      authSchemaPath: join(outDir, 'better-auth-schema.ts'),
       dialect,
       providers: config.auth?.providers ?? null,
     };
@@ -313,20 +273,17 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
     };
     const local = resolvedConfig?.command === 'serve' ? loadLocalEnv(root) : {};
     const env = { ...local, ...process.env } as Record<string, unknown>;
-    const schemaPath = join(outDir, 'better-auth-schema.ts');
-    const databasePath = join(outDir, 'better-auth-db.ts');
+    const { authSchemaPath, authDatabasePath } = compileOptions.auth;
 
-    writeFileIfChanged(schemaPath, generateVoidAuthDrizzleSchema(authRuntime, env));
+    writeFileIfChanged(authSchemaPath, generateVoidAuthDrizzleSchema(authRuntime, env));
     writeFileIfChanged(
-      databasePath,
+      authDatabasePath,
       generateVoidAuthDatabaseModule({
         dialect: compileOptions.auth.dialect,
-        schemaImportPath: schemaPath,
+        schemaImportPath: authSchemaPath,
         drizzleAdapterPath,
       }),
     );
-    compileOptions.auth.authSchemaPath = schemaPath;
-    compileOptions.auth.authDatabasePath = databasePath;
   }
 
   let resolvedConfig: import('vite').ResolvedConfig | null = null;
@@ -398,47 +355,16 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
     };
   }
 
-  function shouldServeSpaFallback(): boolean {
-    if (!scan) {
-      return false;
-    }
-    return resolveCurrentAssetRoutingPolicy().workerSpaFallback;
-  }
-
-  /**
-   * The `not_found_handling` the generated worker entry must agree with. Read
-   * off the SAME resolved policy that produces the wrangler asset config, so
-   * the emitted `serveWithAssets` can never disagree with the platform switch
-   * it is standing in for.
-   */
-  function currentNotFoundHandling(): NotFoundHandling {
-    return resolveCurrentAssetRoutingPolicy().assetConfig.not_found_handling ?? 'none';
-  }
-
   function resolveCurrentAssetRoutingPolicy(): AssetRoutingPolicy {
-    if (!scan) {
-      return resolveAssetRoutingPolicy({
-        isSsr: Boolean(ssr),
-        hasPages: false,
-        hasApiRoutes: compileOptions.auth !== null,
-        hasDocumentRoutes: false,
-        hasMiddleware: false,
-        hasWebSockets: false,
-        authEnabled: compileOptions.auth !== null,
-        liveEnabled: options.live !== undefined,
-        notFound: options.routing?.notFound,
-      });
-    }
+    const { pages, routes, websockets = [], middleware } = scan!;
     return resolveAssetRoutingPolicy({
       isSsr: Boolean(ssr),
-      hasPages: scan.pages.pages.length > 0,
+      hasPages: pages.pages.length > 0,
       hasApiRoutes:
-        hasApiRoutes(scan.routes) ||
-        hasApiRoutes(scan.websockets ?? []) ||
-        compileOptions.auth !== null,
-      hasDocumentRoutes: hasDocumentRoutes(scan.routes),
-      hasMiddleware: scan.middleware.length > 0,
-      hasWebSockets: hasDocumentRoutes(scan.websockets ?? []),
+        hasApiRoutes(routes) || hasApiRoutes(websockets) || compileOptions.auth !== null,
+      hasDocumentRoutes: hasDocumentRoutes(routes),
+      hasMiddleware: middleware.length > 0,
+      hasWebSockets: hasDocumentRoutes(websockets),
       authEnabled: compileOptions.auth !== null,
       liveEnabled: options.live !== undefined,
       notFound: options.routing?.notFound,
@@ -464,6 +390,7 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
 
   /** Write the Cloudflare worker entry from the completed scan. */
   function writeWorkerEntry(isr: WorkerEntryOptions['isr']): void {
+    const policy = resolveCurrentAssetRoutingPolicy();
     writeFileIfChanged(
       join(outDir, 'entry.ts'),
       compileWorkerEntry({
@@ -476,15 +403,15 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
           ...(options.websocketTombstones ?? []),
         ],
         runtimeEnvPath: compileOptions.runtimeEnvPath,
-        runtimeEmailPath: compileOptions.runtimeEmailPath,
+        runtimeEmailPath,
         envSchemaModule: getEnvSchemaModule(),
         sandbox: sandboxEntry,
         hasEmail: hasEmailHandlers(),
-        serveSpaFallback: shouldServeSpaFallback(),
+        serveSpaFallback: policy.workerSpaFallback,
         live: options.live,
         dev: compileOptions.dev,
         isr,
-        notFound: currentNotFoundHandling(),
+        notFound: policy.assetConfig.not_found_handling ?? 'none',
         durableObjects: options.durableObjects,
       }),
     );
@@ -508,7 +435,7 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
         remote,
         webSocketClasses: options.websocketTombstones,
         runtimeEnvPath: compileOptions.runtimeEnvPath,
-        runtimeEmailPath: compileOptions.runtimeEmailPath,
+        runtimeEmailPath,
         envSchemaModule: getEnvSchemaModule(),
         sandbox: sandboxEntry,
         live: options.live,
@@ -533,9 +460,7 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
           plugin.name === 'vite:react-refresh' ||
           plugin.name === 'vite:react-swc',
       );
-      // Vite sets `publicDir` to an empty string when the user passes
-      // `publicDir: false` in their config (public serving disabled).
-      // Fall through to `null` in that case so we skip file-based rules.
+      // Vite resolves `publicDir: false` to ''.
       const resolvedPublicDir =
         config.publicDir && config.publicDir.length > 0 ? config.publicDir : null;
       if (resolvedPublicDir !== publicDir) {
@@ -546,9 +471,6 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
     config(_, env) {
       previewing = env.isPreview === true;
       routeEnvironment = env.command === 'serve' && !env.isPreview ? 'dev' : 'prod';
-      // The Void environment hook has selected the route-specific binding set
-      // before this hook runs. Keep route compilation aligned with the Worker
-      // entry and Cloudflare config for dev-only live streams.
       compileOptions.hasLive = options.live !== undefined;
       compileOptions.managedDispatch =
         !options.target && env.command === 'build' && Boolean(process.env.VOID_DEPLOY_PROJECT_ID);
@@ -632,19 +554,13 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
           compileOptions.migrations = migrations;
           compileOptions.migrationPlanBundle =
             dialect === 'sqlite' ? buildMigrationPlanBundle(migrations) : undefined;
-          compileOptions.migrationDialect = dialect;
         }
       }
       // Re-write entries from the completed scan.
       if (options.target) {
         writeNodeEntries(options.target);
       } else {
-        // ISR gate. Only a real (non-managed) production CF `vite build` bakes
-        // ISR into the worker: managed `void deploy` sets VOID_DEPLOY_PROJECT_ID
-        // (the platform owns ISR then), dev (`command === 'serve'`) never emits
-        // it, and non-CF targets took the branch above. Read the command from
-        // `resolvedConfig` (set in configResolved, available here) — not a stale
-        // captured value.
+        // Only a non-managed production build bakes ISR in; managed deploys leave it to the platform.
         const buildConfig = readConfig(root);
         const merged = collectRevalidate(buildConfig, scan!.pages);
         const configuredRevalidate = buildConfig.routing?.revalidate;
@@ -707,10 +623,7 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
           return compileBrowserClient(getClientAuthPath(id), fetchPath, fetchStreamPath);
         }
         if (virtualClient?.[1] === 'worker') {
-          if (options.target) {
-            return compileNodeClient(getClientAuthPath(id));
-          }
-          return compileWorkerClient(getClientAuthPath(id));
+          return compileWorkerClient(getClientAuthPath(id), Boolean(options.target));
         }
         if (id !== VIRTUAL_ROUTES_ID) {
           return;
@@ -757,15 +670,7 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
           isInDirectory(normalizedPath, normalizedPagesDir) ||
           isPotentialAuthConfigPath(normalizedPath) ||
           isPotentialEnvFilePath(normalizedPath);
-        if (!sourceConventionChanged && !isInDirectory(normalizedPath, normalizedSsrDir)) {
-          return;
-        }
-
-        if (
-          !sourceConventionChanged &&
-          isInDirectory(normalizedPath, normalizedSsrDir) &&
-          !ssrEntryAbsPaths.has(normalizedPath)
-        ) {
+        if (!sourceConventionChanged && !ssrEntryAbsPaths.has(normalizedPath)) {
           return;
         }
 
diff --git a/packages/void/src/plugin-worker-bindings.ts b/packages/void/src/plugin-worker-bindings.ts
index d37dc0b9a..37578de00 100644
--- a/packages/void/src/plugin-worker-bindings.ts
+++ b/packages/void/src/plugin-worker-bindings.ts
@@ -84,9 +84,8 @@ export function mergeWorkerBindings(
     readonly liveConfig: ReturnType<typeof resolveLiveBindingConfig> | undefined;
     readonly root: string;
     readonly remoteMode: boolean;
-    versionMetadataBinding: string | undefined;
   },
-): Partial<WorkerConfig> {
+): { patch: Partial<WorkerConfig>; versionMetadataBinding: string | undefined } {
   const {
     websocketRoutes,
     routeEnvironment,
@@ -193,20 +192,15 @@ export function mergeWorkerBindings(
     result.r2_buckets = [{ binding: r2Name, bucket_name: 'default' }];
   }
 
-  // Workers AI — direct builds use the production binding. A saved direct
-  // Cloudflare destination uses the owner's remote Workers AI binding during
-  // dev because Workers AI has no local simulator. Managed and unsaved dev
-  // projects continue through the Void HTTPS proxy below.
-  // An explicit root binding keeps its name and staging choice; direct dev
-  // only adds `remote: true`. Builds never override the user's root binding.
+  // Workers AI has no local simulator, so direct Cloudflare dev uses the remote
+  // binding; an authored root binding only gains `remote: true`. Managed and
+  // unsaved dev projects use the Void proxy below.
   const resolvedAi = (resolved as { ai?: unknown }).ai;
-  const resultAi = result.ai;
   const aiBindingName = resolveWorkersAiBindingName(resolvedAi, bindingNames?.ai);
   if (
     viteCommand === 'serve' &&
     bindings.needsAI &&
     directCloudflareDestination &&
-    !resultAi &&
     typeof resolvedAi === 'object' &&
     resolvedAi !== null &&
     'binding' in resolvedAi &&
@@ -218,7 +212,7 @@ export function mergeWorkerBindings(
       viteCommand,
       bindings.needsAI,
       resolvedAi,
-      resultAi,
+      result.ai,
       directCloudflareDestination,
     )
   ) {
@@ -241,15 +235,9 @@ export function mergeWorkerBindings(
     result.vars = vars;
   }
 
-  // Email — this patch never adds a send binding. On a Void platform,
-  // outbound mail routes through __VOID_PROXY/email/send (the proxy worker
-  // holds the platform-level send_email binding); native Cloudflare deploys
-  // use the root `SEND_EMAIL` binding handled below.
-  //
-  // Dev only: name the assets binding so `sendEmail` can loop back into the
-  // Vite dev server and reach the `/__void/inbox` buffer, which lives in the
-  // Node process rather than in this worker's isolate — and hand it the
-  // dev-trigger token the inbox middleware requires on every route.
+  // This patch never adds a send binding. In dev, the inbox buffer lives in the
+  // Vite process, so `sendEmail` loops back through the assets binding and
+  // sends the dev-trigger token the inbox requires.
   const emailDevInboxBinding =
     (workerConfig.assets as { binding?: string } | undefined)?.binding ??
     (resolved.assets as { binding?: string } | undefined)?.binding;
@@ -260,26 +248,9 @@ export function mergeWorkerBindings(
     result.vars = vars;
   }
 
-  // Serve never carries Void's own `send_email` binding, so the dev inbox
-  // stays the only sink. `void deploy --platform cloudflare` writes
-  // `send_email: [{ name: "SEND_EMAIL" }]` into the root wrangler.jsonc, and
-  // `sendEmail` falls through to `env.SEND_EMAIL` whenever the inbox is not
-  // armed (`sendInDev: true`, or no assets binding to reach the dev server
-  // through) — under miniflare that binding writes .eml files to disk, or
-  // with `remote: true` sends real mail. Only the entry under the reserved
-  // `SEND_EMAIL` name is removed: a user's own `send_email` binding under
-  // another name is theirs — nothing in Void reads it, and the root config
-  // takes precedence — so it reaches miniflare exactly as declared. Gated on
-  // `needsEmail`, the same signal that arms the inbox: without `void/email`
-  // in the app there is no `sendEmail` to guard, and a `SEND_EMAIL` entry is
-  // then either a stale leftover nothing reads or the user's own choice of
-  // name; `void deploy` warns about the former and deploys as-is, and dev
-  // must not be stricter about the root config than deploy is. Mutate
-  // `resolved`, as the assets policy above does: the return value is
-  // defu-merged over it (arrays concatenate, `undefined` is skipped), so
-  // this is the only way to remove an entry. An emptied array drops the key
-  // — the Cloudflare plugin treats `[]` and absent alike. Build passes the
-  // root entries through untouched.
+  // Serve with `void/email`: drop only the reserved SEND_EMAIL entry so the dev
+  // inbox stays the only sink; other send_email bindings are the user's. The
+  // patch is defu-merged over `resolved`, so mutating it is the only removal.
   if (viteCommand === 'serve' && bindings.needsEmail) {
     const sendEmail = (resolved as { send_email?: unknown }).send_email;
     if (Array.isArray(sendEmail)) {
@@ -294,15 +265,8 @@ export function mergeWorkerBindings(
     }
   }
 
-  // Default sender for `sendEmail()` from void.config.ts `email.from`. Serve-only,
-  // the same gate as `__VOID_TOKEN` — not because it is a credential, but
-  // because on a build the root wrangler.jsonc already owns the var:
-  // `void deploy --platform cloudflare` writes the same `__VOID_EMAIL_FROM`
-  // there once the domain's routing or sending is ready, and that entry
-  // reaches `dist/ssr/wrangler.json` through `resolved.vars`. Injecting it on
-  // build too would advertise a sender on an account nothing was set up on.
-  // The managed deploy ignores the generated wrangler config and injects its
-  // own sender.
+  // Serve only: on build the root wrangler config owns __VOID_EMAIL_FROM, which
+  // `void deploy --platform cloudflare` writes once the domain is ready.
   if (viteCommand === 'serve' && config.email?.from) {
     const vars = (result.vars as Record<string, string>) ?? {};
     vars.__VOID_EMAIL_FROM = config.email.from;
@@ -523,22 +487,22 @@ export function mergeWorkerBindings(
     }
   }
 
-  input.versionMetadataBinding = selectNativeVersionMetadataBinding(
+  const versionMetadataBinding = selectNativeVersionMetadataBinding(
     resolved as Record<string, unknown>,
     {
       nativeBuild: viteCommand === 'build' && process.env[CLOUDFLARE_DEPLOY_BUILD_ENV] === '1',
       preserveBindings: process.env[CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV] === '1',
     },
   );
-  if (input.versionMetadataBinding) {
-    const owner = findBindingNameOwner(result, 'version_metadata', input.versionMetadataBinding);
+  if (versionMetadataBinding) {
+    const owner = findBindingNameOwner(result, 'version_metadata', versionMetadataBinding);
     if (owner) {
       throw new Error(
-        `Cloudflare version metadata binding ${input.versionMetadataBinding} conflicts with ${owner}.`,
+        `Cloudflare version metadata binding ${versionMetadataBinding} conflicts with ${owner}.`,
       );
     }
     if (!resolved.version_metadata) {
-      result.version_metadata = { binding: input.versionMetadataBinding };
+      result.version_metadata = { binding: versionMetadataBinding };
     }
   }
   finalizeDurableObjectPatch(resolved as Record<string, unknown>, result, [
@@ -557,5 +521,5 @@ export function mergeWorkerBindings(
       ? [{ name: liveConfig.bindingName, class_name: liveConfig.className }]
       : []),
   ]);
-  return result as Partial<WorkerConfig>;
+  return { patch: result as Partial<WorkerConfig>, versionMetadataBinding };
 }
diff --git a/packages/void/src/prerender-render.ts b/packages/void/src/prerender-render.ts
index c386b2f14..7b9fb2215 100644
--- a/packages/void/src/prerender-render.ts
+++ b/packages/void/src/prerender-render.ts
@@ -6,10 +6,27 @@ export type PrerenderResult = {
   failed: Array<{ path: string; error: string }>;
 };
 
-function outputFileForPath(path: string): string {
+export function outputFileForPath(path: string): string {
   return path === '/' ? 'index.html' : `${path.slice(1)}.html`;
 }
 
+export async function readPrerenderPathsResponse(response: Response): Promise<Array<string>> {
+  if (!response.ok) {
+    throw new Error(`prerender: Failed to collect prerender paths. HTTP ${response.status}.`);
+  }
+
+  const payload = (await response.json()) as { paths?: unknown } | null;
+  if (
+    !payload ||
+    !Array.isArray(payload.paths) ||
+    !payload.paths.every((path) => typeof path === 'string')
+  ) {
+    throw new Error('prerender: Failed to collect prerender paths. Response payload is invalid.');
+  }
+
+  return payload.paths;
+}
+
 function pageDataFileForPath(path: string): string {
   return path === '/' ? '_void/pages/index.json' : `_void/pages/${path.slice(1)}.json`;
 }
diff --git a/packages/void/src/prerender.ts b/packages/void/src/prerender.ts
index fd8f1a22e..892766bda 100644
--- a/packages/void/src/prerender.ts
+++ b/packages/void/src/prerender.ts
@@ -1,22 +1,22 @@
 import { execFile } from 'node:child_process';
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  unlinkSync,
-  writeFileSync,
-} from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative } from 'pathslash';
 import pc from 'picocolors';
 import { getApiUrl, getProxyUrl, getToken } from './cli/auth.ts';
 import { ensurePlatformProxyAccess } from './cli/cf-access.ts';
+import { readProjectIdField } from './cli/project.ts';
 import { ensureWranglerCompat } from './cli/wrangler.ts';
 import { readConfig } from './config.ts';
 import { voidLog, voidWarn } from './log.ts';
-import { renderPrerenderPaths, type PrerenderResult } from './prerender-render.ts';
+import {
+  outputFileForPath,
+  readPrerenderPathsResponse,
+  renderPrerenderPaths,
+  type PrerenderResult,
+} from './prerender-render.ts';
 export type { PrerenderResult } from './prerender-render.ts';
 import { scopedAccessCredentials } from './shared/cf-access.ts';
+import { collectFiles } from './shared/collect-files.ts';
 import { stripInternalEnvKeys } from './shared/env.ts';
 import { buildEnv } from './shared/untrusted-env.ts';
 
@@ -38,23 +38,6 @@ export type PrerenderRunResult = PrerenderResult & {
   paths: Array<string>;
 };
 
-function outputFileForPath(path: string): string {
-  return path === '/' ? 'index.html' : `${path.slice(1)}.html`;
-}
-
-async function readPrerenderPathsResponse(response: Response): Promise<Array<string>> {
-  if (!response.ok) {
-    throw new Error(`prerender: Failed to collect prerender paths. HTTP ${response.status}.`);
-  }
-
-  const payload = (await response.json()) as { paths?: unknown };
-  if (!Array.isArray(payload.paths) || !payload.paths.every((path) => typeof path === 'string')) {
-    throw new Error('prerender: Failed to collect prerender paths. Response payload is invalid.');
-  }
-
-  return payload.paths;
-}
-
 function normalizeWorkerModulePath(path: string): string {
   return path.replace(/\\/g, '/').replace(/^\.\//, '');
 }
@@ -87,22 +70,6 @@ function resolveWorkerModuleType(relativePath: string): PrerenderWorkerModuleTyp
   return null;
 }
 
-function collectFiles(dir: string): Array<string> {
-  const files: Array<string> = [];
-  const entries = readdirSync(dir, { withFileTypes: true });
-
-  for (const entry of entries) {
-    const fullPath = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      files.push(...collectFiles(fullPath));
-    } else {
-      files.push(fullPath);
-    }
-  }
-
-  return files;
-}
-
 export function collectPrerenderWorkerModules(
   workerDir: string,
   workerMain: string,
@@ -147,7 +114,6 @@ export function collectPrerenderWorkerModules(
 
 export type PrerenderBindingsInput = {
   wranglerVars: Record<string, unknown> | undefined;
-  env: Record<string, string>;
   voidToken: string | null | undefined;
   voidProjectId: string | undefined;
   voidProxyUrl?: string;
@@ -156,14 +122,10 @@ export type PrerenderBindingsInput = {
 };
 
 export function buildPrerenderBindings(input: PrerenderBindingsInput): Record<string, unknown> {
-  const { sanitized: wranglerVars, stripped: wranglerStripped } = stripInternalEnvKeys(
-    input.wranglerVars,
-  );
-  const { sanitized: env, stripped: envStripped } = stripInternalEnvKeys(input.env);
-  const allStripped = [...new Set([...wranglerStripped, ...envStripped])];
-  if (allStripped.length > 0) {
+  const { sanitized: wranglerVars, stripped } = stripInternalEnvKeys(input.wranglerVars);
+  if (stripped.length > 0) {
     voidWarn(
-      `Ignoring internal env keys in prerender inputs: ${allStripped.join(', ')}. These are reserved for Void runtime use.`,
+      `Ignoring internal env keys in prerender inputs: ${stripped.join(', ')}. These are reserved for Void runtime use.`,
     );
   }
 
@@ -185,7 +147,7 @@ export function buildPrerenderBindings(input: PrerenderBindingsInput): Record<st
       voidBindings.__VOID_REMOTE = '1';
     }
   }
-  return { ...wranglerVars, ...env, ...voidBindings };
+  return { ...wranglerVars, ...voidBindings };
 }
 
 async function createCloudflarePrerenderRunner(options: {
@@ -207,29 +169,20 @@ async function createCloudflarePrerenderRunner(options: {
   const wranglerCompat = ensureWranglerCompat(root, readConfig(root), workerDir);
   const workerMain = wranglerConfig.main ?? 'index.js';
 
-  // Local `.env` values never enter a production prerender. Code that needs
-  // production server configuration must read it at runtime from remote secrets.
-  const env: Record<string, string> = {};
-
   // Resolve Void projectId via a three-level chain:
   //   1. explicit options.projectId — passed from runFullDeploy so the
   //      `void deploy --project <slug>` flow works even when the in-memory
   //      config hasn't been persisted to .void/project.json yet.
-  //   2. VOID_DEPLOY_PROJECT_ID env var — crosses the process boundary for
-  //      the static-output path, where plugin-prerender's closeBundle runs
-  //      inside the vite build subprocess and can't see the parent's config.
+  //   2. VOID_DEPLOY_PROJECT_ID env var — only when the caller exports it.
+  //      Managed builds skip plugin prerender (VOID_DEPLOY_BUILD=1) and
+  //      runFullDeploy passes projectId instead.
   //   3. .void/project.json — existing on-disk fallback for linked projects.
   let voidProjectId: string | undefined = options.projectId;
   if (!voidProjectId) {
     voidProjectId = process.env.VOID_DEPLOY_PROJECT_ID || undefined;
   }
   if (!voidProjectId) {
-    const projectJsonPath = join(root, '.void', 'project.json');
-    try {
-      voidProjectId = JSON.parse(readFileSync(projectJsonPath, 'utf-8')).projectId;
-    } catch {
-      // No linked project — prerender without Void credentials.
-    }
+    voidProjectId = readProjectIdField(root);
   }
   // A token is only useful alongside a project ID. Avoid touching the system
   // keychain for ordinary unlinked builds, which also keeps parallel prerenders
@@ -243,10 +196,11 @@ async function createCloudflarePrerenderRunner(options: {
   if (voidProxyUrl) {
     ensurePlatformProxyAccess(getApiUrl(root), voidProxyUrl);
   }
+  // Local `.env` values never enter a production prerender; production server
+  // configuration is read at runtime from remote secrets.
   const bindings = buildPrerenderBindings({
     accessEnv: process.env,
     wranglerVars: wranglerConfig.vars,
-    env,
     voidToken,
     voidProjectId,
     voidProxyUrl,
@@ -420,7 +374,7 @@ async function runNodePrerenderRunner<T>(root: string, config: NodeRunnerConfig)
     `
 import { pathToFileURL } from "node:url";
 import { dirname, join } from "node:path";
-import { renderPrerenderPaths } from ${JSON.stringify(nodeRendererUrl)};
+import { readPrerenderPathsResponse, renderPrerenderPaths } from ${JSON.stringify(nodeRendererUrl)};
 
 const config = JSON.parse(process.argv[2]);
 const { mode, ssrDir, clientDir } = config;
@@ -436,18 +390,12 @@ if (!fetch) {
 // The second argument is the Hono env. Its marker is what lets the built app
 // answer path discovery; HTTP servers never pass it.
 async function collectPaths() {
-  const response = await fetch(
-    new Request("http://localhost${PRERENDER_PATHS_ENDPOINT}", { method: "POST" }),
-    { __VOID_PRERENDER: "1" },
+  return readPrerenderPathsResponse(
+    await fetch(
+      new Request("http://localhost${PRERENDER_PATHS_ENDPOINT}", { method: "POST" }),
+      { __VOID_PRERENDER: "1" },
+    ),
   );
-  if (!response.ok) {
-    throw new Error("prerender: Failed to collect prerender paths. HTTP " + response.status + ".");
-  }
-  const payload = await response.json();
-  if (!payload || !Array.isArray(payload.paths) || !payload.paths.every((path) => typeof path === "string")) {
-    throw new Error("prerender: Failed to collect prerender paths. Response payload is invalid.");
-  }
-  return payload.paths;
 }
 
 async function renderPaths(paths) {
diff --git a/packages/void/src/project-paths.ts b/packages/void/src/project-paths.ts
index 28e3d6a0b..ff9d38af6 100644
--- a/packages/void/src/project-paths.ts
+++ b/packages/void/src/project-paths.ts
@@ -1,5 +1,5 @@
 import { existsSync } from 'node:fs';
-import { isAbsolute, join, normalize, relative } from 'pathslash';
+import { isAbsolute, join, normalize } from 'pathslash';
 import { loadVoidConfig } from './config-loader.ts';
 import type { VoidConfig } from './config.ts';
 
@@ -44,16 +44,15 @@ export type ProjectPaths = {
   migrationsDir: string;
   schemaFile: string;
   schemaDir: string;
-  srcDir: string;
   ssrDir: string;
   sourceRelative: (path: string) => string;
   authConfigCandidates: ReadonlyArray<string>;
   envFileCandidates: ReadonlyArray<string>;
 };
 
-export function validateSourceDir(value: string, label = 'sourceDir'): string {
+export function validateSourceDir(value: string): string {
   if (value.trim() !== value || value.length === 0) {
-    throw new Error(`config: "${label}" in void.json must be a non-empty relative directory.`);
+    throw new Error('config: "sourceDir" in void.json must be a non-empty relative directory.');
   }
   if (
     value === '.' ||
@@ -64,13 +63,13 @@ export function validateSourceDir(value: string, label = 'sourceDir'): string {
     isAbsolute(value)
   ) {
     throw new Error(
-      `config: "${label}" path '${value}' in void.json must be a relative directory.`,
+      `config: "sourceDir" path '${value}' in void.json must be a relative directory.`,
     );
   }
   const normalized = normalize(value).replace(/\/+$/, '');
   if (normalized === '' || normalized === '.') {
     throw new Error(
-      `config: "${label}" path '${value}' in void.json must be a relative directory.`,
+      `config: "sourceDir" path '${value}' in void.json must be a relative directory.`,
     );
   }
   return normalized;
@@ -80,10 +79,6 @@ function getSourceDir(config?: VoidConfig): string {
   return config?.sourceDir ? validateSourceDir(config.sourceDir) : '';
 }
 
-function resolveCandidate(root: string, sourceDir: string, candidate: string): string {
-  return sourceDir ? join(root, sourceDir, candidate) : join(root, candidate);
-}
-
 export function resolveProjectPaths(root: string, config?: VoidConfig): ProjectPaths {
   const sourceDir = getSourceDir(config);
   const sourceRoot = sourceDir ? join(root, sourceDir) : root;
@@ -110,10 +105,9 @@ export function resolveProjectPaths(root: string, config?: VoidConfig): ProjectP
     migrationsDir: join(sourceRoot, 'db', 'migrations'),
     schemaFile: join(sourceRoot, 'db', 'schema.ts'),
     schemaDir: join(sourceRoot, 'db', 'schema'),
-    srcDir: join(sourceRoot, 'src'),
     ssrDir: sourceDir ? sourceRoot : join(root, 'src'),
     sourceRelative,
-    authConfigCandidates: AUTH_CONFIG_FILES.map((file) => resolveCandidate(root, sourceDir, file)),
+    authConfigCandidates: AUTH_CONFIG_FILES.map((file) => join(sourceRoot, file)),
     envFileCandidates,
   };
 }
@@ -147,8 +141,7 @@ export function assertNoRootSourceConventionConflicts(paths: ProjectPaths): void
   if (conflicts.length === 0) {
     return;
   }
-  const relSource = relative(paths.root, paths.sourceRoot);
   throw new Error(
-    `sourceDir: void.json sets "sourceDir": "${paths.sourceDir}", but convention path(s) also exist at the project root: ${conflicts.join(', ')}. Move them under "${relSource}" or remove the root copy.`,
+    `sourceDir: void.json sets "sourceDir": "${paths.sourceDir}", but convention path(s) also exist at the project root: ${conflicts.join(', ')}. Move them under "${paths.sourceDir}" or remove the root copy.`,
   );
 }
diff --git a/packages/void/src/queues/dispatch.ts b/packages/void/src/queues/dispatch.ts
index bcae62a9c..efb7552bb 100644
--- a/packages/void/src/queues/dispatch.ts
+++ b/packages/void/src/queues/dispatch.ts
@@ -8,12 +8,7 @@ export function generateQueueResolverSource(queueNames: ReadonlyArray<string>):
   return `const __queueNames = ${JSON.stringify(queueNames)};
 function __resolveQueueIndex(queueName) {
   if (typeof queueName !== "string") return -1;
-  let exact = -1;
-  for (let i = 0; i < __queueNames.length; i++) {
-    if (__queueNames[i] !== queueName) continue;
-    if (exact !== -1) return -1;
-    exact = i;
-  }
+  const exact = __queueNames.indexOf(queueName);
   if (exact !== -1) return exact;
   let match = -1;
   let matchLength = -1;
diff --git a/packages/void/src/queues/scan.ts b/packages/void/src/queues/scan.ts
index 72583b0e1..90663942b 100644
--- a/packages/void/src/queues/scan.ts
+++ b/packages/void/src/queues/scan.ts
@@ -1,10 +1,8 @@
 import { readFileSync } from 'node:fs';
-import { isAbsolute, join } from 'pathslash';
-import { glob, globSync } from 'tinyglobby';
+import { join } from 'pathslash';
+import { listConventionFiles } from '../shared/convention-files.ts';
 import { staticExportInitializers, staticLiteral } from '../shared/static-exports.ts';
 
-const QUEUE_PATTERN = '**/*.{ts,mts,js,mjs}';
-
 export type QueueDefinition = {
   /** Relative file path from queues/ */
   filePath: string;
@@ -32,16 +30,11 @@ function deriveQueueBindingName(name: string): string {
 
 const OPTION_NAMES = ['maxBatchSize', 'maxBatchTimeout', 'maxRetries', 'retryDelay'] as const;
 
-function resolveQueuesDir(root: string, queuesDir: string): string {
-  return isAbsolute(queuesDir) ? queuesDir : join(root, queuesDir);
-}
-
-function parseQueueFiles(queuesDirPath: string, files: Array<string>): Array<QueueDefinition> {
-  const definitions = files
-    .filter((filePath) => !filePath.split('/').some((segment) => segment.startsWith('_')))
+export function scanQueuesSync(queuesDir: string): Array<QueueDefinition> {
+  const definitions = listConventionFiles(queuesDir)
     .sort()
     .map((filePath) => {
-      const absPath = join(queuesDirPath, filePath);
+      const absPath = join(queuesDir, filePath);
       const source = readFileSync(absPath, 'utf-8');
       const name = extractName(filePath);
       const options = OPTION_NAMES.some((option) => source.includes(option))
@@ -97,25 +90,3 @@ function parseQueueFiles(queuesDirPath: string, files: Array<string>): Array<Que
 
   return definitions;
 }
-
-export async function scanQueues(
-  root: string,
-  queuesDir = 'queues',
-): Promise<Array<QueueDefinition>> {
-  const queuesDirPath = resolveQueuesDir(root, queuesDir);
-  const files = await glob(QUEUE_PATTERN, { cwd: queuesDirPath, absolute: false }).catch(
-    () => [] as Array<string>,
-  );
-  return parseQueueFiles(queuesDirPath, files);
-}
-
-export function scanQueuesSync(root: string, queuesDir = 'queues'): Array<QueueDefinition> {
-  const queuesDirPath = resolveQueuesDir(root, queuesDir);
-  let files: Array<string>;
-  try {
-    files = globSync(QUEUE_PATTERN, { cwd: queuesDirPath, absolute: false });
-  } catch {
-    files = [];
-  }
-  return parseQueueFiles(queuesDirPath, files);
-}
diff --git a/packages/void/src/router/compile.ts b/packages/void/src/router/compile.ts
index 3f008dbe5..b017155dd 100644
--- a/packages/void/src/router/compile.ts
+++ b/packages/void/src/router/compile.ts
@@ -7,6 +7,7 @@ import type { MigrationPlanBundle } from '../migrations/plan.ts';
 import { resolveLayoutIds } from '../pages/layout-resolution.ts';
 import { generateQueueResolverSource } from '../queues/dispatch.ts';
 import { INTERNAL_BINDING_EXACT_NAMES, INTERNAL_BINDING_PREFIXES } from '../runtime/env-raw.ts';
+import { ASSET_EXTENSIONS } from '../runtime/routing-assets.ts';
 import { DEFAULT_SANDBOX_CLASS_NAME } from '../sandbox/config.ts';
 import type { ScanResult } from './scan.ts';
 
@@ -17,15 +18,14 @@ function pushDefaultErrorPageHelpers(lines: Array<string>, options: CompileOptio
   lines.push(
     `const __errorRenderer = __createErrorRenderer(${JSON.stringify({ dev: options.dev === true, projectRoot: options.projectRoot, homeDir: options.homeDir })});`,
   );
-  lines.push('const serveCustomErrorPage = __errorRenderer.serveCustomPage;');
   lines.push('app.onError(__errorRenderer.onError);');
 }
 
 export type AuthCompileOptions = {
   authRuntimePath: string;
   authConfigPath: string | null;
-  authDatabasePath: string | null;
-  authSchemaPath: string | null;
+  authDatabasePath: string;
+  authSchemaPath: string;
   dialect: 'sqlite' | 'postgresql' | 'mysql';
   providers: Array<VoidAuthProvider> | null;
 };
@@ -35,14 +35,7 @@ export type CompileOptions = {
   honoPath: string;
   /** Absolute path to the void/_env module */
   runtimeEnvPath: string;
-  /** Absolute path to the void/email module (inbound `createMessageProxy`) */
-  runtimeEmailPath?: string;
-  /**
-   * Absolute path to the project's top-level `email/` directory. Set when the
-   * app declares inbound email handlers; the route table then emits
-   * `__emailHandler`. Lives here rather than in `compileRouteTable`'s
-   * positional list so existing call sites keep binding correctly.
-   */
+  /** Absolute path to the project's `email/` directory; enables `__emailHandler`. */
   emailDir?: string;
   /** Absolute path to the project root */
   projectRoot: string;
@@ -76,8 +69,6 @@ export type CompileOptions = {
   migrations?: Array<{ name: string; sql: string }>;
   /** Build-time migration execution plans for protocol v2 workers */
   migrationPlanBundle?: MigrationPlanBundle;
-  /** Migration dialect. */
-  migrationDialect?: 'sqlite' | 'postgresql' | 'mysql';
   /** Custom binding names configured through inference.bindings. */
   bindingNames?: { d1?: string; kv?: string; r2?: string };
   /** Header rules from routing.headers config. */
@@ -179,14 +170,10 @@ export function compileRouteTable(
     lines.push(
       `import { ${authImports.join(', ')} } from ${JSON.stringify(auth.authRuntimePath)};`,
     );
-    if (auth.authDatabasePath) {
-      lines.push(`import { __voidAuthDatabase } from ${JSON.stringify(auth.authDatabasePath)};`);
-    }
-    if (auth.authSchemaPath) {
-      lines.push(
-        `import { migrationSchema as __voidAuthMigrationSchema } from ${JSON.stringify(auth.authSchemaPath)};`,
-      );
-    }
+    lines.push(`import { __voidAuthDatabase } from ${JSON.stringify(auth.authDatabasePath)};`);
+    lines.push(
+      `import { migrationSchema as __voidAuthMigrationSchema } from ${JSON.stringify(auth.authSchemaPath)};`,
+    );
     if (auth.authConfigPath) {
       lines.push(`import __voidAuthConfig from ${JSON.stringify(auth.authConfigPath)};`);
     }
@@ -223,53 +210,14 @@ export function compileRouteTable(
     );
     if (webSockets.length > 0) {
       lines.push(
-        `const __resolveVoidAuthState = (request, env, runtime) => __resolveVoidAuthStateRuntime(request, env, runtime${auth.authDatabasePath ? ', __voidAuthDatabase' : ''});`,
+        'const __resolveVoidAuthState = (request, env, runtime) => __resolveVoidAuthStateRuntime(request, env, runtime, __voidAuthDatabase);',
       );
     }
     lines.push('');
   }
 
   lines.push(`const app = new Hono();`);
-  // Known static-asset extensions — `c.rewrite()` into one of these re-enters
-  // the Hono router and 404s (static asset handlers run in front of the
-  // worker, not inside it). `.html` is deliberately excluded: it's ambiguous
-  // with legit route handlers at `.html` paths.
-  //
-  // The framework also lets users name route files with dotted extensions
-  // (e.g. `routes/feed.xml.ts` → pattern `/feed.xml`), so we filter the
-  // blocklist down to extensions NOT used by any registered route/page.
-  // Without this, `c.rewrite("/feed.xml")` to a real `feed.xml.ts` route
-  // would falsely throw, diverging from `routing.rewrites` which routes
-  // the same destination to the same handler without complaint.
-  const ASSET_EXTENSIONS = [
-    'png',
-    'jpg',
-    'jpeg',
-    'gif',
-    'webp',
-    'avif',
-    'svg',
-    'ico',
-    'css',
-    'js',
-    'mjs',
-    'cjs',
-    'woff',
-    'woff2',
-    'ttf',
-    'otf',
-    'eot',
-    'mp4',
-    'webm',
-    'mp3',
-    'wav',
-    'pdf',
-    'txt',
-    'xml',
-    'json',
-    'wasm',
-    'map',
-  ];
+  // Route files may use dotted names (`feed.xml.ts`), so `c.rewrite()` must still reach them.
   const routePatterns: Array<string> = [];
   for (const r of scan.routes) {
     routePatterns.push(r.pattern);
@@ -299,6 +247,13 @@ export function compileRouteTable(
   // owns routing end-to-end, including native Cloudflare production builds.
   // Managed bundles omit it because dispatch applies the same rules first.
   const emitEdgeRules = !managedDispatch;
+  const fallbackRulesJson = JSON.stringify(
+    emitEdgeRules && options.fallbackRules?.length
+      ? options.dev
+        ? options.fallbackRules
+        : stripOriginForProd(options.fallbackRules)
+      : undefined,
+  );
   if (emitEdgeRules && options.redirectRules?.length) {
     compileRoutingRulesMiddleware(lines, options.redirectRules, options.dev === true);
   }
@@ -308,9 +263,7 @@ export function compileRouteTable(
 
   if (auth) {
     lines.push('app.use(async (c, next) => {');
-    lines.push(
-      `  return runVoidAuthMiddleware(c, next, __voidAuthOptions${auth.authDatabasePath ? ', __voidAuthDatabase' : ''});`,
-    );
+    lines.push('  return runVoidAuthMiddleware(c, next, __voidAuthOptions, __voidAuthDatabase);');
     lines.push('});');
     lines.push('');
   }
@@ -344,15 +297,11 @@ export function compileRouteTable(
 
   if (auth) {
     lines.push('app.all("/api/auth", async (c) => {');
-    lines.push(
-      `  return handleVoidAuthRequest(c, __voidAuthOptions${auth.authDatabasePath ? ', __voidAuthDatabase' : ''});`,
-    );
+    lines.push('  return handleVoidAuthRequest(c, __voidAuthOptions, __voidAuthDatabase);');
     lines.push('});');
     lines.push('');
     lines.push('app.all("/api/auth/*", async (c) => {');
-    lines.push(
-      `  return handleVoidAuthRequest(c, __voidAuthOptions${auth.authDatabasePath ? ', __voidAuthDatabase' : ''});`,
-    );
+    lines.push('  return handleVoidAuthRequest(c, __voidAuthOptions, __voidAuthDatabase);');
     lines.push('});');
     lines.push('');
   }
@@ -450,7 +399,7 @@ export function compileRouteTable(
 
   if (pages && scan.pages.pages.length > 0) {
     lines.push(
-      `app.notFound(__createPagesFallback({ routing: __routingRuntime, errors: __errorRenderer, assetsDir: ${JSON.stringify(options.assetsDir)}, fallbackRules: ${JSON.stringify(emitEdgeRules && options.fallbackRules?.length ? (options.dev ? options.fallbackRules : stripOriginForProd(options.fallbackRules)) : undefined)} }));`,
+      `app.notFound(__createPagesFallback({ routing: __routingRuntime, errors: __errorRenderer, assetsDir: ${JSON.stringify(options.assetsDir)}, fallbackRules: ${fallbackRulesJson} }));`,
     );
   }
 
@@ -461,7 +410,7 @@ export function compileRouteTable(
       `const getClientAssetTags = __createClientAssetTags(${JSON.stringify({ entryId: ssr.clientEntryRelativePath, entryUrl: '/' + ssr.clientEntryRelativePath, kind: 'ssr', dev: options.dev === true, reactRefresh: options.reactRefresh })});`,
     );
     lines.push(
-      `app.notFound(__createSsrFallback({ routing: __routingRuntime, nodeTarget: ${JSON.stringify(options.nodeTarget === true)}, assetsDir: ${JSON.stringify(options.assetsDir)}, fallbackRules: ${JSON.stringify(emitEdgeRules && options.fallbackRules?.length ? (options.dev ? options.fallbackRules : stripOriginForProd(options.fallbackRules)) : undefined)}, load: () => import(${JSON.stringify(ssr.serverEntryPath)}), assets: getClientAssetTags }));`,
+      `app.notFound(__createSsrFallback({ routing: __routingRuntime, nodeTarget: ${JSON.stringify(options.nodeTarget === true)}, assetsDir: ${JSON.stringify(options.assetsDir)}, fallbackRules: ${fallbackRulesJson}, load: () => import(${JSON.stringify(ssr.serverEntryPath)}), assets: getClientAssetTags }));`,
     );
   } else if (
     emitEdgeRules &&
@@ -469,7 +418,7 @@ export function compileRouteTable(
     !(pages && scan.pages.pages.length > 0)
   ) {
     lines.push(
-      `app.notFound(__createAssetNotFound({ routing: __routingRuntime, nodeTarget: ${JSON.stringify(options.nodeTarget === true)}, assetsDir: ${JSON.stringify(options.assetsDir)}, fallbackRules: ${JSON.stringify(options.fallbackRules?.length ? (options.dev ? options.fallbackRules : stripOriginForProd(options.fallbackRules)) : undefined)} }));`,
+      `app.notFound(__createAssetNotFound({ routing: __routingRuntime, nodeTarget: ${JSON.stringify(options.nodeTarget === true)}, assetsDir: ${JSON.stringify(options.assetsDir)}, fallbackRules: ${fallbackRulesJson} }));`,
     );
   }
 
@@ -518,16 +467,23 @@ export function compileRouteTable(
     lines.push('');
   }
 
-  if (scan.jobs.length > 0) {
-    lines.push('const __scheduledHandler = async (c) => {');
+  if (scan.jobs.length > 0 || scan.queues.length > 0) {
+    lines.push('function __voidTriggerUnauthorized(c) {');
     lines.push('  const __token = c.req.header("x-void-internal");');
     lines.push('  const __expected = __getRawEnv()?.__VOID_PROXY_TOKEN;');
     lines.push('  const __devToken = c.req.header("x-void-dev-trigger");');
     lines.push(
-      '  if (__VOID_SERVE ? __devToken !== __VOID_DEV_TRIGGER_TOKEN : __expected ? __token !== __expected : __token !== __VOID_BUILD_KEY) {',
+      '  return __VOID_SERVE ? __devToken !== __VOID_DEV_TRIGGER_TOKEN : __expected ? __token !== __expected : __token !== __VOID_BUILD_KEY;',
+    );
+    lines.push('}');
+    lines.push('');
+  }
+
+  if (scan.jobs.length > 0) {
+    lines.push('const __scheduledHandler = async (c) => {');
+    lines.push(
+      '  if (__voidTriggerUnauthorized(c)) return c.json({ error: "unauthorized" }, 401);',
     );
-    lines.push('    return c.json({ error: "unauthorized" }, 401);');
-    lines.push('  }');
     lines.push('  const { cron, scheduledTime } = await c.req.json();');
     lines.push('  const controller = { cron, scheduledTime, noRetry() {} };');
     lines.push('  await scheduled(controller, c.env, c.executionCtx);');
@@ -593,16 +549,10 @@ export function compileRouteTable(
     lines.push('}');
     lines.push('');
 
-    // HTTP route — same auth policy as /__void/scheduled.
     lines.push('const __queueHandler = async (c) => {');
-    lines.push('  const __token = c.req.header("x-void-internal");');
-    lines.push('  const __expected = __getRawEnv()?.__VOID_PROXY_TOKEN;');
-    lines.push('  const __devToken = c.req.header("x-void-dev-trigger");');
     lines.push(
-      '  if (__VOID_SERVE ? __devToken !== __VOID_DEV_TRIGGER_TOKEN : __expected ? __token !== __expected : __token !== __VOID_BUILD_KEY) {',
+      '  if (__voidTriggerUnauthorized(c)) return c.json({ error: "unauthorized" }, 401);',
     );
-    lines.push('    return c.json({ error: "unauthorized" }, 401);');
-    lines.push('  }');
     lines.push('  const payload = await c.req.json();');
     lines.push('  const result = await __processQueue(payload, c.env);');
     lines.push('  return c.json(result);');
@@ -611,24 +561,7 @@ export function compileRouteTable(
     lines.push('');
   }
 
-  // Inbound email — generate __emailHandler that dispatches by recipient
-  // local-part. Patterns are tried in the order the scanner sorted them
-  // (`compareEmailRoutes` in router/email.ts: static-tag > static >
-  // dynamic-tag > dynamic, a literal tag before a captured one, then
-  // alphabetical) and the first match wins; captured groups become `info.params`
-  // and the handler is invoked with (message, env, ctx, info). Falls through
-  // to email/_default.ts when no per-address pattern matches.
-  //
-  // Slug stripping: the shared platform sender rewrites every recipient to
-  // `<slug>+<tag>@<platform mail domain>`, where `<slug>` is the
-  // project slug. User-defined handlers are written against the `<tag>` only
-  // (the slug is invisible to them — see design doc 0078-email-cf-native). When a slug is
-  // configured (`__VOID_PROJECT_SLUG`) the dispatcher strips everything up to
-  // and including the first `+` from the local-part before running it through
-  // the pattern table. Without one — a worker on the developer's own zone, or
-  // a relayed custom-domain envelope (`viaDomain`, suppressed by `handleEmail`)
-  // — the full local part is matched, so `support+T-42@zone` reaches
-  // `email/support+[ticket].ts` there too.
+  // Inbound email: the first recipient pattern in scanner order wins, then `_default`.
   const email = scan.email;
   const emailDir = options.emailDir;
   if (emailDir && email && (email.addresses.length > 0 || email.defaultHandler)) {
@@ -656,30 +589,12 @@ export function compileRouteTable(
     }
     lines.push('');
     lines.push('export async function __emailHandler(message, env, ctx, __opts) {');
-    // Route on the PLATFORM (wire) recipient, not `message.to`.
-    // `createMessageProxy` has already removed the `<slug>+` prefix from
-    // `message.to` so handler authors see the address they wrote, and it
-    // preserves the wire form as `__voidPlatformTo`. Reading `message.to`
-    // here would strip the slug a SECOND time, leaving an empty tag that no
-    // anchored pattern can match. When no slug was injected the two are
-    // identical, so the fallback is exact.
-    // Case is PRESERVED here and the patterns carry the `i` flag instead.
-    // Lowercasing the address first would lowercase the captured groups too,
-    // silently corrupting a case-sensitive tag such as a ticket id or a token
-    // (`support+T-42@` would reach the handler as `t-42`).
+    // Match the wire recipient: `createMessageProxy` already stripped the slug from `message.to`.
+    // Keep the case; patterns use the `i` flag so captured tags stay intact.
     lines.push('  const __platformTo = message ? message.__voidPlatformTo : undefined;');
     lines.push('  const __to = String((__platformTo ?? (message && message.to)) || "");');
     lines.push('  const __localFull = __to.split("@")[0] || "";');
-    // Strip the platform-injected `<slug>+` prefix exactly when a slug is
-    // CONFIGURED (`__VOID_PROJECT_SLUG`, passed in by `handleEmail`), not when
-    // `createMessageProxy` happened to remove one: the platform lane is
-    // `<slug>[+<tag>]`, so a bare `<slug>@domain` (no `+`) carries no
-    // `__voidPlatformTo` yet must still read as an EMPTY tag, not as the
-    // slug itself — otherwise `email/[user].ts` would run with `user=<slug>`.
-    // With no slug configured (a worker on the developer's own zone) the wire
-    // address IS the address the handler author wrote: match all of it. With
-    // the prefix present and no `+` after it there is no tag, and the empty
-    // string falls through to `_default`.
+    // With a slug configured, `<slug>[+<tag>]` routes on the tag; a bare `<slug>@` has an empty tag.
     lines.push('  let __local = __localFull;');
     lines.push('  if (__opts && __opts.slug) {');
     lines.push('    const __plus = __localFull.indexOf("+");');
@@ -712,12 +627,7 @@ export function compileRouteTable(
       lines.push('  }');
       lines.push('  return await __dmod.default(message, env, ctx, { params: {} });');
     } else {
-      // No-match without _default — explicitly reject so the remote MTA
-      // gets a non-delivery report. Silent acceptance would mark the
-      // message accepted on our end while never invoking any handler,
-      // which is invisible to the sender (no NDR) and to the recipient
-      // (no delivery). The reject reason is generic so user-handler
-      // authors can add `_default.ts` to customize.
+      // Reject unmatched mail so the sender gets a bounce instead of silent loss.
       lines.push('  if (typeof message.setReject === "function") {');
       lines.push(
         '    message.setReject("no handler matched recipient \\"" + __to + "\\" — add email/_default.ts to handle unmatched mail");',
@@ -736,9 +646,6 @@ export function compileRouteTable(
     );
     lines.push(`const __migrations = ${JSON.stringify(options.migrations)};`);
     lines.push(`const __migrationPlanBundle = ${JSON.stringify(options.migrationPlanBundle)};`);
-    lines.push(
-      `const __migrationDialect = ${JSON.stringify(options.migrationDialect ?? 'sqlite')};`,
-    );
     if (d1BindingName) {
       lines.push(
         `function __voidGetMigrationEnv() {
@@ -751,17 +658,14 @@ export function compileRouteTable(
       lines.push('function __voidGetMigrationEnv() { return __getRawEnv(); }');
     }
     lines.push(
-      'function __voidCreateMigrationRequestHandler(request, includeAuthMigrations, includePlanBundle) {',
+      'function __voidCreateMigrationRequestHandler(includeAuthMigrations, includePlanBundle) {',
     );
     lines.push('  return __createMigrationHandler(');
     lines.push('    __voidGetMigrationEnv(),');
     lines.push('    __migrations,');
-    lines.push('    __migrationDialect,');
     if (auth) {
       lines.push(
-        `    includeAuthMigrations ? () => runVoidAuthMigrations(new Request(request.url), __voidGetMigrationEnv(), __voidAuthOptions${
-          auth.authSchemaPath ? ', __voidAuthMigrationSchema' : ''
-        }) : undefined,`,
+        '    includeAuthMigrations ? () => runVoidAuthMigrations(__voidGetMigrationEnv(), __voidAuthOptions, __voidAuthMigrationSchema) : undefined,',
       );
     } else {
       lines.push('    undefined,');
@@ -773,101 +677,47 @@ export function compileRouteTable(
     lines.push('  const url = new URL(request.url);');
     lines.push('  if (request.method === "POST" && url.pathname === "/__void/migrate") {');
     lines.push(
-      `    return __voidCreateMigrationRequestHandler(request, ${auth ? 'true' : 'false'}, false)(request);`,
+      `    return __voidCreateMigrationRequestHandler(${auth ? 'true' : 'false'}, false)(request);`,
     );
     lines.push('  }');
     lines.push(
       '  if (request.method === "GET" && url.pathname === "/__void/migrate/capabilities") {',
     );
     lines.push(
-      `    return __voidCreateMigrationRequestHandler(request, ${auth ? 'true' : 'false'}, true)(request);`,
+      `    return __voidCreateMigrationRequestHandler(${auth ? 'true' : 'false'}, true)(request);`,
     );
     lines.push('  }');
     lines.push('  if (request.method === "POST" && url.pathname === "/__void/migrate/app") {');
-    lines.push('    return __voidCreateMigrationRequestHandler(request, false, true)(request);');
+    lines.push('    return __voidCreateMigrationRequestHandler(false, true)(request);');
     lines.push('  }');
     lines.push(
       '  if (request.method === "GET" && url.pathname.startsWith("/__void/migrate/app/attempt/")) {',
     );
-    lines.push('    return __voidCreateMigrationRequestHandler(request, false, true)(request);');
+    lines.push('    return __voidCreateMigrationRequestHandler(false, true)(request);');
     lines.push('  }');
     if (auth) {
       lines.push('  if (request.method === "POST" && url.pathname === "/__void/migrate/auth") {');
-      lines.push('    return __voidCreateMigrationRequestHandler(request, true, true)(request);');
+      lines.push('    return __voidCreateMigrationRequestHandler(true, true)(request);');
       lines.push('  }');
     }
     lines.push('  return null;');
     lines.push('}');
-    lines.push('app.post("/__void/migrate", async (c) => {');
-    lines.push('  const __voidMigrationHandler = __createMigrationHandler(');
-    lines.push('    __voidGetMigrationEnv(),');
-    lines.push('    __migrations,');
-    lines.push('    __migrationDialect,');
-    if (auth) {
-      lines.push(
-        `    () => runVoidAuthMigrations(new Request(c.req.url), __voidGetMigrationEnv(), __voidAuthOptions${
-          auth.authSchemaPath ? ', __voidAuthMigrationSchema' : ''
-        }),`,
-      );
-    } else {
-      lines.push('    undefined,');
-    }
-    lines.push('  );');
-    lines.push('  return __voidMigrationHandler(c.req.raw);');
-    lines.push('});');
-    lines.push('app.get("/__void/migrate/capabilities", async (c) => {');
-    lines.push('  const __voidMigrationHandler = __createMigrationHandler(');
-    lines.push('    __voidGetMigrationEnv(),');
-    lines.push('    __migrations,');
-    lines.push('    __migrationDialect,');
-    if (auth) {
-      lines.push(
-        `    () => runVoidAuthMigrations(new Request(c.req.url), __voidGetMigrationEnv(), __voidAuthOptions${
-          auth.authSchemaPath ? ', __voidAuthMigrationSchema' : ''
-        }),`,
-      );
-    } else {
-      lines.push('    undefined,');
-    }
-    lines.push('    __migrationPlanBundle,');
-    lines.push('  );');
-    lines.push('  return __voidMigrationHandler(c.req.raw);');
-    lines.push('});');
-    lines.push('app.post("/__void/migrate/app", async (c) => {');
-    lines.push('  const __voidMigrationHandler = __createMigrationHandler(');
-    lines.push('    __voidGetMigrationEnv(),');
-    lines.push('    __migrations,');
-    lines.push('    __migrationDialect,');
-    lines.push('    undefined,');
-    lines.push('    __migrationPlanBundle,');
-    lines.push('  );');
-    lines.push('  return __voidMigrationHandler(c.req.raw);');
-    lines.push('});');
-    lines.push('app.get("/__void/migrate/app/attempt/:attemptId", async (c) => {');
-    lines.push('  const __voidMigrationHandler = __createMigrationHandler(');
-    lines.push('    __voidGetMigrationEnv(),');
-    lines.push('    __migrations,');
-    lines.push('    __migrationDialect,');
-    lines.push('    undefined,');
-    lines.push('    __migrationPlanBundle,');
-    lines.push('  );');
-    lines.push('  return __voidMigrationHandler(c.req.raw);');
-    lines.push('});');
+    lines.push(
+      `app.post("/__void/migrate", (c) => __voidCreateMigrationRequestHandler(${auth ? 'true' : 'false'}, false)(c.req.raw));`,
+    );
+    lines.push(
+      `app.get("/__void/migrate/capabilities", (c) => __voidCreateMigrationRequestHandler(${auth ? 'true' : 'false'}, true)(c.req.raw));`,
+    );
+    lines.push(
+      'app.post("/__void/migrate/app", (c) => __voidCreateMigrationRequestHandler(false, true)(c.req.raw));',
+    );
+    lines.push(
+      'app.get("/__void/migrate/app/attempt/:attemptId", (c) => __voidCreateMigrationRequestHandler(false, true)(c.req.raw));',
+    );
     if (auth) {
-      lines.push('app.post("/__void/migrate/auth", async (c) => {');
-      lines.push('  const __voidMigrationHandler = __createMigrationHandler(');
-      lines.push('    __voidGetMigrationEnv(),');
-      lines.push('    __migrations,');
-      lines.push('    __migrationDialect,');
       lines.push(
-        `    () => runVoidAuthMigrations(new Request(c.req.url), __voidGetMigrationEnv(), __voidAuthOptions${
-          auth.authSchemaPath ? ', __voidAuthMigrationSchema' : ''
-        }),`,
+        'app.post("/__void/migrate/auth", (c) => __voidCreateMigrationRequestHandler(true, true)(c.req.raw));',
       );
-      lines.push('    __migrationPlanBundle,');
-      lines.push('  );');
-      lines.push('  return __voidMigrationHandler(c.req.raw);');
-      lines.push('});');
     }
     lines.push('');
   } else {
@@ -1149,22 +999,7 @@ function compilePageRoutes(
   lines.push('');
 }
 
-/**
- * Generate the asset fallthrough helper shared by native Void workers and
- * Class A framework wrappers. If the app returns 404, check ASSETS binding
- * for static files and set cache headers. Edge caching of hashed assets
- * happens at the dispatch layer (see design doc 0042).
- *
- * `notFound` is the RESOLVED `assetConfig.not_found_handling` for this build
- * (`resolveAssetRoutingPolicy`), and it decides what happens once the asset
- * binding has also answered 404. It is a separate argument from
- * `serveSpaFallback` because the two are not derived from each other: the
- * common worker-first app runs with `not_found_handling: 'none'` and STILL
- * wants the worker-side shell fallback (that is the whole reason the flag
- * exists). They are mutually exclusive in practice — `resolveAssetRoutingPolicy`
- * clears `workerSpaFallback` whenever an explicit `routing.notFound` asks for
- * anything other than the SPA shell.
- */
+/** Asset fallthrough shared by native Void workers and Class A framework wrappers. */
 export function compileAssetFallbackHelper(
   assetsDir = 'assets',
   serveSpaFallback = false,
@@ -1175,31 +1010,18 @@ const serveWithAssets = __createAssetFallback(${JSON.stringify({ assetsDir, serv
 `;
 }
 
-// Both modules are siblings under `runtime/`, so `_env` -> `email` is the only
-// transform needed. Works for bare specifiers (`void/_env` -> `void/email`) and
-// for resolved file paths (`/.../runtime/env.mjs` -> `/.../runtime/email.mjs`).
-function deriveEmailRuntimePath(runtimeEnvPath: string): string {
-  return runtimeEnvPath.replace(/_?env(\.[^/]+)?$/, (_m, ext) => 'email' + (ext ?? ''));
-}
-
 export interface WorkerEntryOptions {
   /** Native readiness proves the actual served Worker version through this binding. */
   versionMetadataBinding?: string;
   hasQueues?: boolean;
   remote?: {
     remotePath: string;
-    envPath: string;
     bindingNames?: { d1?: string; kv?: string; r2?: string };
   };
   assetsDir?: string;
   webSocketClasses?: Array<string>;
   runtimeEnvPath?: string;
-  /**
-   * Path to the `void/email` runtime, used for `createMessageProxy` in the
-   * generated email handlers. Defaults to a sibling-of-`runtimeEnvPath`
-   * derivation, which covers both bare specifiers (`void/_env` -> `void/email`)
-   * and resolved file paths.
-   */
+  /** Path to the `void/email` runtime used by the generated email handlers. */
   runtimeEmailPath?: string;
   envSchemaModule?: { importPath: string; helperPath: string };
   sandbox?:
@@ -1269,7 +1091,7 @@ export function compileWorkerEntry(options: WorkerEntryOptions = {}): string {
     assetsDir = 'assets',
     webSocketClasses = [],
     runtimeEnvPath = 'void/_env',
-    runtimeEmailPath,
+    runtimeEmailPath = 'void/email',
     envSchemaModule,
     sandbox,
     serveSpaFallback = false,
@@ -1337,9 +1159,7 @@ export function compileWorkerEntry(options: WorkerEntryOptions = {}): string {
   const remoteImport = remote
     ? `import { createRemoteEnv } from ${JSON.stringify(remote.remotePath)};\n`
     : '';
-  // Boot-time env validation: import the user's env.ts so the schema is
-  // registered, plus the validator helper. The helper short-circuits after
-  // the first call per isolate and throws EnvValidationError on bad values.
+  // Importing env.ts registers the schema that `_validateEnvOnce` checks.
   const envSchemaImport = envSchemaModule
     ? `import ${JSON.stringify(envSchemaModule.importPath)};\nimport { _validateEnvOnce } from ${JSON.stringify(envSchemaModule.helperPath)};\n`
     : '';
@@ -1367,14 +1187,11 @@ const __filterInternalBindings = (env) => __filterBindings(env, ${JSON.stringify
     internalRoute: __voidHandleInternalRoute,
     collectPrerenderPaths: __voidCollectPrerenderPaths${versionMetadataBinding ? ', versionMetadataBinding: ' + JSON.stringify(versionMetadataBinding) : ''}${envSchemaModule ? ', validateEnv: _validateEnvOnce' : ''}${remotePath ? ', remoteEnv: (env) => ' + createRemoteEnvCall : ''}${hasEmail ? ', emailReceipt: __handleEmailReceipt' : ''}${isr ? ', isr: { deploymentId: __VOID_ISR_DEPLOYMENT_ID, handle: (request, env, ctx, render) => handleIsr(request, env, ctx, { revalidate: __VOID_ISR_REVALIDATE, pages: __VOID_ISR_PAGES, pathRevalidate: __VOID_ISR_PATH_REVALIDATE, deploymentId: __VOID_ISR_DEPLOYMENT_ID, queryAllowlist: ' + JSON.stringify(isr.queryAllowlist) + ' }, render) }' : ''}
   })`;
-  const scheduledHandler = remotePath
-    ? `async function handleScheduled(controller, env, ctx) {
-${envValidateCall}  if (env.__VOID_REMOTE === "1") env = ${createRemoteEnvCall};
-${isrDeploymentStamp}  const userEnv = __filterInternalBindings(env);
-  return withRuntimeEnv(env, () => scheduled(controller, userEnv, ctx));
-}`
-    : `async function handleScheduled(controller, env, ctx) {
-${envValidateCall}${isrDeploymentStamp}  const userEnv = __filterInternalBindings(env);
+  const remoteEnvSwap = remotePath
+    ? `  if (env.__VOID_REMOTE === "1") env = ${createRemoteEnvCall};\n`
+    : '';
+  const scheduledHandler = `async function handleScheduled(controller, env, ctx) {
+${envValidateCall}${remoteEnvSwap}${isrDeploymentStamp}  const userEnv = __filterInternalBindings(env);
   return withRuntimeEnv(env, () => scheduled(controller, userEnv, ctx));
 }`;
 
@@ -1382,34 +1199,13 @@ ${envValidateCall}${isrDeploymentStamp}  const userEnv = __filterInternalBinding
   // run the same handler. Native events replay recorded actions on the real
   // message; receipts return bounded action frames to the platform.
   const emailImport = hasEmail ? ', __emailHandler' : '';
-  const emailRuntimePath = runtimeEmailPath ?? deriveEmailRuntimePath(runtimeEnvPath);
   const emailProxyImport = hasEmail
-    ? `import { createMessageProxy as __createMessageProxy, enactEmailActions as __enactEmailActions, isForwardableEmailMessage as __isForwardableEmailMessage } from ${JSON.stringify(emailRuntimePath)};\nimport { EMAIL_PROTOCOL_VERSION as __EMAIL_PROTOCOL_VERSION, encodeEmailActions as __encodeEmailActions, readEmailEnvelope as __readEmailEnvelope, verifyEmailReceiptThroughProxy as __verifyEmailReceiptThroughProxy } from "void/_email-protocol";\n`
+    ? `import { createMessageProxy as __createMessageProxy, enactEmailActions as __enactEmailActions, isForwardableEmailMessage as __isForwardableEmailMessage } from ${JSON.stringify(runtimeEmailPath)};\nimport { EMAIL_PROTOCOL_VERSION as __EMAIL_PROTOCOL_VERSION, encodeEmailActions as __encodeEmailActions, readEmailEnvelope as __readEmailEnvelope, verifyEmailReceiptThroughProxy as __verifyEmailReceiptThroughProxy } from "void/_email-protocol";\n`
     : '';
-  // `__VOID_PROJECT_SLUG` is the same binding the outbound `sendEmail` reads to
-  // default `from`. It is passed to `createMessageProxy` so the user-visible
-  // `message.to` is the bare `<tag>@<domain>` rather than the wire form, and to
-  // the generated `__emailHandler`, which routes on the wire address
-  // (`__voidPlatformTo`) and strips the `<slug>+` prefix iff a slug is set.
-  //
-  // Verified custom-domain receipts carry `viaDomain` and have no project
-  // prefix. Suppress the slug there so tags such as `support+T-42@acme.com`
-  // reach the matching handler intact.
+  // Custom-domain receipts (`viaDomain`) carry no `<slug>+` prefix, so they get no slug.
   const emailHandler = hasEmail
-    ? remotePath
-      ? `async function handleEmail(envelope, env, ctx) {
-${envValidateCall}  if (env.__VOID_REMOTE === "1") env = ${createRemoteEnvCall};
-  const userEnv = __filterInternalBindings(env);
-  const __relayed = typeof envelope.viaDomain === "string" && envelope.viaDomain.length > 0;
-  const __slug = __relayed ? undefined : (typeof env.__VOID_PROJECT_SLUG === "string" && env.__VOID_PROJECT_SLUG.length > 0 ? env.__VOID_PROJECT_SLUG : undefined);
-  const { message, getActions } = __createMessageProxy(envelope, { slug: __slug });
-  await __withRawEnv(env, () => withRuntimeEnv(env, () => __emailHandler(message, userEnv, ctx, { slug: __slug })));
-  const __actions = getActions();
-  if (__isForwardableEmailMessage(envelope)) await __enactEmailActions(envelope, __actions);
-  return __actions;
-}`
-      : `async function handleEmail(envelope, env, ctx) {
-${envValidateCall}  const userEnv = __filterInternalBindings(env);
+    ? `async function handleEmail(envelope, env, ctx) {
+${envValidateCall}${remoteEnvSwap}  const userEnv = __filterInternalBindings(env);
   const __relayed = typeof envelope.viaDomain === "string" && envelope.viaDomain.length > 0;
   const __slug = __relayed ? undefined : (typeof env.__VOID_PROJECT_SLUG === "string" && env.__VOID_PROJECT_SLUG.length > 0 ? env.__VOID_PROJECT_SLUG : undefined);
   const { message, getActions } = __createMessageProxy(envelope, { slug: __slug });
@@ -1467,15 +1263,10 @@ ${envValidateCall}  const userEnv = __filterInternalBindings(env);
   async scheduled(controller) { return handleScheduled(controller, this.env, this.ctx); }
 ${queueMethodBody}${emailMethodBody}}`;
 
-  if (hasQueues) {
-    return `${sandboxImport}${entryImport}${liveRuntimeImport}import app, { scheduled, __voidCollectPrerenderPaths, __voidHandleInternalRoute, __withRawEnv, __processQueue${emailImport}${webSocketClasses.length > 0 ? `, ${webSocketClasses.join(', ')}` : ''}${liveRouteImport} } from 'virtual:void-routes';
-${durableObjectImports}\n${runtimeEnvImport}${emailProxyImport}${envSchemaImport}${remoteImport}${isrImport}${filterBindingsHelper}${assetHelper}
-${fetchDeclaration}
-${scheduledHandler}
-${emailHandler}
-${emailReceiptHandler}
-async function __voidQueue(batch, env, ctx) {
-${envValidateCall}${remotePath ? `  if (env.__VOID_REMOTE === "1") env = ${createRemoteEnvCall};\n` : ''}${isrDeploymentStamp}  const userEnv = __filterInternalBindings(env);
+  const queueImport = hasQueues ? ', __processQueue' : '';
+  const queueFunction = hasQueues
+    ? `async function __voidQueue(batch, env, ctx) {
+${envValidateCall}${remoteEnvSwap}${isrDeploymentStamp}  const userEnv = __filterInternalBindings(env);
   const messages = [...batch.messages].map(m => ({
     id: m.id, timestamp: m.timestamp.toISOString(),
     body: m.body, attempts: m.attempts,
@@ -1495,19 +1286,15 @@ ${envValidateCall}${remotePath ? `  if (env.__VOID_REMOTE === "1") env = ${creat
   if (!__qr.ok) throw new Error("queue: Handler failed.");
 }
 
-${webSocketClasses.map((name) => `export { ${name} };`).join('\n')}
-${liveExport}
-${sandboxExport}
-${durableObjectExports}
-${entryClass}`;
-  }
-  return `${sandboxImport}${entryImport}${liveRuntimeImport}import app, { scheduled, __voidCollectPrerenderPaths, __voidHandleInternalRoute, __withRawEnv${emailImport}${webSocketClasses.length > 0 ? `, ${webSocketClasses.join(', ')}` : ''}${liveRouteImport} } from 'virtual:void-routes';
+`
+    : '';
+  return `${sandboxImport}${entryImport}${liveRuntimeImport}import app, { scheduled, __voidCollectPrerenderPaths, __voidHandleInternalRoute, __withRawEnv${queueImport}${emailImport}${webSocketClasses.length > 0 ? `, ${webSocketClasses.join(', ')}` : ''}${liveRouteImport} } from 'virtual:void-routes';
 ${durableObjectImports}\n${runtimeEnvImport}${emailProxyImport}${envSchemaImport}${remoteImport}${isrImport}${filterBindingsHelper}${assetHelper}
 ${fetchDeclaration}
 ${scheduledHandler}
 ${emailHandler}
 ${emailReceiptHandler}
-${webSocketClasses.map((name) => `export { ${name} };`).join('\n')}
+${queueFunction}${webSocketClasses.map((name) => `export { ${name} };`).join('\n')}
 ${liveExport}
 ${sandboxExport}
 ${durableObjectExports}
@@ -1517,13 +1304,6 @@ ${entryClass}`;
 /**
  * Generate the app module — exports the Hono app with static asset serving.
  * This is the entry imported by `vite preview` and can be used programmatically.
- *
- * When `envSchemaModule` is provided, splices boot-time env validation so it
- * runs on the first request (including the prerender child process spawned
- * by `prerenderPagesNode`). Mirrors `compileWorkerEntry`: a side-effect import
- * registers the schema, and `_validateEnvOnce` throws `EnvValidationError` on
- * bad values. Env source on Node/Bun is `process.env`; on Deno it's
- * `Deno.env.toObject()`.
  */
 export function compileNodeApp(
   target: 'node' | 'bun' | 'deno',
@@ -1537,10 +1317,6 @@ export function compileNodeApp(
         ? `import { serveStatic } from "hono/deno";`
         : `import { serveStatic } from "@hono/node-server/serve-static";`;
 
-  // Boot-time env validation: side-effect import so defineEnv() registers the
-  // schema, plus the validator helper. Helper short-circuits after the first
-  // call per process and throws EnvValidationError on bad values. Node/Bun
-  // read env from `process.env`; Deno from `Deno.env.toObject()`.
   const envSchemaImport = envSchemaModule
     ? `import ${JSON.stringify(envSchemaModule.importPath)};\nimport { _validateEnvOnce } from ${JSON.stringify(envSchemaModule.helperPath)};\n`
     : '';
@@ -1615,75 +1391,6 @@ export { fetchStream, StreamError } from ${JSON.stringify(fetchStreamPath)};
 export { auth, createAuthClient } from ${JSON.stringify(authClientPath)};`;
 }
 
-/**
- * Generate the server-side fetch client module for non-CF targets.
- * Same as compileWorkerClient but without cloudflare:workers dependency.
- * Calls app.fetch() directly (no HTTP round-trip) with ALS context forwarding.
- */
-export function compileNodeClient(authClientPath: string): string {
-  return `import app, { requestContext } from "virtual:void-routes";
-import { interpolateRouteParams } from ${JSON.stringify(ROUTE_URL_PATH)};
-export { auth, createAuthClient } from ${JSON.stringify(authClientPath)};
-
-export class FetchError extends Error {
-  constructor(status, statusText, data) {
-    super(\`fetch: Request failed with status \${status}.\`);
-    this.name = "FetchError";
-    this.status = status;
-    this.statusText = statusText;
-    this.data = data;
-  }
-}
-
-export async function fetch(path, options) {
-  let url = interpolateRouteParams(path, options?.params);
-
-  if (options?.query) {
-    const qs = new URLSearchParams(options.query).toString();
-    if (qs) url += "?" + qs;
-  }
-
-  const method = options?.method ?? "GET";
-  const headers = new Headers(options?.headers);
-
-  const store = requestContext.getStore();
-  if (store?.request) {
-    const outerReq = store.request;
-    if (!headers.has("cookie")) {
-      const cookie = outerReq.headers.get("cookie");
-      if (cookie) headers.set("cookie", cookie);
-    }
-    if (!headers.has("authorization")) {
-      const auth = outerReq.headers.get("authorization");
-      if (auth) headers.set("authorization", auth);
-    }
-  }
-
-  if (options?.body != null && !headers.has("content-type")) {
-    headers.set("content-type", "application/json");
-  }
-
-  const request = new Request("http://localhost" + url, {
-    method,
-    headers,
-    body: options?.body != null ? JSON.stringify(options.body) : undefined,
-  });
-
-  const response = await app.fetch(request);
-
-  if (response.status === 204) return undefined;
-
-  const contentType = response.headers.get("content-type") ?? "";
-  const data = contentType.includes("application/json") ? await response.json() : await response.text();
-
-  if (!response.ok) {
-    throw new FetchError(response.status, response.statusText, data);
-  }
-
-  return data;
-}`;
-}
-
 function stripOriginForProd(rules: Array<DevRedirectRule>): Array<DevRedirectRule> {
   return rules.map(({ origin: _origin, ...rest }) => rest);
 }
@@ -1704,11 +1411,15 @@ function compileHeaderMiddleware(lines: Array<string>, rules: Array<HeaderRule>)
   lines.push('app.use("*", __routingRuntime.headerMiddleware(__headerRules));');
 }
 
-export function compileWorkerClient(authClientPath: string): string {
+/** Generate the server-side fetch client, which calls `app.fetch()` with the current request's credentials. */
+export function compileWorkerClient(authClientPath: string, nodeTarget = false): string {
+  const envImport = nodeTarget ? '' : 'import { env } from "cloudflare:workers";\n';
+  const dispatch = nodeTarget
+    ? 'const response = await app.fetch(request);'
+    : 'const executionCtx = store?.executionCtx ?? { waitUntil() {}, passThroughOnException() {} };\n  const response = await app.fetch(request, env, executionCtx);';
   return `import app, { requestContext } from "virtual:void-routes";
 import { interpolateRouteParams } from ${JSON.stringify(ROUTE_URL_PATH)};
-import { env } from "cloudflare:workers";
-export { auth, createAuthClient } from ${JSON.stringify(authClientPath)};
+${envImport}export { auth, createAuthClient } from ${JSON.stringify(authClientPath)};
 
 export class FetchError extends Error {
   constructor(status, statusText, data) {
@@ -1731,7 +1442,6 @@ export async function fetch(path, options) {
   const method = options?.method ?? "GET";
   const headers = new Headers(options?.headers);
 
-  // Auto-forward cookie and authorization from the outer request via ALS
   const store = requestContext.getStore();
   if (store?.request) {
     const outerReq = store.request;
@@ -1749,15 +1459,13 @@ export async function fetch(path, options) {
     headers.set("content-type", "application/json");
   }
 
-  const request = new Request("http://worker.local" + url, {
+  const request = new Request("${nodeTarget ? 'http://localhost' : 'http://worker.local'}" + url, {
     method,
     headers,
     body: options?.body != null ? JSON.stringify(options.body) : undefined,
   });
 
-  // Use real executionCtx from ALS if available, otherwise provide a no-op fallback
-  const executionCtx = store?.executionCtx ?? { waitUntil() {}, passThroughOnException() {} };
-  const response = await app.fetch(request, env, executionCtx);
+  ${dispatch}
 
   if (response.status === 204) return undefined;
 
diff --git a/packages/void/src/router/email.ts b/packages/void/src/router/email.ts
index 09d40f7b3..528a3fc81 100644
--- a/packages/void/src/router/email.ts
+++ b/packages/void/src/router/email.ts
@@ -27,7 +27,7 @@
  */
 
 import { join } from 'pathslash';
-import { glob, globSync } from 'tinyglobby';
+import { globSync } from 'tinyglobby';
 
 const EMAIL_EXTENSIONS = ['ts', 'mts', 'js', 'mjs'];
 
@@ -250,27 +250,9 @@ function parseEmailFiles(files: Array<string>): {
   return { addresses, defaultHandler };
 }
 
-export async function scanEmailHandlers(
-  root: string,
-  emailDir = 'email',
-): Promise<EmailHandlersScan> {
-  const pattern = `*.{${EMAIL_EXTENSIONS.join(',')}}`;
-  const files = await glob(pattern, {
-    cwd: join(root, emailDir),
-    absolute: false,
-  }).catch(() => [] as Array<string>);
-  return parseEmailFiles(files);
-}
-
 export function scanEmailHandlersSync(root: string, emailDir = 'email'): EmailHandlersScan {
   const pattern = `*.{${EMAIL_EXTENSIONS.join(',')}}`;
-  let files: Array<string>;
-  try {
-    files = globSync(pattern, { cwd: join(root, emailDir), absolute: false });
-  } catch {
-    files = [];
-  }
-  return parseEmailFiles(files);
+  return parseEmailFiles(globSync(pattern, { cwd: join(root, emailDir) }));
 }
 
 export function hasEmailHandlers(scan: EmailHandlersScan): boolean {
diff --git a/packages/void/src/router/scan.ts b/packages/void/src/router/scan.ts
index 38a5c00a1..32f648717 100644
--- a/packages/void/src/router/scan.ts
+++ b/packages/void/src/router/scan.ts
@@ -1,23 +1,20 @@
 import { join } from 'pathslash';
-import { glob, globSync } from 'tinyglobby';
-import { scanJobs, type JobDefinition } from '../crons/scan.ts';
+import { globSync } from 'tinyglobby';
+import type { JobDefinition } from '../crons/scan.ts';
 import { scanPages } from '../pages/scan.ts';
 import type { PageScanResult } from '../pages/types.ts';
 import { readProjectPaths, type ProjectPaths } from '../project-paths.ts';
-import { scanQueues, type QueueDefinition } from '../queues/scan.ts';
+import type { QueueDefinition } from '../queues/scan.ts';
+import { listConventionFiles } from '../shared/convention-files.ts';
 import { detectHttpExports } from './detect-exports.ts';
-import { scanEmailHandlers, type EmailHandlersScan } from './email.ts';
+import type { EmailHandlersScan } from './email.ts';
 import {
   isRouteEnabledForEnvironment,
   parseRouteFilename,
   type RouteDefinition,
   type RouteEnvironment,
 } from './parse-filename.ts';
-import {
-  isWebSocketPatternFile,
-  scanWebSocketRoutes,
-  type WebSocketRouteDefinition,
-} from './websocket.ts';
+import { isWebSocketPatternFile, type WebSocketRouteDefinition } from './websocket.ts';
 
 export type ScanResult = {
   routes: Array<RouteDefinition>;
@@ -36,9 +33,6 @@ export type MiddlewareDefinition = {
   filePath: string;
 };
 
-const HANDLER_EXTENSIONS = ['ts', 'mts', 'js', 'mjs'];
-const ROUTE_PATTERN = `**/*.{${HANDLER_EXTENSIONS.join(',')}}`;
-
 function parseMiddlewareDefinitions(files: Array<string>): Array<MiddlewareDefinition> {
   return files
     .filter((f) => !f.startsWith('_'))
@@ -74,71 +68,31 @@ function compareRouteSpecificity(a: RouteDefinition, b: RouteDefinition): number
   return aSegments.length - bSegments.length;
 }
 
-/**
- * Scan routes/ and middleware/ directories and return a structured manifest.
- * Files starting with _ are ignored.
- */
+/** Add pages and HTTP methods to the inventories already resolved for this application phase. */
 export async function scanRoutes(
   root: string,
-  options?: {
+  options: {
     output?: 'server' | 'static';
-    paths?: ProjectPaths;
-    environment?: RouteEnvironment;
-    /** Reuse the inventories already resolved for this application phase. */
-    inventory?: Omit<ScanResult, 'pages'>;
+    paths: ProjectPaths;
+    inventory: Omit<ScanResult, 'pages'>;
   },
 ): Promise<ScanResult> {
-  const paths = options?.paths ?? readProjectPaths(root);
-  const [routeFiles, websockets, middlewareFiles, jobs, queues, pages, email] = await Promise.all([
-    options?.inventory ? [] : glob(ROUTE_PATTERN, { cwd: paths.routesDir, absolute: false }),
-    options?.inventory?.websockets ?? scanWebSocketRoutes(root, paths, options?.environment),
-    options?.inventory
-      ? []
-      : glob(ROUTE_PATTERN, { cwd: paths.middlewareDir, absolute: false }).catch(
-          () => [] as Array<string>,
-        ),
-    options?.inventory?.jobs ?? scanJobs(root, paths.cronsDir),
-    options?.inventory?.queues ?? scanQueues(root, paths.queuesDir),
-    scanPages(root, { output: options?.output, paths }),
-    // `email/` is a source convention like `crons/` and `queues/`, so it lives
-    // under `sourceRoot` — which is `root` when no `sourceDir` is configured.
-    // `scanEmailHandlers` joins its own `email` segment, so this resolves to
-    // `paths.emailDir`.
-    options?.inventory?.email ?? scanEmailHandlers(paths.sourceRoot),
-  ]);
-
-  const routesDir = paths.routesDir;
-
-  // Parse routes, filtering out files starting with _
-  const parsedRoutes =
-    options?.inventory?.routes ??
-    routeFiles
-      .filter((f) => !isWebSocketPatternFile(f))
-      .filter((f) => !f.split('/').some((s) => s.startsWith('_')))
-      .map((file) => parseRouteFilename(file))
-      .filter((route) => isRouteEnabledForEnvironment(route, options?.environment));
-  const routes = parsedRoutes
-    .map((route) => ({ ...route, methods: detectHttpExports(join(routesDir, route.filePath)) }))
+  const { paths, inventory } = options;
+  const pages = await scanPages(root, { output: options.output, paths });
+  const routes = inventory.routes
+    .map((route) => ({
+      ...route,
+      methods: detectHttpExports(join(paths.routesDir, route.filePath)),
+    }))
     .sort(compareRouteSpecificity);
-
-  // Parse middleware, sorted by numeric prefix
-  const middleware = options?.inventory?.middleware ?? parseMiddlewareDefinitions(middlewareFiles);
-
-  return { routes, websockets, middleware, jobs, queues, pages, email };
+  return { ...inventory, routes, pages };
 }
 
 export function scanMiddlewareSync(
   root: string,
   paths: ProjectPaths = readProjectPaths(root),
 ): Array<MiddlewareDefinition> {
-  let middlewareFiles: Array<string>;
-  try {
-    middlewareFiles = globSync(ROUTE_PATTERN, { cwd: paths.middlewareDir, absolute: false });
-  } catch {
-    middlewareFiles = [];
-  }
-
-  return parseMiddlewareDefinitions(middlewareFiles);
+  return parseMiddlewareDefinitions(globSync('**/*.{ts,mts,js,mjs}', { cwd: paths.middlewareDir }));
 }
 
 export function scanRoutePatternsSync(
@@ -146,16 +100,8 @@ export function scanRoutePatternsSync(
   paths: ProjectPaths = readProjectPaths(root),
   environment?: RouteEnvironment,
 ): Array<RouteDefinition> {
-  let routeFiles: Array<string>;
-  try {
-    routeFiles = globSync(ROUTE_PATTERN, { cwd: paths.routesDir, absolute: false });
-  } catch {
-    routeFiles = [];
-  }
-
-  return routeFiles
+  return listConventionFiles(paths.routesDir)
     .filter((f) => !isWebSocketPatternFile(f))
-    .filter((f) => !f.split('/').some((s) => s.startsWith('_')))
     .map((f) => parseRouteFilename(f))
     .filter((route) => isRouteEnabledForEnvironment(route, environment))
     .sort(compareRouteSpecificity);
diff --git a/packages/void/src/router/websocket.ts b/packages/void/src/router/websocket.ts
index 73796005a..d0f324958 100644
--- a/packages/void/src/router/websocket.ts
+++ b/packages/void/src/router/websocket.ts
@@ -1,6 +1,5 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'pathslash';
-import { glob, globSync } from 'tinyglobby';
 import { readProjectPaths, type ProjectPaths } from '../project-paths.ts';
 import {
   isIdentifier,
@@ -9,6 +8,7 @@ import {
   type AstNode,
   type AstProperty,
 } from '../shared/ast.ts';
+import { listConventionFiles } from '../shared/convention-files.ts';
 import { readResourceDefinition } from '../shared/resource-definition.ts';
 import { resourceNameWords } from '../shared/resource-name.ts';
 import {
@@ -18,7 +18,6 @@ import {
   type RouteEnvironment,
 } from './parse-filename.ts';
 
-const HANDLER_EXTENSIONS = ['ts', 'mts', 'js', 'mjs'];
 const WEBSOCKET_ROUTE_RE = /(?:\.(?:dev|prod))?\.ws\.(?:ts|mts|js|mjs)$/;
 
 export type WebSocketRouteDefinition = RouteDefinition & {
@@ -138,7 +137,6 @@ function parseWebSocketFiles(
 ): Array<WebSocketRouteDefinition> {
   const routes = files
     .filter((f) => isWebSocketRouteFile(f))
-    .filter((f) => !f.split('/').some((segment) => segment.startsWith('_')))
     .filter((filePath) =>
       isRouteEnabledForEnvironment(parseWebSocketFilename(filePath), environment),
     )
@@ -165,31 +163,12 @@ function parseWebSocketFiles(
   return routes;
 }
 
-export async function scanWebSocketRoutes(
-  root: string,
-  paths: ProjectPaths = readProjectPaths(root),
-  environment?: RouteEnvironment,
-): Promise<Array<WebSocketRouteDefinition>> {
-  const pattern = `**/*.{${HANDLER_EXTENSIONS.join(',')}}`;
-  const files = await glob(pattern, { cwd: paths.routesDir, absolute: false }).catch(
-    () => [] as Array<string>,
-  );
-  return parseWebSocketFiles(root, files, paths, environment);
-}
-
 export function scanWebSocketRoutesSync(
   root: string,
   paths: ProjectPaths = readProjectPaths(root),
   environment?: RouteEnvironment,
 ): Array<WebSocketRouteDefinition> {
-  const pattern = `**/*.{${HANDLER_EXTENSIONS.join(',')}}`;
-  let files: Array<string>;
-  try {
-    files = globSync(pattern, { cwd: paths.routesDir, absolute: false });
-  } catch {
-    files = [];
-  }
-  return parseWebSocketFiles(root, files, paths, environment);
+  return parseWebSocketFiles(root, listConventionFiles(paths.routesDir), paths, environment);
 }
 
 export function isWebSocketPatternFile(filePath: string): boolean {
diff --git a/packages/void/src/routes-module.d.ts b/packages/void/src/routes-module.d.ts
deleted file mode 100644
index dd0cabcb5..000000000
--- a/packages/void/src/routes-module.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-export {};
-
-declare module 'void/routes' {
-  /** Stub interface augmented by the generated .void/routes.d.ts */
-  export interface WebSocketRouteMap {}
-}
diff --git a/packages/void/src/runtime/ai.ts b/packages/void/src/runtime/ai.ts
index 33cc1af91..b86782462 100644
--- a/packages/void/src/runtime/ai.ts
+++ b/packages/void/src/runtime/ai.ts
@@ -5,6 +5,7 @@ import {
   type AiProviderFetchInit,
   type AiProviderOptions,
 } from './ai-types.ts';
+import { bytesToBase64 } from './base64.ts';
 import { getRawRuntimeEnv, type RuntimeEnv } from './env-raw.ts';
 import { UsageLimit, limitFromResponse } from './limits.ts';
 
@@ -103,15 +104,6 @@ function copyBinaryView(value: ArrayBufferView): ArrayBuffer {
   return copy.buffer as ArrayBuffer;
 }
 
-function bytesToBase64(bytes: Uint8Array): string {
-  let binary = '';
-  const chunkSize = 0x8000;
-  for (let i = 0; i < bytes.length; i += chunkSize) {
-    binary += String.fromCharCode(...bytes.subarray(i, i + chunkSize));
-  }
-  return btoa(binary);
-}
-
 function arrayBufferToBase64(buffer: ArrayBuffer): string {
   return bytesToBase64(new Uint8Array(buffer));
 }
@@ -286,19 +278,13 @@ async function responseFromResult(result: unknown): Promise<Response> {
   return Response.json(result);
 }
 
-function splitImageOptions(options: unknown): {
-  endpoint: string;
-  runOptions: Record<string, unknown> | undefined;
-} {
+function imageRunOptions(options: unknown): Record<string, unknown> | undefined {
   if (typeof options !== 'object' || options === null) {
-    return { endpoint: 'images/generations', runOptions: undefined };
+    return undefined;
   }
 
-  const { endpoint, ...runOptions } = options as Record<string, unknown>;
-  return {
-    endpoint: typeof endpoint === 'string' ? endpoint : 'images/generations',
-    runOptions: Object.keys(runOptions).length > 0 ? runOptions : undefined,
-  };
+  const { endpoint: _endpoint, ...runOptions } = options as Record<string, unknown>;
+  return Object.keys(runOptions).length > 0 ? runOptions : undefined;
 }
 
 function resolveProviderKey(
@@ -475,9 +461,7 @@ function makeProxyBackend(send: ProxySend, runtimeEnv: RuntimeEnv): AiBackend {
       return readProxyResult(res);
     },
     async image(model, inputs, options) {
-      const { runOptions } = splitImageOptions(options);
-
-      return proxyFetch('run', { model, inputs, options: runOptions });
+      return proxyFetch('run', { model, inputs, options: imageRunOptions(options) });
     },
     async providerFetch(provider, path, init, options) {
       return proxyFetch(
@@ -568,8 +552,7 @@ function makeDirectBackend(
   return {
     run,
     async image(model, inputs, options) {
-      const { runOptions } = splitImageOptions(options);
-      return responseFromResult(await run(model, inputs, runOptions));
+      return responseFromResult(await run(model, inputs, imageRunOptions(options)));
     },
     async providerFetch(provider, path, init, options) {
       if (!gatewayId) {
diff --git a/packages/void/src/runtime/auth-migrations.ts b/packages/void/src/runtime/auth-migrations.ts
index 1b114daac..3d04a2c29 100644
--- a/packages/void/src/runtime/auth-migrations.ts
+++ b/packages/void/src/runtime/auth-migrations.ts
@@ -18,6 +18,36 @@ export type ParameterizedMigrationRunner = {
   run(sql: string, params?: Array<unknown>): Promise<void>;
 };
 
+/** Wraps a `mysql2/promise` connection. */
+export function mysqlMigrationRunner(connection: {
+  query(sql: string, values?: Array<unknown>): Promise<[unknown, unknown]>;
+}): ParameterizedMigrationRunner {
+  return {
+    async all<T extends Record<string, unknown>>(sql: string, params?: Array<unknown>) {
+      const [rows] = await connection.query(sql, params);
+      return rows as Array<T>;
+    },
+    async run(sql: string, params?: Array<unknown>) {
+      await connection.query(sql, params);
+    },
+  };
+}
+
+/** Wraps a `pg` client. */
+export function pgMigrationRunner(client: {
+  query(sql: string, values?: Array<unknown>): Promise<{ rows: Array<unknown> }>;
+}): ParameterizedMigrationRunner {
+  return {
+    async all<T extends Record<string, unknown>>(sql: string, params?: Array<unknown>) {
+      const result = await client.query(sql, params);
+      return result.rows as Array<T>;
+    },
+    async run(sql: string, params?: Array<unknown>) {
+      await client.query(sql, params);
+    },
+  };
+}
+
 function quoteIdentifier(name: string, dialect: VoidAuthMigrationSchema['dialect']): string {
   return dialect === 'mysql'
     ? `\`${name.replaceAll('`', '``')}\``
diff --git a/packages/void/src/runtime/base64.ts b/packages/void/src/runtime/base64.ts
new file mode 100644
index 000000000..5ec328fff
--- /dev/null
+++ b/packages/void/src/runtime/base64.ts
@@ -0,0 +1,19 @@
+export function bytesToBase64(bytes: Uint8Array): string {
+  let binary = '';
+  // Chunked to stay under the call-argument limit.
+  const chunkSize = 0x8000;
+  for (let i = 0; i < bytes.length; i += chunkSize) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + chunkSize));
+  }
+  return btoa(binary);
+}
+
+/** Throws on invalid input. */
+export function base64ToBytes(value: string): Uint8Array {
+  const binary = atob(value);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    out[i] = binary.charCodeAt(i);
+  }
+  return out;
+}
diff --git a/packages/void/src/runtime/better-auth-mysql.ts b/packages/void/src/runtime/better-auth-mysql.ts
index dffe1ff9d..051a54f5c 100644
--- a/packages/void/src/runtime/better-auth-mysql.ts
+++ b/packages/void/src/runtime/better-auth-mysql.ts
@@ -1,61 +1,27 @@
-import { applyMySqlAuthMigrations } from './auth-migrations.ts';
+import type { VoidAuthMigrationSchema } from '../auth/drizzle.ts';
+import { applyMySqlAuthMigrations, mysqlMigrationRunner } from './auth-migrations.ts';
 import {
   createVoidAuthRuntime,
   resolveConnectionString,
-  type ResolvedDatabase,
   type VoidAuthEnv,
   type VoidAuthRuntimeApi,
 } from './better-auth-shared.ts';
 
-async function resolveDatabase(env: VoidAuthEnv): Promise<ResolvedDatabase> {
-  const { createPool } = await import('mysql2/promise');
-  const pool = createPool({ uri: resolveConnectionString(env, 'MySQL'), connectionLimit: 1 });
-  return {
-    database: pool,
-    async dispose() {
-      await pool.end();
-    },
-  };
-}
-
-async function runMySqlAuthMigrations(
-  _request: Request,
+async function applyMigrations(
   env: VoidAuthEnv,
-  runtime: Parameters<VoidAuthRuntimeApi['runVoidAuthMigrations']>[2],
-  migrationSchema: Parameters<VoidAuthRuntimeApi['runVoidAuthMigrations']>[3],
+  migrationSchema: VoidAuthMigrationSchema,
 ): Promise<void> {
-  if (!migrationSchema) {
-    throw new Error('auth: Migration schema is unavailable.');
-  }
-  if (runtime.dialect !== 'mysql' || migrationSchema.dialect !== 'mysql') {
-    throw new Error('auth: Runtime mismatch. Expected mysql.');
-  }
-
   const { createConnection } = await import('mysql2/promise');
   const connection = await createConnection(resolveConnectionString(env, 'MySQL'));
   try {
-    await applyMySqlAuthMigrations(
-      {
-        async all<T extends Record<string, unknown>>(sql: string, params?: Array<unknown>) {
-          const [rows] = await connection.query(sql, params);
-          return rows as Array<T>;
-        },
-        async run(sql: string, params?: Array<unknown>) {
-          await connection.query(sql, params);
-        },
-      },
-      migrationSchema,
-    );
+    await applyMySqlAuthMigrations(mysqlMigrationRunner(connection), migrationSchema);
   } finally {
     await connection.end();
   }
 }
 
-const runtime = createVoidAuthRuntime('mysql', resolveDatabase, runMySqlAuthMigrations);
+const runtime = createVoidAuthRuntime('mysql', applyMigrations);
 
-export const resolveVoidAuthOptions: VoidAuthRuntimeApi['resolveVoidAuthOptions'] =
-  runtime.resolveVoidAuthOptions;
-export const createVoidAuth: VoidAuthRuntimeApi['createVoidAuth'] = runtime.createVoidAuth;
 export const resolveVoidAuthState: VoidAuthRuntimeApi['resolveVoidAuthState'] =
   runtime.resolveVoidAuthState;
 export const runVoidAuthMiddleware: VoidAuthRuntimeApi['runVoidAuthMiddleware'] =
@@ -64,5 +30,3 @@ export const handleVoidAuthRequest: VoidAuthRuntimeApi['handleVoidAuthRequest']
   runtime.handleVoidAuthRequest;
 export const runVoidAuthMigrations: VoidAuthRuntimeApi['runVoidAuthMigrations'] =
   runtime.runVoidAuthMigrations;
-
-export type { VoidAuthDialect, VoidAuthEnv, VoidAuthRuntimeOptions } from './better-auth-shared.ts';
diff --git a/packages/void/src/runtime/better-auth-pg.ts b/packages/void/src/runtime/better-auth-pg.ts
index a41fe43ab..6635d366b 100644
--- a/packages/void/src/runtime/better-auth-pg.ts
+++ b/packages/void/src/runtime/better-auth-pg.ts
@@ -1,69 +1,30 @@
-import { applyPgAuthMigrations } from './auth-migrations.ts';
+import type { VoidAuthMigrationSchema } from '../auth/drizzle.ts';
+import { applyPgAuthMigrations, pgMigrationRunner } from './auth-migrations.ts';
 import {
-  assertRuntimeDialect,
   createVoidAuthRuntime,
   resolveConnectionString,
-  type ResolvedDatabase,
   type VoidAuthEnv,
   type VoidAuthRuntimeApi,
 } from './better-auth-shared.ts';
 import { disablePgPassFallback } from './pg.ts';
 
-async function resolveDatabase(env: VoidAuthEnv): Promise<ResolvedDatabase> {
-  const { default: pg } = await import('pg');
-  const connectionString = resolveConnectionString(env, 'PostgreSQL');
-  const pool = new pg.Pool({ connectionString, max: 1 });
-  return {
-    database: pool,
-    async dispose() {
-      await pool.end();
-    },
-  };
-}
-
-async function runPostgresAuthMigrations(
-  _request: Request,
+async function applyMigrations(
   env: VoidAuthEnv,
-  runtime: Parameters<VoidAuthRuntimeApi['runVoidAuthMigrations']>[2],
-  migrationSchema: Parameters<VoidAuthRuntimeApi['runVoidAuthMigrations']>[3],
+  migrationSchema: VoidAuthMigrationSchema,
 ): Promise<void> {
-  if (!migrationSchema) {
-    throw new Error('auth: Migration schema is unavailable.');
-  }
-  assertRuntimeDialect(runtime, 'postgresql');
-  if (migrationSchema.dialect !== 'postgresql') {
-    throw new Error(
-      `auth: Runtime mismatch. Expected postgresql, received '${migrationSchema.dialect}'.`,
-    );
-  }
-
   const { Client } = await import('pg');
   const client = new Client({ connectionString: resolveConnectionString(env, 'PostgreSQL') });
   disablePgPassFallback(client);
   await client.connect();
   try {
-    await applyPgAuthMigrations(
-      {
-        async all<T extends Record<string, unknown>>(sql: string, params?: Array<unknown>) {
-          const result = await client.query(sql, params);
-          return result.rows as Array<T>;
-        },
-        async run(sql: string, params?: Array<unknown>) {
-          await client.query(sql, params);
-        },
-      },
-      migrationSchema,
-    );
+    await applyPgAuthMigrations(pgMigrationRunner(client), migrationSchema);
   } finally {
     await client.end();
   }
 }
 
-const runtime = createVoidAuthRuntime('postgresql', resolveDatabase, runPostgresAuthMigrations);
+const runtime = createVoidAuthRuntime('postgresql', applyMigrations);
 
-export const resolveVoidAuthOptions: VoidAuthRuntimeApi['resolveVoidAuthOptions'] =
-  runtime.resolveVoidAuthOptions;
-export const createVoidAuth: VoidAuthRuntimeApi['createVoidAuth'] = runtime.createVoidAuth;
 export const resolveVoidAuthState: VoidAuthRuntimeApi['resolveVoidAuthState'] =
   runtime.resolveVoidAuthState;
 export const runVoidAuthMiddleware: VoidAuthRuntimeApi['runVoidAuthMiddleware'] =
@@ -72,5 +33,3 @@ export const handleVoidAuthRequest: VoidAuthRuntimeApi['handleVoidAuthRequest']
   runtime.handleVoidAuthRequest;
 export const runVoidAuthMigrations: VoidAuthRuntimeApi['runVoidAuthMigrations'] =
   runtime.runVoidAuthMigrations;
-
-export type { VoidAuthDialect, VoidAuthEnv, VoidAuthRuntimeOptions } from './better-auth-shared.ts';
diff --git a/packages/void/src/runtime/better-auth-shared.ts b/packages/void/src/runtime/better-auth-shared.ts
index 20007bb63..5b2f198e4 100644
--- a/packages/void/src/runtime/better-auth-shared.ts
+++ b/packages/void/src/runtime/better-auth-shared.ts
@@ -27,12 +27,11 @@ export type VoidAuthEnv = Record<string, unknown> & {
   BETTER_AUTH_SECRET?: string;
 };
 
-export type ResolvedDatabase = {
-  database: NonNullable<BetterAuthOptions['database']>;
-  dispose(): Promise<void>;
-};
-
-type ResolveDatabase = (env: VoidAuthEnv) => Promise<ResolvedDatabase>;
+type AuthDatabase = NonNullable<BetterAuthOptions['database']>;
+type ApplyMigrations = (
+  env: VoidAuthEnv,
+  migrationSchema: VoidAuthMigrationSchema,
+) => Promise<void>;
 type EmailPasswordOptions = NonNullable<BetterAuthOptions['emailAndPassword']>;
 type PasswordOptions = NonNullable<EmailPasswordOptions['password']>;
 type VoidAuthPasswordOptions = PasswordOptions & {
@@ -45,38 +44,32 @@ export type VoidAuthRuntimeApi = {
     request: Request,
     env: VoidAuthEnv,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
-  ): Promise<{ options: BetterAuthOptions; dispose(): Promise<void> }>;
+    database: AuthDatabase,
+  ): Promise<BetterAuthOptions>;
   createVoidAuth(
     request: Request,
     env: VoidAuthEnv,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
-  ): Promise<{ auth: ReturnType<typeof betterAuth>; dispose(): Promise<void> }>;
+    database: AuthDatabase,
+  ): Promise<ReturnType<typeof betterAuth>>;
   resolveVoidAuthState(
     request: Request,
     env: VoidAuthEnv,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
+    database: AuthDatabase,
   ): Promise<AuthState | null>;
   runVoidAuthMiddleware(
     c: Context,
     next: () => Promise<void>,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
+    database: AuthDatabase,
   ): Promise<void>;
   handleVoidAuthRequest(
     c: Context,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
+    database: AuthDatabase,
   ): Promise<Response>;
   runVoidAuthMigrations(
-    request: Request,
     env: VoidAuthEnv,
     runtime: VoidAuthRuntimeOptions,
     migrationSchema: VoidAuthMigrationSchema,
@@ -400,35 +393,24 @@ function applyCloudflareRateLimitDefaults(options: BetterAuthOptions): BetterAut
   };
 }
 
-export function assertRuntimeDialect(
-  runtime: VoidAuthRuntimeOptions,
-  dialect: VoidAuthDialect,
-): void {
-  if (runtime.dialect !== dialect) {
-    throw new Error(`auth: Runtime mismatch. Expected ${dialect}, received '${runtime.dialect}'.`);
-  }
-}
-
 export function createVoidAuthRuntime(
   dialect: VoidAuthDialect,
-  resolveDatabase: ResolveDatabase,
-  runVoidAuthMigrations: VoidAuthRuntimeApi['runVoidAuthMigrations'],
+  applyMigrations: ApplyMigrations,
 ): VoidAuthRuntimeApi {
+  function assertDialect(received: VoidAuthDialect): void {
+    if (received !== dialect) {
+      throw new Error(`auth: Runtime mismatch. Expected ${dialect}, received '${received}'.`);
+    }
+  }
+
   async function resolveVoidAuthOptions(
     request: Request,
     env: VoidAuthEnv,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
-  ): Promise<{ options: BetterAuthOptions; dispose(): Promise<void> }> {
-    assertRuntimeDialect(runtime, dialect);
-
-    const { database, dispose } = databaseOverride
-      ? {
-          database: databaseOverride,
-          dispose: disposeOverride ?? (async () => {}),
-        }
-      : await resolveDatabase(env);
+    database: AuthDatabase,
+  ): Promise<BetterAuthOptions> {
+    assertDialect(runtime.dialect);
+
     const origin = new URL(request.url).origin;
     const emailAndPassword = resolveEmailAndPassword(runtime.providers);
     const socialProviders = resolveSocialProviders(env, runtime.providers);
@@ -444,69 +426,41 @@ export function createVoidAuthRuntime(
     };
 
     const resolved = resolveUserConfig(runtime.userConfig, defaults, request, env, dialect);
-    return {
-      options:
-        runtime.dev !== true && cloudflareClientIp(request)
-          ? applyCloudflareRateLimitDefaults(resolved)
-          : resolved,
-      dispose,
-    };
+    return runtime.dev !== true && cloudflareClientIp(request)
+      ? applyCloudflareRateLimitDefaults(resolved)
+      : resolved;
   }
 
   async function createVoidAuth(
     request: Request,
     env: VoidAuthEnv,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
-  ): Promise<{ auth: ReturnType<typeof betterAuth>; dispose(): Promise<void> }> {
-    const { options, dispose } = await resolveVoidAuthOptions(
-      request,
-      env,
-      runtime,
-      databaseOverride,
-      disposeOverride,
-    );
-    return {
-      auth: betterAuth(options),
-      dispose,
-    };
+    database: AuthDatabase,
+  ): Promise<ReturnType<typeof betterAuth>> {
+    return betterAuth(await resolveVoidAuthOptions(request, env, runtime, database));
   }
 
   async function resolveVoidAuthState(
     request: Request,
     env: VoidAuthEnv,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
+    database: AuthDatabase,
   ): Promise<AuthState | null> {
-    const { auth, dispose } = await createVoidAuth(
-      request,
-      env,
-      runtime,
-      databaseOverride,
-      disposeOverride,
-    );
-
-    try {
-      const result = await auth.api.getSession({
-        headers: await sessionHeaders(request, auth),
-        asResponse: false,
-        returnHeaders: true,
-      });
+    const auth = await createVoidAuth(request, env, runtime, database);
+    const result = await auth.api.getSession({
+      headers: await sessionHeaders(request, auth),
+      asResponse: false,
+      returnHeaders: true,
+    });
 
-      return (result.response ?? null) as AuthState | null;
-    } finally {
-      await dispose();
-    }
+    return (result.response ?? null) as AuthState | null;
   }
 
   async function runVoidAuthMiddleware(
     c: Context,
     next: () => Promise<void>,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
+    database: AuthDatabase,
   ): Promise<void> {
     // Skip auth for internal routes (cron, queue, migration, binding proxy).
     // Still set user/session to null so downstream middleware that checks
@@ -517,66 +471,55 @@ export function createVoidAuthRuntime(
       return next();
     }
 
-    const { auth, dispose } = await createVoidAuth(
-      c.req.raw,
-      c.env as VoidAuthEnv,
-      runtime,
-      databaseOverride,
-      disposeOverride,
-    );
+    const auth = await createVoidAuth(c.req.raw, c.env as VoidAuthEnv, runtime, database);
     c.set('__voidAuth', auth);
 
-    try {
-      const result = await auth.api.getSession({
-        headers: await sessionHeaders(c.req.raw, auth),
-        asResponse: false,
-        returnHeaders: true,
-      });
-
-      const state = (result.response ?? null) as AuthState | null;
-      c.set('user', state?.user ?? null);
-      c.set('session', state?.session ?? null);
-
-      await authContext.run({ user: state?.user ?? null, state }, async () => {
-        await next();
-      });
-
-      const credentialed = ['cookie', 'authorization', 'cf-access-jwt-assertion'].some((header) =>
-        c.req.raw.headers.has(header),
-      );
-      appendAuthHeaders(
-        c,
-        result.headers,
-        state !== null || credentialed || result.headers?.has('set-cookie') === true,
-      );
-    } finally {
-      await dispose();
-    }
+    const result = await auth.api.getSession({
+      headers: await sessionHeaders(c.req.raw, auth),
+      asResponse: false,
+      returnHeaders: true,
+    });
+
+    const state = (result.response ?? null) as AuthState | null;
+    c.set('user', state?.user ?? null);
+    c.set('session', state?.session ?? null);
+
+    await authContext.run({ user: state?.user ?? null, state }, async () => {
+      await next();
+    });
+
+    const credentialed = ['cookie', 'authorization', 'cf-access-jwt-assertion'].some((header) =>
+      c.req.raw.headers.has(header),
+    );
+    appendAuthHeaders(
+      c,
+      result.headers,
+      state !== null || credentialed || result.headers?.has('set-cookie') === true,
+    );
   }
 
   async function handleVoidAuthRequest(
     c: Context,
     runtime: VoidAuthRuntimeOptions,
-    databaseOverride?: NonNullable<BetterAuthOptions['database']>,
-    disposeOverride?: () => Promise<void>,
+    database: AuthDatabase,
   ): Promise<Response> {
     const existingAuth = c.get('__voidAuth') as ReturnType<typeof betterAuth> | undefined;
     if (existingAuth) {
       return existingAuth.handler(c.req.raw);
     }
 
-    const { auth, dispose } = await createVoidAuth(
-      c.req.raw,
-      c.env as VoidAuthEnv,
-      runtime,
-      databaseOverride,
-      disposeOverride,
-    );
-    try {
-      return await auth.handler(c.req.raw);
-    } finally {
-      await dispose();
-    }
+    const auth = await createVoidAuth(c.req.raw, c.env as VoidAuthEnv, runtime, database);
+    return auth.handler(c.req.raw);
+  }
+
+  async function runVoidAuthMigrations(
+    env: VoidAuthEnv,
+    runtime: VoidAuthRuntimeOptions,
+    migrationSchema: VoidAuthMigrationSchema,
+  ): Promise<void> {
+    assertDialect(runtime.dialect);
+    assertDialect(migrationSchema.dialect);
+    await applyMigrations(env, migrationSchema);
   }
 
   return {
diff --git a/packages/void/src/runtime/better-auth.ts b/packages/void/src/runtime/better-auth.ts
index 2b9f8ffba..85b9c017c 100644
--- a/packages/void/src/runtime/better-auth.ts
+++ b/packages/void/src/runtime/better-auth.ts
@@ -1,62 +1,38 @@
+import type { VoidAuthMigrationSchema } from '../auth/drizzle.ts';
 import { applySqliteAuthMigrations } from './auth-migrations.ts';
 import {
-  assertRuntimeDialect,
   createVoidAuthRuntime,
-  type ResolvedDatabase,
   type VoidAuthEnv,
   type VoidAuthRuntimeApi,
 } from './better-auth-shared.ts';
 
-async function resolveDatabase(env: VoidAuthEnv): Promise<ResolvedDatabase> {
-  if (!env.DB) {
-    throw new Error('auth: Better Auth requires the "DB" D1 binding for sqlite apps.');
-  }
-  return {
-    // Auth must observe current revocations. Keep its first lookup on the
-    // primary, then preserve sequential consistency for the request.
-    database: env.DB.withSession('first-primary') as unknown as D1Database,
-    async dispose() {},
-  };
-}
-
-async function runSqliteAuthMigrations(
-  _request: Request,
+async function applyMigrations(
   env: VoidAuthEnv,
-  runtime: Parameters<VoidAuthRuntimeApi['runVoidAuthMigrations']>[2],
-  migrationSchema: Parameters<VoidAuthRuntimeApi['runVoidAuthMigrations']>[3],
+  migrationSchema: VoidAuthMigrationSchema,
 ): Promise<void> {
-  if (!migrationSchema) {
-    throw new Error('auth: Migration schema is unavailable.');
-  }
-  assertRuntimeDialect(runtime, 'sqlite');
-  if (migrationSchema.dialect !== 'sqlite') {
-    throw new Error(
-      `auth: Runtime mismatch. Expected sqlite, received '${migrationSchema.dialect}'.`,
-    );
-  }
-  if (!env.DB) {
+  const database = env.DB;
+  if (!database) {
     throw new Error('auth: Better Auth requires the "DB" D1 binding for sqlite apps.');
   }
 
   await applySqliteAuthMigrations(
     {
       async all<T extends Record<string, unknown>>(sql: string) {
-        const result = await env.DB!.prepare(sql).all();
+        const result = await database.prepare(sql).all();
         return (result.results ?? []) as Array<T>;
       },
       async run(sql: string) {
-        await env.DB!.prepare(sql).run();
+        await database.prepare(sql).run();
       },
     },
     migrationSchema,
   );
 }
 
-const runtime = createVoidAuthRuntime('sqlite', resolveDatabase, runSqliteAuthMigrations);
+const runtime = createVoidAuthRuntime('sqlite', applyMigrations);
 
 export const resolveVoidAuthOptions: VoidAuthRuntimeApi['resolveVoidAuthOptions'] =
   runtime.resolveVoidAuthOptions;
-export const createVoidAuth: VoidAuthRuntimeApi['createVoidAuth'] = runtime.createVoidAuth;
 export const resolveVoidAuthState: VoidAuthRuntimeApi['resolveVoidAuthState'] =
   runtime.resolveVoidAuthState;
 export const runVoidAuthMiddleware: VoidAuthRuntimeApi['runVoidAuthMiddleware'] =
@@ -65,5 +41,3 @@ export const handleVoidAuthRequest: VoidAuthRuntimeApi['handleVoidAuthRequest']
   runtime.handleVoidAuthRequest;
 export const runVoidAuthMigrations: VoidAuthRuntimeApi['runVoidAuthMigrations'] =
   runtime.runVoidAuthMigrations;
-
-export type { VoidAuthDialect, VoidAuthEnv, VoidAuthRuntimeOptions } from './better-auth-shared.ts';
diff --git a/packages/void/src/runtime/email-protocol.ts b/packages/void/src/runtime/email-protocol.ts
index e6a2e1333..3a4548462 100644
--- a/packages/void/src/runtime/email-protocol.ts
+++ b/packages/void/src/runtime/email-protocol.ts
@@ -21,54 +21,71 @@ type ReceiptVerifier = {
   fetch(input: string | Request, init?: RequestInit): Promise<Response>;
 };
 
-async function beforeDeadline<T>(deadline: number, run: () => Promise<T>): Promise<T> {
-  const remaining = deadline - Date.now();
-  if (remaining <= 0) {
-    throw new Error('email receipt verification timeout');
+/**
+ * Settle `run()` within `ms`, or reject with `onTimeout()`. `run` is not
+ * called when `ms` has already elapsed.
+ */
+export async function withTimeout<T>(
+  ms: number,
+  run: () => Promise<T>,
+  onTimeout: () => Error,
+): Promise<T> {
+  if (ms <= 0) {
+    throw onTimeout();
   }
   let timer: ReturnType<typeof setTimeout> | undefined;
-  return Promise.race([
-    run(),
-    new Promise<never>((_, reject) => {
-      timer = setTimeout(() => reject(new Error('email receipt verification timeout')), remaining);
-    }),
-  ]).finally(() => {
+  try {
+    return await Promise.race([
+      run(),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(onTimeout()), ms);
+      }),
+    ]);
+  } finally {
     if (timer !== undefined) {
       clearTimeout(timer);
     }
-  });
+  }
 }
 
-async function readResponseJson(response: Response, deadline: number): Promise<unknown> {
-  const declaredLength = response.headers.get('content-length');
+/**
+ * Read a JSON body of at most `maxBytes`, each read bounded by `race`. A
+ * declared length must be exact.
+ */
+export async function readBoundedJson(
+  response: Response,
+  maxBytes: number,
+  race: <T>(run: () => Promise<T>) => Promise<T>,
+  { rejectEncoding = false }: { rejectEncoding?: boolean } = {},
+): Promise<unknown> {
+  const declared = response.headers.get('content-length');
   if (
-    response.headers.has('content-encoding') ||
-    !response.body ||
-    (declaredLength !== null &&
-      (!/^\d+$/.test(declaredLength) || Number(declaredLength) > MAX_RECEIPT_VERIFICATION_BYTES))
+    (rejectEncoding && response.headers.has('content-encoding')) ||
+    (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > maxBytes))
   ) {
-    throw new Error('invalid email receipt verification response');
+    void response.body?.cancel().catch(() => {});
+    throw new Error('email response refused before reading');
+  }
+  const reader = response.body?.getReader();
+  if (!reader) {
+    throw new Error('email response is empty');
   }
-  const expectedLength = declaredLength === null ? null : Number(declaredLength);
-  const reader = response.body.getReader();
-  const bytes = new Uint8Array(MAX_RECEIPT_VERIFICATION_BYTES);
+  const bytes = new Uint8Array(maxBytes);
   let size = 0;
   try {
     for (;;) {
-      const chunk = await beforeDeadline(deadline, () => reader.read());
+      const chunk = await race(() => reader.read());
       if (chunk.done) {
         break;
       }
-      const nextSize = size + chunk.value.byteLength;
-      if (nextSize > bytes.byteLength) {
-        throw new Error('email receipt verification response too large');
+      if (size + chunk.value.byteLength > maxBytes) {
+        throw new Error('email response too large');
       }
       bytes.set(chunk.value, size);
-      size = nextSize;
+      size += chunk.value.byteLength;
     }
   } finally {
-    // An uncooperative stream may never settle cancellation. Start cleanup,
-    // but do not let it extend the hard request-and-response deadline.
+    // Do not await cancellation: an uncooperative stream may never settle it.
     void reader.cancel().catch(() => {});
     try {
       reader.releaseLock();
@@ -76,8 +93,8 @@ async function readResponseJson(response: Response, deadline: number): Promise<u
       // A timed-out read may still be settling after cancellation.
     }
   }
-  if (size === 0 || (expectedLength !== null && size !== expectedLength)) {
-    throw new Error('invalid email receipt verification response length');
+  if (declared !== null && size !== Number(declared)) {
+    throw new Error('email response length mismatch');
   }
   return JSON.parse(decoder.decode(bytes.subarray(0, size)));
 }
@@ -89,10 +106,12 @@ export async function verifyEmailReceiptThroughProxy(
   input: ReceiptVerificationInput,
 ): Promise<boolean> {
   const deadline = Date.now() + RECEIPT_VERIFICATION_DEADLINE_MS;
+  const beforeDeadline = <T>(run: () => Promise<T>): Promise<T> =>
+    withTimeout(deadline - Date.now(), run, () => new Error('email receipt verification timeout'));
   const controller = new AbortController();
   let response: Response | undefined;
   try {
-    response = await beforeDeadline(deadline, () =>
+    response = await beforeDeadline(() =>
       proxy.fetch('https://proxy/email/verify-receipt', {
         method: 'POST',
         headers: { 'content-type': 'application/json', 'x-void-internal': projectToken },
@@ -103,7 +122,9 @@ export async function verifyEmailReceiptThroughProxy(
     if (!response.ok) {
       return false;
     }
-    const body = await readResponseJson(response, deadline);
+    const body = await readBoundedJson(response, MAX_RECEIPT_VERIFICATION_BYTES, beforeDeadline, {
+      rejectEncoding: true,
+    });
     return (
       !!body &&
       typeof body === 'object' &&
diff --git a/packages/void/src/runtime/email.ts b/packages/void/src/runtime/email.ts
index aa171b72a..b69b203c1 100644
--- a/packages/void/src/runtime/email.ts
+++ b/packages/void/src/runtime/email.ts
@@ -1,25 +1,13 @@
-// void/email — outbound email via the platform proxy or a direct binding.
-//
-// On the managed platform, user worker code never holds a `send_email`
-// binding directly. The framework builds MIME locally, then POSTs to
-// `__VOID_PROXY/email/send`. The platform gateway enforces authoritative
-// project policy and quotas and records each provider submission's outcome.
-//
-// On the developer's own Cloudflare account (`void deploy --platform
-// cloudflare`) there is no proxy: the deploy provisions a `send_email`
-// binding named `SEND_EMAIL` on the worker itself and the same MIME goes
-// straight through `cloudflare:email`, one `EmailMessage` per recipient.
-// Transports are tried in order: dev inbox, `SEND_EMAIL`, `__VOID_PROXY`.
-//
-// In `void dev` (no `__VOID_PROXY`) sends are captured by the dev inbox;
-// pass `sendInDev: true` for a single call to bypass. The dev inbox buffer
-// lives in the Vite dev server's NODE process while this code runs in
-// workerd, so the capture is an explicit HTTP hop over the dev assets
-// binding — see `resolveDevInbox` below and `plugin-email-dev-inbox.ts`.
+// void/email — outbound email. MIME is built here, then sent through the
+// first available transport: the `void dev` inbox, the worker's own
+// `SEND_EMAIL` binding (`void deploy --platform cloudflare`, one
+// `EmailMessage` per recipient), or the Void platform proxy, which enforces
+// project policy and quotas.
 
 import { isRecord } from '@void/deploy-core';
+import { bytesToBase64 } from './base64.ts';
+import { readBoundedJson, withTimeout } from './email-protocol.ts';
 import {
-  bytesToBase64,
   captureMessage,
   DEV_INBOX_ACK_HEADER,
   DEV_INBOX_ACK_VALUE,
@@ -32,8 +20,13 @@ import {
   serializeCapturedMessage,
   type CapturedMessage,
 } from './email/dev-inbox.ts';
-import { bytesToReadableStream } from './email/inbound.ts';
-import { buildMime, MimeError, normalizeEmail } from './email/mime.ts';
+import {
+  bytesToReadableStream,
+  readEnvString,
+  readProjectSlug,
+  tryGetRawRuntimeEnv,
+} from './email/inbound.ts';
+import { buildMime, MimeError, newId, normalizeEmail } from './email/mime.ts';
 import type {
   EmailDeliveryState,
   NormalizedEmail,
@@ -44,7 +37,6 @@ import type {
   SendEmailRecipientResult,
   SendEmailResult,
 } from './email/types.ts';
-import { getRawRuntimeEnv } from './env-raw.ts';
 
 export type {
   Address,
@@ -79,74 +71,14 @@ export type {
   ReplyEmailOptions,
 } from './email/inbound.ts';
 
-// `createEmail` below throws `MimeError`, and `sendEmail` reports its `code`.
-// The barrel is the only supported entry point (`package.json` exposes
-// `./email` and `./email/testing`, with no wildcard subpath), so the error
-// classes have to ship with the functions that throw them.
+// `createEmail` throws `MimeError`; export it with the functions that throw it.
 export { MimeError } from './email/mime.ts';
 export type { MimeErrorCode } from './email/mime.ts';
 
-// Slug shape we'll accept when substituting into the default `from`. The
-// platform owns slug allocation and validates at create-time, but we don't
-// trust the value blindly — a slug containing `@`, `+`, or whitespace
-// would corrupt the resulting address. RFC 5321/2 atom char-class
-// restricted further to lowercase + digits + hyphen, matching the typical
-// project-slug shape.
-//
-// Length cap: 56 chars. The default `from` we build is
-// `<slug>+noreply@<__VOID_EMAIL_DOMAIN>`; the SMTP local-part limit
-// (RFC 5321 § 4.5.3.1.1) is 64 octets, and `+noreply` already eats 8.
-// Capping the slug at `64 - 8 = 56` keeps the assembled local-part
-// within spec. The cap is domain-independent — only the local-part is
-// bounded here.
-const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
-
 function makeError(code: SendEmailErrorCode, message: string, cause?: unknown): SendEmailError {
   return cause === undefined ? { code, message } : { code, message, cause };
 }
 
-// `getRawRuntimeEnv()` throws outside a worker/SSR context. `sendEmail` needs
-// graceful degradation in those settings (local Node tools, tests), so resolve
-// once via this helper.
-function tryGetRawRuntimeEnv(): Record<string, unknown> | undefined {
-  try {
-    return getRawRuntimeEnv();
-  } catch {
-    return undefined;
-  }
-}
-
-function readProjectSlug(): string | undefined {
-  const raw = tryGetRawRuntimeEnv()?.__VOID_PROJECT_SLUG;
-  if (typeof raw !== 'string' || raw.length === 0) {
-    return undefined;
-  }
-  // Defense-in-depth: refuse to substitute an obviously malformed slug
-  // into the address. Returning undefined causes the caller to surface
-  // `INVALID_FROM` rather than build a corrupt envelope.
-  return VALID_SLUG.test(raw) ? raw : undefined;
-}
-
-// The platform mail domain for this environment (production uses
-// `mail.example.com`, staging its own zone). It is injected per
-// deployment rather than baked in, so a staging send is not rejected by
-// the proxy's sender check. There is deliberately no built-in default:
-// silently falling back to the production zone is the bug this binding
-// exists to prevent.
-function readEmailDomain(): string | undefined {
-  const raw = tryGetRawRuntimeEnv()?.__VOID_EMAIL_DOMAIN;
-  return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
-}
-
-// The project's own default sender, written into the worker's `vars` by
-// `void deploy --platform cloudflare` from `email.from` in void.config.ts. It is a
-// full address on a zone the developer owns, so there is no slug to
-// substitute; `normalizeEmail` validates it like any explicit `from`.
-function readEmailFrom(): string | undefined {
-  const raw = tryGetRawRuntimeEnv()?.__VOID_EMAIL_FROM;
-  return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
-}
-
 interface ProxyEnv {
   __VOID_PROXY?: { fetch(req: Request | string, init?: RequestInit): Promise<Response> };
   __VOID_PROXY_TOKEN?: string;
@@ -166,33 +98,6 @@ class EmailBindingTimeoutError extends Error {
   }
 }
 
-function createBindingSendDeadline() {
-  const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
-  return {
-    expired: () => Date.now() >= deadline,
-    async run<T>(submit: () => Promise<T>): Promise<T> {
-      const remaining = Math.min(EMAIL_PROVIDER_DEADLINE_MS, deadline - Date.now());
-      if (remaining <= 0) {
-        throw new EmailBindingTimeoutError();
-      }
-      const work = submit();
-      let timer: ReturnType<typeof setTimeout> | undefined;
-      try {
-        return await Promise.race([
-          work,
-          new Promise<never>((_, reject) => {
-            timer = setTimeout(() => reject(new EmailBindingTimeoutError()), remaining);
-          }),
-        ]);
-      } finally {
-        if (timer !== undefined) {
-          clearTimeout(timer);
-        }
-      }
-    },
-  };
-}
-
 // The legacy `EmailMessage` overload of `SendEmail.send`. Only `messageId`
 // is read, and defensively: some builds have returned nothing.
 interface SendEmailBinding {
@@ -212,15 +117,10 @@ function resolveSendEmailBinding(
 }
 
 /**
- * Map an error thrown by the `send_email` binding to a framework code.
- *
- * Email Service throws `Error`s carrying a `code` (the `E_*` table in
- * Cloudflare's Workers API reference); the older Email Routing sender
- * throws message-only errors, so the destination-verification phrasing the
- * platform proxy already keys on is kept as a fallback. Anything else is
- * `OUTCOME_UNKNOWN` with the original error as `cause`: once `send()` has
- * started, an undocumented rejection does not prove the provider declined
- * the message before accepting it.
+ * Map a `send_email` binding error to a framework code: Email Service `E_*`
+ * codes, then the older Email Routing message. Anything else is
+ * `OUTCOME_UNKNOWN`: once `send()` started, a rejection does not prove the
+ * provider declined the message.
  */
 function classifyBindingError(e: unknown): SendEmailError {
   const message = e instanceof Error ? e.message : String(e);
@@ -251,11 +151,9 @@ const UNVERIFIED_DESTINATION_RE =
   /^[^\n]{0,200}destination address[^\n]{0,200}not (?:yet )?verified/i;
 
 /**
- * Deliver through the worker's own `SEND_EMAIL` binding. One `EmailMessage`
- * per recipient, within one bounded batch, and the same `deliveries` shape
- * the proxy returns so a caller can inspect each attempted or cancelled
- * outcome in either mode. The stream is rebuilt per send because a
- * `ReadableStream` is one-shot.
+ * Send one `EmailMessage` per recipient through the worker's own binding,
+ * within one bounded batch, reporting `deliveries` as the proxy does. The
+ * stream is rebuilt per send: a `ReadableStream` is one-shot.
  */
 async function sendViaBinding(
   binding: SendEmailBinding,
@@ -275,10 +173,11 @@ async function sendViaBinding(
     );
   }
   const deliveries: Array<SendEmailRecipientResult> = [];
-  const deadline = createBindingSendDeadline();
+  const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
+  const remaining = () => Math.min(EMAIL_PROVIDER_DEADLINE_MS, deadline - Date.now());
   for (let index = 0; index < recipients.length; index++) {
     const recipient = recipients[index];
-    if (deadline.expired()) {
+    if (remaining() <= 0) {
       for (const unstarted of recipients.slice(index)) {
         deliveries.push({
           recipient: unstarted,
@@ -293,8 +192,10 @@ async function sendViaBinding(
       break;
     }
     try {
-      const result = await deadline.run(() =>
-        binding.send(new EmailMessage(from, recipient, bytesToReadableStream(raw))),
+      const result = await withTimeout(
+        remaining(),
+        () => binding.send(new EmailMessage(from, recipient, bytesToReadableStream(raw))),
+        () => new EmailBindingTimeoutError(),
       );
       const mid = typeof result?.messageId === 'string' ? result.messageId : '';
       deliveries.push({ recipient, ok: true, messageId: mid || fallbackId });
@@ -328,10 +229,8 @@ async function sendViaBinding(
 }
 
 /**
- * Dedup recipients by lowercased email (CF won't collapse duplicate
- * envelopes for us, and double-billing the quota for the same recipient
- * is worse than the rare case where a user actually wanted Cc + Bcc to
- * the same address — which doesn't change delivery semantics anyway).
+ * Recipients deduplicated by lowercased address: Cloudflare does not
+ * collapse duplicate envelopes, and each one costs quota.
  */
 function uniqueRecipients(normalized: NormalizedEmail): Array<string> {
   const seen = new Set<string>();
@@ -347,22 +246,10 @@ function uniqueRecipients(normalized: NormalizedEmail): Array<string> {
   return recipients;
 }
 
-function newRequestId(): string {
-  const bytes = new Uint8Array(8);
-  crypto.getRandomValues(bytes);
-  let hex = '';
-  for (const b of bytes) {
-    hex += b.toString(16).padStart(2, '0');
-  }
-  return `req_${Date.now().toString(36)}${hex}`;
-}
-
 function resolveDefaultFrom(opts: SendEmailOptions): SendEmailOptions {
   const supplied = opts.from;
-  // Treat literal `null` the same as undefined here. Passing `null`
-  // through to `normalizeEmail` makes `parseAddress` throw a TypeError
-  // that gets surfaced as the opaque MIME_ERROR code; callers expect
-  // INVALID_FROM for "from is missing/empty".
+  // `null` counts as missing: `parseAddress` would throw a TypeError,
+  // reported as MIME_ERROR rather than INVALID_FROM.
   const isEmpty =
     supplied === undefined ||
     supplied === null ||
@@ -371,18 +258,16 @@ function resolveDefaultFrom(opts: SendEmailOptions): SendEmailOptions {
   if (!isEmpty) {
     return opts;
   }
-  // `__VOID_EMAIL_FROM` (own-account deploys) wins over the platform's
-  // `<slug>+noreply@<domain>`: a project that carries both is one whose
-  // void.config.ts names a sender on purpose.
-  const configured = readEmailFrom();
+  // `__VOID_EMAIL_FROM` (`email.from` in void.config.ts) wins over the
+  // platform's `<slug>+noreply@<domain>`: it names a sender on purpose.
+  const configured = readEnvString('__VOID_EMAIL_FROM');
   if (configured) {
     return { ...opts, from: configured };
   }
   const slug = readProjectSlug();
-  const domain = readEmailDomain();
+  const domain = readEnvString('__VOID_EMAIL_DOMAIN');
   if (!slug || !domain) {
-    // Strip the empty value so the downstream `from === undefined` check
-    // surfaces a clean INVALID_FROM rather than passing `null` along.
+    // Drop `null` so the caller reports a clean INVALID_FROM.
     if (supplied === null) {
       const next = { ...opts };
       delete (next as { from?: unknown }).from;
@@ -430,11 +315,9 @@ function coerceErrorCode(code: unknown): SendEmailErrorCode {
 }
 
 /**
- * The text of a refusal the proxy's middleware sent instead of a send
- * response: `{ error: string, message?: string }`. `message` is the
- * sentence written for a person (the capability gate's "This Void platform
- * does not enable email."); `error` is the short code every such refusal
- * carries. `null` when the body is not that shape.
+ * Text of the `{ error, message? }` refusal the proxy's middleware sends
+ * ahead of the email handler, preferring the human `message`; `null` for any
+ * other shape.
  */
 function readProxyRefusal(body: unknown): string | null {
   if (typeof body !== 'object' || body === null || Array.isArray(body)) {
@@ -479,10 +362,9 @@ function readProxyResponse(value: unknown): ProxyResponse | null {
 type RecipientListRead<T> = { ok: true; entries: Array<T> } | { ok: false; reason: string };
 
 /**
- * Require exactly one valid outcome per requested recipient in either list
- * shape. A missing, duplicate, or foreign entry makes the whole result unknown;
- * trimming it could hide a submission. Order is not part of the contract.
- * Diagnostics identify entries by index rather than echoing corrupt addresses.
+ * Require exactly one valid outcome per requested recipient, in any order. A
+ * missing, duplicate or foreign entry makes the whole result unknown, since
+ * trimming it could hide a submission. Diagnostics name entries by index.
  */
 function readRecipientList<T>(
   raw: Array<unknown>,
@@ -519,11 +401,8 @@ function readRecipientList<T>(
 }
 
 /**
- * The `ids` list of an `ok: true` response. The proxy answers `ok: true` only
- * after every requested recipient has an accepted provider outcome. Each entry
- * is `{ recipient, messageId }`; the framework's own Message-ID stands in for
- * an empty provider reference. A missing delivery would leave no safe retry
- * decision, so the whole response is rejected as malformed.
+ * The `ids` of an `ok: true` response, one accepted outcome per recipient.
+ * The framework's Message-ID stands in for an empty provider reference.
  */
 function readDeliveryList(
   raw: Array<unknown>,
@@ -603,162 +482,63 @@ function readDeliveryState(value: unknown): EmailDeliveryState | undefined {
 
 const MAX_PROXY_RESPONSE_BYTES = 64 * 1024;
 
-function createPlatformSendDeadline(): {
-  signal: AbortSignal;
-  beforeDeadline: <T>(run: () => Promise<T>) => Promise<T>;
-} {
-  const controller = new AbortController();
-  const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
-  return {
-    signal: controller.signal,
-    async beforeDeadline<T>(run: () => Promise<T>): Promise<T> {
-      const remaining = deadline - Date.now();
-      if (remaining <= 0) {
-        controller.abort();
-        throw new Error('email platform send timed out');
-      }
-      const promise = run();
-      let timer: ReturnType<typeof setTimeout> | undefined;
-      try {
-        return await Promise.race([
-          promise,
-          new Promise<never>((_, reject) => {
-            timer = setTimeout(() => {
-              controller.abort();
-              reject(new Error('email platform send timed out'));
-            }, remaining);
-          }),
-        ]);
-      } finally {
-        if (timer !== undefined) {
-          clearTimeout(timer);
-        }
-      }
-    },
-  };
-}
-
-async function readBoundedProxyJson(
-  response: Response,
-  beforeDeadline: <T>(run: () => Promise<T>) => Promise<T>,
-): Promise<unknown> {
-  const declared = response.headers.get('content-length');
-  if (
-    declared !== null &&
-    (!/^\d+$/.test(declared) || Number(declared) > MAX_PROXY_RESPONSE_BYTES)
-  ) {
-    void response.body?.cancel().catch(() => {});
-    throw new Error('email proxy response too large');
-  }
-  const reader = response.body?.getReader();
-  if (!reader) {
-    throw new Error('email proxy response is empty');
-  }
-  const bytes = new Uint8Array(MAX_PROXY_RESPONSE_BYTES);
-  let size = 0;
-  try {
-    for (;;) {
-      const chunk = await beforeDeadline(() => reader.read());
-      if (chunk.done) {
-        break;
-      }
-      if (size + chunk.value.byteLength > bytes.byteLength) {
-        throw new Error('email proxy response too large');
-      }
-      bytes.set(chunk.value, size);
-      size += chunk.value.byteLength;
-    }
-    if (declared !== null && size !== Number(declared)) {
-      throw new Error('email proxy response length mismatch');
-    }
-    return JSON.parse(
-      new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes.subarray(0, size)),
-    ) as unknown;
-  } finally {
-    void reader.cancel().catch(() => {});
-    try {
-      reader.releaseLock();
-    } catch {
-      // A timed-out read may still be settling after cancellation.
-    }
-  }
-}
-
 async function readResponseAsResult(
   res: Response,
   recipients: ReadonlyArray<string>,
   fallbackId: string,
   beforeDeadline: <T>(run: () => Promise<T>) => Promise<T>,
 ): Promise<SendEmailResult> {
+  let body: unknown;
   try {
-    let body: unknown;
-    try {
-      body = await readBoundedProxyJson(res, beforeDeadline);
-    } catch {
-      return err(
-        'OUTCOME_UNKNOWN',
-        `email: could not establish the send outcome (status ${res.status}); check email logs or repeat the same idempotency key`,
-      );
-    }
-    const response = readProxyResponse(body);
-    if (response === null) {
-      // The proxy's own middleware — auth, platform lifecycle, capability
-      // gates — answers ahead of the email handler with a flat
-      // `{ error: string, message?: string }` and a non-2xx status. That
-      // is a well-formed refusal, not a malformed send response, so carry
-      // its text through the way the handler's `{ ok: false, error }` is
-      // carried above; a platform without the email module otherwise reads
-      // as "malformed response (status 501)" with the reason buried in
-      // `cause`.
-      const refusal = readProxyRefusal(body);
-      if (!res.ok && refusal !== null) {
-        return err('UPSTREAM_ERROR', `email: proxy returned ${res.status}: ${refusal}`, body);
-      }
-      return err(
-        'OUTCOME_UNKNOWN',
-        `email: proxy returned malformed response (status ${res.status})`,
-        body,
-      );
-    }
-    // Both list-bearing shapes are validated as a whole against the
-    // recipients this send asked for; their entries remain unknown until
-    // the whole list passes validation.
-    const malformedList = (reason: string): SendEmailResult =>
-      err(
-        'OUTCOME_UNKNOWN',
-        `email: proxy returned a malformed delivery list (${reason}); do not retry with a new idempotency key`,
-        body,
-      );
-    const operation =
-      typeof response.operationId === 'string' && response.operationId.length <= 128
-        ? { operationId: response.operationId }
-        : {};
-    if (response.ok === true) {
-      const list = readDeliveryList(response.ids, recipients, fallbackId);
-      return list.ok ? { ok: true, ids: list.entries, ...operation } : malformedList(list.reason);
-    }
-    if ('deliveries' in response) {
-      const list = readFailureDeliveries(response.deliveries, recipients, fallbackId);
-      return list.ok
-        ? { ok: false, deliveries: list.entries, ...operation }
-        : malformedList(list.reason);
+    body = await readBoundedJson(res, MAX_PROXY_RESPONSE_BYTES, beforeDeadline);
+  } catch {
+    return err(
+      'OUTCOME_UNKNOWN',
+      `email: could not establish the send outcome (status ${res.status}); check email logs or repeat the same idempotency key`,
+    );
+  }
+  const response = readProxyResponse(body);
+  if (response === null) {
+    // A `{ error, message? }` refusal from the proxy's middleware is
+    // well-formed: report its text.
+    const refusal = readProxyRefusal(body);
+    if (!res.ok && refusal !== null) {
+      return err('UPSTREAM_ERROR', `email: proxy returned ${res.status}: ${refusal}`, body);
     }
-    const e = response.error;
-    return {
-      ...err(
-        coerceErrorCode(e.code),
-        typeof e.message === 'string' ? e.message : 'email: upstream send failed',
-      ),
-      ...operation,
-    };
-  } catch (e) {
-    // Parsing failures must not imply that no provider submission occurred.
     return err(
       'OUTCOME_UNKNOWN',
-      `email: failed to parse proxy response (status ${res.status}): ${e instanceof Error ? e.message : String(e)}`,
-      e,
+      `email: proxy returned malformed response (status ${res.status})`,
+      body,
     );
   }
+  const malformedList = (reason: string): SendEmailResult =>
+    err(
+      'OUTCOME_UNKNOWN',
+      `email: proxy returned a malformed delivery list (${reason}); do not retry with a new idempotency key`,
+      body,
+    );
+  const operation =
+    typeof response.operationId === 'string' && response.operationId.length <= 128
+      ? { operationId: response.operationId }
+      : {};
+  if (response.ok === true) {
+    const list = readDeliveryList(response.ids, recipients, fallbackId);
+    return list.ok ? { ok: true, ids: list.entries, ...operation } : malformedList(list.reason);
+  }
+  if ('deliveries' in response) {
+    const list = readFailureDeliveries(response.deliveries, recipients, fallbackId);
+    return list.ok
+      ? { ok: false, deliveries: list.entries, ...operation }
+      : malformedList(list.reason);
+  }
+  const e = response.error;
+  return {
+    ...err(
+      coerceErrorCode(e.code),
+      typeof e.message === 'string' ? e.message : 'email: upstream send failed',
+    ),
+    ...operation,
+  };
 }
 
 interface DevInboxFetcher {
@@ -768,23 +548,16 @@ interface DevInboxFetcher {
 interface DevInbox {
   fetcher: DevInboxFetcher;
   /**
-   * The dev-trigger token the inbox middleware requires. Injected under the
-   * same gate as the binding var; when it is somehow absent the POST still
-   * goes out and the dev server's 401 is reported verbatim — the inbox is
-   * never skipped in favour of a real send transport.
+   * Dev-trigger token. When absent the POST still goes out and the 401 is
+   * reported; the inbox is never skipped for a real transport.
    */
   token: string | undefined;
 }
 
 /**
- * Resolve the loopback into the `void dev` inbox, or `undefined` outside dev.
- *
- * `DEV_INBOX_ENV_VAR` is injected only when `viteCommand === 'serve'` and it
- * names the worker's assets binding. In dev, `@cloudflare/vite-plugin` binds
- * that name to a miniflare service whose implementation is the Vite dev
- * server's Node middleware stack, so a fetch through it lands on the inbox
- * middleware in the dev-server process — the only place the buffer exists.
- * In a production build neither the var nor that wiring is present.
+ * The loopback into the `void dev` inbox: `DEV_INBOX_ENV_VAR` names the
+ * assets binding, which in dev reaches the Vite dev server. Undefined
+ * outside dev.
  */
 function resolveDevInbox(env: Record<string, unknown> | undefined): DevInbox | undefined {
   const bindingName = env?.[DEV_INBOX_ENV_VAR];
@@ -814,10 +587,8 @@ const DEV_INBOX_ERROR_EXCERPT_CHARS = 200;
 const DEV_INBOX_ERROR_EXCERPT_TIMEOUT_MS = 1000;
 
 /**
- * First line of a refusal, so a 401 names the header it wanted. Reads ONE
- * chunk under its own deadline: the main 5s race has already settled by the
- * time the status is known, and a body that never arrives must not turn a
- * clean error into a hung `sendEmail`.
+ * First line of a refusal, so a 401 names the header it wanted. One chunk
+ * under its own deadline: a stalled body must not hang `sendEmail`.
  */
 async function readErrorExcerpt(res: Response): Promise<string> {
   let timer: ReturnType<typeof setTimeout> | undefined;
@@ -884,8 +655,6 @@ async function postToDevInbox(
     }
     const { res } = settled;
     if (!res.ok) {
-      // A 401 names the header it wanted; surface that instead of a bare
-      // status so a missing token is diagnosable from the worker's console.
       const excerpt = await readErrorExcerpt(res);
       return {
         ok: false,
@@ -907,24 +676,11 @@ async function postToDevInbox(
   }
 }
 
-/**
- * Shared result shape for both capture paths (in-process sink and dev inbox).
- *
- * `ids` is built from the same deduplicated, lowercased list the two
- * production transports send to, so code written against a captured result
- * sees exactly what a deploy returns: one entry per unique address, keyed the
- * way `sendViaBinding` and the proxy report it. The captured message itself
- * keeps the original fields; the inbox displays what was asked for, the
- * result reports what would be sent.
- */
+/** A captured send's result: one id per unique recipient, as a deployed send reports. */
 function capturedResult(normalized: NormalizedEmail, captureId: string): SendEmailResult {
-  const recipients = uniqueRecipients(normalized);
-  if (recipients.length === 0) {
-    return err('INVALID_TO', "email: 'to' must include at least one recipient.");
-  }
   return {
     ok: true,
-    ids: recipients.map((recipient) => ({ recipient, messageId: captureId })),
+    ids: uniqueRecipients(normalized).map((recipient) => ({ recipient, messageId: captureId })),
   };
 }
 
@@ -962,21 +718,11 @@ export async function sendEmail(opts: SendEmailOptions): Promise<SendEmailResult
   };
 
   let normalized: NormalizedEmail;
-  try {
-    normalized = await normalizeEmail(optsWithFrom);
-  } catch (e) {
-    if (e instanceof MimeError) {
-      return err(e.code, e.message, e);
-    }
-    return err('MIME_ERROR', e instanceof Error ? e.message : String(e), e);
-  }
-
   let raw: Uint8Array;
   let messageId: string;
   try {
-    const built = buildMime(normalized);
-    raw = built.raw;
-    messageId = built.messageId;
+    normalized = await normalizeEmail(optsWithFrom);
+    ({ raw, messageId } = buildMime(normalized));
   } catch (e) {
     if (e instanceof MimeError) {
       return err(e.code, e.message, e);
@@ -986,10 +732,8 @@ export async function sendEmail(opts: SendEmailOptions): Promise<SendEmailResult
 
   const rawEnv = tryGetRawRuntimeEnv();
 
-  // Each sink owns its storage; sendEmail must NOT also push to the dev
-  // buffer or every dev send ends up captured twice. This path only fires
-  // for a send that runs in the SAME isolate as the sink — the test harness,
-  // or a prerender pass inside the dev server's own process.
+  // A sink in this isolate (`createEmailTestHarness`) owns the capture; do
+  // not also post it to the dev inbox.
   if (!opts.sendInDev && hasActiveSink()) {
     const captured = captureMessage(normalized, raw, messageId);
     dispatchToSinks(captured);
@@ -1011,9 +755,6 @@ export async function sendEmail(opts: SendEmailOptions): Promise<SendEmailResult
   }
 
   const recipients = uniqueRecipients(normalized);
-  if (recipients.length === 0) {
-    return err('INVALID_TO', "email: 'to' must include at least one recipient.");
-  }
 
   // Own-account deploy: the worker holds the binding itself, so there is no
   // proxy hop and no platform quota — Cloudflare's own limits apply.
@@ -1043,27 +784,32 @@ export async function sendEmail(opts: SendEmailOptions): Promise<SendEmailResult
     );
   }
 
-  const requestId = newRequestId();
   const body: ProxySendBody = {
     projectId,
     aiToken: proxyToken,
     from: normalized.from.email,
     recipients,
     mimeBase64: bytesToBase64(raw),
-    requestId,
+    requestId: newId('req'),
     ...(opts.idempotencyKey === undefined ? {} : { idempotencyKey: opts.idempotencyKey }),
   };
 
   const requestBody = JSON.stringify(body);
-  const deadline = createPlatformSendDeadline();
+  const controller = new AbortController();
+  const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
+  const beforeDeadline = <T>(run: () => Promise<T>): Promise<T> =>
+    withTimeout(deadline - Date.now(), run, () => {
+      controller.abort();
+      return new Error('email platform send timed out');
+    });
   let res: Response;
   try {
-    res = await deadline.beforeDeadline(() =>
+    res = await beforeDeadline(() =>
       proxy.fetch('https://email-proxy/email/send', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: requestBody,
-        signal: deadline.signal,
+        signal: controller.signal,
       }),
     );
   } catch (e) {
@@ -1073,7 +819,7 @@ export async function sendEmail(opts: SendEmailOptions): Promise<SendEmailResult
       e,
     );
   }
-  return readResponseAsResult(res, recipients, messageId, deadline.beforeDeadline);
+  return readResponseAsResult(res, recipients, messageId, beforeDeadline);
 }
 
 /**
diff --git a/packages/void/src/runtime/email/dev-inbox.ts b/packages/void/src/runtime/email/dev-inbox.ts
index 309900a57..2e7699c7b 100644
--- a/packages/void/src/runtime/email/dev-inbox.ts
+++ b/packages/void/src/runtime/email/dev-inbox.ts
@@ -1,28 +1,13 @@
 /**
- * In-memory capture sink for emails during local dev / tests.
- *
- * Two consumers:
- *   1. The Vite dev-server middleware (`/__void/inbox`) — owns the buffer that
- *      backs the browsable inbox during `void dev`.
- *   2. The test harness (`void/email/testing`) — registers a sink so
- *      assertions like `expect(harness.messages).toHaveLength(1)` work without
- *      mocking the SEND_EMAIL binding.
- *
- * The sink registry lives on globalThis, but it is only ever an IN-ISOLATE
- * channel. It is NOT a bridge between the dev server and user code: under
- * `void dev` the Vite plugin runs in Node while user code runs in workerd — a
- * separate OS process started by miniflare — so each has its own globalThis and
- * its own (empty) registry. A `sendEmail` call inside the worker therefore
- * never sees the plugin's sink.
- *
- * The cross-process hop is explicit instead: the worker POSTs the captured
- * message to {@link DEV_INBOX_CAPTURE_URL} through its dev assets binding
- * (which `@cloudflare/vite-plugin` wires straight into the Vite dev server's
- * Node middleware stack), and the plugin's middleware pushes it into the
- * buffer. See `runtime/email.ts` and `plugin-email-dev-inbox.ts`.
+ * In-memory email capture for `void dev` and tests. The inbox buffer lives in
+ * the Vite dev server's Node process; `sendEmail` runs in workerd, a separate
+ * process, so it POSTs each capture to {@link DEV_INBOX_CAPTURE_URL} over the
+ * dev assets binding. The sink registry serves only sends in the same
+ * isolate, such as `createEmailTestHarness`.
  */
 
-import { MAX_MESSAGE_BYTES } from './mime.ts';
+import { base64ToBytes, bytesToBase64 } from '../base64.ts';
+import { MAX_MESSAGE_BYTES, newId } from './mime.ts';
 import type { NormalizedEmail, NormalizedAttachment } from './types.ts';
 
 export interface CapturedMessage {
@@ -62,101 +47,39 @@ export const DEV_INBOX_CAPTURE_PATH: string = '/_capture';
 export const DEV_INBOX_CAPTURE_URL: string = `${DEV_INBOX_PREFIX}${DEV_INBOX_CAPTURE_PATH}`;
 
 /**
- * Serve-only var naming the fetcher binding that loops back to the Vite dev
- * server. Its presence is also the dev gate: `sendEmail` only attempts the dev
- * inbox when this var is set, and it is injected exclusively when
- * `viteCommand === 'serve'` (see `shouldInjectEmailDevInboxVar` in index.ts),
- * so a production build never carries it.
+ * Serve-only var naming the binding that loops back to the Vite dev server.
+ * Its presence is the dev gate (`shouldInjectEmailDevInboxVar` in index.ts).
  */
 export const DEV_INBOX_ENV_VAR: string = '__VOID_EMAIL_DEV_INBOX';
 
 /**
- * Serve-only var carrying the project's dev-trigger token — the same
- * per-project secret `/__void/scheduled` and `/__void/queue` require — so the
- * worker can authenticate its capture POST. Injected together with
- * {@link DEV_INBOX_ENV_VAR} under the same gate. The compiled router embeds
- * the token as a module-local const the `void/email` runtime cannot import,
- * so a var is the only transport into `sendEmail`.
+ * Serve-only var carrying the dev-trigger token for the capture POST: the
+ * router's token const is not importable from `void/email`.
  */
 export const DEV_INBOX_TOKEN_ENV_VAR: string = '__VOID_EMAIL_DEV_INBOX_TOKEN';
 
 /**
- * How a caller proves it holds the dev-trigger token. Every `/__void/inbox`
- * route — browse, raw download, clear, and the worker's capture POST —
- * requires one of these, mirroring the `x-void-dev-trigger` check on the
- * cron/queue dev routes. The query form exists for the browser: a link
- * printed in the terminal cannot carry a header, and the inbox pages render
- * their own links with it. Responses send `Referrer-Policy: no-referrer`, so
- * the token never leaves the inbox through a Referer.
+ * Every inbox route requires the dev-trigger token, as this header or, for
+ * browser links, this query parameter.
  */
 export const DEV_INBOX_TOKEN_HEADER: string = 'x-void-dev-trigger';
 export const DEV_INBOX_TOKEN_QUERY: string = 'token';
 
 /**
- * Acknowledgement marker on the capture response. The transport rides the
- * assets binding, so a 200 alone proves nothing — if that binding ever stops
- * being a dev-server loopback, a plain static/SPA response would also be 200.
- * The worker treats a capture as delivered only when this header comes back.
+ * Marks a capture response: over the assets binding, a plain 200 could also
+ * be a static asset.
  */
 export const DEV_INBOX_ACK_HEADER: string = 'x-void-email-inbox';
 export const DEV_INBOX_ACK_VALUE: string = 'captured';
 
 /**
- * Upper bound on a capture body. Dev-only, but an unbounded read is still a
- * footgun.
- *
- * Derived from `MAX_MESSAGE_BYTES`, not chosen: a message `buildMime` accepts
- * must never be refused here, or `void dev` fails a send that production
- * delivers. `serializeCapturedMessage` carries the raw MIME as base64 (4/3 of
- * its octets) AND every caller string a second time as JSON, where the
- * expansion over the MIME rendering of the same string is at most 3.75x. That
- * worst case is a control character in a value `encodeWord` renders — the
- * subject, a display name, a custom header value: JSON writes it as `\u0001`
- * (6 bytes) while the encoded-word spends at least 1.6 octets per UTF-8 byte
- * (4/3 of base64 plus 12 octets of `=?UTF-8?B?…?=` per 45-byte word). A body
- * expands at most 2x: the same control is `=01` (3) in quoted-printable, a
- * CRLF (2) is `\r\n` (4), and a `"`, `\` or HTAB (1) is 2. An attachment's
- * filename, media type and Content-ID refuse controls (`rejectControls`), so
- * their worst is `"` or `\` at 2x (verbatim in the media type and Content-ID;
- * escaped, and twice, in the quoted filename), as is a custom header NAME,
- * which is printable ASCII. The MIME holds at most
- * `MAX_MESSAGE_BYTES` of those strings, so the JSON is under
- * `(4/3 + 3.75) * MAX_MESSAGE_BYTES` (5.09x) plus what has no MIME footprint of
- * its own — the JSON framing, ids, timestamps, and the `bcc` addresses
- * (`MAX_RECIPIENTS * MAX_ADDRESS_LENGTH`, 32 KB). 6x is the smallest integer
- * multiple that covers it.
- *
- * Three caller strings have NO MIME footprint, so no multiple of
- * `MAX_MESSAGE_BYTES` bounds them: a `bcc` display name (never rendered), a
- * custom header whose name is reserved (dropped), and a whitespace run inside
- * a long foldable header value (collapsed by folding). They are captured as
- * given, and a message that pads one of them past this cap is still refused.
+ * Capture body cap. 6x covers the base64 MIME plus the JSON copy of every
+ * rendered caller string for a max-size message. Strings with no MIME
+ * footprint (a bcc name, a reserved header, folded-away whitespace) are not
+ * bounded by it, so a message padded with them is still refused.
  */
 export const DEV_INBOX_MAX_CAPTURE_BYTES: number = 6 * MAX_MESSAGE_BYTES;
 
-export function bytesToBase64(bytes: Uint8Array): string {
-  // 8KB chunks keep us well under the typical V8 fromCharCode arg limit.
-  const CHUNK = 0x2000;
-  let binary = '';
-  for (let i = 0; i < bytes.byteLength; i += CHUNK) {
-    binary += String.fromCharCode(...bytes.subarray(i, Math.min(i + CHUNK, bytes.byteLength)));
-  }
-  return btoa(binary);
-}
-
-function base64ToBytes(value: string): Uint8Array | undefined {
-  try {
-    const binary = atob(value);
-    const out = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-      out[i] = binary.charCodeAt(i);
-    }
-    return out;
-  } catch {
-    return undefined;
-  }
-}
-
 /** Encode a captured message for the worker -> dev-server hop (`raw` as base64). */
 export function serializeCapturedMessage(message: CapturedMessage): string {
   return JSON.stringify({ ...message, raw: bytesToBase64(message.raw) });
@@ -201,12 +124,17 @@ export function parseCapturedMessage(value: unknown): CapturedMessage | undefine
   if (typeof v.id !== 'string' || typeof v.raw !== 'string') {
     return undefined;
   }
-  const raw = base64ToBytes(v.raw);
+  let raw: Uint8Array;
+  try {
+    raw = base64ToBytes(v.raw);
+  } catch {
+    return undefined;
+  }
   const from = asAddress(v.from);
   const to = asAddressList(v.to);
   const cc = asAddressList(v.cc);
   const bcc = asAddressList(v.bcc);
-  if (!raw || !from || !to || !cc || !bcc) {
+  if (!from || !to || !cc || !bcc) {
     return undefined;
   }
   const attachments: CapturedMessage['attachments'] = [];
@@ -257,15 +185,7 @@ const SINK_KEY = '__voidEmailSinks__';
 const BUFFER_KEY = '__voidEmailDevBuffer__';
 const DEFAULT_BUFFER_LIMIT = 100;
 
-/**
- * Retained-byte budget for the buffer, alongside the count cap.
- *
- * A count cap alone does not bound the buffer: every item holds its full raw
- * MIME plus the decoded `text`/`html`, and a single message may reach
- * `MAX_MESSAGE_BYTES` (5 MiB), so 100 html-heavy messages is on the order of
- * gigabytes. This buffer lives in the Vite dev server's Node process — not in
- * workerd — so that is the dev server's own heap.
- */
+/** Retained-byte budget: 100 messages of up to 5 MiB each would fill the dev server's heap. */
 const DEFAULT_BUFFER_BYTES = 64 * 1024 * 1024;
 
 interface DevBuffer {
@@ -370,7 +290,7 @@ export function captureMessage(
   messageId: string,
 ): CapturedMessage {
   return {
-    id: generateCaptureId(),
+    id: newId('dev'),
     capturedAt: Date.now(),
     raw,
     messageId,
@@ -392,14 +312,3 @@ export function captureMessage(
     })),
   };
 }
-
-function generateCaptureId(): string {
-  // Compact ULID-like id: timestamp + 8 random bytes hex.
-  const bytes = new Uint8Array(8);
-  crypto.getRandomValues(bytes);
-  let hex = '';
-  for (const b of bytes) {
-    hex += b.toString(16).padStart(2, '0');
-  }
-  return `dev_${Date.now().toString(36)}${hex}`;
-}
diff --git a/packages/void/src/runtime/email/inbound.ts b/packages/void/src/runtime/email/inbound.ts
index 8ef6e9df4..f57c4c0cc 100644
--- a/packages/void/src/runtime/email/inbound.ts
+++ b/packages/void/src/runtime/email/inbound.ts
@@ -9,21 +9,25 @@ import {
   EMAIL_MAX_METADATA_BYTES,
   EMAIL_MAX_REPLY_BYTES,
   EMAIL_MAX_RESPONSE_BYTES,
+  type EmailWireAction,
 } from '@void/platform/email-protocol';
 import type { Email as PostalMimeEmail } from 'postal-mime';
+import { base64ToBytes } from '../base64.ts';
+import { withTimeout } from '../email-protocol.ts';
 import { getRawRuntimeEnv } from '../env-raw.ts';
-import { buildMime, MimeError, normalizeEmail, validateAddressParts } from './mime.ts';
+import {
+  buildMime,
+  indexOfControl,
+  MAX_ADDRESS_LENGTH,
+  MimeError,
+  normalizeEmail,
+  validateAddressParts,
+} from './mime.ts';
 import type { Address, Attachment } from './types.ts';
 
-// Mirror the slug-validity rule from runtime/email.ts so a malformed
-// __VOID_PROJECT_SLUG injection can't smuggle invalid characters into
-// the default reply `from` address.
-const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
-
 // SDK limits give handlers early errors. The gateway independently validates
 // untrusted tenant responses before admitting any action.
 const MAX_ACTIONS = EMAIL_MAX_ACTIONS;
-const MAX_ACTION_ADDRESS_LENGTH = 320;
 const MAX_ACTION_METADATA_BYTES = EMAIL_MAX_METADATA_BYTES;
 
 /** Bounds on a forward's headers. */
@@ -40,6 +44,8 @@ export const MAX_INBOUND_HEADERS: number = EMAIL_MAX_INBOUND_HEADERS;
 const MAX_REPLY_BYTES = EMAIL_MAX_REPLY_BYTES;
 const EMAIL_STREAM_DEADLINE_MS = 15_000;
 const EMAIL_ACTION_TERMINAL_BYTES = 5;
+const INBOUND_PROVIDER_DEADLINE_MS = 30_000;
+const INBOUND_ACTION_BATCH_DEADLINE_MS = 60_000;
 const actionEncoder = new TextEncoder();
 
 function emailActionWireSize(action: EmailAction): number {
@@ -51,39 +57,32 @@ function emailActionWireSize(action: EmailAction): number {
   return 5 + metadata.byteLength + (action.type === 'reply' ? 5 + action.raw.byteLength : 0);
 }
 
-function readRawProjectSlug(): string | undefined {
-  let raw: unknown;
+/** The raw env, or `undefined` outside a worker or SSR request. */
+export function tryGetRawRuntimeEnv(): Record<string, unknown> | undefined {
   try {
-    raw = getRawRuntimeEnv()?.__VOID_PROJECT_SLUG;
+    return getRawRuntimeEnv();
   } catch {
     return undefined;
   }
-  return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
 }
 
-function tryReadProjectSlug(): string | undefined {
-  const raw = readRawProjectSlug();
-  return raw !== undefined && VALID_SLUG.test(raw) ? raw : undefined;
+/** A non-empty string env var. */
+export function readEnvString(name: string): string | undefined {
+  const raw = tryGetRawRuntimeEnv()?.[name];
+  return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
 }
 
-// The platform mail domain for this environment, injected per deployment
-// (production uses `mail.example.com`, staging its own zone). Mirrors
-// `readEmailDomain` in runtime/email.ts — no baked-in default, so a
-// staging reply is never built against the production zone.
-function tryReadEmailDomain(): string | undefined {
-  let raw: unknown;
-  try {
-    raw = getRawRuntimeEnv()?.__VOID_EMAIL_DOMAIN;
-  } catch {
-    return undefined;
-  }
-  return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
+// At most 56 characters, so `<slug>+noreply` fits RFC 5321's 64-octet local part.
+const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
+
+/** `__VOID_PROJECT_SLUG` when it can head a sender address. */
+export function readProjectSlug(): string | undefined {
+  const raw = readEnvString('__VOID_PROJECT_SLUG');
+  return raw !== undefined && VALID_SLUG.test(raw) ? raw : undefined;
 }
 
-// The relay-lane marker `createMessageProxy` sets from `envelope.viaDomain`
-// — the registered custom domain the message arrived on. Undefined for a
-// platform-lane or own-account message, and for a hand-built message in a
-// test that never went through the proxy.
+// The relay-lane marker `createMessageProxy` sets from `envelope.viaDomain`;
+// undefined for platform-lane, own-account and hand-built messages.
 function readRelayDomain(message: ForwardableEmailMessage): string | undefined {
   const raw: unknown = (message as { __voidRelayDomain?: unknown }).__voidRelayDomain;
   return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
@@ -132,13 +131,9 @@ export class ParseEmailError extends Error {
 }
 
 /**
- * Parse a `ForwardableEmailMessage` into structured fields. postal-mime is
- * loaded lazily so workers that never call this don't bundle it.
- *
- * For proxy messages (built via `createMessageProxy`) the raw bytes are
- * cached on first read so subsequent `parseEmail`/`message.raw` accesses
- * still work. For real CF `ForwardableEmailMessage`s the raw stream is
- * one-shot.
+ * Parse a `ForwardableEmailMessage` into structured fields with postal-mime,
+ * loaded on first use. A native Cloudflare message's `raw` stream is
+ * one-shot, so parse it once.
  */
 export async function parseEmail(message: ForwardableEmailMessage): Promise<ParsedEmail> {
   if (message.rawSize > MAX_INBOUND_BYTES) {
@@ -150,15 +145,10 @@ export async function parseEmail(message: ForwardableEmailMessage): Promise<Pars
   const { default: PostalMime } = await import('postal-mime');
   const cached = proxyRawCache.get(message);
   try {
-    // Acquire inside the guard: on an own-account deploy the generated
-    // handler wraps Cloudflare's native one-shot `raw`, so a mid-delivery
-    // stream failure must also surface as `ParseEmailError`.
+    // Inside the try: a native one-shot `raw` stream can fail mid-read.
     const source = cached ? await cached.read() : message.raw;
     return await PostalMime.parse(source);
   } catch (cause) {
-    // postal-mime is lenient — binary garbage, truncated parts and bad
-    // header bytes all parse. What it does reject is a nesting bomb (>256
-    // levels), and a one-shot `raw` stream can fail on a real CF message.
     throw new ParseEmailError(
       'PARSE_FAILED',
       `parseEmail: could not parse the message body. ${cause instanceof Error ? cause.message : String(cause)}`,
@@ -167,12 +157,7 @@ export async function parseEmail(message: ForwardableEmailMessage): Promise<Pars
   }
 }
 
-/**
- * Per-proxy raw-bytes cache. Keyed by the proxy `ForwardableEmailMessage`
- * so `parseEmail()` (and any other reader) can replay the bytes without
- * consuming the underlying ReadableStream. Real CF messages are not in
- * the map, so they fall through to the one-shot stream behaviour.
- */
+/** Replayable raw bytes of proxy messages; native messages are not in the map. */
 interface RawCache {
   read(): Promise<Uint8Array>;
 }
@@ -197,10 +182,7 @@ export interface EmailEnvelope {
 }
 
 /** Handler intents, validated and admitted by the gateway before delivery. */
-export type EmailAction =
-  | { type: 'reject'; reason: string }
-  | { type: 'forward'; to: string; headers?: Record<string, string> }
-  | { type: 'reply'; from: string; to: string; raw: Uint8Array };
+export type EmailAction = EmailWireAction;
 
 export interface MessageProxy {
   message: ForwardableEmailMessage;
@@ -209,24 +191,13 @@ export interface MessageProxy {
 
 export interface CreateMessageProxyOptions {
   /**
-   * Project slug stripped from the `<slug>+<tag>` recipient by the
-   * dispatcher. When set, `message.to` is rewritten to the bare
-   * `<tag>@<domain>` form so user handlers see clean addresses (the slug
-   * is platform-internal). The original `<slug>+<tag>@<domain>` is
-   * preserved on a non-enumerable `__voidPlatformTo` property for
-   * diagnostics.
+   * Project slug the platform prefixes recipients with
+   * (`<slug>+<tag>@<domain>`). When set, `message.to` drops the `<slug>+`.
    */
   slug?: string;
 }
 
-/**
- * Remove the platform-injected `<slug>+` prefix from a recipient address.
- * The platform's shared sender (e.g. `mail.example.com`) rewrites every recipient to
- * `<slug>+<tag>@<domain>`; user handlers expect `<tag>@<domain>`. If the
- * slug is unknown, missing, or doesn't match the local-part prefix, the
- * address is returned unchanged so callers without slug context (e.g. the
- * test harness when no slug is set) don't accidentally mangle the address.
- */
+/** Remove a leading `<slug>+` (case-insensitive) from the local part. */
 function stripSlugFromAddress(address: string, slug: string | undefined): string {
   if (!slug) {
     return address;
@@ -237,8 +208,6 @@ function stripSlugFromAddress(address: string, slug: string | undefined): string
   }
   const localPart = address.slice(0, atIdx);
   const domain = address.slice(atIdx);
-  // Match `<slug>+...` case-insensitively. If the local-part starts with
-  // the slug followed by `+`, drop the `<slug>+` segment.
   const slugLower = slug.toLowerCase();
   const prefix = `${slugLower}+`;
   if (localPart.toLowerCase().startsWith(prefix)) {
@@ -272,26 +241,20 @@ function queueFull(): MimeError {
 function addressTooLong(field: 'from' | 'to', length: number): MimeError {
   return new MimeError(
     field === 'from' ? 'INVALID_FROM' : 'INVALID_TO',
-    `${field} address is ${length} characters, over the ${MAX_ACTION_ADDRESS_LENGTH}-character limit.`,
+    `${field} address is ${length} characters, over the ${MAX_ADDRESS_LENGTH}-character limit.`,
   );
 }
 
 function invalidForwardHeaders(cause: unknown): MimeError {
-  // The runtime's own message names the offending name or value. A handler
-  // may have built that value from the inbound message, so it is bounded.
+  // The detail may echo inbound-derived text, so it is bounded.
   const detail = cause instanceof Error ? cause.message.slice(0, 320) : 'not a valid header set';
   return new MimeError('MIME_ERROR', `forward: invalid header — ${detail}`);
 }
 
 /**
- * The router's `forwardHeadersWithinBounds`, as a throw. It runs on the
- * record about to be recorded — the very object the router receives, so the
- * count is the router's count: a `Headers` folded its duplicate names before
- * it got here, and a record keeps `X-A` and `x-a` as two, both there and
- * here. Runs after the `new Headers()` validity check, so every name is a
- * token and every value is header-safe; what is left is size. The router
- * drops the WHOLE list on any of these — a handler that passed here and
- * failed there deployed as one whose managed delivery performed no actions.
+ * The router's `forwardHeadersWithinBounds`, as a throw: the router drops the
+ * whole action list on a violation, so refuse it at the handler's own call.
+ * Counts the record as stored (a `Headers` has already folded duplicates).
  */
 function assertForwardHeadersWithinBounds(headers: Record<string, string>): void {
   const names = Object.keys(headers);
@@ -308,9 +271,8 @@ function assertForwardHeadersWithinBounds(headers: Record<string, string>): void
         `forward: header name is ${name.length} characters, over the ${MAX_FORWARD_HEADER_LENGTH}-character limit.`,
       );
     }
-    // The declared value type is `string`, and the router refuses anything
-    // else: `new Headers()` coerces an Array with `String()`, so a non-string
-    // value has no `length` the bound below could measure.
+    // The router refuses a non-string value, which `new Headers()` would
+    // have coerced.
     const value: unknown = headers[name];
     if (typeof value !== 'string') {
       throw new MimeError(
@@ -328,25 +290,9 @@ function assertForwardHeadersWithinBounds(headers: Record<string, string>): void
 }
 
 /**
- * The router's rule for a reject reason (`validateActions` in
- * `email-router.ts`: `sanitize(raw, MAX_REJECT_REASON_LENGTH)`, and
- * `'rejected by handler'` for an empty one), applied when the reason is
- * RECORDED so the native replay carries the string the managed one does.
- *
- * The reason goes into the SMTP reply to the connecting client, and a
- * handler may build it from the inbound message: a remote sender's CRLF is
- * then a line injected into that reply, and a multi-megabyte reason is a
- * transient-heap amplifier. The router already refuses both; normalizing at
- * record time covers the native `setReject()` replay on your own account
- * too. NORMALIZED rather than refused, unlike the forward bounds
- * above: a reject is the handler's terminal decision, and throwing out of
- * it would drop that decision and bounce the message as a dispatch error
- * (see the `MAX_ACTIONS` note in `setReject`). Slice FIRST, then replace: a
- * global replace materializes ~66 bytes per match, so the slice is what
- * bounds the work (see `prefixReplySubject`). The result can be SHORTER
- * than the cap: a run of controls inside the window collapses to one space
- * and the window is not refilled from beyond it — the router's own trade,
- * and it is DSN text.
+ * The router's reject-reason rule, applied at record time so native replay
+ * sends the same string. Normalized rather than refused, since a throw would
+ * drop the reject; slice before replace to bound the work.
  */
 function normalizeRejectReason(reason: string): string {
   // A JS handler can pass anything; the router treats a non-string as empty.
@@ -365,10 +311,7 @@ function normalizeRejectReason(reason: string): string {
 async function readStreamToBytes(
   stream: ReadableStream<Uint8Array>,
   limit = Infinity,
-  // The caller decides what crossing `limit` MEANS: a single reply over
-  // `MAX_MESSAGE_BYTES`, or the cumulative budget running out mid-stream.
-  // Without this the second case would be reported as the first, naming a
-  // limit the reply never reached.
+  // Names the limit that was crossed: one reply's cap or the shared budget.
   onOverflow: (total: number) => MimeError = replyTooLarge,
 ): Promise<Uint8Array> {
   const reader = stream.getReader();
@@ -377,24 +320,11 @@ async function readStreamToBytes(
   const deadline = Date.now() + EMAIL_STREAM_DEADLINE_MS;
   try {
     for (;;) {
-      const remaining = deadline - Date.now();
-      if (remaining <= 0) {
-        throw new MimeError('MIME_ERROR', 'email stream timed out');
-      }
-      let timer: ReturnType<typeof setTimeout> | undefined;
-      const { value, done } = await Promise.race([
-        reader.read(),
-        new Promise<never>((_, reject) => {
-          timer = setTimeout(
-            () => reject(new MimeError('MIME_ERROR', 'email stream timed out')),
-            remaining,
-          );
-        }),
-      ]).finally(() => {
-        if (timer !== undefined) {
-          clearTimeout(timer);
-        }
-      });
+      const { value, done } = await withTimeout(
+        deadline - Date.now(),
+        () => reader.read(),
+        () => new MimeError('MIME_ERROR', 'email stream timed out'),
+      );
       if (done) {
         break;
       }
@@ -405,8 +335,7 @@ async function readStreamToBytes(
       chunks.push(value);
     }
   } catch (error) {
-    // Cancellation is cleanup, not part of the stream deadline. A custom
-    // handler stream may never settle its underlying cancel algorithm.
+    // Do not await cancel: a custom handler stream may never settle it.
     void reader.cancel().catch(() => {});
     throw error;
   } finally {
@@ -435,23 +364,10 @@ export function bytesToReadableStream(bytes: Uint8Array): ReadableStream<Uint8Ar
 }
 
 /**
- * Build a proxy `ForwardableEmailMessage` from an envelope. The proxy's
- * `setReject` / `forward` / `reply` methods don't dispatch directly — they
- * record `EmailAction` entries that the router (which holds the real
- * message) enacts after the handler returns.
- *
- * `reply()` accepts a duck-typed `{ from, to, raw }` with `raw` a
- * `Uint8Array` or `ReadableStream` — what `replyEmail()` passes. It does NOT
- * accept a native `EmailMessage` from `cloudflare:email`: that class exposes
- * only `from` and `to` (workers-types declares nothing else, and the body
- * has no public accessor), so its bytes cannot be recorded here, and nothing
- * could encode them for the gateway. The reply MIME bytes are
- * buffered before being recorded so the action is fully self-contained.
- *
- * When `opts.slug` is provided, `message.to` is rewritten to remove the
- * platform-injected `<slug>+` prefix so handlers see `<tag>@<domain>`
- * instead of `<slug>+<tag>@<domain>`. The original wire-form recipient is
- * preserved on a non-enumerable `__voidPlatformTo` property.
+ * Build the message a handler sees from an envelope. `setReject`, `forward`
+ * and `reply` record `EmailAction`s instead of dispatching; the caller enacts
+ * them after the handler returns. `reply()` takes `{ from, to, raw }`, which
+ * `replyEmail()` passes: a native `EmailMessage` has no readable body.
  */
 export function createMessageProxy(
   envelope: EmailEnvelope,
@@ -460,26 +376,14 @@ export function createMessageProxy(
   const actions: Array<EmailAction> = [];
   const headers = new Headers(envelope.headers);
 
-  // A relayed recipient carries no `<slug>+` prefix (the relay lane is
-  // authenticated by the domain's relay secret, and `viaDomain` names that
-  // domain), so the slug is inert here even if a caller passed one — the
-  // generated `handleEmail` already suppresses it, and this keeps a
-  // coincidental `<slug>+` local-part prefix from being stripped off a
-  // customer-domain address.
+  // A relayed recipient (on `viaDomain`) carries no `<slug>+` prefix, so a
+  // coincidental one on a customer address is never stripped.
   const slug =
     envelope.viaDomain === undefined || envelope.viaDomain === '' ? opts.slug : undefined;
 
-  // Strip the platform-injected `<slug>+` prefix from message.to so handler
-  // authors see the same address shape they wrote in `email/<addr>.ts`. The
-  // dispatcher strips the same prefix for routing; mirroring it here keeps
-  // the user-visible envelope consistent with the routing surface.
   const userVisibleTo = stripSlugFromAddress(envelope.to, slug);
 
-  // Cache raw bytes lazily so repeated reads (e.g. parseEmail() followed by
-  // anything touching message.raw) work. Real CF messages are one-shot, but
-  // the proxy is what user handlers see in tests + the platform router, and
-  // they reasonably expect raw to be replayable since the envelope is
-  // already pre-buffered by the router.
+  // Buffer `raw` once so it can be read repeatedly.
   let cachedRaw: Uint8Array | undefined;
   let bufferingPromise: Promise<Uint8Array> | undefined;
   function readRawOnce(): Promise<Uint8Array> {
@@ -501,8 +405,6 @@ export function createMessageProxy(
     return bufferingPromise;
   }
 
-  // If the envelope already gave us bytes, expose them eagerly via the cache
-  // so the WeakMap lookup in parseEmail short-circuits to a sync resolve.
   if (envelope.raw instanceof Uint8Array) {
     cachedRaw = envelope.raw;
   }
@@ -530,8 +432,8 @@ export function createMessageProxy(
     return true;
   }
 
-  // `actions` only ever grows through forward/reply, and `setReject` purges
-  // both, so length IS the queue depth.
+  // `actions` only grows through forward/reply, and `setReject` purges both,
+  // so its length is the queue depth.
   function assertQueueHasRoom(): void {
     if (actions.length + pendingReplies >= MAX_ACTIONS) {
       throw queueFull();
@@ -542,16 +444,11 @@ export function createMessageProxy(
     from: envelope.from,
     to: userVisibleTo,
     headers,
-    // `raw` is accessed as a property by user code and postal-mime. Return a
-    // fresh ReadableStream each access, backed by the cached bytes (or
-    // buffering on first read for stream envelopes).
+    // A fresh stream per access, backed by the buffered bytes.
     get raw(): ReadableStream<Uint8Array> {
       if (cachedRaw) {
         return bytesToReadableStream(cachedRaw);
       }
-      // Stream envelope, not yet buffered. Tee-style: kick off buffering
-      // and return a stream that pulls from the eventual bytes. This keeps
-      // synchronous getter semantics while ensuring later accesses replay.
       const pending = readRawOnce();
       return new ReadableStream({
         async start(controller) {
@@ -564,7 +461,7 @@ export function createMessageProxy(
     rawSize: envelope.rawSize,
     setReject(reason: string) {
       if (rejected) {
-        return; // already rejected; ignore second reject
+        return;
       }
       rejected = true;
       // Reject is terminal and replaces queued deliveries, so it must remain
@@ -597,22 +494,16 @@ export function createMessageProxy(
         return;
       }
       assertQueueHasRoom();
-      if (to.length > MAX_ACTION_ADDRESS_LENGTH) {
+      if (to.length > MAX_ADDRESS_LENGTH) {
         throw addressTooLong('to', to.length);
       }
-      // Validate the bare address before recording any delivery intent.
       validateAddressParts('to', to);
-      // Accept both `Headers` (matches CF's runtime signature) and a plain
-      // `Record<string, string>`. `Headers.entries()` lowercases keys per
-      // spec; users who care about preserving header casing in the wire
-      // form (e.g. for diagnostic headers like `X-Void-Trace`) can pass
-      // the record form instead.
+      // `Headers` lowercases names; a plain record keeps the caller's casing.
       let headersObj: Record<string, string> | undefined;
       if (fwdHeaders instanceof Headers) {
         headersObj = Object.fromEntries(fwdHeaders.entries());
       } else if (fwdHeaders) {
-        // Validate now to avoid partial delivery during native replay. Keep
-        // the record itself so caller-provided header casing is preserved.
+        // Validate now so native replay cannot fail after earlier actions fired.
         try {
           void new Headers(fwdHeaders);
         } catch (e) {
@@ -620,9 +511,6 @@ export function createMessageProxy(
         }
         headersObj = { ...fwdHeaders };
       }
-      // Size, after validity, on the record that is stored — for both forms.
-      // The router applies these bounds to that record and drops the whole
-      // list; here they fail the handler's own call, recording nothing.
       if (headersObj) {
         assertForwardHeadersWithinBounds(headersObj);
       }
@@ -649,17 +537,13 @@ export function createMessageProxy(
       }
       // Everything cheap first, so a doomed reply never buffers its stream.
       assertQueueHasRoom();
-      if (reply.from.length > MAX_ACTION_ADDRESS_LENGTH) {
+      if (reply.from.length > MAX_ADDRESS_LENGTH) {
         throw addressTooLong('from', reply.from.length);
       }
-      if (reply.to.length > MAX_ACTION_ADDRESS_LENGTH) {
+      if (reply.to.length > MAX_ADDRESS_LENGTH) {
         throw addressTooLong('to', reply.to.length);
       }
-      // Same rule as `forward(to)` above, for the hand-built reply form:
-      // `replyEmail()` already goes through `normalizeEmail`, but a caller
-      // who passes `{ from, to, raw }` bypasses it, and otherwise only
-      // Cloudflare's native `reply()` would refuse a malformed address —
-      // after every earlier action had fired. Both are bare addresses.
+      // A hand-built `{ from, to, raw }` bypasses `normalizeEmail`.
       validateAddressParts('from', reply.from);
       validateAddressParts('to', reply.to);
       pendingReplies++;
@@ -677,8 +561,7 @@ export function createMessageProxy(
           );
           return;
         }
-        // `replyEmail()` is bounded by `buildMime`; a hand-built reply is not, so
-        // bound it here before the bytes travel to the proxy (or to native reply).
+        // A hand-built reply is not bounded by `buildMime`.
         const metadataOnlyAction = {
           type: 'reply' as const,
           from: reply.from,
@@ -702,10 +585,8 @@ export function createMessageProxy(
           }
           rawBytes = reply.raw;
         } else {
-          // A native `EmailMessage` lands here: `from` and `to` only, no `raw`.
-          // Name the problem instead of failing on `undefined.getReader()`,
-          // which in platform mode is a generic "project handler error" bounce
-          // with nothing a handler author could act on.
+          // A native `EmailMessage` has no `raw`: name that rather than fail
+          // with a generic handler error.
           const raw: unknown = reply.raw;
           if (
             typeof raw !== 'object' ||
@@ -719,10 +600,8 @@ export function createMessageProxy(
                 'no public accessor. Use replyEmail() from void/email, or pass the MIME bytes as raw.',
             );
           }
-          // The REMAINING budget, not the per-reply cap — an earlier reply has
-          // already spent part of it, and the stream must stop where the budget
-          // does. Whichever bound is lower is the one that fires, so the
-          // callback names the one that actually bound this read.
+          // Stop at the lower of the per-reply cap and the remaining budget,
+          // and name that one.
           const limit = Math.min(MAX_REPLY_BYTES, remaining);
           rawBytes = await readStreamToBytes(reply.raw, limit, (total) =>
             limit === MAX_REPLY_BYTES
@@ -743,11 +622,8 @@ export function createMessageProxy(
     },
   } as unknown as ForwardableEmailMessage;
 
-  // Preserve the original wire-form `<slug>+<tag>@<domain>` recipient for
-  // platform-side diagnostics without surfacing it to user handlers (most
-  // handlers should never need this — they read `message.to` and expect the
-  // clean form they wrote in `email/<addr>.ts`). Non-enumerable so JSON
-  // serialization, structured-clone, and `Object.entries` don't leak it.
+  // The wire-form recipient, for diagnostics; non-enumerable so it never
+  // serializes.
   if (envelope.to !== userVisibleTo) {
     Object.defineProperty(message, '__voidPlatformTo', {
       value: envelope.to,
@@ -757,13 +633,8 @@ export function createMessageProxy(
     });
   }
 
-  // Mark the relay lane: the platform proved the domain's relay secret, so
-  // `viaDomain` names the one registered domain this message arrived on.
-  // `buildReplyMessage` reads the marker to default `from` to the address
-  // that received the message (on the customer domain) instead of the
-  // shared-sender `<slug>+noreply@<platform domain>` default — the platform
-  // pins a relayed reply to the receiving project's registered domains.
-  // Non-enumerable for the same reason as `__voidPlatformTo` above.
+  // Relay-lane marker: `buildReplyMessage` then defaults `from` to the
+  // receiving address on the customer domain.
   if (typeof envelope.viaDomain === 'string' && envelope.viaDomain.length > 0) {
     Object.defineProperty(message, '__voidRelayDomain', {
       value: envelope.viaDomain,
@@ -773,40 +644,22 @@ export function createMessageProxy(
     });
   }
 
-  // Register cache entry so parseEmail() can replay bytes without consuming
-  // the proxy's `raw` getter (which would otherwise hand out a fresh stream
-  // per access — fine for correctness but wasteful for large messages).
   proxyRawCache.set(message, { read: readRawOnce });
 
   return { message, getActions: () => [...actions] };
 }
 
 /**
- * Whether `Name: value` can be emitted without breaking RFC 5322 §2.1.1.
- *
- * Folding only happens at whitespace (§3.2.2), so the widest unbreakable run
- * is what decides it — a `References` chain of ordinary ids folds fine however
- * long, while one oversized id inside it does not.
+ * Whether `Name: value` fits RFC 5322's 998-octet line. Folding happens only
+ * at SP or HTAB, so the widest unbroken run decides.
  */
 function fitsHeaderLine(name: string, value: string | undefined): value is string {
   if (!value) {
     return false;
   }
-  // A predicate, not a maximum, in one pass that allocates nothing. Spreading
-  // the token list into `Math.max` throws `RangeError` past ~123k arguments
-  // (measured on workerd), and `split(/\s+/)` materializes every token before
-  // `.some()` looks at the first — over 30 bytes of heap each, so 10 MiB of
-  // two-character ids (3.5M tokens, inside MAX_INBOUND_BYTES) measured 134 MB
-  // and terminates a 128 MB isolate before the predicate can answer. This
-  // guard exists to stop a hostile header making the app's reply throw, so it
-  // must be neither the thing that throws nor the thing that runs out of
-  // memory.
-  //
-  // A run ends only at SP or HTAB. That is the whitespace `foldHeader` folds
-  // at (§3.2.2 FWS), and a threading value is emitted verbatim, so treating
-  // the rest of `\s` (NBSP, FF, VT …) as a break would pass a value the
-  // folder cannot break. Counting through them is the strict direction: it
-  // can only refuse a value, never pass one that fails.
+  // One pass without allocation: tokenizing a hostile 10 MiB header could
+  // exhaust the isolate. Other `\s` characters do not end a run, because
+  // `foldHeader` cannot fold at them.
   const budget = 998 - (name.length + 2);
   let run = 0;
   for (let i = 0; i < value.length; i++) {
@@ -815,8 +668,7 @@ function fitsHeaderLine(name: string, value: string | undefined): value is strin
       run = 0;
       continue;
     }
-    // UTF-8 octets, as `TextEncoder` would count them: a surrogate pair is one
-    // 4-octet code point, and a lone surrogate encodes as U+FFFD (3 octets).
+    // UTF-8 octets: a surrogate pair is 4, a lone surrogate (U+FFFD) is 3.
     if (c < 0x80) {
       run += 1;
     } else if (c < 0x800) {
@@ -840,39 +692,11 @@ function fitsHeaderLine(name: string, value: string | undefined): value is strin
 }
 
 /**
- * Whether `value` carries a C0 control other than HTAB, or DEL. The
- * sibling of `fitsHeaderLine` for the other way a remote-controlled id can
- * be unrepresentable: a threading value is emitted verbatim, so a control
- * inside it would reach the reply's `In-Reply-To` / `References` line raw —
- * `\x01` and DEL pass a WHATWG `Headers`, which refuses only CR, LF and
- * NUL — and an RFC 5322 §3.6.4 `msg-id` is `dot-atom-text`, which admits no
- * control at all. HTAB is not one here: it is the whitespace that separates
- * ids (§3.2.2 FWS), the same break `fitsHeaderLine` and `replyReferences`
- * cut at. One pass, no allocation, so it costs nothing a hostile header can
- * multiply; never a throw, for the same reason as the line guard.
- */
-function hasControl(value: string): boolean {
-  for (let i = 0; i < value.length; i++) {
-    const c = value.charCodeAt(i);
-    if ((c < 0x20 && c !== 0x09) || c === 0x7f) {
-      return true;
-    }
-  }
-  return false;
-}
-
-/**
- * `chain` without any id that `hasControl` refuses, the rest in their order
- * and joined by single spaces; the chain itself when there is nothing to
- * drop, without allocating. Only ONE id is lost — the others still thread —
- * whereas an id no line can carry drops the whole chain for the parent's id
- * (`replyReferences`), because that guard is about the rendered line and
- * this one is about one token. Called only on a chain already cut to
- * `MAX_REPLY_REFERENCES_CHARS`, so the per-id slices in the rare bad case
- * are bounded by that budget, not by the header a remote sender delivered.
+ * `chain` without the ids that hold a control character, joined by single
+ * spaces. Called only on a chain already cut to `MAX_REPLY_REFERENCES_CHARS`.
  */
 function dropControlIds(chain: string): string {
-  if (!hasControl(chain)) {
+  if (indexOfControl(chain) === -1) {
     return chain;
   }
   const kept: Array<string> = [];
@@ -941,55 +765,18 @@ export interface ReplyEmailOptions {
 }
 
 /**
- * Longest decoded inbound `Subject` the default reply subject is built from;
- * anything longer falls back to a bare `Re:`.
- *
- * RFC 5322 §2.1.1 caps a header LINE at 998 octets, and only folding lets a
- * header run past it — so a subject is something that fits on a line or
- * two. Real ones are tens to hundreds of characters; the longest automated
- * ones (a ticket title under a stack of list tags) reach a few hundred, and
- * Exchange rejects past 255. Four thousand keeps every one of those with an
- * order of magnitude to spare and refuses the shape that is only a subject
- * in name. What the bound buys is proportional cost: the control-character
- * replacements below cost 66 bytes of heap per match, so at this size they
- * cost at most 135 KB, and the reply's own `Subject` line is at most ~20 KB
- * — 4096 code units x 3 UTF-8 octets, base64'd in 45-octet encoded-words
- * with their framing — against a `MAX_MESSAGE_BYTES` of 5 MiB, so the
- * subject alone can never push the reply over the limit.
+ * Longest decoded inbound subject the default reply subject is built from;
+ * longer falls back to a bare `Re:`. Real subjects are far shorter, and the
+ * bound keeps the control-character replacement cheap.
  */
 const MAX_REPLY_SUBJECT_CHARS = 4096;
 
 function prefixReplySubject(original: string): string {
-  // Decode RFC 2047 encoded-words first so we (a) detect existing
-  // `Re:` prefixes inside encoded subjects (avoids `Re: =?UTF-8?B?...?=`
-  // becoming `Re: Re: foo` after the recipient's mailer decodes), and
-  // (b) re-encode cleanly via buildMime's encodeWord on the prefixed
-  // string instead of stacking encoded-words.
-  //
-  // The inbound subject is remote-sender controlled, and two things
-  // downstream throw on it: `normalizeEmail` rejects CR, LF and NUL, and
-  // `buildMime` rejects a header line over 998 octets or a message over
-  // `MAX_MESSAGE_BYTES`. A throw here is not the app's fault, and in
-  // production it rejects the whole delivery — the reply AND any forward
-  // the handler queued. So, as with the threading headers below, the
-  // subject is best-effort: C0 controls (a decoded `=00`, `=0A`, or a
-  // B-encoded NUL) become a single space, and three shapes fall back to a
-  // bare `Re:` — an empty subject, one over `MAX_REPLY_SUBJECT_CHARS`, and
-  // an ASCII one no line can carry.
-  //
-  // The bound is checked BEFORE the replacements, on the decoded string.
-  // A global `replace` materializes one part per match before it builds the
-  // result — about 66 bytes each — and the inbound header can be the whole
-  // 10 MiB message: 5 MiB of alternating tab and letter measured 165 MB on
-  // the first replacement alone and terminated a 128 MB isolate, which is
-  // the tenant's. It is the DECODED length that is bounded, not the raw
-  // header's: an encoded-word is always at least as long as what it decodes
-  // to (base64 is 4/3 of its bytes plus `=?UTF-8?B?…?=` per 45 of them, and
-  // a Q-encoded 3-octet character is nine characters), so a raw bound would
-  // refuse a CJK subject of under a thousand characters whose decoded form
-  // fits. The decode is one linear pass that holds only its output, already
-  // made to survive the 10 MiB case (see `quotedPrintableDecode` below) —
-  // accuracy for a pass that is paid either way.
+  // Decode first so an encoded `Re:` is detected and the result is encoded
+  // once. The subject is remote-controlled and a throw here would reject the
+  // whole delivery, so it is best-effort: controls become a space, and an
+  // empty, over-long or unfoldable ASCII subject becomes a bare `Re:`. The
+  // decoded length is checked before any replace.
   const decoded = decodeRfc2047(original);
   if (decoded.length > MAX_REPLY_SUBJECT_CHARS) {
     return 'Re:';
@@ -1003,9 +790,7 @@ function prefixReplySubject(original: string): string {
     return 'Re:';
   }
   const prefixed = /^re:/i.test(cleaned) ? cleaned : `Re: ${cleaned}`;
-  // Only a pure-ASCII subject can fail to fold: anything else goes through
-  // `encodeWord`, which splits it into 75-character encoded-words joined
-  // by spaces, and those fold. An ASCII token wider than a line cannot.
+  // Non-ASCII goes through `encodeWord`, whose words always fold.
   if (/^[\x20-\x7e]*$/.test(prefixed) && !fitsHeaderLine('Subject', prefixed)) {
     return 'Re:';
   }
@@ -1013,46 +798,23 @@ function prefixReplySubject(original: string): string {
 }
 
 /**
- * Longest `References` value a reply carries, in UTF-16 code units — the
- * measure `MAX_REPLY_SUBJECT_CHARS` uses. It is checked on `length` alone,
- * so a chain the size of the inbound message costs one property read before
- * anything is scanned or sliced.
- *
- * RFC 5322 puts no limit on the field, but everything downstream does. RFC
- * 5537 §3.4.4 has a followup agent trim it to 998 characters, and Postfix's
- * `header_size_limit` discards header bytes past 100 KiB. A message-id is
- * tens of characters, so 8 KiB carries a chain over a hundred replies deep
- * with every id intact — an order of magnitude past any conversation — and
- * a value this size, folded and encoded, is at most ~25 KB of a 5 MiB
- * reply, so the chain alone can never push the reply over the limit.
- * Unbounded, it could: the inbound header can be the whole 10 MiB message,
- * and short ids pass the line guard — every id folds — yet `foldHeader`'s
- * continuations would put the rendered reply over `MAX_MESSAGE_BYTES`.
- *
- * Past the bound the NEWEST ids are kept, whole, and the parent's id still
- * ends the chain. That is what a mail client threads on: it links the reply
- * under any id it recognises, and the parent is also `In-Reply-To`. The
- * root id RFC 5537 keeps is a Netnews convention (a newsreader identifies a
- * thread by it); in mail it would spend the budget on an id older than
- * every client in the conversation.
+ * Longest `References` value a reply carries, in UTF-16 code units. 8 KiB
+ * keeps any real thread whole; past it the newest ids are kept, since mail
+ * clients thread on any id they recognise and the parent is `In-Reply-To`.
  */
 const MAX_REPLY_REFERENCES_CHARS = 8192;
 
 /**
- * The `References` value a reply carries, or `''` when nothing can be
- * threaded. In order: the whole inbound chain continued by the parent's
- * `messageId` when it fits `MAX_REPLY_REFERENCES_CHARS`; otherwise the
- * newest ids of the chain that fit, none of them split; and the parent's id
- * alone (which may be empty) when even those hold an id no line can carry.
+ * The reply's `References`, or `''`: the inbound chain plus the parent's id,
+ * trimmed to its newest whole ids, or the parent's id alone when an id
+ * cannot fit a line.
  */
 function replyReferences(originalReferences: string, messageId: string): string {
   const parent = messageId ? ` ${messageId}` : '';
   let chain = originalReferences;
   const budget = MAX_REPLY_REFERENCES_CHARS - parent.length;
   if (chain.length > budget) {
-    // Keep the tail, from the first SP or HTAB at or after the cut so no id
-    // is split — the breaks `foldHeader` folds at, as in `fitsHeaderLine`.
-    // The scan and the slice are bounded by the budget, not by the header.
+    // Cut at the next SP or HTAB so no id is split.
     let cut = chain.length - budget;
     while (cut < chain.length) {
       const c = chain.charCodeAt(cut);
@@ -1063,49 +825,31 @@ function replyReferences(originalReferences: string, messageId: string): string
     }
     chain = chain.slice(cut);
   }
-  // After the cut, so the only chain this ever walks is one the budget
-  // already bounds. `parent` was checked by the caller and is never dropped.
+  // After the cut, so the walk is bounded; `parent` was already checked.
   chain = dropControlIds(chain);
   chain = `${chain}${parent}`.trim();
-  // A chain folds at its spaces, so one this long is fine; it is a single
-  // oversized id inside it that is not.
   return fitsHeaderLine('References', chain) ? chain : messageId;
 }
 
 /**
- * Minimal RFC 2047 encoded-word decoder. Handles `=?charset?B?base64?=`
- * and `=?charset?Q?quoted-printable?=` segments separated by optional
- * whitespace. Unknown charsets pass through (best-effort UTF-8 decode);
- * malformed inputs return the original.
- *
- * Scope is intentionally narrow — used only for cosmetic subject
- * normalization in `prefixReplySubject`. Anything that needs robust
- * decoding (e.g. searching subject text) should use postal-mime's
- * parsed view via `parseEmail`.
+ * Minimal RFC 2047 decoder for the reply subject: B and Q encoded-words,
+ * unknown charsets read as UTF-8, malformed input returned unchanged.
  */
 function decodeRfc2047(value: string): string {
   if (!value.includes('=?')) {
     return value;
   }
   try {
-    // One encoded-word at a time. `replace` with a callback collects every
-    // match — result array, captures and all — before the callback runs
-    // once, so a 10 MiB subject of tiny encoded-words (750k of them, inside
-    // MAX_INBOUND_BYTES) needed 138 MB on the reply path and terminated a
-    // 128 MB isolate. `matchAll` is lazy: the same path needs 35 MB, and what
-    // is kept is the decoded output.
+    // `matchAll`, not `replace` with a callback: replace collects every match
+    // first, which a subject of tiny encoded-words turns into a heap blowup.
     const parts: Array<string> = [];
     let last = 0;
     for (const m of value.matchAll(/=\?([\w-]+)\?([BbQq])\?([^?]*)\?=(?:\s+(?==\?))?/g)) {
       const [match, charset, enc, payload] = m;
       const bytes =
-        enc.toUpperCase() === 'B' ? base64Decode(payload) : quotedPrintableDecode(payload);
-      // Honor the charset declared in the encoded-word. Q-encoded
-      // ISO-8859-1 / Windows-1252 subjects are still common in mail
-      // from older systems; decoding them as UTF-8 mojibakes any
-      // byte ≥ 0x80. TextDecoder rejects unknown labels by throwing,
-      // so fall back to UTF-8 only when the requested charset isn't
-      // supported (better than leaving the raw encoded-word in place).
+        enc.toUpperCase() === 'B' ? base64ToBytes(payload) : quotedPrintableDecode(payload);
+      // Honor the declared charset; fall back to UTF-8 for a label
+      // TextDecoder rejects.
       let decoder: TextDecoder;
       try {
         decoder = new TextDecoder(charset || 'utf-8', { fatal: false });
@@ -1122,24 +866,9 @@ function decodeRfc2047(value: string): string {
   }
 }
 
-function base64Decode(b64: string): Uint8Array {
-  const binary = atob(b64);
-  const out = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    out[i] = binary.charCodeAt(i);
-  }
-  return out;
-}
-
 function quotedPrintableDecode(qp: string): Uint8Array {
-  // RFC 2047 Q-encoding: `_` = space, `=XX` = hex byte, otherwise literal.
-  //
-  // Decode straight into a typed array. The payload regex in `decodeRfc2047`
-  // accepts whitespace, so an unfolded 10 MiB `Subject` is ONE encoded-word
-  // and this loop sees every character of it. An `Array<number>` would hold
-  // one boxed element per character (about 200 MB for 10 MiB of Q text). Every
-  // input character yields at most one output byte, so `qp.length` is the
-  // exact upper bound and the decode holds nothing but the output.
+  // RFC 2047 Q-encoding: `_` is a space, `=XX` a hex byte. Each input
+  // character yields at most one byte, so a typed array of `qp.length` fits.
   const out = new Uint8Array(qp.length);
   let kept = 0;
   for (let i = 0; i < qp.length; i++) {
@@ -1147,9 +876,8 @@ function quotedPrintableDecode(qp: string): Uint8Array {
     if (ch === 0x5f /* _ */) {
       out[kept++] = 0x20;
     } else if (ch === 0x3d /* = */ && i + 2 < qp.length) {
-      // Both characters must be hex: `parseInt('0G', 16)` is 0, not NaN. A
-      // malformed escape stays literal, which is what RFC 2045 §6.7 asks of a
-      // robust decoder and what postal-mime does.
+      // Both must be hex (`parseInt('0G', 16)` is 0); a malformed escape
+      // stays literal.
       const hex = qp.slice(i + 1, i + 3);
       if (/^[0-9A-Fa-f]{2}$/.test(hex)) {
         out[kept++] = parseInt(hex, 16);
@@ -1165,13 +893,8 @@ function quotedPrintableDecode(qp: string): Uint8Array {
 }
 
 /**
- * Pure helper: build the reply MIME from an inbound message + reply opts,
- * with `Subject: Re: …` (no double-prefix), `In-Reply-To`, and `References`
- * threaded from the original. Threading is best-effort (the inbound values
- * are remote-sender controlled): an id no header line can carry is dropped,
- * and a `References` chain over `MAX_REPLY_REFERENCES_CHARS` is trimmed to
- * its newest ids. Exposed separately so the dispatch step (`message.reply`)
- * can be tested without `cloudflare:email`.
+ * Build the reply MIME for `replyEmail`: `Re:` subject and best-effort
+ * `In-Reply-To` / `References` threading from the inbound message.
  */
 export async function buildReplyMessage(
   message: ForwardableEmailMessage,
@@ -1182,36 +905,18 @@ export async function buildReplyMessage(
   const originalMessageId = headers.get('Message-ID') ?? '';
   const originalReferences = headers.get('References') ?? '';
 
-  // Default `from` for the reply. On the platform (a slug is injected),
-  // build `<slug>+noreply@<domain>` from the slug and mail domain. Falling
-  // back to `message.to` there would reply from the user-visible
-  // (slug-stripped) address, which the platform's slug-pin rejects — every
-  // outbound on the shared sender must carry `<slug>+...@<domain>`. If the
-  // domain binding is missing and the caller didn't provide an explicit
-  // `from`, surface a clear error rather than building an invalid
-  // envelope. There is deliberately no baked-in domain default: guessing
-  // the production zone is exactly the bug the binding exists to prevent.
-  //
-  // With no slug there is no shared sender to pin to: the message was
-  // delivered to a real address on the developer's own zone, and replying
-  // from that address is what a reply means.
-  //
-  // A relayed message (a custom domain on the customer's own Cloudflare
-  // zone — the `__voidRelayDomain` marker from `createMessageProxy`) is the
-  // same shape as the own-account case even though a slug IS injected:
-  // `message.to` is a real address on the customer's domain, the platform
-  // pins relayed replies to the receiving project's registered domains, and
-  // the send leaves through the customer account's REST send. The shared
-  // `<slug>+noreply@<platform domain>` default would fail that pin.
+  // Default `from`: the receiving address on your own zone or a relayed
+  // custom domain; `<slug>+noreply@<domain>` on the platform's shared sender,
+  // which pins replies to the slug. A domain is never guessed.
   let fromAddr: Address;
   if (opts.from !== undefined) {
     fromAddr = opts.from;
   } else if (readRelayDomain(message) !== undefined) {
     fromAddr = message.to;
   } else {
-    const slug = tryReadProjectSlug();
+    const slug = readProjectSlug();
     if (slug) {
-      const domain = tryReadEmailDomain();
+      const domain = readEnvString('__VOID_EMAIL_DOMAIN');
       if (!domain) {
         throw new Error(
           "replyEmail: 'from' is required when __VOID_PROJECT_SLUG is set " +
@@ -1221,13 +926,9 @@ export async function buildReplyMessage(
         );
       }
       fromAddr = `${slug}+noreply@${domain}`;
-    } else if (readRawProjectSlug() !== undefined) {
-      // A slug IS injected, so this is a platform deployment — it just
-      // cannot be a sender, because `<slug>+noreply@` must stay inside RFC
-      // 5321's 64-octet local part, which caps the slug at 56 characters.
-      // Falling through to `message.to` would build the slug-stripped
-      // `<tag>@<domain>` shape that the platform's reply pin drops, with no
-      // error reaching the handler.
+    } else if (readEnvString('__VOID_PROJECT_SLUG') !== undefined) {
+      // A platform slug too long for `<slug>+noreply@`: `message.to` would
+      // build a sender the platform drops without telling the handler.
       throw new Error(
         "replyEmail: 'from' is required — this project's slug cannot build a " +
           'default reply sender (`<slug>+noreply@<domain>` must stay within the ' +
@@ -1241,24 +942,12 @@ export async function buildReplyMessage(
   const toAddr: Address = opts.to ?? message.from;
   const subject = opts.subject ?? prefixReplySubject(originalSubject);
 
-  // User-supplied `headers` go through the normal (reserved-header
-  // filtered) channel; threading headers ride the dedicated `threading`
-  // field that buildMime emits unconditionally. This keeps the
-  // RESERVED_HEADERS guard against `In-Reply-To`/`References` spoofing
-  // from user input intact while letting the trusted reply path emit
-  // them.
-  //
-  // Both values come off the INBOUND message, so a remote sender controls
-  // them. `buildMime` rejects any header line over RFC 5322's 998-octet
-  // limit, and a message-id has no whitespace to fold at — so threading a
-  // hostile one verbatim would let anyone make this app's reply throw, with
-  // the app at fault for nothing. Threading is best-effort: drop a value
-  // that cannot be represented and still send the reply. A control
-  // character is the other way an id is unrepresentable (`hasControl`), and
-  // it is dropped the same way rather than refused by `normalizeEmail`.
+  // Threading rides `threading`, since `headers` reserve these names. Both
+  // ids are remote-controlled: drop one that cannot fit a line or holds a
+  // control character rather than fail the reply.
   const threading: { inReplyTo?: string; references?: string } = {};
   const messageId =
-    fitsHeaderLine('In-Reply-To', originalMessageId) && !hasControl(originalMessageId)
+    fitsHeaderLine('In-Reply-To', originalMessageId) && indexOfControl(originalMessageId) === -1
       ? originalMessageId
       : '';
   if (messageId) {
@@ -1327,72 +1016,41 @@ export function isForwardableEmailMessage(value: unknown): value is ForwardableE
   );
 }
 
-const INBOUND_PROVIDER_DEADLINE_MS = 30_000;
-const INBOUND_ACTION_BATCH_DEADLINE_MS = 60_000;
-
-function createInboundProviderDeadline() {
-  const deadline = Date.now() + INBOUND_ACTION_BATCH_DEADLINE_MS;
-  return {
-    async run<T>(submit: () => Promise<T>): Promise<T> {
-      const remaining = Math.min(INBOUND_PROVIDER_DEADLINE_MS, deadline - Date.now());
-      if (remaining <= 0) {
-        throw new Error('email action batch deadline elapsed before provider submission');
-      }
-      const work = submit();
-      let timer: ReturnType<typeof setTimeout> | undefined;
-      try {
-        return await Promise.race([
-          work,
-          new Promise<never>((_, reject) => {
-            timer = setTimeout(
-              () =>
-                reject(
-                  new Error(
-                    'email action provider timed out; outcome unknown, do not retry automatically',
-                  ),
-                ),
-              remaining,
-            );
-          }),
-        ]);
-      } finally {
-        if (timer !== undefined) {
-          clearTimeout(timer);
-        }
-      }
-    },
-  };
-}
-
 /**
- * Replay recorded `EmailAction`s on a real `ForwardableEmailMessage`, in
- * order. The proxy already made `setReject` terminal (earlier forward/reply
- * entries are purged, later ones dropped), so a reject is never followed by
- * anything. `reply` needs a genuine `EmailMessage` — Cloudflare rejects a
- * duck-typed object — so `cloudflare:email` is loaded here, and only when
- * a reply was recorded.
- *
- * The proxy already validated forward headers and normalized reject reasons.
- * Provider refusals still propagate to the native event caller.
+ * Replay recorded actions on a native message, in order. The proxy already
+ * made `setReject` terminal and validated the rest. `reply` needs a real
+ * `EmailMessage`, so `cloudflare:email` loads only when one was recorded.
  */
 export async function enactEmailActions(
   message: ForwardableEmailMessage,
   actions: ReadonlyArray<EmailAction>,
 ): Promise<void> {
-  const providerDeadline = createInboundProviderDeadline();
+  const deadline = Date.now() + INBOUND_ACTION_BATCH_DEADLINE_MS;
+  const submit = async (run: () => Promise<unknown>): Promise<unknown> => {
+    const remaining = Math.min(INBOUND_PROVIDER_DEADLINE_MS, deadline - Date.now());
+    if (remaining <= 0) {
+      throw new Error('email action batch deadline elapsed before provider submission');
+    }
+    return withTimeout(
+      remaining,
+      run,
+      () =>
+        new Error('email action provider timed out; outcome unknown, do not retry automatically'),
+    );
+  };
   for (const action of actions) {
     switch (action.type) {
       case 'reject':
         message.setReject(action.reason);
         break;
       case 'forward':
-        await providerDeadline.run(() =>
+        await submit(() =>
           message.forward(action.to, action.headers ? new Headers(action.headers) : undefined),
         );
         break;
       case 'reply': {
         const { EmailMessage } = await import('cloudflare:email');
-        await providerDeadline.run(() =>
+        await submit(() =>
           message.reply(
             new EmailMessage(action.from, action.to, bytesToReadableStream(action.raw)),
           ),
diff --git a/packages/void/src/runtime/email/mime.ts b/packages/void/src/runtime/email/mime.ts
index e5ab32097..e239b9239 100644
--- a/packages/void/src/runtime/email/mime.ts
+++ b/packages/void/src/runtime/email/mime.ts
@@ -7,43 +7,23 @@
  */
 
 import { validate as isValidEmailSyntax } from 'email-validator';
+import { bytesToBase64 } from '../base64.ts';
 import type { Address, Attachment, NormalizedAttachment, NormalizedEmail } from './types.ts';
 
 /** Encoded outbound MIME ceiling, separate from the 10 MiB inbound limit. */
 export const MAX_MESSAGE_BYTES: number = 5 * 1024 * 1024;
 
 /**
- * Upper bound on the TOTAL attachment bytes `normalizeEmail` will materialize.
- *
- * Base64 expands by `ceil(n / 3) * 4`, so an attachment set larger than three
- * quarters of `MAX_MESSAGE_BYTES` cannot fit in a message that passes the
- * check at the end of `buildMime` no matter how small everything else is.
- * `buildMime` remains the authority on the final size — this bound only stops
- * `normalizeEmail` from materializing, and then expanding, bytes already known
- * not to fit.
- *
- * It has to be charged here because that final check comes far too late to
- * help. Measured peak live memory is about 10x the attachment bytes (8 MiB in
- * gives 83 MiB live) once the normalized copy, the base64 binary string, the
- * 76-column slices, the joins, `rawText` and its `TextEncoder.encode` are all
- * resident at once. Against a 128 MB isolate ceiling, a set over roughly
- * 12 MiB terminates the isolate rather than returning the `MIME_ERROR` the
- * docs promise for an oversize payload.
- *
- * This is a developer-experience guardrail, NOT the security boundary.
- * Attachments come from the app's own code, never from a remote sender, and
- * the platform proxy already caps the base64 length before decoding and the
- * raw length after. What this buys is a precise, catchable failure at the call
- * that went wrong, instead of a dead isolate with nothing a caller could act
- * on.
+ * Total attachment bytes `normalizeEmail` will materialize: base64 of more
+ * than 3/4 of `MAX_MESSAGE_BYTES` cannot fit. Charged before each copy so an
+ * oversize set fails with `MIME_ERROR` instead of exhausting the isolate;
+ * `buildMime`'s final size check stays authoritative.
  */
 const MAX_ATTACHMENT_BYTES_TOTAL: number = Math.floor((MAX_MESSAGE_BYTES * 3) / 4);
 
 /**
- * Bound raw `to`, `cc`, and `bcc` entries before parsing or rendering headers.
- * Counting before deduplication also bounds work for duplicate-heavy input.
- * The same SDK limit applies in development and on both deployment targets;
- * platform admission independently caps the unique recipients at 50.
+ * Cap on raw `to` + `cc` + `bcc` entries, counted before parsing or
+ * deduplication so it also bounds the work.
  */
 export const MAX_RECIPIENTS: number = 50;
 
@@ -51,15 +31,8 @@ export const MAX_RECIPIENTS: number = 50;
 const MAX_CUSTOM_HEADER_BYTES: number = 16 * 1024;
 
 /**
- * Pre-parse cap on one parsed address, in characters. RFC 5321 §4.5.3.1
- * allows a 64-octet local part and a 255-octet domain, so nothing over 320
- * characters can be delivered; the platform proxy applies the same
- * `MAX_RECIPIENT_LENGTH` to the same parsed address. This is the bound on
- * the WORK — it is checked before the address is scanned — not the
- * deliverability bound, which `email-validator` applies at 254 (see
- * `validateAddressParts`). A display name is not bounded — it is folded or
- * encoded into legal header lines at any length, and the tokenizers below
- * keep that cost linear.
+ * Pre-parse cap on one address. Nothing over 320 characters (RFC 5321
+ * §4.5.3.1) is deliverable; checked before the address is scanned.
  */
 export const MAX_ADDRESS_LENGTH: number = 320;
 
@@ -77,38 +50,30 @@ function rejectCRLF(field: string, value: string): void {
 }
 
 /**
- * Refuse any other C0 control or DEL in a value that is rendered VERBATIM
- * into a header — an attachment's filename, media type and Content-ID.
- * `rejectCRLF` is enough for a value `encodeWord` renders (the subject, a
- * custom header value, a display name): anything outside printable ASCII
- * sends the whole value into base64, so a control never reaches the wire.
- * These three go through `quoteParam` or straight into the line, so a
- * control would reach the wire for the receiving MTA to refuse.
- *
- * RFC 5322 §3.2.4 `qtext` is printable US-ASCII less `"` and `\`; a
- * control inside a quoted-string is `obs-qtext`, which §4 says MUST NOT be
- * generated. HTAB is deliberately NOT refused: `quoted-string` is
- * `DQUOTE *([FWS] qcontent) [FWS] DQUOTE` and `FWS` is built from `WSP`
- * (SP / HTAB), so a tab between characters is folding white space exactly
- * as a space is — and `obs-NO-WS-CTL`, the RFC's own list of the controls
- * that used to be `qtext`, leaves %d9 out. The same set is illegal in an
- * RFC 2045 §5.1 `token` (no CTLs) and an RFC 5322 §3.6.4 `msg-id`
- * (`dot-atom-text`), so one rule serves the media type and the Content-ID.
- *
- * The message names the code point and never echoes the value, as
- * `validateAddressParts` does. Runs AFTER the filename's length bound, so
- * the scan is over a value already known to fit a line.
+ * Index of the first C0 control other than HTAB, or DEL; -1 when there is
+ * none. HTAB is folding whitespace (RFC 5322 §3.2.2).
  */
-function rejectControls(field: string, value: string): void {
+export function indexOfControl(value: string): number {
   for (let i = 0; i < value.length; i++) {
     const c = value.charCodeAt(i);
     if ((c < 0x20 && c !== 0x09) || c === 0x7f) {
-      throw new MimeError(
-        'MIME_ERROR',
-        `${field} contains a control character (U+${c.toString(16).toUpperCase().padStart(4, '0')}).`,
-      );
+      return i;
     }
   }
+  return -1;
+}
+
+/**
+ * Refuse a control in a value rendered verbatim into a header (an
+ * attachment's filename, media type and Content-ID). Names the code point,
+ * never the value.
+ */
+function rejectControls(field: string, value: string): void {
+  const i = indexOfControl(value);
+  if (i !== -1) {
+    const code = value.charCodeAt(i).toString(16).toUpperCase().padStart(4, '0');
+    throw new MimeError('MIME_ERROR', `${field} contains a control character (U+${code}).`);
+  }
 }
 
 /** RFC 2045 §5.1 `tspecials`: what a `token` may not contain besides SPACE and CTLs. */
@@ -120,33 +85,10 @@ function isTokenChar(c: number): boolean {
 }
 
 /**
- * Refuse an attachment media type that does not parse as RFC 2045 §5.1
- * `type "/" subtype *(";" parameter)`.
- *
- * `rejectControls` answers only for CTLs, and `buildAttachmentPart` writes
- * the value verbatim ahead of its own `; name="…"`, so an unterminated
- * quote such as `text/plain; x="` would swallow the builder's `name`
- * parameter as the value of `x`.
- *
- * The grammar is the RFC's, read as a generator: a `token` is printable
- * US-ASCII less SPACE and `tspecials`; a `value` is a `token` or a
- * quoted-string, whose content is anything but a bare `"` or `\` (the same
- * rule `quoteParam` renders `name="…"` by, so a caller's quoted value may
- * carry what the builder's own already does). Optional WSP is admitted on
- * either side of `;` — the RFC 822 implicit LWSP every parser accepts and
- * the form HTTP's `Content-Type` writes — and nowhere else: `text/ plain`,
- * a trailing `;`, and an RFC 822 comment are refused rather than repaired.
- * Two parameters are also refused on their meaning: a `name`, because the
- * builder appends `name="<filename>"` and RFC 6838 §4.3 makes it "an error
- * for a specific parameter to be specified more than once"; and by that
- * same sentence any attribute given twice, compared case-insensitively as
- * §5.1 says attributes match. Type and subtype are kept as given — matching
- * is case-insensitive, so `TEXT/PLAIN` is legal and renders unchanged.
- *
- * One pass, no backtracking, and the only allocation is one lower-cased
- * attribute per parameter for the duplicate check, which is why this runs
- * AFTER the value's length bound. The message names the rule and never
- * echoes the value.
+ * Refuse a media type that is not RFC 2045 §5.1 `type "/" subtype *(";"
+ * parameter)`: it is written verbatim before the builder's `name=`, so an
+ * unterminated quote would swallow it. WSP is allowed only around `;`. A
+ * `name` parameter or a repeated attribute is refused (RFC 6838 §4.3).
  */
 function validateMediaType(field: string, value: string): void {
   const syntax = () =>
@@ -240,34 +182,9 @@ function isAtext(c: number): boolean {
 }
 
 /**
- * Refuse an attachment Content-ID that would not render as one RFC 5322
- * §3.6.4 `msg-id`.
- *
- * `rejectControls` answers only for CTLs, and `buildAttachmentPart` writes
- * the value verbatim — adding `<` and `>` unless the value already starts
- * with `<` — so a malformed id would reach the receiver and break the
- * `cid:` reference.
- *
- * The grammar is the RFC's, read as a generator, with two deliberate
- * differences. An `msg-id` is `"<" id-left "@" id-right ">"`, each side a
- * `dot-atom-text` (§3.2.3: `1*atext *("." 1*atext)`, so no leading,
- * trailing or doubled dot — the strict form; `obs-id-left`/`obs-id-right`
- * are §4 obsolete syntax, which MUST NOT be generated); `no-fold-literal`
- * (`[…]` for `id-right`) is left out. First difference: the `@` and its
- * right side are OPTIONAL. RFC 2392 §2 resolves a `cid:` URL by wrapping
- * its body in `<` `>` and matching that against `Content-ID`, so an id
- * without `@` — the documented `contentId: 'logo'` + `cid:logo` — is what
- * every client already resolves, and the domain that would make it a
- * proper `msg-id` adds nothing a reference could use. Second: the angle
- * brackets are optional too, because the builder has always added them
- * around a bare id; given, they must be one pair around the whole value.
- *
- * Refused, then: whitespace of any kind, a second `@`, `<` or `>` anywhere
- * but as that one pair, `"`, `(`, `)`, `,`, `;`, `:`, `\`, `[`, `]`,
- * anything non-ASCII, and the empty string.
- *
- * One pass, no allocation, which is why this runs AFTER the value's length
- * bound. The message names the rule and never echoes the value.
+ * Refuse a Content-ID that would not render as an RFC 5322 §3.6.4 `msg-id`
+ * of strict `dot-atom-text`. Unlike `msg-id`, the `@` part and the angle
+ * brackets are optional: `cid:logo` resolves against `<logo>` (RFC 2392).
  */
 function validateContentId(field: string, value: string): void {
   const syntax = () =>
@@ -364,37 +281,10 @@ function fieldErrorCode(field: string): MimeErrorCode {
 }
 
 /**
- * Validate one parsed address (and its display name, when there is one),
- * throwing a `MimeError` for `field` on anything undeliverable. Exported so
- * the inbound proxy's `forward(to)` and hand-built `reply()` refuse a bare
- * address by the same rule `sendEmail` applies to its `to`.
- *
- * The address rule is `email-validator`, and nothing else. It is also the
- * platform router's rule (`isValidEmailAddress` in the proxy's
- * `email-router.ts`), so there is exactly ONE address syntax in the tree:
- * an action the framework records is never dropped by the router for its
- * shape, and a test harness never captures as a success what the managed
- * deployment would lose.
- *
- * What it enforces: at most 254 characters in total; an ASCII dot-atom
- * local part of at most 64 characters (RFC 5322 §3.2.3 `atext`, dots only
- * between atoms — no quoted local part, no whitespace, no control, no
- * special); a dotted domain of ASCII labels of at most 63 characters each,
- * with a TLD that starts with a letter and has at least two characters; so
- * `user@localhost`, `x@y` and a raw IDN or SMTPUTF8 address are refused
- * (an IDN domain is accepted as punycode, `xn--…`). ASCII-only makes
- * octets and characters the same thing, so the RFC 5321 §4.5.3.1 octet
- * limits are the package's length checks; the 64 is also what caps the
- * default `<slug>+noreply@` sender (`VALID_SLUG` in `runtime/email.ts`,
- * `MAX_SLUG_LENGTH` = `64 - 8` in `cli/project-slug.ts` and the API). One
- * known quirk, pinned in the tests rather than worked around: the FIRST
- * character of the local part may not be a backtick, while any later one
- * may.
- *
- * `MAX_ADDRESS_LENGTH` still runs first, on the raw string, so the scan is
- * bounded before anything reads the address; the package's own 254 check
- * runs before its regex for the same reason. The message never echoes the
- * address: it may hold a control character, and naming the rule is enough.
+ * Validate one parsed address and optional display name, throwing a
+ * `MimeError` for `field`. The address rule is `email-validator`, the one
+ * the platform router applies, so a recorded action is never dropped for its
+ * shape. The message never echoes the address.
  */
 export function validateAddressParts(field: string, email: string, name?: string): void {
   if (email.length > MAX_ADDRESS_LENGTH) {
@@ -412,14 +302,8 @@ export function validateAddressParts(field: string, email: string, name?: string
   }
   if (name !== undefined) {
     rejectCRLF(`${field} display name`, name);
-    // An ASCII name with specials is rendered as one quoted-string, which
-    // `foldHeader` never splits: ` "name"` is a line of at least 3 octets
-    // plus the name. Same reason as the filename guard in
-    // `normalizeAttachment` — the escaping
-    // in `formatAddress` costs heap per escaped character, and the line
-    // check that would refuse it runs only after everything is rendered.
-    // A non-ASCII name becomes encoded-words and folds; a plain name folds
-    // at its spaces; neither is bounded here.
+    // A quoted ASCII name never folds: refuse one too long for its line
+    // before `formatAddress` escapes it.
     if (
       ASCII_PRINTABLE.test(name) &&
       RFC5322_SPECIALS.test(name) &&
@@ -431,10 +315,7 @@ export function validateAddressParts(field: string, email: string, name?: string
           `so its line would exceed the ${MAX_LINE_OCTETS}-octet limit in RFC 5322 §2.1.1. Shorten it.`,
       );
     }
-    // `@` in a display name almost always means a typo like
-    // `a@x.dev<b@evil.dev>` got mis-parsed as `name=a@x.dev,
-    // email=b@evil.dev`. Reject so the caller sees a clear validation
-    // error rather than silently rerouting to a different address.
+    // An `@` in a name usually means a mis-parsed `a@x.dev<b@evil.dev>`.
     if (name.includes('@')) {
       throw new MimeError(
         fieldErrorCode(field),
@@ -445,25 +326,9 @@ export function validateAddressParts(field: string, email: string, name?: string
 }
 
 /**
- * Undo the quoted-pairs in the content of a quoted display name: `\x` →
- * `x` for any `x` (RFC 5322 §3.2.4 — `qtext` excludes `"` and `\`, so a
- * quoted-string carries either only as a quoted-pair). The parsed name is
- * the RAW text `formatAddress` will quote and escape again, so leaving the
- * pairs in place would escape them twice. Only the quoted branch
- * of `parseAddress` calls this; a backslash in an unquoted name is a
- * character like any other, as it is in the object form.
- *
- * NOT `text.replace(/\\(.)/g, '$1')`: a global-regex replacement holds one
- * part per match before it builds the result, about 60 bytes each, and
- * nothing bounds this name before it runs — the quoted-string line guard
- * in `validateAddressParts` needs the DECODED name, and a non-ASCII name is
- * never bounded at all. Measured, 10 MiB of `\"` pairs peaked at 307 MB of
- * heap that way and terminated a 128 MB isolate; this shape peaks at 49 MB.
- * Same discipline as `to7bitBody`: one counting pass, a buffer of exactly
- * the output size, one fill, and one chunked `codeUnitsToString`.
- * The common case — no backslash at all — is one scan and no allocation.
- * The regex that admits the text guarantees every backslash is followed by
- * a character, so the fill never reads past the end.
+ * Undo quoted-pairs (`\x` → `x`) in a quoted display name so `formatAddress`
+ * escapes it once. A counting pass and an exact buffer, not a global-regex
+ * replace, which allocates per match on an unbounded name.
  */
 function unquotePairs(text: string): string {
   const first = text.indexOf('\\');
@@ -477,8 +342,7 @@ function unquotePairs(text: string): string {
       i++;
     }
   }
-  // UTF-16 code units, not bytes: a quoted name may be non-ASCII, and a
-  // surrogate pair is two units that round-trip exactly.
+  // UTF-16 code units: a surrogate pair round-trips exactly.
   const out = new Uint16Array(text.length - pairs);
   let n = 0;
   for (let i = 0; i < text.length; i++) {
@@ -500,22 +364,14 @@ function unquotePairs(text: string): string {
 export function parseAddress(value: Address, field: string): { email: string; name?: string } {
   if (typeof value === 'string') {
     rejectCRLF(`${field} address`, value);
-    // Match `Display Name <email@domain>` with paired quotes around the
-    // name (both or neither).
-    //
-    // The unquoted name must start and end on a non-whitespace character so
-    // `[^"<\s]` cannot take a space from the surrounding `\s*`. Letting
-    // consecutive quantifiers compete for one whitespace run makes the
-    // backtracker cubic in its length (4,000 leading spaces cost 10 s).
+    // `Display Name <email@domain>`, quotes paired or absent. The unquoted
+    // name starts and ends on non-whitespace so adjacent quantifiers cannot
+    // compete for one whitespace run, which backtracks cubically.
     const quoted = value.match(/^\s*"((?:[^"\\]|\\.)*)"\s*<\s*([^>\s]+)\s*>\s*$/);
     const angle =
       quoted ?? value.match(/^\s*(?:([^"<\s](?:[^"<]*[^"<\s])?)\s*)?<\s*([^>\s]+)\s*>\s*$/);
     if (angle) {
-      // The quoted form's `\"` and `\\` are quoted-pairs, undone here so
-      // the parsed name is the raw text — the same thing the object form
-      // carries — and `formatAddress` escapes it exactly once. Decoded
-      // BEFORE `validateAddressParts`, whose quoted-string line guard has
-      // to see the name `formatAddress` will render.
+      // Undo quoted-pairs first: the name guard must see what renders.
       const name = (quoted ? unquotePairs(angle[1] ?? '') : angle[1])?.trim();
       const email = angle[2];
       validateAddressParts(field, email, name);
@@ -545,11 +401,7 @@ function countRecipients(value: Address | Array<Address> | undefined): number {
   return Array.isArray(value) ? value.length : 1;
 }
 
-/**
- * Keeps the `exceeds Cloudflare limit of <N> bytes` tail that `buildMime`'s
- * own size error already uses, so the documented shape — and any caller
- * matching on it — holds for both paths.
- */
+/** Same `exceeds Cloudflare limit of <N> bytes` tail as `buildMime`'s size error. */
 function attachmentsTooLargeError(bytes: number): MimeError {
   return new MimeError(
     'MIME_ERROR',
@@ -558,13 +410,9 @@ function attachmentsTooLargeError(bytes: number): MimeError {
 }
 
 /**
- * Size of `content` WITHOUT materializing it.
- *
- * A string reports its UTF-16 `length`, which is a sound LOWER bound on its
- * UTF-8 byte length — every code unit encodes to at least one byte — so this
- * can never reject a string that would have fit; the exact length is charged
- * after the encode. Anything else reports 0 and is left to `toBytes` to reject
- * by type.
+ * Size of `content` without materializing it. A string's `length` is a lower
+ * bound on its UTF-8 size; an unsupported type reports 0 for `toBytes` to
+ * reject.
  */
 function declaredSize(content: Attachment['content']): number {
   if (content instanceof Uint8Array) {
@@ -606,13 +454,8 @@ async function normalizeAttachment(att: Attachment): Promise<NormalizedAttachmen
     throw new MimeError('MIME_ERROR', 'attachment: missing filename.');
   }
   rejectCRLF('attachment filename', att.filename);
-  // A quoted parameter never folds — `foldHeader` keeps a quoted-string
-  // whole — so ` filename="…"` is one line of at least 12 octets plus the
-  // filename. Refuse here what the post-render line check would refuse
-  // anyway: `quoteParam` costs heap per escaped character, and a filename
-  // of ~1.7M quotes killed a 128 MB isolate before that check could run.
-  // `length` never exceeds the UTF-8 octet count, so this cannot reject a
-  // filename whose line would have fit.
+  // A quoted parameter never folds: refuse a filename too long for its line
+  // before `quoteParam` escapes it. Bound first, then scan.
   if (att.filename.length + QUOTED_FILENAME_LINE_OVERHEAD > MAX_LINE_OCTETS) {
     throw new MimeError(
       'MIME_ERROR',
@@ -620,15 +463,9 @@ async function normalizeAttachment(att: Attachment): Promise<NormalizedAttachmen
         `so its line would exceed the ${MAX_LINE_OCTETS}-octet limit in RFC 5322 §2.1.1. Shorten the filename.`,
     );
   }
-  // After the bound: `rejectCRLF` above answers for the line delimiters on
-  // the raw string, and this scan is over a filename already known to fit.
   rejectControls('attachment filename', att.filename);
   if (att.contentType !== undefined) {
     rejectCRLF('attachment contentType', att.contentType);
-    // Same order as the filename: the bound, then the scans. `Content-Type:
-    // <contentType>; name="…"` puts the media type on the line ahead of the
-    // builder's own parameter, and `validateMediaType` keeps one string per
-    // parameter, so both run over a value already known to fit.
     if (att.contentType.length + CONTENT_TYPE_LINE_OVERHEAD > MAX_LINE_OCTETS) {
       throw new MimeError(
         'MIME_ERROR',
@@ -641,15 +478,7 @@ async function normalizeAttachment(att: Attachment): Promise<NormalizedAttachmen
   }
   if (att.contentId !== undefined) {
     rejectCRLF('attachment contentId', att.contentId);
-    // Same order again: the bound, then the scans. An id the grammar admits
-    // has no whitespace, so `Content-ID: <id>` is one token after the field
-    // name and `foldHeader` returns the line whole: exactly the field name
-    // plus the id plus the `<` `>` `buildAttachmentPart` adds around a bare
-    // one — an id that already starts with `<` renders as given, so it is
-    // allowed those 2 characters more. `length` never exceeds the UTF-8
-    // octet count, so this cannot reject an id whose line would have fit;
-    // an over-long id with whitespace in it is refused here rather than
-    // by the grammar, and refused either way.
+    // `Content-ID: <id>` never folds; the builder adds `<>` around a bare id.
     const brackets = att.contentId.startsWith('<') ? 0 : 2;
     if (att.contentId.length + brackets + CONTENT_ID_LINE_OVERHEAD > MAX_LINE_OCTETS) {
       throw new MimeError(
@@ -661,11 +490,8 @@ async function normalizeAttachment(att: Attachment): Promise<NormalizedAttachmen
     rejectControls('attachment contentId', att.contentId);
     validateContentId('attachment contentId', att.contentId);
   }
-  // The type admits only the two literals, but that binds nothing at
-  // runtime: a JS caller, or a JSON-parsed options object, can hand over any
-  // string, and `buildAttachmentPart` interpolates the value straight into
-  // `Content-Disposition`. An allow-list, not `rejectCRLF`: there is no
-  // third disposition this builder could render meaningfully.
+  // A JS caller can pass any string, and it is interpolated into
+  // `Content-Disposition`.
   if (
     att.disposition !== undefined &&
     att.disposition !== 'attachment' &&
@@ -717,17 +543,8 @@ export async function normalizeEmail(opts: {
           `headers: '${name}' is not a valid RFC 5322 header name.`,
         );
       }
-      // A field name never folds. The shortest line that can carry it is
-      // `Name:` on its own — what `foldHeader` emits when the value's
-      // first token does not fit beside a long name — so a name over
-      // `MAX_LINE_OCTETS - 1` characters has no legal rendering whatever
-      // its value, and the post-render line check would refuse it. Refuse
-      // it here instead, as `normalizeAttachment` does a filename: that
-      // check runs only after the name has been lowercased, joined into
-      // its line, the header block, `rawText` and `raw` — four copies of a
-      // name that can be the whole message. `HEADER_NAME` admits only
-      // ASCII, so `length` is the octet count exactly and this cannot
-      // reject a name whose line would have fit.
+      // A field name never folds: refuse one too long for any line before it
+      // is copied into the rendered message.
       if (name.length + HEADER_NAME_LINE_OVERHEAD > MAX_LINE_OCTETS) {
         throw new MimeError(
           'MIME_ERROR',
@@ -735,9 +552,7 @@ export async function normalizeEmail(opts: {
             `so its line would exceed the ${MAX_LINE_OCTETS}-octet limit in RFC 5322 §2.1.1. Shorten the name.`,
         );
       }
-      // Keep raw input work bounded even when folding later collapses a long
-      // whitespace run. The character check rejects huge values before the
-      // UTF-8 measurement allocates its byte copy.
+      // The character check refuses a huge value before UTF-8 encoding copies it.
       if (headerInputBytes + name.length + value.length + 4 > MAX_CUSTOM_HEADER_BYTES) {
         throw new MimeError('MIME_ERROR', 'email: custom headers exceed the 16 KiB limit.');
       }
@@ -757,9 +572,8 @@ export async function normalizeEmail(opts: {
       ) {
         throw new MimeError('MIME_ERROR', 'email: custom headers exceed the 16 KiB limit.');
       }
-      // Match the proxy's wire-level accounting exactly: RFC 2047 expansion,
-      // every folded continuation line, and the terminating CRLF. encodeWord
-      // always returns ASCII, so the rendered string length is its byte size.
+      // The proxy's wire-level accounting; `encodeWord` returns ASCII, so
+      // length is bytes.
       headerBytes += foldHeader(name, encodeWord(value)).length + CRLF.length;
       if (headerBytes > MAX_CUSTOM_HEADER_BYTES) {
         throw new MimeError('MIME_ERROR', 'email: custom headers exceed the 16 KiB limit.');
@@ -783,12 +597,8 @@ export async function normalizeEmail(opts: {
   const cc = opts.cc ? parseAddresses(opts.cc, 'cc') : [];
   const bcc = opts.bcc ? parseAddresses(opts.bcc, 'bcc') : [];
   const replyTo = opts.replyTo ? parseAddress(opts.replyTo, 'replyTo') : undefined;
-  // Before any entry is normalized: the count is what bounds the loop below
-  // for a zero-byte attachment, which the byte total never sees. The type
-  // admits only an array, but that binds nothing at runtime, and the count
-  // is only a bound on the loop if the loop walks the array it was read
-  // from — so anything else is refused, as `toBytes` refuses a content of
-  // a type outside the contract.
+  // The count bounds the loop below (zero-byte entries never advance the
+  // byte total), but only if the loop walks the array it was read from.
   const attachmentList = opts.attachments ?? [];
   if (!Array.isArray(attachmentList)) {
     throw new MimeError('MIME_ERROR', 'email: attachments must be an array.');
@@ -799,12 +609,7 @@ export async function normalizeEmail(opts: {
       `email: too many attachments (max ${MAX_ATTACHMENTS}, got ${attachmentList.length}).`,
     );
   }
-  // Sequential, not `Promise.all`: the running total has to be charged
-  // BEFORE each copy, or the entire set is already resident by the time
-  // anything looks at a size. Sequencing costs nothing measurable — every
-  // conversion in `toBytes` is synchronous except `Blob.arrayBuffer`, which
-  // is a memcpy of bytes the caller already holds, so there is no I/O here to
-  // overlap.
+  // Sequential so the running total is charged before each copy.
   const attachments: Array<NormalizedAttachment> = [];
   let attachmentBytes = 0;
   for (const att of attachmentList) {
@@ -821,9 +626,7 @@ export async function normalizeEmail(opts: {
     }
     attachments.push(normalized);
   }
-  // Threading headers are passed through as-is — they come from the
-  // trusted reply path (buildReplyMessage), not user input. We still
-  // reject CR/LF inside them, same as any other header value.
+  // Threading comes from the trusted reply path, but CR/LF are still refused.
   if (opts.threading?.inReplyTo) {
     rejectCRLF('threading.inReplyTo', opts.threading.inReplyTo);
   }
@@ -847,23 +650,14 @@ export async function normalizeEmail(opts: {
 }
 
 /**
- * RFC 2047 §2 caps an encoded-word at 75 characters *including* the
- * `=?UTF-8?B?` prefix (10) and the `?=` suffix (2). That leaves 63
- * characters of base64, and base64 spends 4 characters per 3 input
- * bytes, so 45 source bytes is the largest payload that fits — 48 would
- * need 64.
+ * RFC 2047 §2: a 75-character encoded-word less `=?UTF-8?B?` and `?=` leaves
+ * 63 characters of base64, so 45 source bytes.
  */
 const ENCODED_WORD_PAYLOAD_BYTES = 45;
 
 /**
- * RFC 2047 encoded-word for non-ASCII text in headers (UTF-8, base64).
- *
- * Text longer than one word's payload becomes several encoded-words
- * separated by a space, which `foldHeader` turns into CRLF + SPACE
- * wherever a line would otherwise overrun (RFC 2047 §6.2: whitespace
- * between adjacent encoded-words is dropped on decode either way). This
- * keeps each word under §2's 75-character ceiling and a long subject or
- * display name under RFC 5322 §2.1.1's 998-octet line limit.
+ * RFC 2047 B encoded-words for non-ASCII header text, space-separated so
+ * `foldHeader` can fold between them.
  */
 function encodeWord(text: string): string {
   if (ASCII_PRINTABLE.test(text)) {
@@ -877,18 +671,11 @@ function encodeWord(text: string): string {
   const words: Array<string> = [];
   const flush = () => {
     if (length > 0) {
-      words.push(`=?UTF-8?B?${base64(pending.subarray(0, length))}?=`);
+      words.push(`=?UTF-8?B?${bytesToBase64(pending.subarray(0, length))}?=`);
       length = 0;
     }
   };
-  // `for..of` iterates code points, so a surrogate pair is never split
-  // across two words — RFC 2047 §5 forbids splitting a multi-octet
-  // character between adjacent encoded-words, and half a pair would
-  // decode to U+FFFD. Each chunk is base64'd on its own for the same
-  // reason: encoding once and slicing the output would cut characters
-  // mid-sequence. Every character is measured and appended exactly once,
-  // so a character wider than the whole budget (impossible in UTF-8)
-  // lands alone in its own word instead of spinning.
+  // Code points, so no character is split across words (RFC 2047 §5).
   for (const char of text) {
     const bytes = encoder.encode(char);
     if (length > 0 && length + bytes.length > ENCODED_WORD_PAYLOAD_BYTES) {
@@ -902,17 +689,8 @@ function encodeWord(text: string): string {
 }
 
 /**
- * RFC 5322 §3.2.3, verbatim:
- *
- *     specials = "(" / ")" / "<" / ">" / "[" / "]" / ":" / ";" / "@" /
- *                "\" / "," / "." / DQUOTE
- *
- * A display name is a §3.2.5 `phrase = 1*word`, `word = atom /
- * quoted-string`, and `atext` is everything printable EXCEPT these, so an
- * ASCII name containing any of them must be rendered as one quoted-string.
- * The class below lists the thirteen in the RFC's order so it can be checked
- * against the production by eye. `.` matters: an unquoted `Dr. Smith` is
- * `obs-phrase` (§4.1), which §4 says MUST NOT be generated.
+ * RFC 5322 §3.2.3 `specials`, in the RFC's order: an ASCII display name with
+ * any of them must be quoted (an unquoted `Dr. Smith` is obsolete syntax).
  */
 const RFC5322_SPECIALS = /[()<>[\]:;@\\,."]/;
 
@@ -937,25 +715,10 @@ function formatAddressList(addrs: Array<{ email: string; name?: string }>): stri
 }
 
 /**
- * Soft-fold a long header line. Fold points, strongest first: address-list
- * separators (a `, ` outside any double-quoted string), then any remaining
- * unquoted whitespace inside a part. A naive `split(/, /)` would split
- * inside `"Smith, John"`, corrupting quoted display names, and folding only
- * between whole parts is not enough — one recipient carrying a long encoded
- * display name, or a `References:` run of message IDs, is a single part
- * that can blow past RFC 5322 §2.1.1's 998-octet hard limit on its own.
- *
- * RFC 2047 §2 limits any header line carrying an encoded-word to 76
- * characters; RFC 5322 §2.1.1 makes 78 a SHOULD and 998 a MUST. Folding at
- * 76 satisfies all three. A comma always stays on the line it terminates.
- * A token longer than the budget still gets its own line, which is the
- * best a WSP-only fold rule allows (§3.2.2 permits folding only at WSP).
- *
- * One pass, and the only thing kept per input character is the folded
- * output itself: each finished line is one flat string in `lines`. Any
- * per-token allocation (a slice array, token objects, `out +=`) costs about
- * 130 bytes of heap per token, so a legal 3 MB subject of one-letter words
- * would terminate a 128 MB isolate even though the message fits.
+ * Soft-fold a header at 76 columns (RFC 2047 §2): at `, ` outside quotes
+ * first, then at unquoted whitespace. A token longer than a line keeps its
+ * own line, since RFC 5322 folds only at WSP. One pass that keeps only the
+ * output; per-token allocation would exhaust the isolate on a large subject.
  */
 function foldHeader(name: string, value: string): string {
   const line = `${name}: ${value}`;
@@ -1063,22 +826,11 @@ const MAX_LINE_OCTETS = 998;
 /** ` filename="` + `"`: the shortest line a quoted filename parameter can fold onto. */
 const QUOTED_FILENAME_LINE_OVERHEAD = 12;
 /**
- * ` ` + `;`: the shortest line an attachment's media type can fold onto,
- * the whole value taken as one token. `foldHeader` would split a value
- * of several parameters at their spaces, so this bound is exact for the
- * one-token media type every attachment carries in practice and
- * conservative for a run of parameters that together pass the line
- * limit; that is accepted, because the alternative — find the fold points
- * first — is the scan this bound exists to run ahead of.
+ * ` ` + `;`: the shortest line the media type can fold onto as one token
+ * (conservative for several parameters).
  */
 const CONTENT_TYPE_LINE_OVERHEAD = 2;
-/**
- * `Content-ID: `: the only line an attachment's Content-ID can sit on. The
- * value is one token — `<id>` — so `foldHeader` cannot fold it onto a
- * continuation line the way it can a media type, and the field name is
- * part of what the id must fit beside. Exact, not conservative: the `<`
- * and `>` the builder adds around a bare id are charged at the call.
- */
+/** `Content-ID: `: the id is one token and cannot fold off this line. */
 const CONTENT_ID_LINE_OVERHEAD = 'Content-ID: '.length;
 /** ` "` + `"`: the shortest line a quoted display name can fold onto. */
 const QUOTED_NAME_LINE_OVERHEAD = 3;
@@ -1086,18 +838,9 @@ const QUOTED_NAME_LINE_OVERHEAD = 3;
 const HEADER_NAME_LINE_OVERHEAD = 1;
 
 /**
- * First line of `text` that exceeds the octet limit, if any.
- *
- * Every line is scanned, not just the top header block: a multipart part's
- * own headers (`Content-Disposition: …; filename="…"`) live inside the body
- * and are just as unfoldable. Body content cannot trip this — text is
- * quoted-printable re-encoded above 990 octets and base64 is emitted at a
- * fixed width — so a hit is always a header.
- *
- * One pass over the string, counting UTF-8 octets per CRLF-delimited line,
- * with NO allocation: a `split(CRLF)` would hold one substring per line, and
- * a legal body of pasted logs is millions of lines. Only a CRLF pair ends a
- * line; a bare CR or LF is content.
+ * First CRLF-delimited line over the octet limit, counted in UTF-8 without
+ * allocating. Every line is scanned because part headers live in the body;
+ * encoded body content never trips it.
  */
 function findOverlongLine(text: string): { index: number; octets: number } | undefined {
   let index = 0;
@@ -1130,26 +873,24 @@ function findOverlongLine(text: string): { index: number; octets: number } | und
   return octets > MAX_LINE_OCTETS ? { index, octets } : undefined;
 }
 
-/**
- * Escape a value for a quoted-string parameter (RFC 2045 §5.1 value, whose
- * quoted-string comes from RFC 5322 §3.2.4).
- *
- * `qtext` excludes both `\\` and `"`, so each may appear only as a
- * quoted-pair: a raw trailing backslash would escape the closing quote, and
- * a conformant parser drops every other raw backslash.
- *
- * Backslash first, then quote — the other order would double-escape.
- */
+/** Escape `\` and `"` as quoted-pairs (RFC 5322 §3.2.4), backslash first. */
 function quoteParam(value: string): string {
   return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
-function base64(bytes: Uint8Array): string {
-  return btoa(codeUnitsToString(bytes));
+/** `<prefix>_<base36 time><16 random hex>`. */
+export function newId(prefix: string): string {
+  const bytes = new Uint8Array(8);
+  crypto.getRandomValues(bytes);
+  let hex = '';
+  for (const b of bytes) {
+    hex += b.toString(16).padStart(2, '0');
+  }
+  return `${prefix}_${Date.now().toString(36)}${hex}`;
 }
 
 function base64Wrapped(bytes: Uint8Array): string {
-  const encoded = base64(bytes);
+  const encoded = bytesToBase64(bytes);
   const lines: Array<string> = [];
   for (let i = 0; i < encoded.length; i += 76) {
     lines.push(encoded.slice(i, i + 76));
@@ -1160,13 +901,9 @@ function base64Wrapped(bytes: Uint8Array): string {
 function quotedPrintable(text: string): string {
   // Encode as UTF-8 bytes then quote per RFC 2045.
   const bytes = new TextEncoder().encode(text);
-  // Emit into a byte buffer, not a string: `out += chunk` per byte builds a
-  // V8 cons-string tree whose nodes cost ~56 bytes per encoded byte and stay
-  // live until the message is flattened. Measured, 1 MiB of non-ASCII text
-  // held 57 MiB that way; a 1.9 MiB body killed a 128 MB isolate while its
-  // 5.9 MiB message was under the limit. Every input byte yields at most 3
-  // output bytes, a soft break (3) lands at most once per 73 content bytes,
-  // and a lone LF becomes CRLF, so this buffer never grows.
+  // A byte buffer, not `out +=`, whose cons-string nodes cost ~56 bytes per
+  // byte. At most 3 bytes per input byte plus a soft break per 73, so it
+  // never grows.
   const out = new Uint8Array(Math.ceil(bytes.length * 3 * (76 / 73)) + 8);
   let n = 0;
   let lineLen = 0;
@@ -1240,14 +977,9 @@ function codeUnitsToString(units: Uint8Array | Uint16Array): string {
 }
 
 /**
- * Whether a body must be quoted-printable encoded: anything outside
- * printable ASCII, or any line longer than 990 characters (RFC 5322 §2.1.1
- * makes 998 octets the hard limit). Only LF and CRLF end a line; a bare CR
- * is a control character like any other and forces the encoding.
- *
- * One pass over the string with NO allocation: a `replace`/`split` shape
- * holds a copy of the body plus one substring per line, and a legal 6 MB
- * body of millions of two-character lines needed about 100 MB that way.
+ * Whether a body needs quoted-printable: anything outside printable ASCII
+ * (a bare CR included) or a line over 990 characters. One pass without
+ * allocation.
  */
 function needsQuotedPrintable(text: string): boolean {
   let lineLen = 0;
@@ -1275,18 +1007,9 @@ function needsQuotedPrintable(text: string): boolean {
 }
 
 /**
- * The 7bit body: `text` with every bare LF widened to CRLF, and every CRLF
- * kept. Only called once `needsQuotedPrintable` has returned false, so every
- * character is printable ASCII, LF, or the CR of a CRLF — one byte each —
- * and a byte buffer is exact.
- *
- * NOT `text.replace(/\r?\n/g, CRLF)`: V8 builds a global-regex replacement
- * from a parts array that holds two or three slots per match, grown by
- * doubling, so that one line cost 144 MB of heap on a legal 6 MB body of
- * 3M lines and terminated a 128 MB isolate — the largest single allocation
- * in the whole build, for a body that renders to 9 MB. The buffer here is
- * the output size, known up front from one counting pass. A body that is
- * already CRLF-only (or has no line breaks) is returned as-is.
+ * `text` with each bare LF widened to CRLF. Called only when every character
+ * is one byte, so a counting pass sizes the buffer exactly; a global-regex
+ * replace would allocate per line.
  */
 function to7bitBody(text: string): string {
   let bare = 0;
@@ -1311,16 +1034,8 @@ function to7bitBody(text: string): string {
 }
 
 /**
- * Lower bound on the octets `text` will occupy in the rendered message, in
- * one pass over the string and with NO allocation. Every UTF-8 byte yields at
- * least one octet on either body path — the 7bit path copies bytes and only
- * ever widens a bare LF to CRLF; the quoted-printable path emits each
- * non-ASCII byte as `=XX` (3 octets) and every other byte as itself, and its
- * soft breaks only add. So `ascii + 3 * nonAscii` can never overshoot the
- * real size, which keeps a false rejection impossible; `buildMime`'s final
- * check remains the authority. `TextEncoder.encode` would give the same count
- * but at the price of a full copy, which is exactly the allocation this
- * bound exists to avoid.
+ * Lower bound on `text`'s rendered octets, without allocating: ASCII is at
+ * least 1 octet and each non-ASCII UTF-8 byte is `=XX`.
  */
 function minBodyOctets(text: string): number {
   let octets = 0;
@@ -1388,7 +1103,7 @@ function makeBoundary(prefix: string): string {
   // 16 random bytes → 24-char base64. Workers + browsers expose crypto.
   const bytes = new Uint8Array(16);
   crypto.getRandomValues(bytes);
-  return `=_void_${prefix}_${base64(bytes).replace(/[+/=]/g, '')}`;
+  return `=_void_${prefix}_${bytesToBase64(bytes).replace(/[+/=]/g, '')}`;
 }
 
 function wrapMultipart(
@@ -1426,29 +1141,10 @@ const RESERVED_HEADERS = new Set([
 ]);
 
 /**
- * Lower bound on the octets one header VALUE occupies once `encodeWord` (or
- * `formatAddress`, for a display name) and `foldHeader` have rendered it, in
- * one pass over the string and with NO allocation.
- *
- * `encodeWord` leaves a value alone when every character is printable ASCII
- * and otherwise B-encodes ALL of it, so the two paths need different terms:
- *
- * - Plain: every character is at least one octet, EXCEPT whitespace.
- *   `foldHeader` re-joins a long value from its non-WSP tokens, so a run of
- *   spaces or tabs collapses to one, and a bound that charged them could
- *   reject a message that fits. Only the non-WSP characters count.
- * - Encoded: each RFC 2047 word carries at most `ENCODED_WORD_PAYLOAD_BYTES`
- *   (45) UTF-8 bytes as base64 — `ceil(n / 3) * 4 >= 4n / 3` octets — inside
- *   12 octets of `=?UTF-8?B?` and `?=`, so there are at least `floor(n / 45)`
- *   words' worth of framing. Whitespace inside the value is base64 like any
- *   other byte; only the single separators between words fold.
- *
- * Folding (`foldHeader`) can only ADD octets beyond that — a `CRLF SP` per
- * line — and quoting a display name (`formatAddress`) adds the quotes and
- * escapes, so neither path can render fewer octets than this returns.
- * Measured, the encoded bound is 96% of the rendered size for CJK, where the
- * real cost is 5 octets per character; a UTF-16 `length` would have counted
- * 1 and let the isolate die on a header five times over the limit.
+ * Lower bound on one rendered header value, without allocating. Printable
+ * ASCII counts its non-WSP characters (folding may collapse WSP runs);
+ * anything else is B-encoded whole, at least 4/3 of its UTF-8 bytes plus 12
+ * octets of framing per 45-byte word.
  */
 function minHeaderValueOctets(value: string): number {
   let utf8 = 0;
@@ -1494,18 +1190,9 @@ function minAddressOctets(addr: { email: string; name?: string }): number {
 }
 
 /**
- * Lower bound on the octets of a value rendered VERBATIM — never through
- * `encodeWord` — into a header `foldHeader` may still fold: `In-Reply-To`,
- * `References`, and an attachment part's `Content-Type` media type and
- * `Content-ID`. Every non-WSP UTF-16 code unit is at least one octet of
- * UTF-8; a WSP run may collapse to a single space when the line folds, so
- * none is charged. The `<>` around a Content-ID and the fold's `CRLF SP`
- * only add.
- *
- * `minHeaderValueOctets` cannot stand in here: a non-ASCII value sends it
- * down the encoded-word formula (4.8 octets per CJK character) while these
- * values render as raw UTF-8 (3), so it would overshoot and could reject a
- * message that fits.
+ * Lower bound on a value rendered verbatim (threading ids, media type,
+ * Content-ID): one octet per non-WSP code unit. `minHeaderValueOctets` would
+ * overshoot, since these are raw UTF-8, not encoded-words.
  */
 function minVerbatimOctets(value: string): number {
   let octets = 0;
@@ -1519,16 +1206,8 @@ function minVerbatimOctets(value: string): number {
 }
 
 /**
- * Octets every attachment part costs before any of its values: what
- * `wrapMultipart`, `renderPart` and `buildAttachmentPart` emit for a part
- * whose filename, media type, disposition and content are all empty. Each
- * term is emitted verbatim on every path — `foldHeader` returns a short
- * line as-is and re-joins a long one from its tokens with at least one
- * space between them, so the space after `Name:` and the one after `;` are
- * floors, not counts — and a fold's `CRLF SP` only adds. The boundary's
- * random suffix is left out: `makeBoundary` strips `+`, `/` and `=`, so it
- * has no provable minimum, and `mixed` is the shortest prefix an attachment
- * part can sit under.
+ * Framing every attachment part costs with empty values. The random boundary
+ * suffix has no provable minimum, so it is not counted.
  */
 const ATTACHMENT_PART_MIN_OCTETS: number =
   CRLF.length + // the join between this part and the one before it
@@ -1539,85 +1218,23 @@ const ATTACHMENT_PART_MIN_OCTETS: number =
   CRLF.length; // the blank line before the body
 
 /**
- * Cap on the attachment COUNT, checked against the raw list in
- * `normalizeEmail` before a single entry is normalized.
- *
- * Every part costs at least `ATTACHMENT_PART_MIN_OCTETS` of framing plus
- * its filename twice, and `normalizeAttachment` refuses an empty filename,
- * so the size projection in `buildMime` charges a part at least 119 octets
- * and refuses one more part than this whatever else the message holds.
- * That projection runs only after `normalizeEmail` has normalized EVERY
- * entry, and `MAX_ATTACHMENT_BYTES_TOTAL` cannot bound that loop for a
- * zero-byte attachment — its running total never advances — while the
- * normalized copy (the object, a fresh `Uint8Array`, the `TextEncoder`
- * that made it) costs about 275 bytes of live heap per entry. Measured, 2M
- * empty attachments terminated a 128 MB isolate in 0.3 s instead of
- * returning `MIME_ERROR`; this many normalize in 24 MB and are then refused
- * by the post-render size check under the same ceiling.
- *
- * Derived, not chosen: it is exactly the largest count the projection can
- * admit, so this cannot reject a message that would have been accepted, and
- * `buildMime` remains the authority on the final size. Same class as
- * `MAX_ATTACHMENT_BYTES_TOTAL` — a developer-experience guardrail on the
- * app's own input, not the security boundary.
+ * Cap on the attachment count, checked before any entry is normalized:
+ * zero-byte entries never advance the byte total. It is the most parts
+ * `buildMime`'s size projection can admit, so it refuses nothing that fits.
  */
 export const MAX_ATTACHMENTS: number = Math.floor(
   MAX_MESSAGE_BYTES / (ATTACHMENT_PART_MIN_OCTETS + 2),
 );
 
-/**
- * Octets every custom header costs around its value: the `: ` after the
- * name and the CRLF that ends its line. Exact, not a floor, once the name
- * is counted: `buildMime` renders each non-reserved custom header through
- * `foldHeader`, which emits the name verbatim, then `: ` — or, when the
- * value's first token does not fit beside the name, `:` CRLF SP, which is
- * more — and `join(CRLF)` ends every header line, a custom header never
- * being the last of the block (the body part's own headers follow it).
- */
+/** `: ` and the CRLF around a custom header value; exact once the name is counted. */
 const CUSTOM_HEADER_FRAMING_OCTETS: number = ': '.length + CRLF.length;
 
 /**
- * Lower bound on the octets of every header `buildMime` renders from
- * caller-supplied values: `Subject`, the custom headers, the addresses in
- * `From`, `To`, `Cc` and `Reply-To`, the `In-Reply-To` / `References` pair
- * `replyEmail` threads through (remote-sender controlled, up to the whole
- * inbound message), and each attachment part's `Content-Type`, `Content-ID`
- * and — twice, once per header it is rendered into — filename. `Bcc` is
- * never rendered and a reserved custom header is dropped, so neither is
- * counted — charging either could reject a message that fits. The fixed
- * `Name: ` and `CRLF` of the headers `buildMime` itself names — `Subject`,
- * the address lists, the threading pair — are omitted for the same reason
- * a lower bound may omit any term. They are NOT omitted where the caller
- * controls the name or the count, because there they can be the whole
- * message:
- *
- * - A custom header's name is rendered verbatim, and `normalizeEmail`
- *   bounds ONE name at under a kilobyte, not the sum, nor the count. With
- *   empty values the names and the `: ` CRLF around each are the entire
- *   size, and the framing is exact once the name is counted (see
- *   `CUSTOM_HEADER_FRAMING_OCTETS`), so charging both cannot reject a
- *   message that fits. Uncharged, 60k empty headers with 500-character
- *   names (a 30 MB message) would project to zero.
- * - An attachment part: `normalizeAttachment` bounds ONE filename at under
- *   a kilobyte, not the sum, and a message is free to carry any number of
- *   parts, so the filename and the framing every part is wrapped in are
- *   the whole size of a message of empty attachments. Measured, 50k
- *   zero-byte attachments with legal 986-character filenames rendered to
- *   106 MB — held three to four times over between the parts, their join,
- *   `rawText` and `raw` — and terminated a 128 MB isolate before the final
- *   size check could return `MIME_ERROR`.
- *
- * The header COUNT is deliberately not bounded here. Each header costs
- * at least five octets (a one-character name, `: `, CRLF), so the count
- * the projection can admit is finite, and past a few hundred thousand keys
- * the caller's own object — measured at about 74 bytes per key, before
- * `sendEmail` is called — is the dominant cost, which no check inside this
- * module can pre-empt. Rendering does add live heap per header (about
- * 150 bytes: two `Object.entries`, the `topHeaders` pair, the folded line),
- * so a legal message of 500k four-character headers still does not fit a
- * 128 MB isolate while one of 400k does; a bound on that would be the
- * framework's own number — the platform proxy bounds bytes, not headers —
- * and is left as a product decision rather than invented here.
+ * Lower bound on every header rendered from caller values. Bcc and reserved
+ * custom headers never render, and the fixed framing of Void's own headers
+ * is omitted. A custom header's name and framing, and each attachment part's
+ * framing and filename (twice), are charged: a message of many empty headers
+ * or attachments is all framing.
  */
 function minHeaderOctets(email: NormalizedEmail): number {
   let octets = minHeaderValueOctets(email.subject);
@@ -1644,10 +1261,7 @@ function minHeaderOctets(email: NormalizedEmail): number {
     octets += minVerbatimOctets(email.threading.references);
   }
   for (const att of email.attachments) {
-    // The filename sits inside a quoted-string in both `name="…"` and
-    // `filename="…"`, and `foldHeader` never splits a quoted-string, so
-    // every code unit of it — whitespace included — is at least one octet
-    // on each line; `quoteParam`'s escapes only add.
+    // The filename is quoted twice and never folds, so whitespace counts too.
     octets += ATTACHMENT_PART_MIN_OCTETS + 2 * att.filename.length;
     octets += minVerbatimOctets(att.contentType);
     if (att.contentId) {
@@ -1661,7 +1275,7 @@ function generateMessageId(fromEmail: string): string {
   const domain = fromEmail.split('@')[1] ?? 'localhost';
   const bytes = new Uint8Array(12);
   crypto.getRandomValues(bytes);
-  const id = base64(bytes).replace(/[+/=]/g, '');
+  const id = bytesToBase64(bytes).replace(/[+/=]/g, '');
   return `<${id}@${domain}>`;
 }
 
@@ -1670,18 +1284,9 @@ function generateMessageId(fromEmail: string): string {
  * generated Message-ID header so callers can surface it in the result.
  */
 export function buildMime(email: NormalizedEmail): { raw: Uint8Array; messageId: string } {
-  // Project the message size BEFORE rendering anything — headers included.
-  // The final check below sees the message only after every header has been
-  // encoded and folded and every body quoted-printable encoded, all of it
-  // rendered into `rawText` and encoded again. Measured, that peak is about
-  // 11x the UTF-8 bytes of a non-ASCII body, and `encodeWord` alone holds
-  // over 3x the UTF-8 bytes of a non-ASCII header (its array of encoded
-  // words plus their join) before the fold, the join, `rawText` and `raw`
-  // each add another copy of the rendered header. A body several times over the
-  // limit, or a 20 MB subject or display name, terminated a 128 MB isolate
-  // instead of returning the `MIME_ERROR` the guide promises. Each term is
-  // a lower bound on the rendered size, so this never rejects a message
-  // that would have fit; the final check stays the authority.
+  // Project the size before rendering, which holds several copies of the
+  // message: an oversize body or header must fail with `MIME_ERROR`, not
+  // exhaust the isolate. Each term is a lower bound; the final check rules.
   const projected =
     minHeaderOctets(email) +
     (email.text ? minBodyOctets(email.text) : 0) +
@@ -1770,23 +1375,9 @@ export function buildMime(email: NormalizedEmail): { raw: Uint8Array; messageId:
   const rawText = headerBlock + CRLF + CRLF + bodyPart.body;
   const raw = new TextEncoder().encode(rawText);
 
-  // RFC 5322 §2.1.1 makes 998 octets per line a MUST, and RFC 5321
-  // §4.5.3.1.6 caps an SMTP text line at 1000 including CRLF. `foldHeader`
-  // can only fold at whitespace (§3.2.2), so a long token with none —
-  // a JWT, a signed URL, a machine-generated Message-ID — cannot be folded
-  // at all and leaks through both its single-chunk early return AND its
-  // fold loop, which still gives an over-long chunk its own line.
-  //
-  // Checked here, after rendering, rather than per field: this is the only
-  // place that sees every header path at once, including the header NAME
-  // and the `filename=` / `name=` / `Content-ID` parameters that are built
-  // outside `foldHeader`. Encoding the value instead of rejecting is not a
-  // general remedy — RFC 2047 §5 permits encoded-words only in unstructured
-  // fields, comments and phrases, so it is illegal in `References`,
-  // `In-Reply-To`, `Content-ID` and parameter values, where a receiver
-  // would read `=?UTF-8?B?…?=` as a literal id or filename. Truncating
-  // silently corrupts: a clipped `References` breaks threading with no
-  // signal, a clipped `Content-ID` orphans a `cid:` reference.
+  // RFC 5322 §2.1.1: at most 998 octets per line, and a token without
+  // whitespace cannot fold. Checked after rendering, the only place that sees
+  // every header path; encoding or truncating would corrupt ids and names.
   const overlong = findOverlongLine(rawText);
   if (overlong !== undefined) {
     throw new MimeError(
diff --git a/packages/void/src/runtime/email/testing.ts b/packages/void/src/runtime/email/testing.ts
index 6e2c38b1c..2131e45a7 100644
--- a/packages/void/src/runtime/email/testing.ts
+++ b/packages/void/src/runtime/email/testing.ts
@@ -194,28 +194,14 @@ async function buildSyntheticRaw(opts: InboundDeliverOptions): Promise<Uint8Arra
   return buildMime(normalized).raw;
 }
 
-/**
- * Thrown by `parseHeaderBlock` at the first distinct name past its cap —
- * the router's `InboundTooManyHeadersError` (`email-router.ts`).
- */
+/** The router's `InboundTooManyHeadersError` (`email-router.ts`). */
 class InboundTooManyHeadersError extends Error {}
 
 /**
- * Headers of a raw MIME message, up to the first blank line.
- *
- * Unfolds continuation lines (RFC 5322 §2.2.3: a line starting with WSP
- * continues the one before it). Anything it cannot parse is skipped rather
- * than thrown, because a test may deliver deliberately malformed bytes.
- *
- * `maxDistinct` is the router's header-count admission (`buildEnvelope` in
- * `email-router.ts`): it walks the bag Cloudflare built from the wire and
- * refuses at the cap, BEFORE any entry past it is materialized. That bag is
- * a `Headers`, so the unit is the DISTINCT, case-insensitive name — a
- * repeated `Received:` is one entry, and a continuation line is part of the
- * one before it, never its own. The check sits in the same walk, checked
- * before the `set`, so an over-cap message costs this harness the same
- * `maxDistinct + 1` names it costs the router. A name a `Headers` refuses
- * is not in the bag on either side, so it does not count.
+ * Unfolded headers of a raw message, up to the first blank line. Unparsable
+ * lines are skipped so malformed fixtures still reach the handler. Like the
+ * router's `buildEnvelope`, refuses more than `maxDistinct` distinct
+ * case-insensitive names before materializing more.
  */
 function parseHeaderBlock(raw: Uint8Array, maxDistinct: number): Headers {
   const headers = new Headers();
@@ -250,8 +236,7 @@ function parseHeaderBlock(raw: Uint8Array, maxDistinct: number): Headers {
     }
     current = '';
   };
-  // One line at a time rather than `split`, so the lines past the cap are
-  // never materialized either.
+  // Line by line, not `split`, so lines past the cap are never materialized.
   for (let pos = 0; pos <= block.length;) {
     const nl = block.indexOf('\r\n', pos);
     const line = nl === -1 ? block.slice(pos) : block.slice(pos, nl);
@@ -282,32 +267,11 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
   async function deliver(input: InboundDeliverOptions): Promise<InboundDeliveryResult> {
     const raw = await buildSyntheticRaw(input);
 
-    // The managed router's ADMISSION, before anything else looks at the
-    // bytes (`routeInbound` in `email-router.ts`): a message over
-    // `MAX_INBOUND_BYTES` is rejected from `rawSize` before its body is
-    // read, then `buildEnvelope` refuses one with more than
-    // `MAX_INBOUND_HEADERS` distinct names — each with a reject the handler
-    // never sees, because it is never invoked. Same order, same reasons, same
-    // outcome: one reject, no handler call. Platform lane only — a worker on
-    // your own Cloudflare account (`slug: null`) has no router in front of
-    // it, so Cloudflare hands the handler everything it accepts.
-    //
-    // The router prefixes every reason with the zone it serves
-    // (`EMAIL_SENDER_DOMAIN`). It is the catch-all rule on that zone, so the
-    // wire recipient's domain IS that zone and the harness recovers the label
-    // from the address it was given; `void email` is the router's own
-    // fallback when the var is unset. The size check reads `byteLength`: it
-    // runs BEFORE `parseHeaderBlock` decodes anything.
-    //
-    // Production's `buildEnvelope` copies every wire header verbatim, so
-    // `message.headers` and `message.raw` agree by construction. Start from
-    // the bytes for the same reason: the harness's own synthetic MIME
-    // carries a generated `Message-ID` that `replyEmail` threads on, and a
-    // caller-supplied `raw:` carries the exact wire headers to deliver.
-    //
-    // A hand-rolled header split rather than postal-mime, so a deliberately
-    // malformed `raw:` fixture still reaches the handler instead of
-    // throwing PARSE_FAILED inside the harness.
+    // Mirrors the router's admission (`routeInbound` in `email-router.ts`):
+    // size, then distinct-header count, each a reject before any handler
+    // runs, prefixed with the zone (the recipient's domain). Own-account
+    // (`slug: null`) has no router. Headers come from the bytes, as
+    // production copies the wire headers.
     let headers: Headers;
     if (opts.slug === null) {
       headers = parseHeaderBlock(raw, Infinity);
@@ -326,18 +290,13 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
         throw e;
       }
     }
-    // The caller's own headers win, so an explicit override stays an escape
-    // hatch. Applied AFTER admission: they are not on the wire, so the
-    // router never counted them.
+    // The caller's own headers win, applied after admission: they are not on
+    // the wire.
     for (const [k, v] of new Headers(input.headers ?? {})) {
       headers.set(k, v);
     }
-    // Subject is NOT re-set from `input.subject`. The bytes already carry it,
-    // and they carry it the way the wire does: `buildMime` RFC 2047-encodes a
-    // non-ASCII subject, and production hands the handler that encoded form.
-    // Overriding with the decoded string here would make
-    // `message.headers.get('Subject')` differ between harness and production
-    // for any non-ASCII subject — the pattern the guide itself shows.
+    // Subject is not re-set from `input.subject`: the bytes carry the RFC
+    // 2047-encoded form production hands the handler.
     if (!headers.has('Subject') && input.subject) {
       headers.set('Subject', input.subject);
     }
@@ -348,13 +307,6 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
       headers.set('To', input.to);
     }
 
-    // Mirror production: the dispatcher strips the platform-injected
-    // `<slug>+` prefix from message.to before user code sees it. When the
-    // harness was created with an explicit `slug`, use that; otherwise
-    // infer it from this delivery's recipient (the part before the first
-    // `+`). Inference keeps existing tests with `slug+tag@domain` recipients
-    // working without configuration. Falls back to the verbatim address
-    // if no `+` is present.
     const slug = (() => {
       if (opts.slug === null) {
         return undefined;
@@ -367,17 +319,8 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
       return plus === -1 ? undefined : local.slice(0, plus);
     })();
 
-    // The message the handler sees is production's own proxy, built the way
-    // the generated `email()` entry builds it: from an envelope and the slug.
-    // Everything the proxy enforces — setReject is terminal, the 100-action
-    // queue, the address checks (length and shape), the header-record check, the
-    // per-reply and per-delivery byte bounds — therefore throws here at the
-    // same call, with the same error, as it does after deploy. The proxy also
-    // makes `raw` replayable,
-    // as the platform lane does.
-    //
-    // `Object.fromEntries` is what the platform router's `buildEnvelope`
-    // does with the native message's headers.
+    // Production's own proxy, built as the generated `email()` entry builds
+    // it, so every proxy check throws here as it does after deploy.
     const { message, getActions } = createMessageProxy(
       {
         from: input.from,
@@ -398,24 +341,12 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
       },
     } as unknown as ExecutionContext;
 
-    // Mirror the production dispatcher's slug-strip: on the platform the
-    // recipient is `<projectSlug>+<tag>@mail.example.com` and the dispatcher
-    // strips through the first `+` before matching. The test harness must do
-    // the same so tests don't pass against routing paths that can't occur in
-    // production. With `slug: null` (own-account deploy) nothing is stripped
-    // and the full local part is matched, exactly as the dispatcher does with
-    // no `__VOID_PROJECT_SLUG` configured.
-    // Case is PRESERVED and the patterns carry the `i` flag instead, exactly
-    // as the generated dispatcher does (`router/compile.ts`). Lowercasing
-    // here would lowercase the CAPTURED groups too, so a handler under test
-    // would see `t-42` for `support+T-42@` while production hands it `T-42` —
-    // a green test asserting behavior the deployed code does not have.
+    // Case is preserved and patterns match with `i`, as the generated
+    // dispatcher does, so captured params keep their case. On the platform a
+    // recipient without `+` has no tag, so only `_default` can take it.
     const fullLocal = input.to.split('@')[0] ?? '';
     const plus = fullLocal.indexOf('+');
     const local = opts.slug === null ? fullLocal : plus === -1 ? '' : fullLocal.slice(plus + 1);
-    // Note: on the platform a recipient with no `+` (e.g. `slug@mail.example.com`)
-    // has no tag to match — production lands at `_default` if defined, otherwise
-    // no-op. We mirror that here.
 
     async function dispatch(): Promise<InboundDeliveryResult> {
       for (const route of compiled) {
@@ -437,17 +368,8 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
         await defaultHandler(message, env, ctx, info);
         return { handler: '_default', params: {} };
       }
-      // Nothing matched and there is no `_default`. The generated dispatcher
-      // rejects here so the remote MTA gets a non-delivery report
-      // (`router/compile.ts`), and the harness has to mirror that or a test
-      // for catch-all or anti-spam behavior observes an ACCEPTED message
-      // where deployment bounces it. Routed through `setReject` rather than
-      // pushed directly, so the terminal-reject semantics stay identical.
-      //
-      // The reason is byte-for-byte the dispatcher's, built from the WIRE
-      // recipient with its original case — that string reaches the sender's
-      // DSN, and rebuilding it from the stripped or lowercased address would
-      // recreate the divergence class this mirroring exists to prevent.
+      // No match and no `_default`: the dispatcher (`router/compile.ts`)
+      // rejects with this exact reason, built from the wire recipient.
       message.setReject(
         `no handler matched recipient "${input.to}" — add email/_default.ts to handle unmatched mail`,
       );
@@ -455,10 +377,7 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
     }
 
     const result = await dispatch();
-    // Recorded once the handler has returned, as production enacts them: a
-    // handler that throws leaves nothing — the platform router rejects the
-    // message as a handler error, and on your own account the invocation
-    // fails before `enactEmailActions` runs.
+    // Recorded after the handler returns: a throwing handler enacts nothing.
     record(getActions());
     deliveries.push(result);
     return result;
@@ -473,10 +392,8 @@ export function createInboundTestHarness(opts: InboundTestHarnessOptions): Inbou
     return result;
   }
 
-  // The proxy already made `setReject` terminal — earlier forward/reply
-  // entries purged, later ones dropped — so the queue is exactly what the
-  // router would enact. A forward's headers cross the queue as the record
-  // the proxy validated; the capture hands them back as `Headers`.
+  // The proxy already made `setReject` terminal, so the queue is what the
+  // router would enact.
   function record(actions: ReadonlyArray<EmailAction>): void {
     for (const action of actions) {
       switch (action.type) {
diff --git a/packages/void/src/runtime/email/types.ts b/packages/void/src/runtime/email/types.ts
index 334d82b95..3c910e3af 100644
--- a/packages/void/src/runtime/email/types.ts
+++ b/packages/void/src/runtime/email/types.ts
@@ -17,12 +17,11 @@ export interface Attachment {
 
 export interface SendEmailOptions {
   /**
-   * Sender envelope address. Optional — when omitted, the framework
-   * substitutes `<__VOID_PROJECT_SLUG>+noreply@<__VOID_EMAIL_DOMAIN>`
-   * from the two platform-injected bindings (the project slug and the
-   * mail domain configured for this environment). Outside a deployed
-   * worker, or whenever either binding is missing, `sendEmail` returns
-   * `INVALID_FROM` — it never falls back to a baked-in domain.
+   * Sender envelope address. Optional. When omitted, `void dev` and
+   * `void deploy --platform cloudflare` use `email.from` from void.config.ts,
+   * and a Void platform deploy uses `<project-slug>+noreply@<mail-domain>`.
+   * Without either, `sendEmail` returns `INVALID_FROM`; it never falls back
+   * to a baked-in domain.
    */
   from?: Address;
   to: Address | Array<Address>;
diff --git a/packages/void/src/runtime/env-public.ts b/packages/void/src/runtime/env-public.ts
index 728de72b0..058c88380 100644
--- a/packages/void/src/runtime/env-public.ts
+++ b/packages/void/src/runtime/env-public.ts
@@ -117,21 +117,10 @@ export function defineEnv<S extends AnySchema>(schema: S): InferEnv<S> {
 }
 
 /**
- * Internal: validate the entire schema against the worker's actual env on
- * the first request per isolate. Catches bad remote-secret values and
- * post-deploy drift that the deploy CLI can't see (it only knows secret
- * names, not their values).
- *
- * Spliced into the generated worker entry by `compileWorkerEntry`. Cached
- * after the first call so subsequent requests pay no cost.
- *
- * Async lifecycle: this function awaits any async Standard Schema
- * validators (zod `refine`, arktype async narrows, etc.) and seeds the
- * per-key cache with the resolved values. Subsequent reads via `env.X`
- * hit the sync cache — async work only happens here, at boot. If a user
- * accesses `env.X` for a key with an async validator *before* this
- * function has run (e.g. during module-top-level code), the proxy will
- * throw with guidance pointing back to this boot-time pre-validation.
+ * Internal: validate the whole schema against the worker env once per isolate,
+ * from the generated worker entry. Catches remote-secret values the deploy CLI
+ * cannot see. Async validators are awaited here and their values cached, so
+ * later synchronous `env.X` reads can serve them.
  */
 export async function _validateEnvOnce(envValues: unknown): Promise<void> {
   if (registry.bootValidation) {
@@ -152,20 +141,12 @@ export async function _validateEnvOnce(envValues: unknown): Promise<void> {
   };
   const report = await validateAllEnvWithValues(registry.schema, values);
   if (report.valid) {
-    // Seed the sync cache with already-validated values so subsequent
-    // `env.X` reads (including ones with async validators) hit the cache
-    // instead of re-running validation. The cache key is the current raw
-    // runtime env (matches what `readKey` will use). If no runtime env is
-    // bound (e.g. called in an isolated test), skip seeding — the validator
-    // result is still cached via registry.bootValidation.
+    // Seed the per-key cache, keyed by the raw env as in `readKey`.
     try {
       const cacheKey = getRawRuntimeEnv() as object;
       const cache = getValidatedCache(cacheKey);
       for (const [key, value] of report.values) {
-        // Never seed internal framework bindings (__VOID_*, __PROJECT_*, and —
-        // while ISR is active — ISR_CACHE), even when the user's schema
-        // declares one: `env.X` must not expose them. `readKey` also
-        // short-circuits internal names.
+        // Internal bindings stay hidden even when the schema declares them.
         if (isInternalBinding(key, cacheKey as RuntimeEnv)) {
           continue;
         }
@@ -251,10 +232,7 @@ export class EnvValidationError extends Error {
   readonly issues: Array<StandardSchemaV1.Issue>;
 
   constructor(key: string, issues: Array<StandardSchemaV1.Issue>) {
-    // Messages supplied to this constructor are expected to be pre-redacted
-    // by the caller (readKey / _validateEnvOnce / validateAllEnvWithValues).
-    // We intentionally don't re-scan here — we don't know the raw value at
-    // this point in the chain — so the contract is enforced upstream.
+    // Callers redact messages first; the raw value is not known here.
     super(`Invalid env "${key}": ${issues.map((i) => i.message).join(', ')}`);
     this.name = 'EnvValidationError';
     this.key = key;
@@ -263,18 +241,11 @@ export class EnvValidationError extends Error {
 }
 
 function readKey(key: string): unknown {
-  // Internal framework bindings (__VOID_*, __PROJECT_*, and — while ISR is
-  // active — ISR_CACHE) are never exposed through the public `env` proxy —
-  // treat them as absent BEFORE consulting the schema/cache. This holds even
-  // when a user's defineEnv schema declares one and boot validation seeded its
-  // raw value; returning `undefined` matches the "not in schema / not found"
-  // behavior of the filtered env. The exact-name (ISR_CACHE) gate needs the raw
-  // env, so resolve it up front and reuse it as the cache key below.
+  // Internal bindings stay hidden even when the schema declares them.
   const rawEnv = getRawRuntimeEnv();
   if (isInternalBinding(key, rawEnv)) {
     return undefined;
   }
-  // Filtered env hides internal __VOID_*/__PROJECT_* bindings from user code.
   const filtered = getRuntimeEnv() as Record<string, unknown>;
   const clientValues = getClientEnvValues();
   const rawValue = Object.hasOwn(clientValues, key) ? clientValues[key] : filtered[key];
@@ -317,13 +288,7 @@ function readKey(key: string): unknown {
 /**
  * Typed env proxy. Reads from the runtime env, validating declared keys
  * on first access and passing through bindings / unknown keys unchanged.
- *
- * Sync-only: the `get` trap must be synchronous, so validators that return
- * a `Promise` cannot be awaited here. For async Standard Schema validators,
- * `_validateEnvOnce()` pre-resolves them at worker boot and seeds the
- * per-env cache; property reads then serve the cached value synchronously.
- * If an async validator is encountered here without a prior pre-validation,
- * the trap throws with guidance on how to resolve it.
+ * Async validators must be resolved first by `_validateEnvOnce()`.
  */
 export const env = new Proxy({} as Record<string, unknown>, {
   get(_target, key) {
diff --git a/packages/void/src/runtime/env-raw.ts b/packages/void/src/runtime/env-raw.ts
index 6deace7a6..908763d1d 100644
--- a/packages/void/src/runtime/env-raw.ts
+++ b/packages/void/src/runtime/env-raw.ts
@@ -12,29 +12,12 @@ export type RuntimeEnv = Record<string, unknown>;
 export const INTERNAL_BINDING_PREFIXES = ['__VOID_', '__PROJECT_'] as const;
 
 /**
- * Exact binding names that must be hidden from user code even though they carry
- * no internal prefix. `ISR_CACHE` (the self-host ISR KV namespace) is a plain
- * binding name, but it is a framework internal — route handlers read the ISR
- * cache through `handleIsr`/`revalidate()` on the raw env, never via `c.env` or
- * the public `void/env` API. Single source of truth shared by the generated
- * `c.env` filter (`router/compile.ts`) and the runtime `env` filter (`env.ts`).
- *
- * Unlike the prefix internals, these are hidden ONLY when ISR is active for the
- * isolate (see {@link isIsrActive}). In a non-ISR app, `ISR_CACHE` is an
- * ordinary user binding and stays visible everywhere — matching the build-time
- * `isr` gate on the generated `c.env` filter.
+ * Framework bindings hidden from user code only while ISR is active, so a non-ISR
+ * app keeps its own `ISR_CACHE`. Shared with the generated `c.env` filter.
  */
 export const INTERNAL_BINDING_EXACT_NAMES = ['ISR_CACHE'] as const;
 
-/**
- * ISR is active for this isolate iff the framework has stamped the compile-time
- * deployment id onto the raw env (`__VOID_ISR_DEPLOYMENT_ID`). The generated
- * worker entry stamps it at the top of `fetch()` (and in cron/queue handlers)
- * only for ISR-emitting builds, so its presence is a reliable runtime signal
- * that `ISR_CACHE` should be treated as a framework internal. The id itself is a
- * `__VOID_`-prefixed binding that is always hidden and framework-controlled, so
- * a user cannot forge it.
- */
+/** Only ISR builds stamp the `__VOID_ISR_DEPLOYMENT_ID` binding onto the raw env. */
 export function isIsrActive(rawEnv: RuntimeEnv): boolean {
   return rawEnv.__VOID_ISR_DEPLOYMENT_ID != null;
 }
diff --git a/packages/void/src/runtime/env.ts b/packages/void/src/runtime/env.ts
index 7b4de62b8..2e39cd786 100644
--- a/packages/void/src/runtime/env.ts
+++ b/packages/void/src/runtime/env.ts
@@ -58,18 +58,7 @@ export function withRuntimeEnv<T>(env: unknown, fn: () => T): T {
   return envContext.run(resolved, () => runtimeRequestContext.run(scope, fn));
 }
 
-/**
- * Shared internal-binding predicate. A binding is framework-internal — and must
- * never be exposed to user code — when it carries an internal prefix
- * (`__VOID_`, `__PROJECT_`; always hidden) or is an exact-name internal (e.g.
- * `ISR_CACHE`; hidden ONLY while ISR is active for the isolate). `rawEnv` is the
- * unfiltered runtime env, consulted via {@link isIsrActive} to gate the
- * exact-name check so a non-ISR app's own `ISR_CACHE` binding stays visible —
- * matching the build-time `isr` gate on the generated `c.env` filter.
- *
- * Single source of truth for the runtime `env` filter here and the public
- * `void/env` proxy (`env-public.ts`).
- */
+/** Whether `name` is a framework binding hidden from user code; `rawEnv` is the unfiltered env. */
 export function isInternalBinding(name: string, rawEnv: RuntimeEnv): boolean {
   if (INTERNAL_BINDING_PREFIXES.some((p) => name.startsWith(p))) {
     return true;
diff --git a/packages/void/src/runtime/handler.ts b/packages/void/src/runtime/handler.ts
index 192cebea7..88356f4f7 100644
--- a/packages/void/src/runtime/handler.ts
+++ b/packages/void/src/runtime/handler.ts
@@ -2,6 +2,7 @@ import type { Context, Env, MiddlewareHandler } from 'hono';
 import type { RewriteDestination } from 'void/routes';
 import type { HeadDescriptor } from '../pages/head.ts';
 import type { AuthSession, AuthUser } from './auth.ts';
+import { base64ToBytes } from './base64.ts';
 import { convertReturnValue } from './response.ts';
 import { runValidation, type ValidatorSlots, type HandlerInput } from './validator.ts';
 
@@ -309,8 +310,7 @@ function parseBasicAuthHeader(authorization: string | null) {
 
   try {
     const encoded = authorization.slice(6).trim();
-    const binary = atob(encoded);
-    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    const bytes = base64ToBytes(encoded);
     const decoded = basicAuthDecoder.decode(bytes);
     const separator = decoded.indexOf(':');
     if (separator === -1) {
diff --git a/packages/void/src/runtime/isr.ts b/packages/void/src/runtime/isr.ts
index 9dae39b63..2deaccf5f 100644
--- a/packages/void/src/runtime/isr.ts
+++ b/packages/void/src/runtime/isr.ts
@@ -36,21 +36,12 @@ export async function revalidate(options: RevalidateOptions): Promise<void> {
   const rawEnv = getRawRuntimeEnv();
   const proxy = rawEnv.__VOID_PROXY as Fetcher | undefined;
   if (!proxy) {
-    // Self-host — no platform proxy. Purge this worker's own ISR cache: KV
-    // entries (global, authoritative) plus the caches.default edge variants.
-    // When ISR_CACHE / deployment id are absent (e.g. local dev with no ISR
-    // binding), this is a silent no-op.
     const kv = rawEnv.ISR_CACHE as KVNamespace | undefined;
     const id = rawEnv.__VOID_ISR_DEPLOYMENT_ID as string | undefined;
     if (!kv || !id) {
       return;
     }
     const requestHost = rawEnv.__VOID_ISR_HOST as string | undefined;
-    // Cache keys are deployment- and host-scoped, so a purge must
-    // target a concrete (host, path). Delete KV first and unconditionally — the
-    // authoritative purge must never depend on the Cache API — then best-effort
-    // purge the per-host edge variants, guarded so a degraded `caches.default`
-    // (scheduled/queue handlers, or no Cache API) cannot fail the KV delete.
     const purgeKey = async (
       host: string,
       path: string,
@@ -59,14 +50,13 @@ export async function revalidate(options: RevalidateOptions): Promise<void> {
     ): Promise<void> => {
       await kv.delete(key);
       try {
-        // Cast because this package has both @types/node and @cloudflare/workers-types
-        // in scope, and Node's ambient CacheStorage (which lacks `.default`)
-        // otherwise shadows the Workers one — same pattern as isr-cache.ts.
+        // The DOM lib that the pages client modules reference declares
+        // CacheStorage without `.default`, shadowing the Workers type here.
         const cache = (caches as unknown as { default: Cache }).default;
         await cache.delete(isrEdgeCacheUrlForToken(host, path, id, 'html', variantToken));
         await cache.delete(isrEdgeCacheUrlForToken(host, path, id, 'json', variantToken));
       } catch {
-        // Fail open — a degraded Cache API must not fail the authoritative KV purge.
+        // Best effort: a degraded Cache API must not fail the KV purge.
       }
     };
     const purgePath = async (host: string, path: string): Promise<void> => {
@@ -82,9 +72,8 @@ export async function revalidate(options: RevalidateOptions): Promise<void> {
       } while (cursor);
     };
     if (options.all) {
-      // Enumerate the actual host-scoped cache keys (registry-independent, so it
-      // is complete even for a host that was never registered). Split the host
-      // off the key tail before denormalizing the remaining pathname.
+      // Scan KV keys instead of the host registry so hosts that were never
+      // registered are purged too.
       const prefix = isrPrefix(id);
       let cursor: string | undefined;
       do {
diff --git a/packages/void/src/runtime/live-names.ts b/packages/void/src/runtime/live-names.ts
new file mode 100644
index 000000000..7cb307e89
--- /dev/null
+++ b/packages/void/src/runtime/live-names.ts
@@ -0,0 +1,22 @@
+import { bytesToBase64 } from './base64.ts';
+
+export async function topicDigest(streamId: string, topic: string): Promise<string> {
+  const bytes = new TextEncoder().encode(`${streamId}\u0000${topic}`);
+  const digest = await crypto.subtle.digest('SHA-256', bytes);
+  return bytesToBase64(new Uint8Array(digest))
+    .replaceAll('+', '-')
+    .replaceAll('/', '_')
+    .replace(/=+$/, '');
+}
+
+export function connectionInstanceName(streamId: string, connectionId: string): string {
+  return `live:${streamId}:connection:${connectionId}`;
+}
+
+export function topicInstanceName(streamId: string, topicKey: string): string {
+  return `live:${streamId}:topic:${topicKey}`;
+}
+
+export function internalUrl(path: string): string {
+  return `https://void.live${path}`;
+}
diff --git a/packages/void/src/runtime/live-server.ts b/packages/void/src/runtime/live-server.ts
index 58d17fd84..f42e4a196 100644
--- a/packages/void/src/runtime/live-server.ts
+++ b/packages/void/src/runtime/live-server.ts
@@ -1,3 +1,9 @@
+import {
+  connectionInstanceName,
+  internalUrl,
+  topicDigest,
+  topicInstanceName,
+} from './live-names.ts';
 import {
   __getLiveBindingName,
   type LiveClientEvent,
@@ -679,22 +685,3 @@ function subscriberPrefix(streamId: string, topicKey: string): string {
 function subscriberKey(row: SubscriberRow): string {
   return `${subscriberPrefix(row.streamId, row.topicKey)}${row.connectionId}:${row.subscriptionId}:${row.generation}:${row.revision}`;
 }
-
-async function topicDigest(streamId: string, topic: string): Promise<string> {
-  const bytes = new TextEncoder().encode(`${streamId}\u0000${topic}`);
-  const digest = await crypto.subtle.digest('SHA-256', bytes);
-  const binary = String.fromCharCode(...new Uint8Array(digest));
-  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
-}
-
-function connectionInstanceName(streamId: string, connectionId: string): string {
-  return `live:${streamId}:connection:${connectionId}`;
-}
-
-function topicInstanceName(streamId: string, topicKey: string): string {
-  return `live:${streamId}:topic:${topicKey}`;
-}
-
-function internalUrl(path: string): string {
-  return `https://void.live${path}`;
-}
diff --git a/packages/void/src/runtime/live.ts b/packages/void/src/runtime/live.ts
index 709ce941b..e6f8b076c 100644
--- a/packages/void/src/runtime/live.ts
+++ b/packages/void/src/runtime/live.ts
@@ -1,6 +1,12 @@
 import { getUser, type AuthUser } from './auth.ts';
 import { getRawRuntimeEnv } from './env-raw.ts';
 import type { CloudContext, CloudEnv } from './handler.ts';
+import {
+  connectionInstanceName,
+  internalUrl,
+  topicDigest,
+  topicInstanceName,
+} from './live-names.ts';
 
 type MaybePromise<T> = T | Promise<T>;
 
@@ -594,25 +600,6 @@ function assertJsonSerializable(value: unknown): void {
   }
 }
 
-async function topicDigest(streamId: string, topic: string): Promise<string> {
-  const bytes = new TextEncoder().encode(`${streamId}\u0000${topic}`);
-  const digest = await crypto.subtle.digest('SHA-256', bytes);
-  const binary = String.fromCharCode(...new Uint8Array(digest));
-  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
-}
-
-function connectionInstanceName(streamId: string, connectionId: string): string {
-  return `live:${streamId}:connection:${connectionId}`;
-}
-
-function topicInstanceName(streamId: string, topicKey: string): string {
-  return `live:${streamId}:topic:${topicKey}`;
-}
-
-function internalUrl(path: string): string {
-  return `https://void.live${path}`;
-}
-
 class LiveResponseError extends Error {
   constructor(
     readonly code: LiveControlErrorCode,
diff --git a/packages/void/src/runtime/log.ts b/packages/void/src/runtime/log.ts
index e5c545d52..1ace7bc41 100644
--- a/packages/void/src/runtime/log.ts
+++ b/packages/void/src/runtime/log.ts
@@ -17,30 +17,8 @@
 type Fields = Record<string, unknown>;
 
 function format(message: string, fields?: Fields): string {
-  // `msg` first key for greppability; remaining fields after. The `message`
-  // arg always wins over a user-provided `fields.msg` (safer — never silently
-  // drops the explicit primary message).
-  //
-  // Use `Object.create(null)` so the payload has no prototype chain — this
-  // makes assigning `payload.__proto__ = ...` a plain own-property write
-  // instead of triggering the `Object.prototype.__proto__` setter (which
-  // would mutate the payload's prototype and let an inherited `toJSON`
-  // hijack `JSON.stringify`).
-  //
-  // Use `Object.entries` (own enumerable keys only) instead of `for...in` to
-  // avoid copying inherited properties. Skip `toJSON` so a user-provided
-  // method cannot hijack `JSON.stringify(payload)` and emit an arbitrary
-  // shape that bypasses the `msg` contract. Skip `__proto__` and
-  // `constructor` for defense in depth (the null-prototype payload already
-  // neutralizes the `__proto__` setter, but skipping the keys keeps the
-  // intent explicit). Skip function values for the same reason —
-  // `JSON.stringify` would silently drop them, but excluding them explicitly
-  // keeps the output deterministic.
-  //
-  // The whole field-normalization loop runs inside the try/catch because
-  // `Object.entries(fields)` itself may invoke enumerable getters or proxy
-  // traps that throw. A logging call must never propagate exceptions from
-  // user-provided fields.
+  // `message` always wins over `fields.msg`. The loop sits inside the try because
+  // getters and proxy traps on `fields` may throw; logging must never throw.
   try {
     const payload: Record<string, unknown> = Object.create(null);
     payload.msg = message;
@@ -57,9 +35,6 @@ function format(message: string, fields?: Fields): string {
     }
     return JSON.stringify(payload);
   } catch {
-    // Non-stringifiable values (e.g. circular refs) or throwing accessors
-    // /proxy traps — fall back to a safe shape so a logging call never
-    // throws.
     return JSON.stringify({ msg: message, error: 'log: fields not serializable' });
   }
 }
diff --git a/packages/void/src/runtime/migration-handler-mysql.ts b/packages/void/src/runtime/migration-handler-mysql.ts
index 8b971fff1..6a9839c32 100644
--- a/packages/void/src/runtime/migration-handler-mysql.ts
+++ b/packages/void/src/runtime/migration-handler-mysql.ts
@@ -3,7 +3,6 @@ import type { MigrationEntry, MigrationResponse, MigrationResult } from './migra
 export function createMigrationHandler(
   env: Record<string, unknown>,
   migrations: Array<MigrationEntry>,
-  _dialect: 'sqlite' | 'postgresql' | 'mysql',
   runAuthMigrations?: () => Promise<void>,
 ) {
   return async (request: Request): Promise<Response> => {
diff --git a/packages/void/src/runtime/migration-handler-pg.ts b/packages/void/src/runtime/migration-handler-pg.ts
index 792a876e8..a5e93405b 100644
--- a/packages/void/src/runtime/migration-handler-pg.ts
+++ b/packages/void/src/runtime/migration-handler-pg.ts
@@ -4,7 +4,6 @@ import { disablePgPassFallback } from './pg.ts';
 export function createMigrationHandler(
   env: Record<string, unknown>,
   migrations: Array<MigrationEntry>,
-  _dialect: 'sqlite' | 'postgresql' | 'mysql',
   runAuthMigrations?: () => Promise<void>,
 ) {
   return async (request: Request): Promise<Response> => {
diff --git a/packages/void/src/runtime/migration-handler.ts b/packages/void/src/runtime/migration-handler.ts
index cc0513f02..f815914f3 100644
--- a/packages/void/src/runtime/migration-handler.ts
+++ b/packages/void/src/runtime/migration-handler.ts
@@ -4,8 +4,8 @@ import {
   getMigrationPlanHashInput,
   isSingleStatement,
   splitSqlStatements,
-  type MigrationPlanHashInput,
 } from '@void/deploy-core';
+import type { MigrationExecutionPlan, MigrationPlanBundle } from '../migrations/plan.ts';
 
 export type MigrationEntry = {
   name: string;
@@ -33,28 +33,6 @@ export type MigrationResponse = {
   warnings?: Array<string>;
 };
 
-type MigrationExecutionPlan = {
-  name: string;
-  dialect: 'sqlite';
-  classifierVersion: number;
-  sqlHash: string;
-  planHash: string;
-  stability: 'stable' | 'legacy';
-  warnings?: Array<string>;
-} & (
-  | { kind: 'single-statement' }
-  | { kind: 'breakpoint-framed'; statements: Array<string> }
-  | { kind: 'legacy-unsplit-multi-statement'; allowLegacy: boolean }
-);
-
-type MigrationPlanBundle = {
-  protocolVersion: 2;
-  classifierVersion: number;
-  migrationListHash: string;
-  destructiveValidation: 'passed';
-  plans: Array<MigrationExecutionPlan>;
-};
-
 type AttemptRow = {
   attempt_id: string;
   deployment_id: string | null;
@@ -72,7 +50,6 @@ const SUPPORTED_CLASSIFIER_VERSION = 1;
 export function createMigrationHandler(
   env: Record<string, unknown>,
   migrations: Array<MigrationEntry> | undefined,
-  _dialect: 'sqlite' | 'postgresql' | 'mysql',
   runAuthMigrations?: () => Promise<void>,
   planBundle?: MigrationPlanBundle,
 ) {
@@ -669,7 +646,7 @@ async function sha256Hex(value: string): Promise<string> {
 }
 
 async function hashPlan(plan: MigrationExecutionPlan): Promise<string> {
-  return sha256Hex(canonicalJson(getMigrationPlanHashInput(plan as MigrationPlanHashInput)));
+  return sha256Hex(canonicalJson(getMigrationPlanHashInput(plan)));
 }
 
 async function runD1LegacyMigrations(
diff --git a/packages/void/src/runtime/remote/binding-handler.ts b/packages/void/src/runtime/remote/binding-handler.ts
index b3e3428b1..1267e2e28 100644
--- a/packages/void/src/runtime/remote/binding-handler.ts
+++ b/packages/void/src/runtime/remote/binding-handler.ts
@@ -1,8 +1,37 @@
-import { Hono } from 'hono';
+import { Hono, type Context } from 'hono';
+import { base64ToBytes } from '../base64.ts';
 import { parseR2Conditional } from './r2-conditions.ts';
 
-function decodeBase64(value: string): Uint8Array {
-  return Uint8Array.from(atob(value), (ch) => ch.charCodeAt(0));
+type BindingRequest = { binding: string };
+
+/** Parse the body, answer 400 when `invalid` names a problem, and 404 for an unknown binding. */
+async function readBindingRequest<T, B extends BindingRequest>(
+  c: Context,
+  env: Record<string, unknown>,
+  invalid: (body: B) => string | undefined,
+): Promise<{ body: B; binding: T } | Response> {
+  const body = await c.req.json<B>();
+  const error = invalid(body);
+  if (error) {
+    return c.json({ error }, 400);
+  }
+  const binding = env[body.binding] as T | undefined;
+  if (!binding) {
+    return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+  }
+  return { body, binding };
+}
+
+function requireBinding(body: BindingRequest): string | undefined {
+  return body.binding ? undefined : 'binding required';
+}
+
+function requireKey(body: BindingRequest & { key: string }): string | undefined {
+  return body.binding && body.key ? undefined : 'binding and key required';
+}
+
+function r2DeleteKeys(body: { key?: string; keys?: Array<string> }): Array<string> {
+  return body.keys ? body.keys : body.key ? [body.key] : [];
 }
 
 /**
@@ -29,22 +58,14 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   // --- D1 ---
 
   app.post('/d1/query', async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      sql: string;
-      params?: Array<unknown>;
-      method?: string;
-    }>();
-
-    if (!body.binding || !body.sql) {
-      return c.json({ error: 'binding and sql required' }, 400);
-    }
-
-    const db = env[body.binding] as D1Database | undefined;
-    if (!db) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
-    }
-
+    const request = await readBindingRequest<
+      D1Database,
+      { binding: string; sql: string; params?: Array<unknown>; method?: string }
+    >(c, env, (body) => (body.binding && body.sql ? undefined : 'binding and sql required'));
+    if (request instanceof Response) {
+      return request;
+    }
+    const { body, binding: db } = request;
     const stmt = db.prepare(body.sql).bind(...(body.params ?? []));
 
     switch (body.method) {
@@ -75,20 +96,18 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   });
 
   app.post('/d1/batch', async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      statements: Array<{ sql: string; params?: Array<unknown> }>;
-    }>();
-
-    if (!body.binding || !Array.isArray(body.statements)) {
-      return c.json({ error: 'binding and statements required' }, 400);
-    }
-
-    const db = env[body.binding] as D1Database | undefined;
-    if (!db) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+    const request = await readBindingRequest<
+      D1Database,
+      { binding: string; statements: Array<{ sql: string; params?: Array<unknown> }> }
+    >(c, env, (body) =>
+      body.binding && Array.isArray(body.statements)
+        ? undefined
+        : 'binding and statements required',
+    );
+    if (request instanceof Response) {
+      return request;
     }
-
+    const { body, binding: db } = request;
     const stmts = body.statements.map((s) => db.prepare(s.sql).bind(...(s.params ?? [])));
     const results = await db.batch(stmts);
     return c.json(
@@ -103,21 +122,14 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   // --- KV ---
 
   app.post('/kv/get', async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      key: string;
-      type?: string;
-    }>();
-
-    if (!body.binding || !body.key) {
-      return c.json({ error: 'binding and key required' }, 400);
-    }
-
-    const kv = env[body.binding] as KVNamespace | undefined;
-    if (!kv) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
-    }
-
+    const request = await readBindingRequest<
+      KVNamespace,
+      { binding: string; key: string; type?: string }
+    >(c, env, requireKey);
+    if (request instanceof Response) {
+      return request;
+    }
+    const { body, binding: kv } = request;
     const type = body.type ?? 'text';
     if (type === 'json') {
       const val = await kv.get(body.key, 'json');
@@ -141,33 +153,25 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
         headers: { 'content-type': 'application/octet-stream' },
       });
     }
-    // Default: text
-    const val = await kv.get(body.key, 'text');
-    if (val === null) {
-      return c.json(null);
-    }
-    return c.json(val);
+    return c.json(await kv.get(body.key, 'text'));
   });
 
   app.post('/kv/put', async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      key: string;
-      value: unknown;
-      base64?: boolean;
-      expiration?: number;
-      expiration_ttl?: number;
-    }>();
-
-    if (!body.binding || !body.key) {
-      return c.json({ error: 'binding and key required' }, 400);
-    }
-
-    const kv = env[body.binding] as KVNamespace | undefined;
-    if (!kv) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+    const request = await readBindingRequest<
+      KVNamespace,
+      {
+        binding: string;
+        key: string;
+        value: unknown;
+        base64?: boolean;
+        expiration?: number;
+        expiration_ttl?: number;
+      }
+    >(c, env, requireKey);
+    if (request instanceof Response) {
+      return request;
     }
-
+    const { body, binding: kv } = request;
     const opts: KVNamespacePutOptions = {};
     if (body.expiration) {
       opts.expiration = body.expiration;
@@ -178,7 +182,7 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
 
     let value: string | ArrayBuffer;
     if (body.base64 && typeof body.value === 'string') {
-      value = decodeBase64(body.value).buffer as ArrayBuffer;
+      value = base64ToBytes(body.value).buffer as ArrayBuffer;
     } else {
       value = typeof body.value === 'string' ? body.value : JSON.stringify(body.value);
     }
@@ -188,38 +192,27 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   });
 
   app.post('/kv/delete', async (c) => {
-    const body = await c.req.json<{ binding: string; key: string }>();
-
-    if (!body.binding || !body.key) {
-      return c.json({ error: 'binding and key required' }, 400);
-    }
-
-    const kv = env[body.binding] as KVNamespace | undefined;
-    if (!kv) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+    const request = await readBindingRequest<KVNamespace, { binding: string; key: string }>(
+      c,
+      env,
+      requireKey,
+    );
+    if (request instanceof Response) {
+      return request;
     }
-
-    await kv.delete(body.key);
+    await request.binding.delete(request.body.key);
     return c.json({ success: true });
   });
 
   app.post('/kv/list', async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      prefix?: string;
-      limit?: number;
-      cursor?: string;
-    }>();
-
-    if (!body.binding) {
-      return c.json({ error: 'binding required' }, 400);
-    }
-
-    const kv = env[body.binding] as KVNamespace | undefined;
-    if (!kv) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
-    }
-
+    const request = await readBindingRequest<
+      KVNamespace,
+      { binding: string; prefix?: string; limit?: number; cursor?: string }
+    >(c, env, requireBinding);
+    if (request instanceof Response) {
+      return request;
+    }
+    const { body, binding: kv } = request;
     const opts: KVNamespaceListOptions = {};
     if (body.prefix) {
       opts.prefix = body.prefix;
@@ -242,27 +235,22 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   // --- R2 ---
 
   app.post('/r2/get', async (c) => {
-    const body = await c.req.json<{ binding: string; key: string }>();
-
-    if (!body.binding || !body.key) {
-      return c.json({ error: 'binding and key required' }, 400);
-    }
-
-    const bucket = env[body.binding] as R2Bucket | undefined;
-    if (!bucket) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+    const request = await readBindingRequest<R2Bucket, { binding: string; key: string }>(
+      c,
+      env,
+      requireKey,
+    );
+    if (request instanceof Response) {
+      return request;
     }
-
-    const obj = await bucket.get(body.key);
+    const obj = await request.binding.get(request.body.key);
     if (!obj) {
       return c.json(null);
     }
 
     const headers = new Headers();
     headers.set('content-type', obj.httpMetadata?.contentType ?? 'application/octet-stream');
-    if (obj.size !== undefined) {
-      headers.set('content-length', String(obj.size));
-    }
+    headers.set('content-length', String(obj.size));
     if (obj.httpEtag) {
       headers.set('etag', obj.httpEtag);
     }
@@ -271,27 +259,24 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   });
 
   app.on('POST', ['/r2/put', '/r2/put-conditional'], async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      key: string;
-      base64?: string;
-      value?: string;
-      contentType?: string;
-      customMetadata?: Record<string, string>;
-      onlyIf?: unknown;
-    }>();
-
-    if (!body.binding || !body.key) {
-      return c.json({ error: 'binding and key required' }, 400);
-    }
-
-    const bucket = env[body.binding] as R2Bucket | undefined;
-    if (!bucket) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+    const request = await readBindingRequest<
+      R2Bucket,
+      {
+        binding: string;
+        key: string;
+        base64?: string;
+        value?: string;
+        contentType?: string;
+        customMetadata?: Record<string, string>;
+        onlyIf?: unknown;
+      }
+    >(c, env, requireKey);
+    if (request instanceof Response) {
+      return request;
     }
-
+    const { body, binding: bucket } = request;
     const data = body.base64
-      ? decodeBase64(body.base64)
+      ? base64ToBytes(body.base64)
       : new TextEncoder().encode(body.value ?? '');
 
     let onlyIf: R2Conditional | Headers | undefined;
@@ -324,48 +309,32 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   });
 
   app.post('/r2/delete', async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      key?: string;
-      keys?: Array<string>;
-    }>();
-
-    if (!body.binding) {
-      return c.json({ error: 'binding required' }, 400);
-    }
-
-    const keys: Array<string> = body.keys ? body.keys : body.key ? [body.key] : [];
-    if (keys.length === 0) {
-      return c.json({ error: 'key or keys required' }, 400);
-    }
-
-    const bucket = env[body.binding] as R2Bucket | undefined;
-    if (!bucket) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+    const request = await readBindingRequest<
+      R2Bucket,
+      { binding: string; key?: string; keys?: Array<string> }
+    >(
+      c,
+      env,
+      (body) =>
+        requireBinding(body) ??
+        (r2DeleteKeys(body).length === 0 ? 'key or keys required' : undefined),
+    );
+    if (request instanceof Response) {
+      return request;
     }
-
-    await bucket.delete(keys);
+    await request.binding.delete(r2DeleteKeys(request.body));
     return c.json({ success: true });
   });
 
   app.post('/r2/list', async (c) => {
-    const body = await c.req.json<{
-      binding: string;
-      prefix?: string;
-      limit?: number;
-      cursor?: string;
-      delimiter?: string;
-    }>();
-
-    if (!body.binding) {
-      return c.json({ error: 'binding required' }, 400);
-    }
-
-    const bucket = env[body.binding] as R2Bucket | undefined;
-    if (!bucket) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
-    }
-
+    const request = await readBindingRequest<
+      R2Bucket,
+      { binding: string; prefix?: string; limit?: number; cursor?: string; delimiter?: string }
+    >(c, env, requireBinding);
+    if (request instanceof Response) {
+      return request;
+    }
+    const { body, binding: bucket } = request;
     const opts: R2ListOptions = {};
     if (body.prefix) {
       opts.prefix = body.prefix;
@@ -385,7 +354,7 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
       objects: result.objects.map((o) => ({
         key: o.key,
         size: o.size,
-        lastModified: o.uploaded?.toISOString() ?? '',
+        lastModified: o.uploaded.toISOString(),
       })),
       truncated: result.truncated,
       cursor: result.truncated ? result.cursor : null,
@@ -393,27 +362,24 @@ export function createBindingHandler(env: Record<string, unknown>): Hono {
   });
 
   app.post('/r2/head', async (c) => {
-    const body = await c.req.json<{ binding: string; key: string }>();
-
-    if (!body.binding || !body.key) {
-      return c.json({ error: 'binding and key required' }, 400);
-    }
-
-    const bucket = env[body.binding] as R2Bucket | undefined;
-    if (!bucket) {
-      return c.json({ error: `unknown binding "${body.binding}"` }, 404);
+    const request = await readBindingRequest<R2Bucket, { binding: string; key: string }>(
+      c,
+      env,
+      requireKey,
+    );
+    if (request instanceof Response) {
+      return request;
     }
-
-    const obj = await bucket.head(body.key);
+    const obj = await request.binding.head(request.body.key);
     if (!obj) {
       return c.json(null);
     }
 
     return c.json({
-      key: body.key,
+      key: request.body.key,
       size: obj.size,
-      etag: obj.httpEtag ?? '',
-      lastModified: obj.uploaded?.toISOString() ?? '',
+      etag: obj.httpEtag,
+      lastModified: obj.uploaded.toISOString(),
       contentType: obj.httpMetadata?.contentType ?? 'application/octet-stream',
     });
   });
diff --git a/packages/void/src/runtime/remote/client.ts b/packages/void/src/runtime/remote/client.ts
index de42f185c..b4d27773d 100644
--- a/packages/void/src/runtime/remote/client.ts
+++ b/packages/void/src/runtime/remote/client.ts
@@ -1,14 +1,5 @@
 import { cfAccessHeaders } from '../../shared/cf-access.ts';
 
-/** Base64-encode binary values for JSON transport to the proxy. */
-export function bytesToBase64(bytes: Uint8Array): string {
-  let binary = '';
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary);
-}
-
 function readableMessage(value: unknown): string | undefined {
   if (typeof value !== 'string') {
     return undefined;
@@ -131,35 +122,4 @@ export class ProxyClient {
     }
     return res;
   }
-
-  /**
-   * Send a request to the proxy and return the raw Response (for streaming).
-   * Injects `Authorization` header and `projectId` into the JSON body.
-   * Throws on non-OK responses.
-   */
-  async stream(path: string, init: RequestInit): Promise<Response> {
-    let body = init.body;
-    if (typeof body === 'string') {
-      try {
-        const parsed = JSON.parse(body);
-        body = JSON.stringify({ ...parsed, projectId: this.projectId });
-      } catch {
-        // Not JSON, leave body as-is
-      }
-    }
-
-    const res = await globalThis.fetch(`${this.proxyUrl}${path}`, {
-      ...init,
-      headers: {
-        ...(init.headers as Record<string, string>),
-        ...this.authHeaders,
-      },
-      body,
-      redirect: 'manual',
-    });
-    if (!res.ok) {
-      throw await proxyError(res);
-    }
-    return res;
-  }
 }
diff --git a/packages/void/src/runtime/remote/kv.ts b/packages/void/src/runtime/remote/kv.ts
index c933afbcf..ef5acbff9 100644
--- a/packages/void/src/runtime/remote/kv.ts
+++ b/packages/void/src/runtime/remote/kv.ts
@@ -1,27 +1,11 @@
-import { bytesToBase64, type ProxyClient } from './client.ts';
+import { bytesToBase64 } from '../base64.ts';
+import type { ProxyClient } from './client.ts';
 
 /**
  * KVNamespace implementation backed by the remote proxy.
  * Used during local development when `remote: true` is set in void.config.ts.
  */
 export class ProxyKVNamespace {
-  private normalizeGetOptions(
-    options?: { type?: string } | string,
-  ): string | { type: 'json' | 'text' | 'arrayBuffer' | 'stream' } | undefined {
-    if (typeof options === 'string') {
-      return options;
-    }
-    if (
-      options?.type === 'json' ||
-      options?.type === 'text' ||
-      options?.type === 'arrayBuffer' ||
-      options?.type === 'stream'
-    ) {
-      return { type: options.type };
-    }
-    return undefined;
-  }
-
   constructor(
     private client: ProxyClient,
     private binding: string,
@@ -47,62 +31,26 @@ export class ProxyKVNamespace {
       type,
     });
 
-    // The proxy returns JSON `null` (200, application/json) for missing keys
-    // regardless of the requested type. Check for null before type conversion.
-    const ct = res.headers.get('content-type') ?? '';
-    if (type === 'arrayBuffer' || type === 'stream') {
-      // For binary types, the proxy returns application/octet-stream for real values
-      // but application/json for null. Check content-type to detect null responses.
-      if (ct.includes('application/json')) {
-        const data = await res.json();
-        if (data === null) {
-          return null;
-        }
-        // Non-null JSON response for binary type — shouldn't happen, but handle gracefully
-        const encoded = new TextEncoder().encode(JSON.stringify(data));
-        return type === 'arrayBuffer'
-          ? encoded.buffer
-          : new ReadableStream({
-              start(controller) {
-                controller.enqueue(encoded);
-                controller.close();
-              },
-            });
-      }
-      if (type === 'arrayBuffer') {
-        return res.arrayBuffer();
-      }
-      return res.body;
+    // A missing key is JSON `null` for every type; binary values arrive as octet-stream.
+    if (
+      (type !== 'arrayBuffer' && type !== 'stream') ||
+      res.headers.get('content-type')?.includes('application/json')
+    ) {
+      return res.json();
     }
-
-    // text and json are returned as JSON by the proxy
-    return res.json();
+    return type === 'arrayBuffer' ? res.arrayBuffer() : res.body;
   }
 
   async getWithMetadata<T = string, M = unknown>(
     key: string,
     options?: { type?: string } | string,
   ): Promise<{ value: T | null; metadata: M | null; cacheStatus: null }> {
-    const normalized = this.normalizeGetOptions(options);
-    let value: T | null;
-    switch (typeof normalized === 'string' ? normalized : normalized?.type) {
-      case 'json':
-        value = (await this.get(key, 'json')) as T | null;
-        break;
-      case 'text':
-        value = (await this.get(key, 'text')) as T | null;
-        break;
-      case 'arrayBuffer':
-        value = (await this.get(key, 'arrayBuffer')) as T | null;
-        break;
-      case 'stream':
-        value = (await this.get(key, 'stream')) as T | null;
-        break;
-      default:
-        value = (await this.get(key)) as T | null;
-        break;
-    }
-    // The proxy doesn't support metadata retrieval via REST API in V1
+    const requested = typeof options === 'string' ? options : options?.type;
+    const type =
+      requested === 'json' || requested === 'arrayBuffer' || requested === 'stream'
+        ? requested
+        : 'text';
+    const value = (await this.get(key, type as never)) as T | null;
     return { value, metadata: null, cacheStatus: null };
   }
 
diff --git a/packages/void/src/runtime/remote/r2.ts b/packages/void/src/runtime/remote/r2.ts
index 75876c3ee..5e453822d 100644
--- a/packages/void/src/runtime/remote/r2.ts
+++ b/packages/void/src/runtime/remote/r2.ts
@@ -1,4 +1,5 @@
-import { bytesToBase64, type ProxyClient } from './client.ts';
+import { bytesToBase64 } from '../base64.ts';
+import type { ProxyClient } from './client.ts';
 import { serializeR2Conditional } from './r2-conditions.ts';
 
 /**
@@ -30,11 +31,7 @@ export class ProxyR2Bucket {
   }
 
   async get(key: string): Promise<R2ObjectBody | null> {
-    const res = await this.client.stream('/r2/get', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ binding: this.binding, key }),
-    });
+    const res = await this.client.fetch('/r2/get', { binding: this.binding, key });
 
     // Check if the proxy returned null (JSON response for 404).
     // Clone first so we don't consume the body if the object exists.
@@ -55,7 +52,6 @@ export class ProxyR2Bucket {
     value: ReadableStream | ArrayBuffer | ArrayBufferView | string | null | Blob,
     options?: R2PutOptions,
   ): Promise<R2Object | null> {
-    // For V1, send as base64 or text in JSON body
     let base64: string | undefined;
     let textValue: string | undefined;
 
diff --git a/packages/void/src/runtime/routing-assets.ts b/packages/void/src/runtime/routing-assets.ts
index 09a91747d..edf598c0e 100644
--- a/packages/void/src/runtime/routing-assets.ts
+++ b/packages/void/src/runtime/routing-assets.ts
@@ -1,6 +1,37 @@
 import type { DevCssAsset } from '../pages/types.ts';
 import type { RuntimeEnvironment } from './routing-worker.ts';
 
+// `c.rewrite()` cannot reach files the asset layer serves. `.html` is excluded: routes may use it.
+export const ASSET_EXTENSIONS: Array<string> = [
+  'png',
+  'jpg',
+  'jpeg',
+  'gif',
+  'webp',
+  'avif',
+  'svg',
+  'ico',
+  'css',
+  'js',
+  'mjs',
+  'cjs',
+  'woff',
+  'woff2',
+  'ttf',
+  'otf',
+  'eot',
+  'mp4',
+  'webm',
+  'mp3',
+  'wav',
+  'pdf',
+  'txt',
+  'xml',
+  'json',
+  'wasm',
+  'map',
+];
+
 export type ClientAssetTags = {
   css: string;
   preloads: string;
diff --git a/packages/void/src/runtime/routing-errors.ts b/packages/void/src/runtime/routing-errors.ts
index 1cb82d18d..060c41714 100644
--- a/packages/void/src/runtime/routing-errors.ts
+++ b/packages/void/src/runtime/routing-errors.ts
@@ -21,7 +21,7 @@ export type ErrorRenderer = {
   ) => Promise<Response>;
   onError: (error: Error, context: Context) => Promise<Response> | Response;
 };
-const __VOID_ERROR_PAGE_FONT_STACK =
+const ERROR_PAGE_FONT_STACK =
   'system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif';
 const errorStack = Error as unknown as {
   captureStackTrace?: (error: Error, constructor?: Function) => void;
@@ -30,10 +30,8 @@ const errorStack = Error as unknown as {
 
 /** Error rendering is shared by generated Pages apps; production never includes exception details. */
 export function createErrorRenderer(options: ErrorRendererOptions): ErrorRenderer {
-  const __VOID_DEV = options.dev === true;
-  const __VOID_PROJECT_ROOT = options.projectRoot;
-  const __VOID_HOME_DIR = options.homeDir;
-  function __voidEscapeHtml(value: unknown): string {
+  const dev = options.dev === true;
+  function escapeHtml(value: unknown): string {
     return String(value)
       .replaceAll('&', '&amp;')
       .replaceAll('<', '&lt;')
@@ -41,7 +39,7 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       .replaceAll('"', '&quot;');
   }
 
-  function __voidShouldServeHtmlErrorPage(request: Request): boolean {
+  function shouldServeHtmlErrorPage(request: Request): boolean {
     if (request.method !== 'GET' && request.method !== 'HEAD') {
       return false;
     }
@@ -60,18 +58,18 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     return !accept || accept.includes('text/html') || accept.includes('*/*');
   }
 
-  function __voidNormalizeFsPath(value: unknown): string {
+  function normalizeFsPath(value: unknown): string {
     return typeof value === 'string' ? value.replaceAll('\\', '/') : '';
   }
 
-  function __voidIsAbsolutePath(value: string): boolean {
+  function isAbsolutePath(value: string): boolean {
     return value.startsWith('/') || /^[A-Za-z]:\//.test(value);
   }
 
-  function __voidDisplayPath(value: unknown): string {
-    const path = __voidNormalizeFsPath(value);
-    const homeDir = __voidNormalizeFsPath(__VOID_HOME_DIR);
-    const projectRoot = __voidNormalizeFsPath(__VOID_PROJECT_ROOT);
+  function toDisplayPath(value: unknown): string {
+    const path = normalizeFsPath(value);
+    const homeDir = normalizeFsPath(options.homeDir);
+    const projectRoot = normalizeFsPath(options.projectRoot);
     if (!path) {
       return '';
     }
@@ -86,9 +84,9 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     return path;
   }
 
-  function __voidEditorHref(value: unknown, line: number, column: number): string {
-    const path = __voidNormalizeFsPath(value);
-    if (!__voidIsAbsolutePath(path)) {
+  function editorHref(value: unknown, line: number, column: number): string {
+    const path = normalizeFsPath(value);
+    if (!isAbsolutePath(path)) {
       return '';
     }
     return (
@@ -101,14 +99,14 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     );
   }
 
-  function __voidCreateStackFrame(
+  function createStackFrame(
     functionName: string | null | undefined,
     file: unknown,
     line: unknown,
     column: unknown,
     raw: string,
   ): StackFrame | null {
-    const normalizedFile = __voidNormalizeFsPath(file);
+    const normalizedFile = normalizeFsPath(file);
     const lineNumber = Number(line);
     const columnNumber = Number(column);
     if (!normalizedFile || !Number.isFinite(lineNumber) || lineNumber <= 0) {
@@ -120,21 +118,21 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       file: normalizedFile,
       line: lineNumber,
       column: safeColumn,
-      displayPath: __voidDisplayPath(normalizedFile),
-      href: __voidEditorHref(normalizedFile, lineNumber, safeColumn),
+      displayPath: toDisplayPath(normalizedFile),
+      href: editorHref(normalizedFile, lineNumber, safeColumn),
       raw: raw || '',
     };
   }
 
-  function __voidParseFrameLocation(value: string): StackFrame | null {
+  function parseFrameLocation(value: string): StackFrame | null {
     const match = value.match(/^(.*):(\d+):(\d+)$/);
     if (!match) {
       return null;
     }
-    return __voidCreateStackFrame('', match[1], Number(match[2]), Number(match[3]), value);
+    return createStackFrame('', match[1], Number(match[2]), Number(match[3]), value);
   }
 
-  function __voidParseStackFrames(stack: string): Array<StackFrame> {
+  function parseStackFrames(stack: string): Array<StackFrame> {
     if (!stack) {
       return [];
     }
@@ -147,16 +145,16 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       let frame = null;
       let match = line.match(/^at\s+(?:async\s+)?(.+?)\s+\((.+)\)$/);
       if (match) {
-        const location = __voidParseFrameLocation(match[2]);
+        const location = parseFrameLocation(match[2]);
         frame = location ? { ...location, functionName: match[1] } : null;
       } else {
         match = line.match(/^at\s+(.+)$/);
         if (match) {
-          frame = __voidParseFrameLocation(match[1]);
+          frame = parseFrameLocation(match[1]);
         } else {
           match = line.match(/^(.*?)@(.+)$/);
           if (match) {
-            const location = __voidParseFrameLocation(match[2]);
+            const location = parseFrameLocation(match[2]);
             frame = location ? { ...location, functionName: match[1] } : null;
           }
         }
@@ -168,13 +166,13 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     return frames;
   }
 
-  function __voidGetStackFrames(error: unknown): Array<StackFrame> {
+  function getStackFrames(error: unknown): Array<StackFrame> {
     if (!(error instanceof Error)) {
       return [];
     }
     if (!error.stack && typeof errorStack.captureStackTrace === 'function') {
       try {
-        errorStack.captureStackTrace(error, __voidGetStackFrames);
+        errorStack.captureStackTrace(error, getStackFrames);
       } catch {
         // Ignore runtimes that reject captureStackTrace on thrown errors.
       }
@@ -191,7 +189,7 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
             const line = callSite.getLineNumber?.();
             const column = callSite.getColumnNumber?.();
             const functionName = callSite.getFunctionName?.() || callSite.getMethodName?.() || '';
-            const frame = __voidCreateStackFrame(
+            const frame = createStackFrame(
               functionName,
               fileName || '',
               line,
@@ -214,16 +212,16 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     } finally {
       errorStack.prepareStackTrace = originalPrepareStackTrace;
     }
-    return __voidParseStackFrames(typeof error.stack === 'string' ? error.stack : '');
+    return parseStackFrames(typeof error.stack === 'string' ? error.stack : '');
   }
 
-  function __voidDescribeThrownValue(value: unknown): ErrorDetails {
+  function describeThrownValue(value: unknown): ErrorDetails {
     if (value instanceof Error) {
       return {
         name: value.name || 'Error',
         message: value.message || '',
         stack: typeof value.stack === 'string' ? value.stack : '',
-        frames: __voidGetStackFrames(value),
+        frames: getStackFrames(value),
       };
     }
     if (typeof value === 'string') {
@@ -242,15 +240,15 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     return { name: 'Thrown value', message, stack: '', frames: [] };
   }
 
-  function __voidRenderStack(entry: ErrorDetails): string {
+  function renderStack(entry: ErrorDetails): string {
     if (Array.isArray(entry.frames) && entry.frames.length > 0) {
       const items = entry.frames
         .map((frame) => {
           const name = frame.functionName || '(anonymous)';
           const location = frame.displayPath + ':' + frame.line + ':' + frame.column;
-          const body = `<span class="__void-error-frame-function">${__voidEscapeHtml(name)}</span><span class="__void-error-frame-location">${__voidEscapeHtml(location)}</span>`;
+          const body = `<span class="__void-error-frame-function">${escapeHtml(name)}</span><span class="__void-error-frame-location">${escapeHtml(location)}</span>`;
           if (frame.href) {
-            return `<a class="__void-error-frame" href="${__voidEscapeHtml(frame.href)}">${body}</a>`;
+            return `<a class="__void-error-frame" href="${escapeHtml(frame.href)}">${body}</a>`;
           }
           return `<div class="__void-error-frame is-static">${body}</div>`;
         })
@@ -260,17 +258,17 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     if (!entry.stack) {
       return '';
     }
-    return `<div class="__void-error-stack"><div class="__void-error-stack-label">Stack trace</div><pre>${__voidEscapeHtml(entry.stack)}</pre></div>`;
+    return `<div class="__void-error-stack"><div class="__void-error-stack-label">Stack trace</div><pre>${escapeHtml(entry.stack)}</pre></div>`;
   }
 
-  function __voidCollectErrorChain(error: unknown): Array<ErrorDetails & { label: string }> {
+  function collectErrorChain(error: unknown): Array<ErrorDetails & { label: string }> {
     const chain = [];
     const seen = new Set();
     let current = error;
     let depth = 0;
     while (current != null && depth < 8 && !seen.has(current)) {
       seen.add(current);
-      const entry = __voidDescribeThrownValue(current);
+      const entry = describeThrownValue(current);
       chain.push({
         label: depth === 0 ? 'Error' : 'Cause ' + depth,
         ...entry,
@@ -299,18 +297,18 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     return chain;
   }
 
-  function __voidRenderDevErrorOverlay(status: number, title: string, error: unknown): string {
-    const chain = __voidCollectErrorChain(error);
+  function renderDevErrorOverlay(status: number, title: string, error: unknown): string {
+    const chain = collectErrorChain(error);
     const errorCountLabel = chain.length + (chain.length === 1 ? ' Error' : ' Errors');
     const sections = chain
       .map((entry, index) => {
         const heading = entry.name || (index === 0 ? title : 'Cause');
         const message = entry.message || title;
-        const stack = __voidRenderStack(entry);
+        const stack = renderStack(entry);
         if (index === 0) {
-          return `<section class="__void-error-section is-root"><p class="__void-error-message">${__voidEscapeHtml(message)}</p>${stack}</section>`;
+          return `<section class="__void-error-section is-root"><p class="__void-error-message">${escapeHtml(message)}</p>${stack}</section>`;
         }
-        return `<section class="__void-error-section"><div class="__void-error-kicker">${__voidEscapeHtml(entry.label)}</div><h2>${__voidEscapeHtml(heading)}</h2><p>${__voidEscapeHtml(message)}</p>${stack}</section>`;
+        return `<section class="__void-error-section"><div class="__void-error-kicker">${escapeHtml(entry.label)}</div><h2>${escapeHtml(heading)}</h2><p>${escapeHtml(message)}</p>${stack}</section>`;
       })
       .join('');
     return `<style>
@@ -319,7 +317,7 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       inset: 0;
       z-index: 2147483647;
       pointer-events: none;
-      font-family: ${__VOID_ERROR_PAGE_FONT_STACK};
+      font-family: ${ERROR_PAGE_FONT_STACK};
       color: #f5f5f5;
     }
     .__void-error-backdrop {
@@ -382,7 +380,7 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       padding: 12px 8px;
       box-shadow: 0 18px 36px rgba(0, 0, 0, 0.28);
       cursor: pointer;
-      font: 700 13px/1 ${__VOID_ERROR_PAGE_FONT_STACK};
+      font: 700 13px/1 ${ERROR_PAGE_FONT_STACK};
       letter-spacing: 0.04em;
       text-transform: uppercase;
       transition: transform 180ms ease, opacity 180ms ease;
@@ -541,16 +539,16 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       }
     }
   </style>
-<aside class="__void-error-overlay" data-void-error-overlay role="dialog" aria-label="Void dev error overlay"><div class="__void-error-backdrop" data-void-error-backdrop></div><section class="__void-error-panel"><button type="button" class="__void-error-close" data-void-error-close aria-label="Minimize error overlay"><svg viewBox="0 0 16 16" aria-hidden="true" focusable="false"><path d="M3.757 3.757 12.243 12.243M12.243 3.757 3.757 12.243" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round"/></svg></button><header class="__void-error-header"><p class="__void-error-status">${__voidEscapeHtml(String(status) + ': ' + title)}</p></header>${sections}</section><button type="button" class="__void-error-minimized" data-void-error-toggle aria-label="Show dev error overlay" aria-expanded="true">${__voidEscapeHtml(errorCountLabel)}</button><script>(function(){const script=document.currentScript;if(!(script instanceof HTMLScriptElement))return;const root=script.closest("[data-void-error-overlay]");if(!(root instanceof HTMLElement))return;const backdrop=root.querySelector("[data-void-error-backdrop]");const closeButton=root.querySelector("[data-void-error-close]");const toggle=root.querySelector("[data-void-error-toggle]");const setMinimized=(minimized)=>{root.classList.toggle("is-minimized", minimized);if(toggle instanceof HTMLElement)toggle.setAttribute("aria-expanded", minimized ? "false" : "true");};if(backdrop instanceof HTMLElement)backdrop.addEventListener("click",()=>setMinimized(true));if(closeButton instanceof HTMLElement)closeButton.addEventListener("click",()=>setMinimized(true));if(toggle instanceof HTMLElement)toggle.addEventListener("click",()=>setMinimized(false));})();</script></aside>`;
+<aside class="__void-error-overlay" data-void-error-overlay role="dialog" aria-label="Void dev error overlay"><div class="__void-error-backdrop" data-void-error-backdrop></div><section class="__void-error-panel"><button type="button" class="__void-error-close" data-void-error-close aria-label="Minimize error overlay"><svg viewBox="0 0 16 16" aria-hidden="true" focusable="false"><path d="M3.757 3.757 12.243 12.243M12.243 3.757 3.757 12.243" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round"/></svg></button><header class="__void-error-header"><p class="__void-error-status">${escapeHtml(String(status) + ': ' + title)}</p></header>${sections}</section><button type="button" class="__void-error-minimized" data-void-error-toggle aria-label="Show dev error overlay" aria-expanded="true">${escapeHtml(errorCountLabel)}</button><script>(function(){const script=document.currentScript;if(!(script instanceof HTMLScriptElement))return;const root=script.closest("[data-void-error-overlay]");if(!(root instanceof HTMLElement))return;const backdrop=root.querySelector("[data-void-error-backdrop]");const closeButton=root.querySelector("[data-void-error-close]");const toggle=root.querySelector("[data-void-error-toggle]");const setMinimized=(minimized)=>{root.classList.toggle("is-minimized", minimized);if(toggle instanceof HTMLElement)toggle.setAttribute("aria-expanded", minimized ? "false" : "true");};if(backdrop instanceof HTMLElement)backdrop.addEventListener("click",()=>setMinimized(true));if(closeButton instanceof HTMLElement)closeButton.addEventListener("click",()=>setMinimized(true));if(toggle instanceof HTMLElement)toggle.addEventListener("click",()=>setMinimized(false));})();</script></aside>`;
   }
 
-  function __voidInjectDevErrorOverlay(html: string, overlay: string): string {
+  function injectDevErrorOverlay(html: string, overlay: string): string {
     return /<\/body\s*>/i.test(html)
       ? html.replace(/<\/body\s*>/i, overlay + '</body>')
       : html + overlay;
   }
 
-  function __voidGetErrorAssetCss(error: unknown): string {
+  function getErrorAssetCss(error: unknown): string {
     const tags =
       error &&
       (typeof error === 'object' || typeof error === 'function') &&
@@ -562,31 +560,29 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       : '';
   }
 
-  function __voidInjectErrorAssetCss(html: string, css: string): string {
+  function injectErrorAssetCss(html: string, css: string): string {
     if (!css) {
       return html;
     }
     return /<\/head\s*>/i.test(html) ? html.replace(/<\/head\s*>/i, css + '</head>') : css + html;
   }
 
-  function __voidRenderErrorPage(status: number, title: string, error?: unknown): string {
+  function renderErrorPage(status: number, title: string, error?: unknown): string {
     const heading = status + ': ' + title;
     const prefix = status + ': ';
     const overlay =
-      __VOID_DEV && status === 500 && error
-        ? __voidRenderDevErrorOverlay(status, title, error)
-        : '';
+      dev && status === 500 && error ? renderDevErrorOverlay(status, title, error) : '';
     return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>${__voidEscapeHtml(heading)}</title>
-    ${__voidGetErrorAssetCss(error)}
+    <title>${escapeHtml(heading)}</title>
+    ${getErrorAssetCss(error)}
     <style>
       :root {
         color-scheme: light dark;
-        font-family: ${__VOID_ERROR_PAGE_FONT_STACK};
+        font-family: ${ERROR_PAGE_FONT_STACK};
         background: #f5f5f5;
         color: #171717;
       }
@@ -598,7 +594,7 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
         place-items: center;
         padding: 24px;
         background: radial-gradient(circle at top, rgba(255, 255, 255, 0.96), rgba(245, 245, 245, 0.96) 52%), linear-gradient(180deg, #fafafa 0%, #f1f1f1 100%);
-        font: 500 16px/1.5 ${__VOID_ERROR_PAGE_FONT_STACK};
+        font: 500 16px/1.5 ${ERROR_PAGE_FONT_STACK};
       }
       main {
         inline-size: min(100%, 560px);
@@ -612,7 +608,7 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
       }
       h1 {
         margin: 0;
-        font: 400 clamp(1.5rem, 1.2rem + 1vw, 2rem) / 1.1 ${__VOID_ERROR_PAGE_FONT_STACK};
+        font: 400 clamp(1.5rem, 1.2rem + 1vw, 2rem) / 1.1 ${ERROR_PAGE_FONT_STACK};
         letter-spacing: -0.03em;
       }
       strong {
@@ -635,29 +631,26 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
   </head>
   <body>
     <main>
-      <h1><strong>${__voidEscapeHtml(prefix)}</strong>${__voidEscapeHtml(title)}</h1>
+      <h1><strong>${escapeHtml(prefix)}</strong>${escapeHtml(title)}</h1>
     </main>
     ${overlay}
   </body>
 </html>`;
   }
 
-  function __voidCreateErrorResponse(
+  function createErrorResponse(
     request: Request,
     status: number,
     title: string,
     error?: unknown,
   ): Response {
-    if (!__voidShouldServeHtmlErrorPage(request)) {
+    if (!shouldServeHtmlErrorPage(request)) {
       return new Response(title, { status });
     }
-    return new Response(
-      request.method === 'HEAD' ? null : __voidRenderErrorPage(status, title, error),
-      {
-        status,
-        headers: { 'content-type': 'text/html; charset=utf-8' },
-      },
-    );
+    return new Response(request.method === 'HEAD' ? null : renderErrorPage(status, title, error), {
+      status,
+      headers: { 'content-type': 'text/html; charset=utf-8' },
+    });
   }
 
   async function serveCustomPage(
@@ -672,16 +665,13 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
         const request = new Request(new URL('/' + status + '.html', c.req.url));
         const response: Response = await assets.fetch(request);
         if (response.ok) {
-          const assetCss = __voidGetErrorAssetCss(error);
+          const assetCss = getErrorAssetCss(error);
           const showOverlay =
-            __VOID_DEV && status === 500 && !!error && __voidShouldServeHtmlErrorPage(c.req.raw);
+            dev && status === 500 && !!error && shouldServeHtmlErrorPage(c.req.raw);
           if (assetCss || showOverlay) {
-            const html = __voidInjectErrorAssetCss(await response.text(), assetCss);
+            const html = injectErrorAssetCss(await response.text(), assetCss);
             const body = showOverlay
-              ? __voidInjectDevErrorOverlay(
-                  html,
-                  __voidRenderDevErrorOverlay(status, fallbackText, error),
-                )
+              ? injectDevErrorOverlay(html, renderDevErrorOverlay(status, fallbackText, error))
               : html;
             return new Response(c.req.method === 'HEAD' ? null : body, {
               status,
@@ -697,10 +687,10 @@ export function createErrorRenderer(options: ErrorRendererOptions): ErrorRendere
     } catch {
       /* Asset failure falls back to the built-in page. */
     }
-    return __voidCreateErrorResponse(c.req.raw, status, fallbackText, error);
+    return createErrorResponse(c.req.raw, status, fallbackText, error);
   }
   return {
-    createResponse: __voidCreateErrorResponse,
+    createResponse: createErrorResponse,
     serveCustomPage,
     onError: (error, c) => {
       if (
diff --git a/packages/void/src/runtime/routing.ts b/packages/void/src/runtime/routing.ts
index 1edf7f7f3..35e19a455 100644
--- a/packages/void/src/runtime/routing.ts
+++ b/packages/void/src/runtime/routing.ts
@@ -1,9 +1,16 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { compilePattern, mergeQueryIntoLocation, substituteParams } from '@void/edge';
+import {
+  compilePattern,
+  matchPattern,
+  matchPatternCaptures,
+  mergeQueryIntoLocation,
+  substituteParams,
+} from '@void/edge';
 import type { Context, Hono, MiddlewareHandler } from 'hono';
 import type { RedirectStatusCode } from 'hono/utils/http-status';
 import { VoidAssetRewriteError } from './handler.ts';
 import { convertReturnValue } from './response.ts';
+import { ASSET_EXTENSIONS } from './routing-assets.ts';
 export { createErrorRenderer } from './routing-errors.ts';
 
 export type RoutingRule = {
@@ -23,7 +30,6 @@ export type RoutingContext = Context & {
 };
 export type RoutingRuntime = {
   requestContext: AsyncLocalStorage<RequestContextStore>;
-  originalUrls: WeakMap<Request, URL>;
   contextMiddleware: MiddlewareHandler;
   requestMiddleware: MiddlewareHandler;
   routingMiddleware: (rules: Array<RoutingRule>) => MiddlewareHandler;
@@ -40,14 +46,13 @@ export function createRoutingRuntime(
     nodeTarget?: boolean;
     managedDispatch?: boolean;
     blockedAssetExtensions?: Array<string>;
-    originalUrls?: WeakMap<Request, URL>;
   } = {},
 ): RoutingRuntime {
-  const originalUrls = options.originalUrls ?? new WeakMap<Request, URL>();
+  const originalUrls = new WeakMap<Request, URL>();
   const fallbackHandled = new WeakSet<Request>();
   const warnedPatterns = new Set<string>();
   const requestContext = new AsyncLocalStorage<RequestContextStore>();
-  const assetExtensions = options.blockedAssetExtensions ?? DEFAULT_ASSET_EXTENSIONS;
+  const assetExtensions = options.blockedAssetExtensions ?? ASSET_EXTENSIONS;
   const assetExtensionRE = assetExtensions.length
     ? new RegExp(`\\.(${assetExtensions.join('|')})$`, 'i')
     : /(?!)/;
@@ -92,17 +97,17 @@ export function createRoutingRuntime(
       if (rule.host && rule.host !== url.hostname) {
         continue;
       }
-      let match: RegExpExecArray | null;
       try {
-        match = compilePattern(rule.source).regex.exec(url.pathname);
+        compilePattern(rule.source);
       } catch (error) {
         warn(rule.source, error, 'routing');
         continue;
       }
-      if (!match) {
+      const params = matchPatternCaptures(rule.source, url.pathname);
+      if (!params) {
         continue;
       }
-      const destination = substituteParams(rule.destination, match.groups ?? {});
+      const destination = substituteParams(rule.destination, params);
       if (rule.status === 200) {
         const q = destination.indexOf('?');
         const rewriteUrl = new URL(c.req.url);
@@ -180,7 +185,6 @@ export function createRoutingRuntime(
   };
   return {
     requestContext,
-    originalUrls,
     contextMiddleware,
     requestMiddleware: async (c, next) => {
       await requestContext.run(
@@ -213,11 +217,13 @@ export function createRoutingRuntime(
       const matched: Array<[string, string]> = [];
       for (const rule of rules) {
         try {
-          if (compilePattern(rule.pattern).regex.test(pathname)) {
-            matched.push(...rule.headers);
-          }
+          compilePattern(rule.pattern);
         } catch (error) {
           warn(rule.pattern, error, 'header');
+          continue;
+        }
+        if (matchPattern(rule.pattern, pathname)) {
+          matched.push(...rule.headers);
         }
       }
       if (!matched.length) {
@@ -239,36 +245,6 @@ export function createRoutingRuntime(
   };
 }
 
-export const DEFAULT_ASSET_EXTENSIONS: Array<string> = [
-  'png',
-  'jpg',
-  'jpeg',
-  'gif',
-  'webp',
-  'avif',
-  'svg',
-  'ico',
-  'css',
-  'js',
-  'mjs',
-  'cjs',
-  'woff',
-  'woff2',
-  'ttf',
-  'otf',
-  'eot',
-  'mp4',
-  'webm',
-  'mp3',
-  'wav',
-  'pdf',
-  'txt',
-  'xml',
-  'json',
-  'wasm',
-  'map',
-];
-
 export function markNoMatch(request: Request, response: Response): Response {
   const url = new URL(request.url);
   if (
diff --git a/packages/void/src/runtime/ws-server.ts b/packages/void/src/runtime/ws-server.ts
index ac8a50e8d..5c0e73551 100644
--- a/packages/void/src/runtime/ws-server.ts
+++ b/packages/void/src/runtime/ws-server.ts
@@ -126,22 +126,9 @@ export function buildWebSocketInstanceId(
   return route.params.map((name) => `${name}=${params[name] ?? ''}`).join('&');
 }
 
-async function validateSchema(
-  schema: StandardSchemaV1,
-  value: unknown,
-): Promise<
-  { ok: true; value: unknown } | { ok: false; issues: ReadonlyArray<StandardSchemaV1.Issue> }
-> {
-  const result = await schema['~standard'].validate(value);
-  if (result.issues) {
-    return { ok: false, issues: result.issues };
-  }
-  return { ok: true, value: result.value };
-}
-
 async function serializeServerEvent(schema: StandardSchemaV1, event: unknown): Promise<string> {
-  const result = await validateSchema(schema, event);
-  if (!result.ok) {
+  const result = await schema['~standard'].validate(event);
+  if (result.issues) {
     throw new Error(
       `ws: Message validation failed: ${result.issues.map((issue) => issue.message).join('; ')}.`,
     );
@@ -393,8 +380,8 @@ export function createWebSocketDurableObject(
         return;
       }
 
-      const result = await validateSchema(definition.messages.client, parsed);
-      if (!result.ok) {
+      const result = await definition.messages.client['~standard'].validate(parsed);
+      if (result.issues) {
         webSocket.close(1007, 'Invalid message');
         return;
       }
@@ -473,30 +460,6 @@ function getStub(
   return binding.get(id);
 }
 
-export async function handleWebSocketUpgrade(
-  request: Request,
-  env: Record<string, unknown>,
-  routes: Array<WebSocketRouteMeta>,
-): Promise<Response | null> {
-  if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') {
-    return null;
-  }
-
-  for (const route of routes) {
-    const params = getRouteMatch(request, route);
-    if (!params) {
-      continue;
-    }
-    const stub = getStub(env, route, params);
-    if (!stub) {
-      return new Response(`Missing Durable Object binding "${route.bindingName}"`, { status: 503 });
-    }
-    return stub.fetch(request);
-  }
-
-  return null;
-}
-
 export async function forwardWebSocketRequest(
   request: Request,
   env: Record<string, unknown>,
diff --git a/packages/void/src/shared/atomic-write.ts b/packages/void/src/shared/atomic-write.ts
new file mode 100644
index 000000000..d8325e3ae
--- /dev/null
+++ b/packages/void/src/shared/atomic-write.ts
@@ -0,0 +1,13 @@
+import { randomUUID } from 'node:crypto';
+import { renameSync, rmSync, writeFileSync } from 'node:fs';
+
+/** Write through a unique temporary file and rename it, so readers never see a partial file. */
+export function writeFileAtomic(path: string, content: string, mode?: number): void {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, content, { flag: 'wx', mode });
+    renameSync(temporary, path);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
diff --git a/packages/void/src/shared/cf-access.ts b/packages/void/src/shared/cf-access.ts
index 1e0cb927b..04db125f4 100644
--- a/packages/void/src/shared/cf-access.ts
+++ b/packages/void/src/shared/cf-access.ts
@@ -44,18 +44,11 @@ export function cfAccessHeaders(
       if (!records || typeof records !== 'object' || Array.isArray(records)) {
         return {};
       }
-      const entry =
-        records &&
-        typeof records === 'object' &&
-        !Array.isArray(records) &&
-        Object.hasOwn(records, origin)
-          ? records[origin]
-          : undefined;
-      if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
-        return accessHeaders(entry as Record<string, unknown>);
-      }
       if (Object.hasOwn(records, origin)) {
-        return {};
+        const entry = records[origin];
+        return entry && typeof entry === 'object' && !Array.isArray(entry)
+          ? accessHeaders(entry as Record<string, unknown>)
+          : {};
       }
     } catch {
       // Invalid explicit configuration never falls back to credentials for another recipient.
diff --git a/packages/void/src/shared/collect-files.ts b/packages/void/src/shared/collect-files.ts
new file mode 100644
index 000000000..f664f2321
--- /dev/null
+++ b/packages/void/src/shared/collect-files.ts
@@ -0,0 +1,20 @@
+import { readdirSync } from 'node:fs';
+import { join } from 'pathslash';
+
+/**
+ * Every non-directory path under `dir`, depth first. Unlike
+ * `readdirSync(dir, { recursive: true })`, it does not descend into
+ * symlinked directories.
+ */
+export function collectFiles(dir: string): Array<string> {
+  const files: Array<string> = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectFiles(fullPath));
+    } else {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
diff --git a/packages/void/src/shared/convention-files.ts b/packages/void/src/shared/convention-files.ts
new file mode 100644
index 000000000..a31091856
--- /dev/null
+++ b/packages/void/src/shared/convention-files.ts
@@ -0,0 +1,8 @@
+import { globSync } from 'tinyglobby';
+
+/** Handler files under `dir`, relative to it, skipping paths with a `_`-prefixed segment. */
+export function listConventionFiles(dir: string): Array<string> {
+  return globSync('**/*.{ts,mts,js,mjs}', { cwd: dir }).filter(
+    (filePath) => !filePath.split('/').some((segment) => segment.startsWith('_')),
+  );
+}
diff --git a/packages/void/src/shared/dotenv.ts b/packages/void/src/shared/dotenv.ts
index 8135ee13e..e37d0979b 100644
--- a/packages/void/src/shared/dotenv.ts
+++ b/packages/void/src/shared/dotenv.ts
@@ -29,40 +29,25 @@ import { parseEnv } from 'node:util';
 const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 export type ParseDotenvOptions = {
-  /** When true, run `${VAR}` / `$VAR` expansion after parsing. Default: true. */
-  expand?: boolean;
-  /**
-   * When true (default), silently skip lines whose key doesn't match the
-   * standard dotenv key regex. Set to false to throw instead.
-   */
-  skipInvalidKeys?: boolean;
   /** Callback for expansion warnings (cycles). Caller routes to `voidWarn`. */
   onWarn?: (message: string) => void;
 };
 
 /**
- * Parse the raw contents of a dotenv file into a record, optionally
- * expanding `${VAR}` / `$VAR` references against earlier entries.
+ * Parse the raw contents of a dotenv file into a record, skipping invalid
+ * keys and expanding `${VAR}` / `$VAR` references against earlier entries.
  */
 export function parseDotenv(
   content: string,
   options: ParseDotenvOptions = {},
 ): Record<string, string> {
-  const { expand: shouldExpand = true, skipInvalidKeys = true, onWarn } = options;
   const env: Record<string, string> = {};
   for (const [key, value] of Object.entries(parseEnv(content))) {
-    if (value === undefined) {
-      continue;
-    }
-    if (!VALID_KEY.test(key)) {
-      if (skipInvalidKeys) {
-        continue;
-      }
-      throw new Error(`dotenv: Invalid key '${key}'.`);
+    if (value !== undefined && VALID_KEY.test(key)) {
+      env[key] = value;
     }
-    env[key] = value;
   }
-  return shouldExpand ? expandDotenv(env, { onWarn }) : env;
+  return expandDotenv(env, options);
 }
 
 /**
@@ -202,10 +187,6 @@ const WRANGLER_DOTENV_LINE =
 
 /**
  * The set of declared dotenv KEYS in `filePath`, parsed the way wrangler does.
- * Lives in this leaf module (no `proper-lockfile` / lifecycle side effects) so both
- * the provisioner's transport fence and the deploy orchestrator's config-override
- * fence can read keys exactly as wrangler's per-command reload would, without either
- * caller pulling in the provision lifecycle just to parse dotenv keys.
  */
 export function scanWranglerDotenvKeys(filePath: string): Set<string> {
   const keys = new Set<string>();
diff --git a/packages/void/src/shared/env-mask.ts b/packages/void/src/shared/env-mask.ts
index 8abebddef..338d20651 100644
--- a/packages/void/src/shared/env-mask.ts
+++ b/packages/void/src/shared/env-mask.ts
@@ -7,8 +7,7 @@
  * it to locate the offending entry).
  *
  * Server env values are production secrets by definition, so validator
- * messages redact the raw input unconditionally. The old `.secret()` /
- * `.public()` masking axis was removed because it did not control storage.
+ * messages redact the raw input unconditionally.
  *
  * Users can opt out of the guard for local debugging via
  * `VOID_ENV_UNMASK=1` in the environment; that path prints a one-shot
@@ -47,7 +46,6 @@ export function redactMessage(
 }
 
 let unmaskResolved: boolean | null = null;
-let unmaskNoticeShown = false;
 
 /**
  * Resolve the effective unmask flag, consulting `process.env` exactly once
@@ -58,31 +56,23 @@ export function isUnmaskActive(): boolean {
   if (unmaskResolved !== null) {
     return unmaskResolved;
   }
-  let active = false;
   try {
-    // `process` may not exist in some worker bundles; ignore if missing.
+    // `process` may be missing in Worker bundles, and Deno throws without env permission.
     const proc = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process;
-    active = proc?.env?.[UNMASK_ENV_VAR] === '1';
+    unmaskResolved = proc?.env?.[UNMASK_ENV_VAR] === '1';
   } catch {
-    active = false;
+    unmaskResolved = false;
   }
-  unmaskResolved = active;
-  if (active && !unmaskNoticeShown) {
-    unmaskNoticeShown = true;
-    try {
-      // eslint-disable-next-line no-console -- explicit operator warning.
-      console.error(
-        `[void/env] ${UNMASK_ENV_VAR}=1 is set — env validation errors will include raw values. Unset it before sharing logs.`,
-      );
-    } catch {
-      // best-effort
-    }
+  if (unmaskResolved) {
+    // eslint-disable-next-line no-console -- explicit operator warning.
+    console.error(
+      `[void/env] ${UNMASK_ENV_VAR}=1 is set — env validation errors will include raw values. Unset it before sharing logs.`,
+    );
   }
-  return active;
+  return unmaskResolved;
 }
 
 /** Test hook — resets the memoised unmask state. Not part of the public API. */
 export function _resetUnmaskCacheForTests(): void {
   unmaskResolved = null;
-  unmaskNoticeShown = false;
 }
diff --git a/packages/void/src/shared/utils.ts b/packages/void/src/shared/utils.ts
deleted file mode 100644
index cb402d577..000000000
--- a/packages/void/src/shared/utils.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { posix } from 'pathslash';
-
-export const isWindows: boolean = typeof process !== 'undefined' && process.platform === 'win32';
-
-export function slash(p: string): string {
-  return p.replace(/\\/g, '/');
-}
-
-export function toSlash(p: string): string {
-  return isWindows ? slash(p) : p;
-}
-
-export function normalizePath(id: string): string {
-  return posix.normalize(toSlash(id));
-}
diff --git a/packages/void/test/e2e/cloudflare-deploy-live.test.ts b/packages/void/test/e2e/cloudflare-deploy-live.test.ts
index 71e2cf6c4..9624db848 100644
--- a/packages/void/test/e2e/cloudflare-deploy-live.test.ts
+++ b/packages/void/test/e2e/cloudflare-deploy-live.test.ts
@@ -12,20 +12,15 @@ import {
 // VOID_E2E_CF_TOKEN and VOID_E2E_CF_ACCOUNT_ID are set, and skips each test otherwise. See
 // README.md in this directory for prerequisites, CI wiring, and resource naming/cleanup.
 
-// Read the credentials + the enable gate at EXECUTION time, never at module top-level. Vitest imports
-// (collects) this file BEFORE the CI runner injects the job's step env into the worker's process.env,
-// so a top-level `process.env.VOID_E2E_CF_TOKEN` read sees an empty string and `describe.skipIf` would
-// skip the suite even when the credentials are present — while an identical read inside a hook/test
-// (which run AFTER injection) sees the real value. So these are functions, called from the hooks/tests.
+// Read env inside hooks and tests, never at module load: Vitest collects this file before the
+// runner injects the job env, so a top-level read sees empty credentials.
 function cfToken(): string {
   return process.env.VOID_E2E_CF_TOKEN ?? '';
 }
 function cfAccountId(): string {
   return process.env.VOID_E2E_CF_ACCOUNT_ID ?? '';
 }
-// Windows is intentionally excluded from the LIVE deploy: invoking the cf CLI against a real
-// account on win32 is unverified. The real-build integration test
-// (test/integration/cloudflare-deploy-build.test.ts) exercises the build path on Windows.
+// Live cf calls are unverified on Windows; cloudflare-deploy-build.test.ts covers the build there.
 function e2eEnabled(): boolean {
   return cfToken().length > 0 && cfAccountId().length > 0 && process.platform !== 'win32';
 }
@@ -37,55 +32,28 @@ const PACKAGE_ROOT = join(ROOT, 'packages', 'void');
 const CLI_ENTRY = join(PACKAGE_ROOT, 'dist', 'cli', 'cli.mjs');
 const CF_BIN = join(PACKAGE_ROOT, 'node_modules', 'cf', 'bin', 'cf');
 const OPERATION_ENTRY = join(PACKAGE_ROOT, 'dist', 'cli', 'cloudflare-operation-process.mjs');
-// Bound each deploy subprocess BELOW the enclosing vitest timeout. `spawn.sync` blocks the test
-// worker's event loop, so a hung CLI/cf call would keep vitest's own timer from firing AND keep
-// `afterAll` from running — leaking the worker/D1/KV. On timeout, spawnSync returns a null status,
-// which fails the status assertion loudly and lets teardown reclaim the resources.
+// `spawn.sync` blocks the event loop, so Vitest cannot time out a hung call and teardown would
+// never run. Bound every spawn below its hook timeout.
 const DEPLOY_TIMEOUT_MS = 480_000;
-// The same event-loop-block reasoning applies to every `cf` call (ownership lists and teardown):
-// an unbounded `spawn.sync` on a stalled Cloudflare call would freeze vitest's hook timer and strand
-// already-created resources. Quick ops, so a much shorter bound.
 const CF_TIMEOUT_MS = 120_000;
-// Per-request abort deadline for the polling fetches, so a single stalled request aborts and the
-// retry loop moves on instead of consuming the whole per-test budget on one hung socket.
 const REQUEST_TIMEOUT_MS = 20_000;
-// `CF_TIMEOUT_MS` bounds ONE stalled call, but each hook fires SEVERAL cf calls back to
-// back with no `await` between them (setup: 2 lists; teardown: up to 5 list/delete), so
-// `spawn.sync` blocks the event loop across the whole run and vitest's hook timer can never fire to
-// interrupt it — the per-call bound alone lets the AGGREGATE (5–6 × 120s) blow past the hook budget,
-// and an external cancel mid-teardown strands D1/KV. These budgets cap the SUM of cf wall-clock
-// per hook: each hook stamps `cfDeadline` at its start and `cf()` shrinks each call's
-// timeout to the time left, skipping (as a failed call) once spent. Sized under the hook timeouts —
-// setup: 90s + DEPLOY_TIMEOUT_MS (a separate spawn) = 570s < 600s beforeAll; teardown: 200s + the
-// ~64s async worker probe = 264s < 300s afterAll.
+// Total cf time per hook, since several blocking calls run back to back. Setup: 90s +
+// DEPLOY_TIMEOUT_MS < 600s; teardown: 200s + the ~64s worker probe < 300s.
 const SETUP_CF_BUDGET_MS = 90_000;
 const TEARDOWN_CF_BUDGET_MS = 200_000;
 
-// Deploy target: the SPA playground (real, buildable Void app exercising D1 + KV + a cron). The
-// deploy CLI runs its own build → provision → migrate → deploy pipeline against this dir.
+// The SPA playground uses D1, KV and a cron.
 const APP = join(ROOT, 'playground', 'spa');
 const APP_WRANGLER = join(APP, 'wrangler.jsonc');
 
-// A UNIQUE per-run worker name: two runs that overlap (two pushes in flight, a rerun of the same
-// commit) must never deploy the same-named worker or create the same D1/KV, or they would clobber
-// each other and teardown would race one against the other. The suffix is `VOID_E2E_RUN_ID` (CI
-// sets it to run-id + attempt) or, locally, a timestamp + random. The shared
-// `void-e2e-cf-deploy-` prefix keeps every resource greppable for manual cleanup of an orphan from a
-// hard-killed run. Derived names mirror the provisioner (`suffixedResourceName`): `<name>-db` (D1),
-// `<name>-kv` (KV).
+// A unique name per run keeps overlapping runs apart; the shared prefix keeps orphans greppable.
+// D1/KV names mirror the provisioner's `suffixedResourceName`.
 function uniqueRunSuffix(): string {
-  // `||`, not `??`: `VOID_E2E_RUN_ID` arrives as an EMPTY STRING (not undefined) when unset, because
-  // `vite.config.ts` forwards `VOID_E2E_RUN_ID: process.env.VOID_E2E_RUN_ID ?? ''` into the worker
-  // via `test.env`. `??` would treat that `''` as present and collapse every local run onto the
-  // `-local` suffix (below), so overlapping local runs would clobber one shared worker/D1/KV. `||`
-  // lets the empty value fall through to a unique timestamp + random. CI sets a non-empty run id, so
-  // its value is unaffected.
+  // `||`, not `??`: vite.config.ts forwards an unset VOID_E2E_RUN_ID as ''.
   const raw =
     process.env.VOID_E2E_RUN_ID ||
     `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
-  // Cloudflare worker/D1/KV names are lowercase `[a-z0-9-]` and must not start/end with `-`.
-  // Sanitize, then cap the suffix so the worker name — and its `-db`/`-kv` tails — stay well under
-  // the 63-char limit.
+  // Cloudflare names are lowercase [a-z0-9-], cannot start or end with '-', and max out at 63 chars.
   const cleaned = raw
     .toLowerCase()
     .replace(/[^a-z0-9]+/g, '-')
@@ -93,9 +61,6 @@ function uniqueRunSuffix(): string {
     .replace(/^-+|-+$/g, '');
   return cleaned || 'local';
 }
-// Computed in `beforeAll` (execution time), not here, so `VOID_E2E_RUN_ID` is read after the runner
-// injects it — the same collection-vs-execution timing as the credentials above. A module-load read
-// would always miss the CI run id and fall back to the timestamp.
 let WORKER_NAME = '';
 let D1_NAME = '';
 let KV_TITLE = '';
@@ -111,9 +76,7 @@ let wranglerSnapshotTaken = false;
 let wranglerOriginal: string | undefined;
 let deployOutput = '';
 let deployStatus: number | null = null;
-// Set true ONLY once the pre-deploy ownership gate proves none of the fixed-name resources already
-// existed in the account. Teardown deletes ONLY when this is true, so a collision (gate throws) can
-// never delete a pre-existing resource the test does not own.
+// Teardown deletes only after the ownership gate proved the names were free before the deploy.
 let ownershipVerified = false;
 
 /** The credentialed env every real Cloudflare call (deploy + teardown) shares. */
@@ -123,12 +86,8 @@ function cloudEnv(): NodeJS.ProcessEnv {
     CLOUDFLARE_API_TOKEN: cfToken(),
     CLOUDFLARE_ACCOUNT_ID: cfAccountId(),
   };
-  // This suite only supports the PUBLIC Cloudflare API + a `*.workers.dev` URL: `workerExistence()`
-  // fetches `api.cloudflare.com` directly and the 200 assertion hits `*.workers.dev`. Scrub every
-  // Cloudflare transport-redirect override inherited from the operator's shell so the spawned cf
-  // calls AND the direct fetch resolve the SAME api base. Otherwise a worker deployed to a
-  // staging/FedRAMP/custom base would 404 on the public api, and teardown's existence check would
-  // treat it as absent and skip the delete — leaking the worker on the alternate base.
+  // The direct fetches use the public api.cloudflare.com, so cf must too. Otherwise teardown could
+  // miss a worker deployed to another API base and leak it.
   delete env.CLOUDFLARE_API_BASE_URL;
   delete env.CF_API_BASE_URL;
   delete env.WRANGLER_API_ENVIRONMENT;
@@ -136,9 +95,7 @@ function cloudEnv(): NodeJS.ProcessEnv {
   return env;
 }
 
-// Absolute wall-clock deadline (epoch ms) for the CURRENT hook's aggregate cf work; each hook
-// stamps it at its start (see SETUP_/TEARDOWN_CF_BUDGET_MS). Infinity outside a hook so a stray
-// call is still bounded by CF_TIMEOUT_MS alone.
+// Deadline for the current hook's total cf time (see SETUP_/TEARDOWN_CF_BUDGET_MS).
 let cfDeadline = Number.POSITIVE_INFINITY;
 
 /** Best-effort pinned cf invocation for setup and teardown. */
@@ -147,10 +104,7 @@ function cf(args: Array<string> | CloudflareOperation): {
   stdout: string;
   output: string;
 } {
-  // Shrink this call's timeout to the time left in the hook's aggregate budget, so a run of stalled
-  // calls can't collectively overrun the hook (spawn.sync blocks the loop, so vitest can't interrupt).
-  // Once the budget is spent, skip the call as a failed one rather than launching a doomed spawn — the
-  // ownership gate fails closed and teardown records the leak loudly instead of silently hanging.
+  // Once the hook budget is spent, fail the call instead of spawning; every caller fails closed.
   const remaining = cfDeadline - Date.now();
   if (remaining <= 0) {
     return {
@@ -167,9 +121,6 @@ function cf(args: Array<string> | CloudflareOperation): {
       encoding: 'utf8',
       maxBuffer: 10 * 1024 * 1024,
       env: { ...cloudEnv(), CF_DELEGATION: '1' },
-      // Bound each call so a stalled CF request can't block the event loop and freeze teardown
-      // (see CF_TIMEOUT_MS). On timeout, status is null → `?? 1` makes it a non-zero (failed) call,
-      // which every caller already handles: the ownership gate fails closed, teardown records a failure.
       timeout: Math.min(CF_TIMEOUT_MS, remaining),
     },
   );
@@ -187,9 +138,7 @@ function cf(args: Array<string> | CloudflareOperation): {
       ? JSON.stringify(decoded.data)
       : (decoded.stdout ?? '');
   const stderr = decoded.stderr ?? '';
-  // `output` (stdout+stderr) is for human-facing error text only. JSON parsing must read `stdout`
-  // ALONE: cf can print notices/warnings to stderr on a status-0 list, and any non-JSON
-  // trailing the payload would make JSON.parse throw — breaking the ownership gate / teardown.
+  // Parse JSON from `stdout` only: cf can print notices to stderr on success.
   return {
     status: decoded.status ?? 1,
     stdout,
@@ -198,14 +147,8 @@ function cf(args: Array<string> | CloudflareOperation): {
 }
 
 /**
- * Definitively resolve whether the fixed-name worker already exists, for the ownership gate. The CF
- * API returns an unambiguous 200 (exists) / 404 (absent) for a script, unlike a CLI exit code
- * (a genuinely-absent worker ALSO exits nonzero). A DEFINITIVE 200/404 is returned immediately; any
- * other outcome — a non-200/404 status or a network error — is retried a few times so a single
- * transient CF API blip (a 5xx, a 429, a dropped connection) does not needlessly fail the gate. Only
- * when EVERY attempt is non-definitive does it return `'unknown'`, which the gate treats as a
- * collision and fails closed on — so an ownership lookup that merely errored can never be mistaken
- * for "the name is free", while a lone hiccup no longer blocks an otherwise-clean run.
+ * Ask the CF API whether the worker exists: `cf` exits nonzero for a missing worker too, so its
+ * exit code cannot tell. Returns 'unknown' after three tries without a 200 or 404.
  */
 async function workerExistence(): Promise<'exists' | 'absent' | 'unknown'> {
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -214,8 +157,6 @@ async function workerExistence(): Promise<'exists' | 'absent' | 'unknown'> {
         `https://api.cloudflare.com/client/v4/accounts/${cfAccountId()}/workers/scripts/${WORKER_NAME}`,
         {
           headers: { Authorization: `Bearer ${cfToken()}` },
-          // Abort a stalled connection so the retry loop (and teardown that depends on it) stays
-          // bounded — an accepted-but-never-answered request would otherwise hang the whole check.
           signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
         },
       );
@@ -226,7 +167,7 @@ async function workerExistence(): Promise<'exists' | 'absent' | 'unknown'> {
         return 'absent';
       }
     } catch {
-      // Network error — transient; fall through to retry.
+      // Retry network errors.
     }
     if (attempt < 2) {
       await new Promise((resolve) => setTimeout(resolve, 2000));
@@ -237,10 +178,7 @@ async function workerExistence(): Promise<'exists' | 'absent' | 'unknown'> {
 
 /** Extract the deployed workers.dev URL the CLI prints on a successful deploy. */
 function extractWorkerUrl(output: string): string | undefined {
-  // `[a-z0-9.-]+` spans the MULTI-label host (`<worker>.<account-subdomain>.workers.dev`); the
-  // optional `(?:\/[^\s]*)?` consumes only a real URL path, so a trailing sentence period (were the
-  // URL ever printed in prose) is not captured. A bare `[a-z0-9-]+` before `.workers.dev` would NOT
-  // match the two-label host and would return undefined — do not "simplify" it to that.
+  // The host has two labels before workers.dev: `<worker>.<account-subdomain>`.
   return output.match(/https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?/)?.[0];
 }
 
@@ -265,14 +203,8 @@ function abortableDelay(ms: number, signal?: AbortSignal): Promise<void> {
 }
 
 /**
- * Poll the live worker until it serves a 200. A BRAND-NEW `*.workers.dev` hostname (every run uses a
- * unique worker name) needs the route to propagate globally before the first request succeeds, and
- * that window is materially longer from a CI runner's network path than from a dev machine — a run
- * observed a solid 30s of 404s before the route went live. So poll generously (~2 min). Retries on ANY
- * non-200 — not just 5xx — so a propagation-window 404 is not mistaken for the final answer. On
- * exhaustion returns the LAST response so the caller's status assertion reports the real final status;
- * throws only when every attempt was a network error (no response at all). `init` is forwarded to
- * `fetch` for non-GET requests (e.g. a KV `PUT`) and defaults to a GET.
+ * Poll until a 200, retrying any other status: a new workers.dev host can 404 while its route
+ * propagates. Returns the last response, or throws when no attempt got a response.
  */
 async function fetchWithRetry(
   url: string,
@@ -284,18 +216,13 @@ async function fetchWithRetry(
   let lastResponse: Response | undefined;
   let lastError: unknown;
   for (let i = 0; i < attempts; i++) {
-    // Overall deadline: callers pass the test's `ctx.signal`, which vitest aborts at the test timeout.
-    // Without it, a worker that accepts connections but never answers could keep this loop running
-    // (e.g. 40 × ~22s ≈ 15 min) long after vitest already failed the test, leaking requests and timers
-    // into later tests and teardown. Stop as soon as the enclosing test is done.
+    // Stop once the test times out, so retries do not leak into later tests.
     if (signal?.aborted) {
       break;
     }
     try {
       const res = await fetch(url, {
         ...init,
-        // Per-request deadline (fail a single stalled socket fast) AND the overall test signal, so
-        // neither one request nor the whole loop can outlive its budget.
         signal:
           init.signal ??
           (signal
@@ -321,11 +248,7 @@ async function fetchWithRetry(
   throw lastError ?? new Error(`worker at ${url} never answered`);
 }
 
-/**
- * Whether the deployed worker has its `*.workers.dev` route enabled, for diagnosing a persistent 404.
- * A propagation-window 404 has the route enabled (just not live yet); a route that is DISABLED 404s
- * forever. Best-effort — returns a short human string, never throws.
- */
+/** Report whether the worker's workers.dev route is enabled, to diagnose a persistent 404. */
 async function workersDevEnabled(): Promise<string> {
   try {
     const res = await fetch(
@@ -348,8 +271,6 @@ async function cfWorkerApi(path: string, signal?: AbortSignal): Promise<Response
     `https://api.cloudflare.com/client/v4/accounts/${cfAccountId()}/workers/scripts/${WORKER_NAME}${path}`,
     {
       headers: { Authorization: `Bearer ${cfToken()}` },
-      // Bound the request so one stalled schedules read aborts and the caller's retry loop continues;
-      // when the caller passes the test signal, also abort the moment Vitest times the test out.
       signal: signal
         ? AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal])
         : AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -359,32 +280,16 @@ async function cfWorkerApi(path: string, signal?: AbortSignal): Promise<Response
 
 describe('void deploy --platform cloudflare (live account)', () => {
   beforeAll(async () => {
-    // Gate at execution time (see the credential note): when the token/account are absent the suite is
-    // a no-op — the tests below skip too. Compute the unique resource names now, from the injected env.
     if (!e2eEnabled()) {
       return;
     }
-    // Cap the SUM of this hook's cf wall-clock (the ownership-gate lists)
-    // so it plus the separate deploy spawn stays under the 600s beforeAll budget. The deploy is NOT a
-    // cf() call, so it keeps its own DEPLOY_TIMEOUT_MS.
     cfDeadline = Date.now() + SETUP_CF_BUDGET_MS;
     computeResourceNames();
 
-    // Ownership gate — refuse to run if any of this run's resources ALREADY exist in the target account.
-    // Automatic provisioning ADOPTS an exact-name D1/KV (it would migrate pre-existing data), and teardown
-    // deletes by these exact names, so a collision with a real resource risks destroying data this
-    // test does not own. Only after proving the names are exclusively ours do we set
-    // `ownershipVerified` — the sole condition under which teardown deletes anything.
-    //
-    // Every check fails CLOSED: a lookup that neither confirms "free" nor confirms "taken" (a
-    // transient API error, a missing read scope, a non-JSON body) is recorded as a collision, so an
-    // ambiguous result can never be mistaken for a free name and let teardown delete a resource this
-    // test did not create.
+    // Ownership gate: provisioning adopts an existing D1/KV with the same name and teardown deletes
+    // by name, so refuse to run on any collision. An ambiguous lookup counts as a collision.
     const collisions: Array<string> = [];
 
-    // Worker — a genuinely-absent worker ALSO makes `cf` exit nonzero, so an exit code cannot
-    // tell "free" from "errored". Resolve it against the CF API instead, which returns an unambiguous
-    // 200/404; anything else is `'unknown'` → treated as a collision (fail closed).
     const worker = await workerExistence();
     if (worker === 'exists') {
       collisions.push(`worker ${WORKER_NAME}`);
@@ -392,9 +297,7 @@ describe('void deploy --platform cloudflare (live account)', () => {
       collisions.push(`worker ${WORKER_NAME} (could not confirm it is free — lookup errored)`);
     }
 
-    // D1 — `d1 info <name>` exits nonzero BOTH when the database is absent and when the call errors,
-    // so it cannot fail closed. List every database instead: a successful JSON list that omits the
-    // name proves it is free; a list failure or non-JSON body is ambiguous → collision.
+    // `d1 info` cannot tell a missing database from an error, so list them all.
     const d1List = cf({ type: 'd1.list' });
     if (d1List.status !== 0) {
       collisions.push(`d1 database ${D1_NAME} (could not list databases to rule out a collision)`);
@@ -436,17 +339,14 @@ describe('void deploy --platform cloudflare (live account)', () => {
           'Remove them (or change WORKER_NAME) and rerun.',
       );
     }
-    // Exclusive ownership proven: any resource with these names after this point was created by THIS
-    // run, so teardown may safely delete them.
     ownershipVerified = true;
 
-    // Snapshot BEFORE any filesystem work so an early failure never deletes a developer-local file.
+    // Snapshot before writing so an early failure never deletes a local file.
     wranglerOriginal = existsSync(APP_WRANGLER) ? readFileSync(APP_WRANGLER, 'utf-8') : undefined;
     wranglerSnapshotTaken = true;
 
-    // Start from an intentionally incomplete config. The deploy itself must create D1 + KV and
-    // persist their real ids/migrations_dir before continuing. `account_id` pins whoami,
-    // provisioning, migration, and deploy to the intended account.
+    // No D1/KV ids, so the deploy must provision them. `account_id` pins every step to the test
+    // account. The deploy migrates this file into void.config.ts.
     const overlay = {
       name: WORKER_NAME,
       compatibility_date: COMPAT_DATE,
@@ -454,8 +354,6 @@ describe('void deploy --platform cloudflare (live account)', () => {
     };
     writeFileSync(APP_WRANGLER, `${JSON.stringify(overlay, null, 2)}\n`);
 
-    // No extra flag: this exercises automatic provision → build → tamper guard → remote migrations
-    // → `cf deploy` against the live account.
     const res = spawn.sync('node', [CLI_ENTRY, 'deploy', '--platform', 'cloudflare'], {
       cwd: APP,
       encoding: 'utf8',
@@ -468,13 +366,8 @@ describe('void deploy --platform cloudflare (live account)', () => {
   }, 600_000);
 
   afterAll(async () => {
-    // Tear DOWN the worker + the D1/KV created in `beforeAll`, even if the deploy or an assertion
-    // failed. Each delete is best-effort and independent so one failure never blocks the others.
-    // A delete is only required to succeed for a resource that STILL EXISTS: a resource confirmed
-    // ABSENT (e.g. the deploy failed before the worker was created) is already gone — no leak, no
-    // failure. A nonzero delete of a resource that IS present — or a lookup that cannot confirm the
-    // resource is gone — is COLLECTED and re-thrown after cleanup + config restore, so a genuine
-    // leak (or an ambiguous teardown) fails LOUD instead of reporting green.
+    // Independent best-effort deletes, even after a failed deploy. A failed delete or a lookup that
+    // cannot confirm a resource is gone is collected and thrown after the config restore.
     const failures: Array<string> = [];
     const attemptDelete = (label: string, args: Array<string>): void => {
       const res = cf(args);
@@ -482,21 +375,13 @@ describe('void deploy --platform cloudflare (live account)', () => {
         failures.push(`${label} (exit ${res.status})\n${res.output.trim()}`);
       }
     };
-    // Delete ONLY when the ownership gate proved these names were free before the deploy, so a
-    // collision that aborted beforeAll never deletes a pre-existing resource the test does not own.
     if (e2eEnabled() && ownershipVerified) {
-      // Cap the SUM of teardown's cf wall-clock (the worker probe is async + separately bounded)
-      // so the whole cleanup stays under the 300s afterAll budget even if every list/delete stalls.
       cfDeadline = Date.now() + TEARDOWN_CF_BUDGET_MS;
-      // Worker — exists only if the deploy succeeded. Skip when the CF API confirms it is ABSENT
-      // (avoids a spurious "does not exist" failure on a deploy that never got that far); fail closed
-      // when existence cannot be confirmed ('unknown') by attempting the delete anyway.
+      // Skip only a worker the API confirms absent; 'unknown' still tries the delete.
       const worker = await workerExistence();
       if (worker !== 'absent') {
         attemptDelete(`worker ${WORKER_NAME}`, ['workers', 'delete', WORKER_NAME, '--force']);
       }
-      // D1 — created in beforeAll; delete when the account still lists it by EXACT name. A list
-      // failure cannot confirm the database is gone, so it is recorded (fail closed).
       const d1List = cf({ type: 'd1.list' });
       if (d1List.status !== 0) {
         failures.push(`d1 list (exit ${d1List.status})\n${d1List.output.trim()}`);
@@ -515,9 +400,7 @@ describe('void deploy --platform cloudflare (live account)', () => {
           );
         }
       }
-      // KV delete needs the namespace id — resolve it from the account's namespace list by EXACT
-      // title. Matching by exact title (not `endsWith`) avoids selecting an unrelated namespace that
-      // merely shares the suffix. A namespace absent from the list is already gone (skip).
+      // KV delete needs the namespace id; match the exact title.
       const list = cf({ type: 'kv.namespace.list' });
       if (list.status !== 0) {
         failures.push(`kv namespace list (exit ${list.status})\n${list.output.trim()}`);
@@ -537,8 +420,7 @@ describe('void deploy --platform cloudflare (live account)', () => {
         }
       }
     }
-    // Restore the app's original root config (or remove the overlay if it had none) BEFORE surfacing
-    // any teardown failure, so the working tree is always left clean.
+    // Restore the root config before surfacing teardown failures.
     if (wranglerSnapshotTaken) {
       if (wranglerOriginal === undefined) {
         rmSync(APP_WRANGLER, { force: true });
@@ -554,12 +436,9 @@ describe('void deploy --platform cloudflare (live account)', () => {
   it('deploys the worker to the live account', (ctx) => {
     ctx.skip(!e2eEnabled(), NO_CREDS_NOTE);
     expect(deployStatus, deployOutput).toBe(0);
-    // A successful `void deploy` prints the worker's workers.dev URL.
     const url = extractWorkerUrl(deployOutput);
     expect(url, deployOutput).toBeDefined();
-    // The host's FIRST label must be THIS run's worker name. If a concurrent local run had clobbered
-    // the shared `wrangler.jsonc` overlay, the deploy would have targeted a different worker — this
-    // catches that cross-run contamination rather than silently validating someone else's worker.
+    // A concurrent local run sharing the playground could have deployed another worker.
     const workerLabel = new URL(url!).hostname.split('.')[0];
     expect(workerLabel, `deployed host for ${url}`).toBe(WORKER_NAME);
   });
@@ -570,8 +449,6 @@ describe('void deploy --platform cloudflare (live account)', () => {
     expect(base, deployOutput).toBeDefined();
     const url = `${base!.replace(/\/$/, '')}/api/hello`;
     const res = await fetchWithRetry(url, {}, 40, 3000, ctx.signal);
-    // On a persistent non-200, report the URL + whether the workers.dev route is even enabled, to
-    // tell a slow-propagation 404 (route enabled) from a route that never went live (disabled).
     const diagnostic =
       res.status === 200 ? '' : ` — GET ${url} → ${res.status}; ${await workersDevEnabled()}`;
     expect(res.status, `worker ${WORKER_NAME}${diagnostic}`).toBe(200);
@@ -582,11 +459,8 @@ describe('void deploy --platform cloudflare (live account)', () => {
     const base = extractWorkerUrl(deployOutput);
     expect(base, deployOutput).toBeDefined();
     const root = base!.replace(/\/$/, '');
-    // A 500 here means the remote D1 migration never applied (no `users` table) or the DB binding did
-    // not resolve — the exact deploy failure the static /api/hello check cannot catch. A unique email
-    // keeps the read-back assertion precise regardless of any pre-existing rows. This (and the KV/
-    // idempotency cases) run AFTER `serves a live 200` has already blocked until the hostname routes
-    // globally, so their shorter retry budgets only need to cover worker cold-start, not propagation.
+    // A 500 means the remote D1 migration or binding failed. The live-200 test already waited for
+    // the route, so shorter retries only cover cold start.
     const email = `e2e-${uniqueRunSuffix()}@example.com`;
     const created = await fetchWithRetry(
       `${root}/api/users`,
@@ -618,8 +492,6 @@ describe('void deploy --platform cloudflare (live account)', () => {
     const base = extractWorkerUrl(deployOutput);
     expect(base, deployOutput).toBeDefined();
     const root = base!.replace(/\/$/, '');
-    // Proves the `KV` binding resolves to the real namespace end to end: write via the deployed worker,
-    // then read it back. (The deploy in beforeAll created the namespace and pinned its id.)
     const key = `probe-${uniqueRunSuffix()}`;
     const value = `kv-${Date.now().toString(36)}`;
     const put = await fetchWithRetry(
@@ -630,9 +502,7 @@ describe('void deploy --platform cloudflare (live account)', () => {
       ctx.signal,
     );
     expect(put.status, `PUT /api/kv/${key}`).toBe(200);
-    // KV is eventually consistent and a first-read MISS can be negatively cached at the edge for up to
-    // ~60s, so poll past that window (40 × 2s = 80s). A healthy binding whose first GET raced the
-    // write's central visibility then converges rather than false-failing CI.
+    // KV can cache a first-read miss for ~60s, so poll past that window.
     const got = await fetchWithRetry(`${root}/api/kv/${key}`, {}, 40, 2000, ctx.signal);
     const gotBody = await got.text();
     expect(got.status, gotBody).toBe(200);
@@ -641,16 +511,10 @@ describe('void deploy --platform cloudflare (live account)', () => {
 
   it('registers the cron trigger on the deployed worker', async (ctx) => {
     ctx.skip(!e2eEnabled(), NO_CREDS_NOTE);
-    // The deploy emits `triggers.crons` and Cloudflare registers them on the worker. We
-    // assert the schedule is REGISTERED via the CF API — fast + deterministic — instead of waiting for
-    // the hourly job to actually fire. Retry so a single transient CF-API blip (a 429/5xx or a network
-    // throw) or a brief registration-visibility lag on the shared CI runner does not red an
-    // otherwise-healthy deploy; a genuinely-unregistered cron still fails loud after the retries.
+    // Check the registered schedule through the CF API instead of waiting for the hourly run.
     let crons: Array<string | undefined> = [];
     let diag = 'no response';
     for (let attempt = 0; attempt < 8; attempt++) {
-      // Stop as soon as Vitest times the test out: like `fetchWithRetry`, thread `ctx.signal` into the
-      // request AND the inter-attempt delay so 8 × 20s of polling can't outlive the 60s test budget.
       if (ctx.signal.aborted) {
         break;
       }
@@ -678,10 +542,7 @@ describe('void deploy --platform cloudflare (live account)', () => {
 
   it('re-deploys idempotently to the same worker', async (ctx) => {
     ctx.skip(!e2eEnabled(), NO_CREDS_NOTE);
-    // A SECOND `void deploy` against the already-created worker/D1/KV must succeed cleanly: the
-    // existing D1/KV are reused, the remote migration is already applied (a no-op), and the worker
-    // is updated in place. The overlay wrangler.jsonc is still on disk
-    // (afterAll restores it only after every test), so this reuses it. Runs LAST for that reason.
+    // Runs last: redeploys with the config the first deploy wrote, reusing the worker, D1 and KV.
     const res = spawn.sync('node', [CLI_ENTRY, 'deploy', '--platform', 'cloudflare'], {
       cwd: APP,
       encoding: 'utf8',
@@ -691,15 +552,12 @@ describe('void deploy --platform cloudflare (live account)', () => {
     });
     const output = `${res.stdout ?? ''}${res.stderr ?? ''}${res.error ? `\n${res.error}` : ''}`;
     expect(res.status, output).toBe(0);
-    // Prove THIS deploy re-targeted the same worker: read the URL from ITS OWN output (no fallback to
-    // the first deploy, which would mask a second deploy that uploaded nothing) and require the host's
-    // worker label to equal WORKER_NAME.
+    // Read the URL from this deploy's own output, not the first deploy's.
     const base = extractWorkerUrl(output);
     expect(base, output).toBeDefined();
     expect(new URL(base!).hostname.split('.')[0], output).toBe(WORKER_NAME);
     const root = base!.replace(/\/$/, '');
-    // The re-deployed worker still serves AND its bindings survived the update: /api/hello (static) is
-    // 200, and /api/users (a D1-backed route) is 200 — a dropped or broken DB binding would 500.
+    // /api/users reads D1, so a dropped binding would return 500.
     const served = await fetchWithRetry(`${root}/api/hello`, {}, 15, 2000, ctx.signal);
     expect(served.status).toBe(200);
     const dbRoute = await fetchWithRetry(`${root}/api/users`, {}, 15, 2000, ctx.signal);
diff --git a/packages/void/test/helpers/cli-command.ts b/packages/void/test/helpers/cli-command.ts
new file mode 100644
index 000000000..ccdfadf5a
--- /dev/null
+++ b/packages/void/test/helpers/cli-command.ts
@@ -0,0 +1,53 @@
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { vi } from 'vite-plus/test';
+import { Buffer } from '../../src/cli/node-buffer.ts';
+import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
+
+/** Collects stdout writes and `console.log` lines until `restore()` is called. */
+export function captureOutput(): { output: () => string; restore: () => void } {
+  const chunks: Array<string> = [];
+  const writeMock = vi
+    .spyOn(process.stdout, 'write')
+    .mockImplementation((...args: Array<unknown>) => {
+      const chunk = args[0];
+      if (typeof chunk === 'string') {
+        chunks.push(chunk);
+      } else if (Buffer.isBuffer(chunk)) {
+        chunks.push(chunk.toString());
+      }
+      return true;
+    });
+  const logMock = vi.spyOn(console, 'log').mockImplementation((...args: Array<unknown>) => {
+    chunks.push(args.map(String).join(' ') + '\n');
+  });
+  return {
+    output: () => chunks.join(''),
+    restore: () => {
+      writeMock.mockRestore();
+      logMock.mockRestore();
+    },
+  };
+}
+
+/**
+ * Points HOME and the platform registry at a new temp directory that holds one
+ * connected platform. Returns the directory so the caller can remove it.
+ */
+export function setIsolatedHome(): string {
+  const dir = mkdtempSync(join(tmpdir(), 'void-home-'));
+  process.env.HOME = dir;
+  process.env.USERPROFILE = dir;
+  process.env.VOID_PLATFORM_REGISTRY_DIR = join(dir, 'registry');
+  savePlatformConnection({
+    accountId: null,
+    apiUrl: 'https://api.example.test',
+    applicationDomain: 'apps.example.test',
+    displayName: 'Test platform',
+    installationId: null,
+    kind: 'connected',
+    proxyUrl: 'https://proxy.example.test',
+  });
+  return dir;
+}
diff --git a/packages/void/test/helpers/cloudflare-vite-plugin.ts b/packages/void/test/helpers/cloudflare-vite-plugin.ts
new file mode 100644
index 000000000..daac7f7ef
--- /dev/null
+++ b/packages/void/test/helpers/cloudflare-vite-plugin.ts
@@ -0,0 +1,6 @@
+import type { Plugin } from 'vite';
+
+/** Stand-in for `@cloudflare/vite-plugin`: exposes the options Void passes as `api.pluginConfig`. */
+export function cloudflare(pluginConfig: unknown): Array<Plugin> {
+  return [{ name: 'mock:cloudflare', api: { pluginConfig } }];
+}
diff --git a/packages/void/test/helpers/github-cli.ts b/packages/void/test/helpers/github-cli.ts
new file mode 100644
index 000000000..431de7179
--- /dev/null
+++ b/packages/void/test/helpers/github-cli.ts
@@ -0,0 +1,73 @@
+import { vi, type Mock, type MockInstance } from 'vite-plus/test';
+import type { GithubConnection, ProjectResponse } from '../../src/cli/client.ts';
+
+export const projectId = 'proj_test';
+export const slug = 'my-app';
+
+const realFetch = globalThis.fetch.bind(globalThis);
+
+export function makeProject(): ProjectResponse {
+  return {
+    id: projectId,
+    user_id: 'user_1',
+    slug,
+    type: 'void',
+    created_at: '2024-01-01T00:00:00Z',
+    custom_domain: null,
+    role: 'owner',
+  };
+}
+
+export function makeConnection(overrides: Partial<GithubConnection> = {}): GithubConnection {
+  return {
+    id: 'conn_1',
+    project_id: projectId,
+    installation_id: '123456',
+    repo_full_name: 'octocat/hello-world',
+    branch: 'main',
+    build_executor: 'container',
+    workflow_path: '.github/workflows/void-deploy.yml',
+    created_at: '2024-01-01T00:00:00Z',
+    updated_at: '2024-01-01T00:00:00Z',
+    ...overrides,
+  };
+}
+
+/** Makes `process.exit` throw so a test can assert the exit without stopping the runner. */
+export function throwOnProcessExit(): MockInstance<typeof process.exit> {
+  return vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    throw new Error(`process.exit(${code})`);
+  }) as never);
+}
+
+export interface BrowserCallback {
+  authUrl: Mock<(redirect: string) => Promise<{ url: string }>>;
+  /** Settles with the command, after the simulated redirect has finished. */
+  settle: <T>(run: Promise<T>) => Promise<T>;
+}
+
+/**
+ * Fakes the platform endpoint that returns a GitHub authorize URL. When the
+ * command requests it, `query` turns the command's localhost callback URL into
+ * the redirect a browser would send back.
+ */
+export function browserCallback(query?: (callbackUrl: URL) => URL): BrowserCallback {
+  let resolveCallback!: (url: URL) => void;
+  const callbackReady = new Promise<URL>((resolve) => {
+    resolveCallback = resolve;
+  });
+  const authUrl = vi.fn(async (redirect: string) => {
+    resolveCallback(new URL(redirect));
+    return { url: 'https://github.com/login/oauth/authorize?client_id=x' };
+  });
+  // Error paths close the callback server mid-response, so the redirect may reject.
+  const fired = query
+    ? callbackReady.then(async (callbackUrl) => {
+        await realFetch(query(callbackUrl)).catch(() => {});
+      })
+    : Promise.resolve();
+  return {
+    authUrl,
+    settle: (run) => run.finally(() => fired.catch(() => {})),
+  };
+}
diff --git a/packages/void/test/helpers/mock-event-source.ts b/packages/void/test/helpers/mock-event-source.ts
new file mode 100644
index 000000000..142f92305
--- /dev/null
+++ b/packages/void/test/helpers/mock-event-source.ts
@@ -0,0 +1,37 @@
+/** EventSource stand-in that records every instance and lets tests dispatch events. */
+export class MockEventSource {
+  static instances: Array<MockEventSource> = [];
+
+  readonly listeners: Map<string, Set<(event: Event) => void>> = new Map();
+  closed = false;
+
+  constructor(
+    readonly url: string,
+    readonly options?: { withCredentials?: boolean },
+  ) {
+    MockEventSource.instances.push(this);
+  }
+
+  addEventListener(type: string, listener: (event: Event) => void): void {
+    const listeners = this.listeners.get(type) ?? new Set();
+    listeners.add(listener);
+    this.listeners.set(type, listeners);
+  }
+
+  removeEventListener(type: string, listener: (event: Event) => void): void {
+    this.listeners.get(type)?.delete(listener);
+  }
+
+  /** Dispatches `event`; a string is sent as the `data` of a message event. */
+  emit(type: string, event: Event | string, lastEventId = ''): void {
+    const payload =
+      typeof event === 'string' ? ({ data: event, lastEventId } as MessageEvent) : event;
+    for (const listener of this.listeners.get(type) ?? []) {
+      listener(payload);
+    }
+  }
+
+  close(): void {
+    this.closed = true;
+  }
+}
diff --git a/packages/void/test/helpers/page-scan.ts b/packages/void/test/helpers/page-scan.ts
new file mode 100644
index 000000000..c35b0ffc0
--- /dev/null
+++ b/packages/void/test/helpers/page-scan.ts
@@ -0,0 +1,22 @@
+import type { PageDefinition, PageScanResult } from '../../src/pages/types.ts';
+
+export function makePage(pattern: string, revalidate?: number): PageDefinition {
+  return {
+    pattern,
+    params: [],
+    catchAll: false,
+    componentPath: `${pattern}.vue`,
+    serverPath: `${pattern}.server.ts`,
+    methods: ['GET'],
+    componentId: pattern.replace(/^\//, ''),
+    revalidate,
+    ssrMode: 'auto',
+    prerenderMode: 'auto',
+    renderMode: 'server',
+    shouldPrerender: false,
+  };
+}
+
+export function makeScan(pages: Array<PageDefinition>): PageScanResult {
+  return { pages, layouts: [], namedLayouts: [] };
+}
diff --git a/packages/void/test/helpers/platform-installation.ts b/packages/void/test/helpers/platform-installation.ts
new file mode 100644
index 000000000..d8c710a4e
--- /dev/null
+++ b/packages/void/test/helpers/platform-installation.ts
@@ -0,0 +1,65 @@
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { stripVTControlCharacters } from 'node:util';
+import {
+  createPlatformResourceOwnershipMarker,
+  type InstallationResource,
+  type PlatformInstallationManifest,
+} from '@void/platform';
+import { note } from '@voidzero-dev/vite-plus-prompts';
+import { expect, vi } from 'vite-plus/test';
+import {
+  promoteInstallationSecrets,
+  writeInstallationManifest,
+  writePendingInstallationSecrets,
+} from '../../src/cli/platform-registry.ts';
+
+/** Saves the installation and its recovery secrets in a new registry directory added to `directories`. */
+export function persistInstallation(
+  manifest: PlatformInstallationManifest,
+  directories: Array<string>,
+): void {
+  const directory = mkdtempSync(join(tmpdir(), 'void-platform-installation-test-'));
+  directories.push(directory);
+  process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+  writeInstallationManifest(manifest);
+  writePendingInstallationSecrets(manifest, { databaseUrl: 'postgres://recovery' });
+  promoteInstallationSecrets(manifest);
+}
+
+export function ownershipMarker(
+  manifest: Pick<PlatformInstallationManifest, 'account' | 'id' | 'ownershipNonce'>,
+  resource: Pick<InstallationResource, 'id' | 'key' | 'kind' | 'name'>,
+): string {
+  return JSON.stringify(
+    createPlatformResourceOwnershipMarker({
+      accountId: manifest.account.id,
+      installationId: manifest.id,
+      ownershipNonce: manifest.ownershipNonce,
+      resourceId: resource.id,
+      resourceKey: resource.key,
+      resourceKind: resource.kind,
+      resourceName: resource.name,
+    }),
+  );
+}
+
+/** The last note shown under `title`. The calling test file must mock `note`. */
+export function noteText(title: string): string {
+  return String(
+    vi
+      .mocked(note)
+      .mock.calls.filter(([, noteTitle]) => stripVTControlCharacters(noteTitle ?? '') === title)
+      .at(-1)?.[0] ?? '',
+  );
+}
+
+export function expectInOrder(text: string, lines: ReadonlyArray<string>): void {
+  const positions = lines.map((line) => text.indexOf(line));
+  expect(
+    positions.map((position, index) => [lines[index], position >= 0]),
+    text,
+  ).toEqual(lines.map((line) => [line, true]));
+  expect(positions, text).toEqual([...positions].sort((left, right) => left - right));
+}
diff --git a/packages/void/test/helpers/vite-hooks.ts b/packages/void/test/helpers/vite-hooks.ts
new file mode 100644
index 000000000..3f70a397c
--- /dev/null
+++ b/packages/void/test/helpers/vite-hooks.ts
@@ -0,0 +1,9 @@
+export function getHookHandler<T>(hook: T | { handler: T } | undefined): T {
+  if (typeof hook === 'function') {
+    return hook;
+  }
+  if (hook && typeof hook === 'object' && 'handler' in hook) {
+    return hook.handler;
+  }
+  throw new Error('Expected Vite hook handler.');
+}
diff --git a/packages/void/test/integration/auth-isr-cache-policy.test.ts b/packages/void/test/integration/auth-isr-cache-policy.test.ts
index e80dcbc6f..f599ebb6e 100644
--- a/packages/void/test/integration/auth-isr-cache-policy.test.ts
+++ b/packages/void/test/integration/auth-isr-cache-policy.test.ts
@@ -9,34 +9,26 @@ const options = { dialect: 'sqlite' as const, providers: null };
 
 function fixture() {
   const database = memoryAdapter({});
-  const runtime = createVoidAuthRuntime(
-    'sqlite',
-    async () => ({ database, dispose: async () => {} }),
-    async () => {},
-  );
+  const runtime = createVoidAuthRuntime('sqlite', async () => {});
   const app = new Hono();
-  app.use(async (c, next) => runtime.runVoidAuthMiddleware(c, next, options));
+  app.use(async (c, next) => runtime.runVoidAuthMiddleware(c, next, options, database));
   return { app, runtime, database };
 }
 
 describe('real anonymous Better Auth lookup cache policy', () => {
   it('does not copy the null-session lookup policy onto an ordinary response', async () => {
-    const { app, runtime } = fixture();
+    const { app, runtime, database } = fixture();
     const request = new Request('https://app.test/assets/client-abcdefgh.js');
-    const { auth, dispose } = await runtime.createVoidAuth(request, env, options);
-    try {
-      const lookup = await auth.api.getSession({
-        headers: request.headers,
-        asResponse: false,
-        returnHeaders: true,
-      });
-      expect(lookup.response).toBeNull();
-      expect(lookup.headers.get('cache-control')).toBe('no-store');
-      expect(lookup.headers.get('pragma')).toBe('no-cache');
-      expect(lookup.headers.has('set-cookie')).toBe(false);
-    } finally {
-      await dispose();
-    }
+    const auth = await runtime.createVoidAuth(request, env, options, database);
+    const lookup = await auth.api.getSession({
+      headers: request.headers,
+      asResponse: false,
+      returnHeaders: true,
+    });
+    expect(lookup.response).toBeNull();
+    expect(lookup.headers.get('cache-control')).toBe('no-store');
+    expect(lookup.headers.get('pragma')).toBe('no-cache');
+    expect(lookup.headers.has('set-cookie')).toBe(false);
     app.get(
       '/assets/client-abcdefgh.js',
       () =>
@@ -90,8 +82,8 @@ describe('real anonymous Better Auth lookup cache policy', () => {
   });
 
   it('retains the actual auth endpoint no-store and no-cache headers', async () => {
-    const { app, runtime } = fixture();
-    app.get('/api/auth/get-session', (c) => runtime.handleVoidAuthRequest(c, options));
+    const { app, runtime, database } = fixture();
+    app.get('/api/auth/get-session', (c) => runtime.handleVoidAuthRequest(c, options, database));
     const response = await app.request('https://app.test/api/auth/get-session', undefined, env);
     expect(response.status).toBe(200);
     expect(response.headers.get('cache-control')).toBe('no-store');
diff --git a/packages/void/test/integration/auth-rate-limit.test.ts b/packages/void/test/integration/auth-rate-limit.test.ts
index 395331017..fcc07e923 100644
--- a/packages/void/test/integration/auth-rate-limit.test.ts
+++ b/packages/void/test/integration/auth-rate-limit.test.ts
@@ -8,31 +8,22 @@ const options = { dialect: 'sqlite' as const, providers: null };
 
 function fixture() {
   const database = memoryAdapter({ user: [], session: [], account: [], verification: [] });
-  const runtime = createVoidAuthRuntime(
-    'sqlite',
-    async () => ({ database, dispose: async () => {} }),
-    async () => {},
-  );
+  const runtime = createVoidAuthRuntime('sqlite', async () => {});
   const app = new Hono();
-  app.use(async (c, next) => runtime.runVoidAuthMiddleware(c, next, options));
-  app.on(['GET', 'POST'], '/api/auth/*', (c) => runtime.handleVoidAuthRequest(c, options));
+  app.use(async (c, next) => runtime.runVoidAuthMiddleware(c, next, options, database));
+  app.on(['GET', 'POST'], '/api/auth/*', (c) =>
+    runtime.handleVoidAuthRequest(c, options, database),
+  );
   return app;
 }
 
-// Better Auth keeps its in-memory limiter for the whole module, so every test
-// signs in from its own client address.
-function signIn(clientIp: string | null, cf: boolean): Request {
+function signIn(clientIp: string): Request {
   const request = new Request('https://app.test/api/auth/sign-in/email', {
     method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      ...(clientIp ? { 'cf-connecting-ip': clientIp } : {}),
-    },
+    headers: { 'content-type': 'application/json', 'cf-connecting-ip': clientIp },
     body: JSON.stringify({ email: 'nobody@example.test', password: 'wrong-password' }),
   });
-  if (cf) {
-    Object.defineProperty(request, 'cf', { value: { colo: 'SJC' } });
-  }
+  Object.defineProperty(request, 'cf', { value: { colo: 'SJC' } });
   return request;
 }
 
@@ -48,29 +39,11 @@ async function statuses(app: Hono, requests: () => Request, count: number) {
 describe('auth rate limits on deployed Cloudflare requests', () => {
   it('limits repeated sign-in attempts from one client IP', async () => {
     const app = fixture();
-    const results = await statuses(app, () => signIn('203.0.113.10', true), 4);
+    const results = await statuses(app, () => signIn('203.0.113.10'), 4);
     expect(results.slice(0, 3)).not.toContain(429);
     expect(results[3]).toBe(429);
 
-    const other = await app.fetch(signIn('203.0.113.11', true), env);
+    const other = await app.fetch(signIn('203.0.113.11'), env);
     expect(other.status).not.toBe(429);
   });
-
-  it('does not limit requests outside a deployed Worker', async () => {
-    const app = fixture();
-    const results = await statuses(app, () => signIn('203.0.113.12', false), 5);
-    expect(results).not.toContain(429);
-  });
-
-  it.each(['127.0.0.1', '::1'])('does not limit a local preview from %s', async (ip) => {
-    const app = fixture();
-    const results = await statuses(app, () => signIn(ip, true), 5);
-    expect(results).not.toContain(429);
-  });
-
-  it('does not limit Worker requests without a client IP', async () => {
-    const app = fixture();
-    const results = await statuses(app, () => signIn(null, true), 5);
-    expect(results).not.toContain(429);
-  });
 });
diff --git a/packages/void/test/integration/browser-helpers.test.ts b/packages/void/test/integration/browser-helpers.test.ts
deleted file mode 100644
index 8b4c9885b..000000000
--- a/packages/void/test/integration/browser-helpers.test.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import { chromium, type Browser } from 'playwright';
-import { afterAll, beforeAll, expect, it } from 'vite-plus/test';
-import { waitForIslandsHydrated } from '../../../../test/browser-helpers.ts';
-
-let browser: Browser;
-
-beforeAll(async () => {
-  browser = await chromium.launch();
-});
-
-afterAll(async () => {
-  await browser?.close();
-});
-
-it('waits for the expected islands and every independent hydration', async () => {
-  const page = await browser.newPage();
-  try {
-    // Empty SSR output must not make an all-elements check pass vacuously.
-    await page.setContent('<main></main>');
-    await expect(waitForIslandsHydrated(page, 1, 500)).rejects.toThrow('Timeout');
-
-    await page.setContent('<div data-island="counter" data-hydrated="true"></div>');
-    await expect(waitForIslandsHydrated(page, 2, 500)).rejects.toThrow('Timeout');
-
-    await page.setContent(
-      '<div data-island="counter" data-hydrated="true"></div><div data-island="form"></div>',
-    );
-    // One hydrated island must not satisfy the wait while a sibling is still unhydrated.
-    await expect(waitForIslandsHydrated(page, 2, 500)).rejects.toThrow('Timeout');
-
-    await page.locator('[data-island="form"]').evaluate((el) => {
-      el.setAttribute('data-hydrated', 'true');
-    });
-    await waitForIslandsHydrated(page, 2);
-  } finally {
-    await page.close();
-  }
-});
diff --git a/packages/void/test/integration/cloudflare-deploy-build.test.ts b/packages/void/test/integration/cloudflare-deploy-build.test.ts
index 07ca44948..589a05ca5 100644
--- a/packages/void/test/integration/cloudflare-deploy-build.test.ts
+++ b/packages/void/test/integration/cloudflare-deploy-build.test.ts
@@ -1,5 +1,6 @@
 import { readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join, normalize, resolve } from 'node:path';
+import { join, normalize } from 'node:path';
+import { parseRootWranglerConfig } from '@void/deploy-cloudflare';
 import spawn from 'cross-spawn';
 import { toSlash } from 'pathslash';
 import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
@@ -7,15 +8,14 @@ import {
   createIsolatedPlayground,
   type IsolatedPlayground,
 } from '../../../../test/integration-helpers.ts';
+import { verifyGeneratedDeployConfig } from '../../src/cli/deploy-artifact-validation.ts';
 import {
-  computeDesiredCloudflareResources,
-  parseRootWranglerConfig,
   reconstructExpectedContainers,
   snapshotBindingIdentities,
   snapshotPassthroughIdentities,
   snapshotPassthroughRawFields,
-  verifyGeneratedDeployConfig,
-} from '../../src/cli/deploy.ts';
+} from '../../src/cli/deploy-binding-snapshot.ts';
+import { computeDesiredCloudflareResources } from '../../src/cli/deploy-resources.ts';
 import { materializeCloudflareConfig } from '../../src/cloudflare-config.ts';
 import { renderVoidConfig } from '../../src/config-write.ts';
 import { readConfig } from '../../src/config.ts';
@@ -26,50 +26,28 @@ import {
 } from '../../src/sandbox/config.ts';
 import { CLOUDFLARE_DEPLOY_BUILD_ENV } from '../../src/shared/env.ts';
 
-// Real-build FP-safety lock for `void deploy --platform cloudflare`. The unit tests drive
-// `runCloudflareDeploy` with a STUBBED `vite build` and HAND-WRITTEN emitted configs, so nothing
-// there proves the guard's core premise: that a REAL `@cloudflare/vite-plugin` + wrangler build
-// emits exactly the shape `verifyGeneratedDeployConfig` reconstructs, adding nothing that would
-// false-positive a legitimate deploy. This test runs a real `vite build` of the richest playground
-// (kitchen-sink: D1 + KV + R2 + AI + sandbox/containers + cron + queue), reconstructs `expected`
-// with the SAME exported builders `runCloudflareDeploy` uses (steps 1 + 5/6), and asserts the real
-// emission PASSES the real guard unmodified. A future plugin/wrangler upgrade that adds a field
-// would break this lock instead of surfacing as a production deploy-blocking false positive.
-//
-// Negative cases start from the SAME real emitted artifact, apply one minimal tamper in memory,
-// write it back to the path the guard reads, and assert it is REJECTED — real-shape teeth.
+// A real build of kitchen-sink must pass the deploy guard unmodified. Unit tests use hand-written
+// configs, so only this catches a plugin upgrade that emits a field the guard rejects.
 
 const ROOT = join(import.meta.dirname, '..', '..', '..', '..');
 const SOURCE_PLAYGROUND = 'playground/kitchen-sink';
 let playground: IsolatedPlayground;
 let pg = '';
-let emittedPath = '';
 
-// Real-SHAPED ids the guard treats as genuine (`isRealD1Id` UUID / `isRealKvId` 32-hex).
-// Provisioning writes real ids into the root config before the build, and the build merges the
-// root config into the emitted artifact, so an overlaid `cloudflare` config carrying these ids
-// yields an emitted artifact whose id-bearing bindings match the pinned snapshot — the exact
-// clean-deploy condition the guard authorizes.
+// The guard accepts only real-shaped ids (D1 UUID, 32-hex KV).
 const ACCOUNT_ID = '0123456789abcdef0123456789abcdef';
 const WORKER_NAME = 'void-kitchen-sink';
 const REAL_D1_ID = '52b3bbc7-c473-4b26-9486-1345f5de61c4';
 const REAL_KV_ID = '7c07b54c9f2a4d1e8b3f6a0c153aa11a';
 const REAL_ISR_CACHE_ID = 'a1b2c3d4e5f60718293a4b5c6d7e8f90';
-const OTHER_D1_ID = '11111111-2222-3333-4444-555555555555';
 const R2_BUCKET_NAME = 'void-kitchen-sink-storage';
 
-// The overlaid Cloudflare config. kitchen-sink ships no authored Cloudflare bindings (it relies on void.config.ts +
-// inference), so the test declares `account_id`, `name`, and real-shaped ids for every
-// id-bearing binding the source uses, then removes the isolated playground on teardown.
 const OVERLAY_WRANGLER = {
   name: WORKER_NAME,
   account_id: ACCOUNT_ID,
   compatibility_date: '2026-02-24',
   d1_databases: [{ binding: 'DB', database_name: 'void-kitchen-sink-db', database_id: REAL_D1_ID }],
-  // kitchen-sink enables ISR (`pages/revalidate.server.ts`), so `computeDesiredCloudflareResources`
-  // adds a SECOND KV binding — `ISR_CACHE` — beyond the app's own `KV`. Pin a distinct real-shaped id
-  // for it too, so the emitted artifact carries both KV namespaces and the FP-lock covers the two-KV
-  // shape a real provisioned ISR deploy builds (not just the single app KV).
+  // kitchen-sink uses ISR, which adds the ISR_CACHE namespace.
   kv_namespaces: [
     { binding: 'KV', id: REAL_KV_ID },
     { binding: 'ISR_CACHE', id: REAL_ISR_CACHE_ID },
@@ -77,39 +55,11 @@ const OVERLAY_WRANGLER = {
   r2_buckets: [{ binding: 'STORAGE', bucket_name: R2_BUCKET_NAME }],
 };
 
-// The `expected` payload `runCloudflareDeploy` (steps 5/6) threads into the guard, rebuilt here from
-// the same exported builders.
 type ExpectedPayload = Parameters<typeof verifyGeneratedDeployConfig>[1];
 
-// The pristine real emission, parsed once and reused (deep-cloned) across every tamper case.
 let pristineEmitted: Record<string, unknown> = {};
 let expectedPayload: ExpectedPayload;
 
-/** A fresh deep clone of the pristine emitted config, so a tamper never mutates the shared copy. */
-function cloneEmitted(): Record<string, unknown> {
-  return JSON.parse(JSON.stringify(pristineEmitted)) as Record<string, unknown>;
-}
-
-/**
- * Write a tampered emitted config to the exact path the guard reads (via the CF plugin's
- * `.wrangler/deploy/config.json` redirect), run the REAL guard, then restore the pristine emission —
- * even if the assertion throws. No rebuild: the tamper models a compromised build editing the one
- * artifact `wrangler deploy` uploads.
- */
-function guardOnTamper(mutate: (config: Record<string, unknown>) => void): {
-  ok: boolean;
-  reason?: string;
-} {
-  const tampered = cloneEmitted();
-  mutate(tampered);
-  writeFileSync(emittedPath, JSON.stringify(tampered));
-  try {
-    return verifyGeneratedDeployConfig(pg, expectedPayload);
-  } finally {
-    writeFileSync(emittedPath, JSON.stringify(pristineEmitted));
-  }
-}
-
 describe('playground/kitchen-sink --platform cloudflare real-build deploy guard', () => {
   beforeAll(async () => {
     playground = createIsolatedPlayground(ROOT, SOURCE_PLAYGROUND);
@@ -132,19 +82,13 @@ describe('playground/kitchen-sink --platform cloudflare real-build deploy guard'
       }),
     );
     const configPath = materializeCloudflareConfig(pg);
-    emittedPath = join(pg, 'dist', 'ssr', 'wrangler.json');
 
-    // Fresh build inputs: drop the previous dist + the stale CF-plugin deploy pointer so the guard
-    // trusts only a pointer this build wrote.
+    // The guard must follow only a deploy pointer this build wrote.
     rmSync(join(pg, 'dist'), { recursive: true, force: true });
     rmSync(join(pg, '.wrangler', 'deploy', 'config.json'), { force: true });
 
-    // Reconstruct `expected` EXACTLY as runCloudflareDeploy does (steps 1 + 5/6): the desired set +
-    // signals from `computeDesiredCloudflareResources`, and the four snapshots + container set from
-    // the root config — captured BEFORE the build, matching the orchestrator's pre-build snapshot.
-    // Doing this AFTER the build would let build-time code that rewrote the root config launder a
-    // tampered binding set into `expected`, so the FP-safety lock could pass an artifact that
-    // production (which snapshots pre-build) would reject.
+    // Build `expected` before the build, as runCloudflareDeploy does, so a build that rewrites the
+    // root config cannot change what the guard expects.
     const voidConfig = readConfig(pg);
     const { desired, needsAI, needsSandbox, expectedCrons } =
       await computeDesiredCloudflareResources(pg, voidConfig, configPath);
@@ -169,23 +113,20 @@ describe('playground/kitchen-sink --platform cloudflare real-build deploy guard'
     });
     expect(result.status, `${result.stdout ?? ''}${result.stderr ?? ''}`).toBe(0);
 
-    pristineEmitted = JSON.parse(readFileSync(emittedPath, 'utf-8')) as Record<string, unknown>;
+    pristineEmitted = JSON.parse(
+      readFileSync(join(pg, 'dist', 'ssr', 'wrangler.json'), 'utf-8'),
+    ) as Record<string, unknown>;
   });
 
   afterAll(() => {
     playground?.cleanup();
   });
 
-  // --- Proof this is a REAL build (not a hand-written facsimile) ---------------------------------
-
   it('emits the CF-plugin deploy pointer the guard follows', () => {
     const pointer = JSON.parse(
       readFileSync(join(pg, '.wrangler', 'deploy', 'config.json'), 'utf-8'),
     ) as { configPath?: string };
-    // The CF plugin writes this with node:path.relative, so the separator is PLATFORM-NATIVE
-    // (`..\..\dist\ssr\wrangler.json` on Windows). The guard that consumes it resolves through
-    // pathslash, which normalizes backslashes, so compare the normalized form rather than pinning
-    // a POSIX literal that only holds on one platform.
+    // The pointer uses the platform's path separator.
     expect(toSlash(normalize(pointer.configPath ?? ''))).toBe('../../dist/ssr/wrangler.json');
   });
 
@@ -198,8 +139,6 @@ describe('playground/kitchen-sink --platform cloudflare real-build deploy guard'
     expect(pristineEmitted.kv_namespaces).toContainEqual(
       expect.objectContaining({ binding: 'KV', id: REAL_KV_ID }),
     );
-    // The SECOND KV binding an ISR app requires — the guard's clean-pass below therefore exercises
-    // the two-KV shape a real provisioned ISR deploy builds, not just the single app KV.
     expect(pristineEmitted.kv_namespaces).toContainEqual(
       expect.objectContaining({ binding: 'ISR_CACHE', id: REAL_ISR_CACHE_ID }),
     );
@@ -223,79 +162,7 @@ describe('playground/kitchen-sink --platform cloudflare real-build deploy guard'
     expect(queues.consumers).toContainEqual(expect.objectContaining({ queue: 'demo-queue' }));
   });
 
-  it('reconstructs a container set byte-identical to the emitted sandbox container', () => {
-    // The highest-value FP-safety lock: `reconstructExpectedContainers` (a pure pre-build function)
-    // must produce EXACTLY what the CF plugin emitted, or every sandbox deploy would false-positive.
-    const actual = structuredClone(pristineEmitted.containers) as Array<{
-      images: { default: { dockerfile: string } };
-    }>;
-    for (const container of actual) {
-      container.images.default.dockerfile = resolve(
-        pg,
-        'dist/ssr',
-        container.images.default.dockerfile,
-      );
-    }
-    expect(expectedPayload.expectedContainers).toEqual(actual);
-  });
-
-  // --- Positive: the real emission passes the real guard unmodified (FP-lock) -------------------
-
   it('the real emitted config passes verifyGeneratedDeployConfig unmodified', () => {
     expect(verifyGeneratedDeployConfig(pg, expectedPayload)).toEqual({ ok: true });
   });
-
-  // --- Negative: the SAME real emission, minimally tampered, is rejected (teeth) -----------------
-
-  it('rejects an injected container application', () => {
-    const result = guardOnTamper((config) => {
-      (config.containers as Array<unknown>).push({ class_name: 'Evil', image: '/attacker' });
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/container application .*injected/i);
-  });
-
-  it('rejects a swapped D1 database_id', () => {
-    const result = guardOnTamper((config) => {
-      (config.d1_databases as Array<{ database_id: string }>)[0].database_id = OTHER_D1_ID;
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/identity|tampered|flattened/i);
-  });
-
-  it('rejects an injected id-bearing binding (EXTRA_DB)', () => {
-    const result = guardOnTamper((config) => {
-      (config.d1_databases as Array<unknown>).push({
-        binding: 'EXTRA_DB',
-        database_name: 'attacker-db',
-        database_id: OTHER_D1_ID,
-      });
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/not present before the build|injected/i);
-  });
-
-  it('rejects an injected cron schedule', () => {
-    const result = guardOnTamper((config) => {
-      (config.triggers as { crons: Array<string> }).crons.push('0 0 * * *');
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/cron trigger schedule .*injected/i);
-  });
-
-  it('rejects an injected services binding', () => {
-    const result = guardOnTamper((config) => {
-      config.services = [{ binding: 'EVIL_SVC', service: 'attacker-worker' }];
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/services binding .*injected/i);
-  });
-
-  it('rejects an injected routes entry', () => {
-    const result = guardOnTamper((config) => {
-      config.routes = [{ pattern: 'evil.example.com/*', zone_name: 'example.com' }];
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/routes value does not match/i);
-  });
 });
diff --git a/packages/void/test/integration/cloudflare-durable-build.test.ts b/packages/void/test/integration/cloudflare-durable-build.test.ts
index 206fef5a7..11c540b42 100644
--- a/packages/void/test/integration/cloudflare-durable-build.test.ts
+++ b/packages/void/test/integration/cloudflare-durable-build.test.ts
@@ -1,19 +1,19 @@
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { parseRootWranglerConfig } from '@void/deploy-cloudflare';
 import spawn from 'cross-spawn';
 import { describe, expect, it } from 'vite-plus/test';
 import { createIsolatedPlayground } from '../../../../test/integration-helpers.ts';
 import { analyzeApplicationSync } from '../../src/application-analysis.ts';
+import { verifyGeneratedDeployConfig } from '../../src/cli/deploy-artifact-validation.ts';
 import {
-  computeDesiredCloudflareResources,
-  parseRootWranglerConfig,
   reconstructExpectedContainers,
   reconstructExpectedDurableObjectState,
   snapshotBindingIdentities,
   snapshotPassthroughIdentities,
   snapshotPassthroughRawFields,
-  verifyGeneratedDeployConfig,
-} from '../../src/cli/deploy.ts';
+} from '../../src/cli/deploy-binding-snapshot.ts';
+import { computeDesiredCloudflareResources } from '../../src/cli/deploy-resources.ts';
 import { syncWranglerBindings } from '../../src/cli/wrangler.ts';
 import { materializeCloudflareConfig } from '../../src/cloudflare-config.ts';
 import { renderVoidConfig } from '../../src/config-write.ts';
diff --git a/packages/void/test/integration/dev-trigger-secret-guard.test.ts b/packages/void/test/integration/dev-trigger-secret-guard.test.ts
index f75c4ab29..022818e1a 100644
--- a/packages/void/test/integration/dev-trigger-secret-guard.test.ts
+++ b/packages/void/test/integration/dev-trigger-secret-guard.test.ts
@@ -38,7 +38,6 @@ describe('dev server with the dev-trigger secret guard', () => {
     mkdirSync(join(root, '.void'), { recursive: true });
     writeFileSync(join(root, 'index.html'), '<!doctype html><title>app</title>');
     writeFileSync(join(root, '.void', 'dev-trigger-token'), TOKEN);
-    writeFileSync(join(root, '.void', 'dev-triggers.ts'), `export const token = "${TOKEN}";\n`);
     writeFileSync(join(root, '.void', 'routes.d.ts'), 'export {};\n');
     // Astro writes its background dev server output, startup hint included, here.
     mkdirSync(join(root, '.astro'), { recursive: true });
@@ -72,19 +71,10 @@ describe('dev server with the dev-trigger secret guard', () => {
     return posix.startsWith('/') ? posix : `/${posix}`;
   };
 
+  // One path each for the static, /@fs/ and transform middlewares the guard must precede.
   it.each([
     '/.void/dev-trigger-token',
-    '/.VOID/dev-trigger-token',
-    '/.void/./dev-trigger-token',
-    '/.void//dev-trigger-token',
-    '/%2evoid/dev-trigger-token',
-    '/.void/dev-trigger-token?raw',
-    '/.void/dev-trigger-token?import',
     '/@fs<root>/.void/dev-trigger-token',
-    '/.void/dev-triggers.ts',
-    '/.void/dev-triggers.ts?import',
-    '/.void/dev-triggers.ts?raw',
-    '/.astro/dev.log',
     '/.astro/dev.log?raw',
   ])('does not serve the token at %s', async (path) => {
     const response = await get(port, path.replace('<root>', fsRoot()));
diff --git a/packages/void/test/integration/env-cli.test.ts b/packages/void/test/integration/env-cli.test.ts
index 1997efdef..a69aef40c 100644
--- a/packages/void/test/integration/env-cli.test.ts
+++ b/packages/void/test/integration/env-cli.test.ts
@@ -5,21 +5,6 @@ import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
 
-/**
- * Subprocess coverage for `void env check` and `void env types`. Unit tests
- * cover the individual pieces (schema validation, codegen, dotenv parsing),
- * but only a subprocess invocation exercises the full wiring: argv parsing,
- * the dynamic `import(./env-*.mjs)` chunks resolved from the dist bundle,
- * `await import(envFile)` against an on-disk env.ts, and exit codes — the
- * parts most likely to break silently when dist refactors happen.
- *
- * The fixture env.ts imports `defineEnv` from the dist runtime by absolute
- * file:// URL. That's what the CLI itself loads, so the schema singleton
- * matches end-to-end. A user-shaped `import "void/env"` wouldn't resolve
- * without installing the package into the temp dir, which the subprocess
- * test doesn't need to prove.
- */
-
 const PACKAGE_ROOT = join(import.meta.dirname, '..', '..');
 const CLI_ENTRY = join(PACKAGE_ROOT, 'dist', 'cli', 'cli.mjs');
 const ENV_PUBLIC_DIST = join(PACKAGE_ROOT, 'dist', 'runtime', 'env-public.mjs');
@@ -29,11 +14,10 @@ const roots: Array<string> = [];
 function createProject(envSchemaBody?: string): string {
   const root = mkdtempSync(join(tmpdir(), 'void-env-cli-'));
   roots.push(root);
-  // Native TypeScript loading follows the same package module rules as .js.
-  // Void projects are ESM, so keep the subprocess fixture representative even
-  // when the host's temporary directory has no package boundary of its own.
+  // Node loads env.ts with the nearest package's module type; tmpdir has no package.json.
   writeFileSync(join(root, 'package.json'), '{"type":"module"}\n');
   if (envSchemaBody !== undefined) {
+    // Import defineEnv from dist so the CLI and env.ts share one schema registry.
     const envPublicUrl = pathToFileURL(ENV_PUBLIC_DIST).href;
     writeFileSync(
       join(root, 'env.ts'),
@@ -51,7 +35,6 @@ function runVoid(
   const res = spawnSync(process.execPath, [CLI_ENTRY, ...args], {
     cwd: root,
     encoding: 'utf8',
-    // Isolate: the env command shouldn't pick up the developer's real env.
     env: {
       PATH: process.env.PATH,
       HOME: root,
@@ -83,7 +66,6 @@ describe('void env check (subprocess)', () => {
   it('exits 1 and names the missing key when a required env var is absent', () => {
     const root = createProject('{ STRIPE_KEY: string() }');
     const { stdout, status } = runVoid(root, ['env', 'check']);
-    // The command prints clack's `note()` block to stdout on failure.
     expect(status).toBe(1);
     expect(stdout).toContain('Env validation failed');
     expect(stdout).toContain('STRIPE_KEY');
@@ -117,28 +99,6 @@ describe('void env check (subprocess)', () => {
     expect(stdout).toContain('only .env is supported');
     expect(stdout).toContain('.env.local');
   });
-
-  it('rejects names reserved for Void in .env', () => {
-    const root = createProject('{ STRIPE_KEY: string() }');
-    writeFileSync(join(root, '.env'), 'STRIPE_KEY=sk_dev\n__VOID_PROXY_TOKEN=local\n');
-    const { stdout, status } = runVoid(root, ['env', 'check']);
-    expect(status).toBe(1);
-    expect(stdout).toContain('.env defines names reserved for Void: __VOID_PROXY_TOKEN.');
-    expect(stdout).toContain('x-void-dev-trigger');
-  });
-
-  it('rejects reserved names written as export K=v or K: v in .env', () => {
-    const root = createProject('{ STRIPE_KEY: string() }');
-    writeFileSync(
-      join(root, '.env'),
-      'STRIPE_KEY=sk_dev\nexport __VOID_PROXY_TOKEN=x\n__VOID_EMAIL_FROM: a@b.c\n',
-    );
-    const { stdout, status } = runVoid(root, ['env', 'check']);
-    expect(status).toBe(1);
-    // The CLI wraps long lines, so check each name on its own.
-    expect(stdout).toContain('.env defines names reserved for Void: __VOID_PROXY_TOKEN,');
-    expect(stdout).toContain('__VOID_EMAIL_FROM.');
-  });
 });
 
 describe('void env types (subprocess)', () => {
diff --git a/packages/void/test/integration/full-deploy-manifest.test.ts b/packages/void/test/integration/full-deploy-manifest.test.ts
index bec9bf2d7..13e542ab8 100644
--- a/packages/void/test/integration/full-deploy-manifest.test.ts
+++ b/packages/void/test/integration/full-deploy-manifest.test.ts
@@ -20,8 +20,6 @@ import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
 import type { DetectedFramework } from '../../src/plugin-inference.ts';
 import { withPlatformDiscovery } from '../helpers/platform-discovery.ts';
 
-// @voidzero-dev/vite-plus-prompts + the output-spinner wrapper are TTY-bound; noop them (same as
-// direct-r2-deploy.test.ts) so runDeploy's interactive UI doesn't render here.
 const noopSpinner = {
   start: vi.fn(),
   stop: vi.fn(),
@@ -53,13 +51,7 @@ vi.mock('../../src/cli/output.ts', async () => {
   return { ...actual, createSpinner: () => noopSpinner };
 });
 
-// Prerender path discovery spins Miniflare/workerd in-process. It feeds
-// `manifest.prerender`, NOT `manifest.pages`, so it is orthogonal to the seam
-// under test. Stub it to [] to keep this test offline, fast and deterministic —
-// everything else in runFullDeploy (including assembleVoidManifest) runs for
-// real. (For a non-`output:static` Void app this is the only in-process CF
-// runtime the deploy path would otherwise start; all network I/O is mocked
-// below.)
+// Prerender discovery starts workerd and feeds only `manifest.prerender`; stub it to stay offline.
 const { mockCollectPrerenderPaths } = vi.hoisted(() => ({
   mockCollectPrerenderPaths: vi.fn(async () => [] as Array<string>),
 }));
@@ -72,12 +64,7 @@ vi.mock('../../src/prerender.ts', async () => {
   };
 });
 
-// detectFramework is mocked so the SAME pre-built fixture can be driven down
-// both deploy routes: the default (undefined → Void pages path, exercised by
-// the first test) and, per-test, a forced Class-A framework (→ runFullDeploy
-// with isFrameworkMode = true, which must suppress manifest.pages). The return
-// value is set in beforeEach (undefined) and overridden inside the framework
-// test — so the Void test always sees the real-world `undefined`.
+// Lets one pre-built fixture take both the Void pages and the framework deploy paths.
 const { mockDetectFramework } = vi.hoisted(() => ({
   mockDetectFramework: vi.fn<(root: string) => DetectedFramework | undefined>(),
 }));
@@ -103,9 +90,7 @@ let savedProject: string | undefined;
 
 type Captured = { finalizeBody: { manifest?: { pages?: unknown } } | null };
 
-// Minimal platform mock: report every asset as already-present so the
-// upload-urls + R2 PUT phase is skipped and runFullDeploy goes straight to the
-// finalize POST, whose JSON body we capture.
+// Every asset is reported as present, so the deploy skips uploads and goes straight to finalize.
 function installPlatformMocks(role: ProjectRole = 'owner'): Captured {
   const captured: Captured = { finalizeBody: null };
 
@@ -189,18 +174,12 @@ function ndjson(events: Array<unknown>): Response {
   });
 }
 
-// End-to-end guard for the `assembleVoidManifest` seam: drives the REAL exported
-// runDeploy → runDeployInner → runFullDeploy (Void/SSR path) against a
-// pre-built minimal Void pages fixture, with only network + prompts + prerender
-// stubbed, and asserts the finalize manifest carries `pages`.
 describe('runFullDeploy emits manifest.pages (Void pages app, end-to-end)', () => {
   beforeAll(() => {
     playground = createIsolatedPlayground(ROOT, SOURCE_PLAYGROUND);
     fixture = playground.root;
     projectJson = join(fixture, '.void', 'project.json');
 
-    // Real build of the minimal React pages fixture so runDeploy(skipBuild:true)
-    // finds dist/client/.vite/manifest.json + dist/ssr/{index.js,wrangler.json}.
     const result = spawn.sync('vp', ['build'], {
       cwd: fixture,
       encoding: 'utf8',
@@ -209,7 +188,6 @@ describe('runFullDeploy emits manifest.pages (Void pages app, end-to-end)', () =
     });
     expect(result.status, `${result.stdout ?? ''}${result.stderr ?? ''}`).toBe(0);
 
-    // Link the fixture to a fake project.
     mkdirSync(join(fixture, '.void'), { recursive: true });
     writeFileSync(
       projectJson,
@@ -226,8 +204,6 @@ describe('runFullDeploy emits manifest.pages (Void pages app, end-to-end)', () =
   });
 
   beforeEach(() => {
-    // Default: no framework detected → the Void pages path. The framework test
-    // overrides this to a Class-A framework before driving runDeploy.
     mockDetectFramework.mockReset().mockReturnValue(undefined);
 
     originalFetch = globalThis.fetch;
@@ -288,32 +264,16 @@ describe('runFullDeploy emits manifest.pages (Void pages app, end-to-end)', () =
       | Array<{ pattern: string; revalidate?: number }>
       | undefined;
 
-    // manifest.pages must be a non-empty array.
-    expect(Array.isArray(pages)).toBe(true);
-    expect(pages!.length).toBeGreaterThan(0);
-    // Every entry carries a string pattern (raw, route-shaped).
-    for (const p of pages!) {
-      expect(typeof p.pattern).toBe('string');
-    }
-    // The /isr page (pages/isr.server.ts → `export const revalidate = 60`) must
-    // survive into the real deploy manifest with its exact TTL.
     expect(pages).toContainEqual({ pattern: '/isr', revalidate: 60 });
 
-    // The object `routing.revalidate` in the fixture void.config.ts is NOT baked into
-    // per-page TTLs — a REAL build must emit the 3-state table + the RAW object
-    // config as `manifest.pathRevalidate` (this is the producer half of the
-    // contract platform dispatch consumes; a manually-constructed manifest
-    // would not prove the actual CLI emits it). `/docs` and `/docs/ref` have no
-    // per-page export, so they ship INHERIT-ELIGIBLE (no `revalidate` key) and
-    // dispatch resolves the per-path config against the real request path.
+    // The fixture's object `routing.revalidate` ships as `pathRevalidate`; pages without their own
+    // export carry no `revalidate`, so dispatch resolves it per request path.
     const manifest = captured.finalizeBody!.manifest as unknown as {
       pathRevalidate?: Record<string, number>;
     };
     expect(manifest.pathRevalidate).toEqual({ '/docs': 120, '/docs/ref': 0 });
     expect(pages).toContainEqual({ pattern: '/docs' });
     expect(pages).toContainEqual({ pattern: '/docs/ref' });
-    // Neither inherit-eligible page carries a baked `revalidate` (that would be
-    // the unsafe build-time collapse of a per-path config — incl. the `0` opt-out).
     const docsEntry = pages!.find((p) => p.pattern === '/docs');
     const docsRefEntry = pages!.find((p) => p.pattern === '/docs/ref');
     expect(docsEntry).not.toHaveProperty('revalidate');
@@ -321,20 +281,14 @@ describe('runFullDeploy emits manifest.pages (Void pages app, end-to-end)', () =
   });
 
   it('suppresses manifest.pages in framework mode (Class-A framework forced via detectFramework)', async () => {
-    // Force the SAME pre-built fixture down the Class-A framework route. The
-    // vinext-pages preset (workerDir dist/ssr, assetsDir dist/client,
-    // workerMain index.js) matches the Void React build layout exactly, so
-    // runDeployInner routes to runFullDeploy with isFrameworkMode = true.
+    // The vinext-pages preset uses the same dist layout as this Void build.
     mockDetectFramework.mockReturnValue({ name: 'vinext-pages', class: 'a' });
     const captured = installPlatformMocks();
 
     await runDeploy(fixture, { skipBuild: true });
 
-    // The deploy still finalizes (manifest present)...
     expect(captured.finalizeBody).not.toBeNull();
     expect(captured.finalizeBody!.manifest).toBeDefined();
-    // ...but `pages` (the Void pages-mode ISR table) is suppressed in framework
-    // mode even though the fixture has a pages/ dir with an ISR page.
     expect(captured.finalizeBody!.manifest?.pages).toBeUndefined();
   });
 
diff --git a/packages/void/test/integration/info-cli.test.ts b/packages/void/test/integration/info-cli.test.ts
index 0756e1c6e..cf7b41c48 100644
--- a/packages/void/test/integration/info-cli.test.ts
+++ b/packages/void/test/integration/info-cli.test.ts
@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
@@ -36,19 +36,7 @@ afterEach(() => {
 });
 
 describe('void info (subprocess)', () => {
-  it('works offline without credentials and leaves project files untouched', () => {
-    const root = project();
-    const before = readdirSync(root);
-    const result = runVoid(root, ['info']);
-    expect(result.status, result.stderr).toBe(0);
-    expect(result.stdout).toContain('Inferred name: chat-room');
-    expect(result.stdout).toContain(
-      "To preserve this resource when moving its code, add this to 'defineRoom':",
-    );
-    expect(readdirSync(root)).toEqual(before);
-  });
-
-  it('prints clean JSON and exposes the command in help', () => {
+  it('prints clean JSON without credentials', () => {
     const root = project();
     const result = runVoid(root, ['info', '--json']);
     expect(result.status, result.stderr).toBe(0);
@@ -60,37 +48,6 @@ describe('void info (subprocess)', () => {
       nameSource: 'inferred',
     });
     expect(info.recordedResources).toEqual([]);
-    const help = runVoid(root, ['info', '--help']);
-    expect(help.status, help.stderr).toBe(0);
-    expect(help.stdout).toContain('void info [--json]');
-  });
-
-  it('lets a user discover, pin and move a room while preserving its generated identity', () => {
-    const root = project();
-    const inferred = JSON.parse(runVoid(root, ['info', '--json']).stdout).resources[0];
-    writeFileSync(
-      join(root, 'routes/chat/[room].ws.ts'),
-      `export default defineRoom({ name: ${JSON.stringify(inferred.name)}, messages: {} });`,
-    );
-    const pinned = JSON.parse(runVoid(root, ['info', '--json']).stdout).resources[0];
-    expect(pinned).toMatchObject({
-      name: inferred.name,
-      className: inferred.className,
-      bindingName: inferred.bindingName,
-      nameSource: 'explicit',
-    });
-    mkdirSync(join(root, 'routes/rooms'), { recursive: true });
-    renameSync(join(root, 'routes/chat/[room].ws.ts'), join(root, 'routes/rooms/[room].ws.ts'));
-    const movedResult = runVoid(root, ['info', '--json']);
-    expect(movedResult.status, movedResult.stderr).toBe(0);
-    expect(JSON.parse(movedResult.stdout).resources[0]).toMatchObject({
-      file: 'routes/rooms/[room].ws.ts',
-      route: '/rooms/:room',
-      name: inferred.name,
-      className: inferred.className,
-      bindingName: inferred.bindingName,
-      nameSource: 'explicit',
-    });
   });
 
   it('rejects invalid arguments with a structured JSON error', () => {
diff --git a/packages/void/test/integration/kitchen-sink-build.test.ts b/packages/void/test/integration/kitchen-sink-build.test.ts
index acee21b5c..021907afe 100644
--- a/packages/void/test/integration/kitchen-sink-build.test.ts
+++ b/packages/void/test/integration/kitchen-sink-build.test.ts
@@ -1,17 +1,13 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import spawn from 'cross-spawn';
+import { toSlash } from 'pathslash';
 import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
 import {
   createIsolatedPlayground,
   type IsolatedPlayground,
 } from '../../../../test/integration-helpers.ts';
-import { assembleVoidManifest } from '../../src/cli/deploy.ts';
-import { readConfig } from '../../src/config.ts';
-import { scanPages } from '../../src/pages/scan.ts';
 import { collectPrerenderPaths } from '../../src/prerender.ts';
-import { resolveProjectPaths } from '../../src/project-paths.ts';
-import { toSlash } from '../../src/shared/utils.ts';
 
 const ROOT = join(import.meta.dirname, '..', '..', '..', '..');
 const SOURCE_PLAYGROUND = 'playground/kitchen-sink';
@@ -127,49 +123,9 @@ describe('playground/kitchen-sink build', () => {
       'API_URL',
       'BETTER_AUTH_SECRET',
     ]);
-  });
-
-  it('requires auth deployments to inherit BETTER_AUTH_SECRET without emitting plaintext', () => {
-    const wranglerConfig = JSON.parse(readFileSync(join(dist, 'ssr', 'wrangler.json'), 'utf-8'));
-    const vars = (wranglerConfig.vars ?? {}) as Record<string, unknown>;
-    expect(wranglerConfig.secrets?.required).toContain('BETTER_AUTH_SECRET');
     expect(vars.BETTER_AUTH_SECRET).toBeUndefined();
   });
 
-  it('emits manifest.pages for the Void pages app (scan order, RAW patterns)', async () => {
-    // The deploy manifest (carrying `pages`) is a `void deploy` artifact, not a
-    // `vite build` output — the `vp build` above never writes it to `dist`. Drive
-    // the SAME production seam `runFullDeploy` uses (`assembleVoidManifest`, which
-    // owns `scanPages` result → collectPages → manifest.pages) against the real
-    // kitchen-sink pages to prove it emits `manifest.pages` for a Void pages app
-    // (which includes an ISR page).
-    const pg = playground.root;
-    const deployConfig = readConfig(pg);
-    const paths = resolveProjectPaths(pg, deployConfig);
-    const pageScan = await scanPages(pg, { output: deployConfig.output, paths });
-    const manifest = assembleVoidManifest(pageScan, false, {
-      bindings: {
-        needsD1: false,
-        needsKV: false,
-        needsR2: false,
-        needsAuth: false,
-        needsQueues: false,
-        needsAI: false,
-        needsSandbox: false,
-      },
-    });
-
-    // kitchen-sink is a Void pages app → manifest.pages is emitted, in scan order.
-    expect(Array.isArray(manifest.pages)).toBe(true);
-    expect(manifest.pages!.length).toBeGreaterThan(0);
-    // every entry has a string pattern; catch-alls are RAW (`{.+}`/`*`), not normalized away
-    for (const p of manifest.pages!) {
-      expect(typeof p.pattern).toBe('string');
-    }
-    // the /revalidate page (export const revalidate = 60) surfaces as an ISR entry
-    expect(manifest.pages!.some((p) => p.revalidate != null)).toBe(true);
-  });
-
   it('includes sandbox bindings and container metadata', () => {
     const wranglerConfig = JSON.parse(readFileSync(join(dist, 'ssr', 'wrangler.json'), 'utf-8'));
     expect(wranglerConfig.compatibility_flags).toContain('nodejs_compat');
diff --git a/packages/void/test/integration/kitchen-sink-observations-browser.test.ts b/packages/void/test/integration/kitchen-sink-observations-browser.test.ts
deleted file mode 100644
index 0e0ac4fcf..000000000
--- a/packages/void/test/integration/kitchen-sink-observations-browser.test.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-import { chromium, type Browser } from 'playwright';
-import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
-import { waitForRenderedText } from '../../../../platform/scripts/kitchen-sink-observations.ts';
-import { serializePageData } from '../../src/pages/serialize.ts';
-
-describe('kitchen-sink rendered app observations', () => {
-  let browser: Browser;
-  const key = 'smoke-q-browser-observation';
-
-  beforeAll(async () => {
-    browser = await chromium.launch();
-  });
-  afterAll(async () => {
-    await browser?.close();
-  });
-
-  it('observes a deleted row while its original SSR hydration data remains in the document', async () => {
-    const page = await browser.newPage();
-    try {
-      const payload = serializePageData({ props: { results: [{ id: 1, key }] } });
-      await page.setContent(`<!doctype html><html><body><script id="__VOID_PAGE_DATA__" type="application/json">${payload}</script>
-        <div id="app"><table><tbody><tr><td>${key}</td><td><button>Delete</button></td></tr></tbody></table></div></body></html>`);
-      await waitForRenderedText(page, key, true, 1_000);
-      await page.evaluate(() => {
-        const button = document.querySelector('button')!;
-        button.addEventListener('click', () => button.closest('tr')!.remove());
-      });
-      await page.getByRole('button', { name: 'Delete' }).click();
-
-      expect(await page.locator('tr').count()).toBe(0);
-      expect(await page.locator('body').textContent()).toContain(key);
-      await waitForRenderedText(page, key, false, 1_000);
-      expect(await page.locator('#__VOID_PAGE_DATA__').textContent()).toBe(payload);
-    } finally {
-      await page.close();
-    }
-  });
-
-  it('does not count hydration-only or hidden text as a visible consumer result', async () => {
-    const page = await browser.newPage();
-    try {
-      await page.setContent(`<!doctype html><html><body><script id="__VOID_PAGE_DATA__" type="application/json">${serializePageData({ props: { key } })}</script>
-        <div id="app"><span hidden>${key}</span><p>No results</p></div></body></html>`);
-      await expect(waitForRenderedText(page, key, true, 100)).rejects.toThrow('Timeout');
-    } finally {
-      await page.close();
-    }
-  });
-
-  it('fails if the rendered row remains after a delete request', async () => {
-    const page = await browser.newPage();
-    try {
-      await page.setContent(`<div id="app"><table><tr><td>${key}</td></tr></table></div>`);
-      await expect(waitForRenderedText(page, key, false, 100)).rejects.toThrow('Timeout');
-    } finally {
-      await page.close();
-    }
-  });
-
-  it('requires the app to exist before accepting rendered-text absence', async () => {
-    const page = await browser.newPage();
-    try {
-      await page.setContent('<p>Wrong destination</p>');
-      await expect(waitForRenderedText(page, key, false, 100)).rejects.toThrow('Timeout');
-    } finally {
-      await page.close();
-    }
-  });
-});
diff --git a/packages/void/test/integration/kitchen-sink.test.ts b/packages/void/test/integration/kitchen-sink.test.ts
index 03348c0bf..42696b2a4 100644
--- a/packages/void/test/integration/kitchen-sink.test.ts
+++ b/packages/void/test/integration/kitchen-sink.test.ts
@@ -102,8 +102,6 @@ describe('playground/kitchen-sink', () => {
     }
   });
 
-  // -- SSR + SPA navigation --
-
   it('serves SSR home page and hydrates', async () => {
     const page = await newPage();
     try {
@@ -124,7 +122,6 @@ describe('playground/kitchen-sink', () => {
       await page.goto(`${BASE}/`);
       await waitForHydration(page);
 
-      // Set a marker to detect full reload
       await page.evaluate(() => {
         window.__SPA_MARKER = true;
       });
@@ -137,7 +134,6 @@ describe('playground/kitchen-sink', () => {
       const marker = await page.evaluate(() => window.__SPA_MARKER);
       expect(marker).toBe(true);
 
-      // Navigate to another page
       await page.click('a[href="/kv"]');
       await page.waitForFunction(() => document.querySelector('h1')?.textContent?.includes('KV'));
       expect(page.url()).toBe(`${BASE}/kv`);
@@ -168,8 +164,6 @@ describe('playground/kitchen-sink', () => {
     }
   });
 
-  // -- DB --
-
   it('DB: create and delete a note via the UI', async () => {
     const page = await newPage();
     const title = `e2e-${Date.now()}`;
@@ -178,30 +172,24 @@ describe('playground/kitchen-sink', () => {
       await page.goto(`${BASE}/db`);
       await waitForHydration(page);
 
-      // Fill the form and submit
       await page.fill('input[placeholder="Note title"]', title);
       await page.fill('input[placeholder="Note body"]', 'test body');
       await page.click('button:has-text("Add Note")');
 
-      // Wait for the note to appear in the table
       await page.waitForFunction((t) => document.body.textContent?.includes(t), title);
       const text = await page.textContent('body');
       expect(text).toContain(title);
       expect(text).toContain('test body');
 
-      // Delete it — find the row with our title and click its Delete button
       const row = page.locator('tr', { hasText: title });
       await row.locator('button:has-text("Delete")').click();
 
-      // Wait for it to disappear
       await page.waitForFunction((t) => !document.body.textContent?.includes(t), title);
     } finally {
       await page.context().close();
     }
   });
 
-  // -- KV --
-
   it('KV: set and delete a key via the UI', async () => {
     const page = await newPage();
     const key = `e2e-kv-${Date.now()}`;
@@ -210,17 +198,14 @@ describe('playground/kitchen-sink', () => {
       await page.goto(`${BASE}/kv`);
       await waitForHydration(page);
 
-      // Set a key
       await page.fill('input[placeholder="my-key"]', key);
       await page.fill('input[placeholder="my-value"]', 'hello');
       await page.click('button:has-text("Set")');
 
-      // Wait for it to appear in the keys list
       await page.waitForFunction((k) => document.body.textContent?.includes(k), key);
       let text = await page.textContent('body');
       expect(text).toContain(key);
 
-      // Delete it
       const row = page.locator('tr', { hasText: key });
       await row.locator('button:has-text("Delete")').click();
 
@@ -232,8 +217,6 @@ describe('playground/kitchen-sink', () => {
     }
   });
 
-  // -- Storage (R2) --
-
   it('Storage: upload and delete a file via the UI', async () => {
     const page = await newPage();
 
@@ -241,7 +224,6 @@ describe('playground/kitchen-sink', () => {
       await page.goto(`${BASE}/storage`);
       await waitForHydration(page);
 
-      // Create a temp file via the file input
       const fileChooserPromise = page.waitForEvent('filechooser');
       await page.click('input[type="file"]');
       const fileChooser = await fileChooserPromise;
@@ -253,12 +235,10 @@ describe('playground/kitchen-sink', () => {
 
       await page.click('button:has-text("Upload")');
 
-      // Wait for it to appear
       await page.waitForFunction(() => document.body.textContent?.includes('e2e-test.txt'));
       const text = await page.textContent('body');
       expect(text).toContain('e2e-test.txt');
 
-      // Delete it
       const row = page.locator('tr', { hasText: 'e2e-test.txt' });
       await row.locator('button:has-text("Delete")').click();
 
@@ -268,8 +248,6 @@ describe('playground/kitchen-sink', () => {
     }
   });
 
-  // -- Env --
-
   it('Env: displays bindings including DB and KV', async () => {
     const page = await newPage();
 
@@ -285,8 +263,6 @@ describe('playground/kitchen-sink', () => {
     }
   });
 
-  // -- Queues --
-
   it('Queues: send message and see consumer result', async () => {
     const page = await newPage();
     const key = `e2e-q-${Date.now()}`;
@@ -295,7 +271,6 @@ describe('playground/kitchen-sink', () => {
       await page.goto(`${BASE}/queues`);
       await waitForHydration(page);
 
-      // Send a message
       await page.fill('input[placeholder="my-key"]', key);
       await page.fill('input[placeholder="my-value"]', 'queued');
       await page.click('button:has-text("Send to Queue")');
@@ -320,8 +295,6 @@ describe('playground/kitchen-sink', () => {
     }
   });
 
-  // -- Auth --
-
   it('Auth: register, login, protected route, logout via the UI', async () => {
     const page = await newPage();
     const email = `e2e-${Date.now()}@example.com`;
@@ -331,15 +304,12 @@ describe('playground/kitchen-sink', () => {
       await page.goto(`${BASE}/auth`);
       await waitForHydration(page);
 
-      // Should show "Not logged in"
       await page.waitForFunction(() => document.body.textContent?.includes('Not logged in'));
 
-      // Switch to Register tab
       const registerTab = page.locator('button', { hasText: 'Register' }).first();
       await registerTab.click();
       await page.waitForSelector('input[placeholder="Email"][type="email"]');
 
-      // Fill and submit the register form
       const regSection = page.locator('section', {
         has: page.locator('h2:has-text("Email Register")'),
       });
@@ -348,12 +318,10 @@ describe('playground/kitchen-sink', () => {
       await regSection.locator('input[type="text"]').fill('E2E User');
       await regSection.locator('button[type="submit"]').click();
 
-      // After register + reload, status should update (wait for "Not logged in" to disappear)
       await page.waitForFunction(() => !document.body.textContent?.includes('Not logged in'));
       const statusText = await page.textContent('body');
       expect(statusText).toContain(email);
 
-      // Test protected route
       await page.click('button:has-text("GET /api/profile")');
       await page.waitForFunction(() =>
         document.querySelector('pre')?.textContent?.includes('"user"'),
@@ -361,11 +329,9 @@ describe('playground/kitchen-sink', () => {
       const responseText = await page.textContent('pre');
       expect(responseText).toContain(email);
 
-      // Logout
       await page.click('button:has-text("Logout")');
       await page.waitForFunction(() => document.body.textContent?.includes('Not logged in'));
 
-      // Switch to Login tab and log back in
       const loginTab = page.locator('button', { hasText: 'Login' }).first();
       await loginTab.click();
 
@@ -376,7 +342,6 @@ describe('playground/kitchen-sink', () => {
       await loginSection.locator('input[type="password"]').fill(password);
       await loginSection.locator('button[type="submit"]').click();
 
-      // Should be logged in again
       await page.waitForFunction(() => !document.body.textContent?.includes('Not logged in'));
     } finally {
       await page.context().close();
@@ -436,92 +401,40 @@ describe('playground/kitchen-sink', () => {
     }
   });
 
-  // -- 404 handling --
-
-  it('returns 404 for paths with standard file extensions', async () => {
-    const res = await fetch(`${BASE}/missing.css`);
-    expect(res.status).toBe(404);
-  });
-
-  it('returns 404 for dotfiles like /.env', async () => {
-    const res = await fetch(`${BASE}/.env`);
+  it.each([
+    '/missing.css',
+    '/.env',
+    '/laravel/.env',
+    '/.well-known/traffic-advice',
+    '/.git/HEAD',
+    '/.htaccess',
+    '/wp-login.php',
+    '/xmlrpc.php',
+    '/robots.txt',
+    '/favicon.ico',
+    '/api/nonexistent',
+  ])('returns 404 for %s', async (path) => {
+    const res = await fetch(`${BASE}${path}`);
     expect(res.status).toBe(404);
   });
 
-  it('returns 404 for nested dotfiles like /laravel/.env', async () => {
-    const res = await fetch(`${BASE}/laravel/.env`);
-    expect(res.status).toBe(404);
-  });
-
-  it('returns 404 for dot-prefixed directory segments like /.well-known/traffic-advice', async () => {
-    const res = await fetch(`${BASE}/.well-known/traffic-advice`);
-    expect(res.status).toBe(404);
-  });
-
-  it('returns 404 for /.git/HEAD', async () => {
-    const res = await fetch(`${BASE}/.git/HEAD`);
-    expect(res.status).toBe(404);
-  });
-
-  it('returns 404 for /.htaccess', async () => {
-    const res = await fetch(`${BASE}/.htaccess`);
-    expect(res.status).toBe(404);
-  });
-
-  // File extension paths caught by last-segment dot check
-  it('returns 404 for /wp-login.php', async () => {
-    const res = await fetch(`${BASE}/wp-login.php`);
-    expect(res.status).toBe(404);
-  });
-
-  it('returns 404 for /xmlrpc.php', async () => {
-    const res = await fetch(`${BASE}/xmlrpc.php`);
-    expect(res.status).toBe(404);
-  });
-
-  it('returns 404 for /robots.txt', async () => {
-    const res = await fetch(`${BASE}/robots.txt`);
-    expect(res.status).toBe(404);
-  });
-
-  it('returns 404 for /favicon.ico', async () => {
-    const res = await fetch(`${BASE}/favicon.ico`);
-    expect(res.status).toBe(404);
-  });
-
-  // Bot probes — single-segment paths without dots, caught by notFound fallback
-  it('returns 404 for /wp-admin', async () => {
+  // Paths without a dot fall through to the notFound page.
+  it('returns an HTML Not Found page for /wp-admin', async () => {
     const res = await fetch(`${BASE}/wp-admin`);
     expect(res.status).toBe(404);
     expect(res.headers.get('content-type')).toContain('text/html');
     expect(await res.text()).toContain('Not Found');
   });
 
-  it('returns 404 for /phpmyadmin', async () => {
-    const res = await fetch(`${BASE}/phpmyadmin`);
-    expect(res.status).toBe(404);
-    expect(await res.text()).toContain('Not Found');
-  });
-
-  // Multi-segment unknown paths
-  it('returns 404 for /foo/bar/baz', async () => {
-    const res = await fetch(`${BASE}/foo/bar/baz`);
-    expect(res.status).toBe(404);
-    expect(await res.text()).toContain('Not Found');
-  });
-
-  it('returns 404 for /wp-content/plugins/exploit', async () => {
-    const res = await fetch(`${BASE}/wp-content/plugins/exploit`);
-    expect(res.status).toBe(404);
-    expect(await res.text()).toContain('Not Found');
-  });
-
-  it('returns 404 for unknown API routes', async () => {
-    const res = await fetch(`${BASE}/api/nonexistent`);
-    expect(res.status).toBe(404);
-  });
+  it.each(['/phpmyadmin', '/foo/bar/baz', '/wp-content/plugins/exploit'])(
+    'returns the Not Found page for %s',
+    async (path) => {
+      const res = await fetch(`${BASE}${path}`);
+      expect(res.status).toBe(404);
+      expect(await res.text()).toContain('Not Found');
+    },
+  );
 
-  // Non-GET methods to unknown paths
   it('returns 404 for POST to unknown paths', async () => {
     const res = await fetch(`${BASE}/nonexistent`, { method: 'POST' });
     expect(res.status).toBe(404);
@@ -534,13 +447,8 @@ describe('playground/kitchen-sink', () => {
   });
 });
 
-// Preview runs the built worker in miniflare with no Cloudflare credentials.
-// Two bindings can't run in that environment, so strip them before preview.
-// Neither is exercised by this smoke test — both have dedicated coverage:
-//   - containers (SANDBOX) need a local Docker build.
-//   - ai (Workers AI) is remote-only, so its presence forces a remote-proxy
-//     session that needs a CF account/login. The build-time AI binding is
-//     covered directly by kitchen-sink-build.test.ts.
+// Preview runs without Cloudflare credentials: containers need a local Docker build and Workers AI
+// is remote-only, so turn both off. kitchen-sink-build.test.ts covers them.
 function preparePreviewWranglerConfig(pg: string): string {
   const wranglerPath = join(pg, 'dist', 'ssr', 'wrangler.json');
   const wranglerConfig = JSON.parse(readFileSync(wranglerPath, 'utf-8')) as {
diff --git a/packages/void/test/integration/named-layouts.test.ts b/packages/void/test/integration/named-layouts.test.ts
index f44ea86f0..d8d82e513 100644
--- a/packages/void/test/integration/named-layouts.test.ts
+++ b/packages/void/test/integration/named-layouts.test.ts
@@ -8,7 +8,6 @@ let DEV_BASE: string;
 
 describe('named-layouts integration', () => {
   let child: ReturnType<typeof spawn>;
-  let stderr = '';
 
   beforeAll(async () => {
     const server = await startServer((port) => {
@@ -34,10 +33,6 @@ describe('named-layouts integration', () => {
           },
         },
       );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
       return child;
     }, 20_000);
     DEV_BASE = server.base;
@@ -47,9 +42,6 @@ describe('named-layouts integration', () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
   it('/ — default layout chain (root only)', async () => {
diff --git a/packages/void/test/integration/native-asset-cache-policy.test.ts b/packages/void/test/integration/native-asset-cache-policy.test.ts
index 89bf34485..c99a2e602 100644
--- a/packages/void/test/integration/native-asset-cache-policy.test.ts
+++ b/packages/void/test/integration/native-asset-cache-policy.test.ts
@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { Miniflare, convertV4MiniflareOptions } from 'miniflare';
 import { build, type Manifest } from 'vite';
 import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
+import { analyzeApplicationSync } from '../../src/application-analysis.ts';
 import { routingPlugin } from '../../src/plugin-routing.ts';
 
 const runtimeSource = (file: string) => join(import.meta.dirname, '../../src/runtime', file);
@@ -21,6 +22,11 @@ beforeAll(async () => {
   const assets = join(directory, 'client');
   const output = join(directory, 'output');
   const clientRoot = join(directory, 'app');
+  const routingOptions = {
+    getApplicationAnalysis: (environment: 'dev' | 'prod') =>
+      analyzeApplicationSync(clientRoot, { config: {}, environment }),
+    isAuthEnabled: () => false,
+  };
   mkdirSync(clientRoot);
   writeFileSync(join(clientRoot, 'package.json'), '{"type":"module"}');
   writeFileSync(join(clientRoot, 'client.js'), 'import "./client.css"; window.value = 1;');
@@ -38,7 +44,7 @@ beforeAll(async () => {
     configFile: false,
     logLevel: 'silent',
     plugins: [
-      routingPlugin(clientRoot, { isAuthEnabled: () => false }),
+      routingPlugin(clientRoot, routingOptions),
       {
         name: 'explicit-stable-css',
         buildStart() {
@@ -88,7 +94,7 @@ beforeAll(async () => {
     root: clientRoot,
     configFile: false,
     logLevel: 'silent',
-    plugins: [routingPlugin(clientRoot, { isAuthEnabled: () => false })],
+    plugins: [routingPlugin(clientRoot, routingOptions)],
     build: {
       outDir: stableOutput,
       assetsDir: 'static',
diff --git a/packages/void/test/integration/node-static.test.ts b/packages/void/test/integration/node-static.test.ts
index 6bf949bf3..19c6d2aab 100644
--- a/packages/void/test/integration/node-static.test.ts
+++ b/packages/void/test/integration/node-static.test.ts
@@ -1,5 +1,5 @@
 import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { createServer, type Server } from 'node:http';
 import { extname, isAbsolute, join, relative, resolve } from 'node:path';
 import { chromium } from 'playwright';
@@ -158,16 +158,6 @@ describe('playground/node-static build (target: node, output: static)', () => {
     expect(legacyData.url).toBe('/legacy');
   });
 
-  it('keeps static file traversal outside the client dir blocked', () => {
-    const clientDir = join(DIST, 'client');
-    const secretDir = join(DIST, 'client-secret');
-    const secretPath = join(secretDir, 'foo');
-    mkdirSync(secretDir, { recursive: true });
-    writeFileSync(secretPath, 'secret');
-
-    expect(resolveStaticFile(clientDir, '/..%2fclient-secret/foo')).toBeNull();
-  });
-
   it('serves static output with SPA navigation between prerendered Link routes', async () => {
     const browser = await chromium.launch();
     const page = await browser.newPage();
diff --git a/packages/void/test/integration/node-target.test.ts b/packages/void/test/integration/node-target.test.ts
index 247bff3b7..3a257bdb2 100644
--- a/packages/void/test/integration/node-target.test.ts
+++ b/packages/void/test/integration/node-target.test.ts
@@ -16,7 +16,6 @@ let PROD_BASE: string;
 describe('playground/node-app dev', () => {
   let playground: IsolatedPlayground;
   let child: ReturnType<typeof spawn>;
-  let stderr = '';
 
   beforeAll(async () => {
     playground = createIsolatedPlayground(ROOT, 'playground/node-app');
@@ -25,10 +24,6 @@ describe('playground/node-app dev', () => {
         cwd: playground.root,
         stdio: ['ignore', 'pipe', 'pipe'],
       });
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
       return child;
     }, 20_000);
     DEV_BASE = server.base;
@@ -39,9 +34,6 @@ describe('playground/node-app dev', () => {
       await killChild(child);
     }
     playground?.cleanup();
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
   it('serves API routes via Hono in Node.js', async () => {
diff --git a/packages/void/test/integration/operator-cli.test.ts b/packages/void/test/integration/operator-cli.test.ts
index d77ffca53..778b01aa8 100644
--- a/packages/void/test/integration/operator-cli.test.ts
+++ b/packages/void/test/integration/operator-cli.test.ts
@@ -23,10 +23,7 @@ const requests: Array<{
   method?: string;
   body: Record<string, unknown>;
 }> = [];
-let reply: (
-  path: string,
-  body: Record<string, unknown>,
-) => { status?: number; body: unknown; headers?: Record<string, string> };
+let reply: (path: string, body: Record<string, unknown>) => { status?: number; body: unknown };
 
 beforeEach(async () => {
   directory = mkdtempSync(join(tmpdir(), 'void-operator-subprocess-'));
@@ -50,10 +47,7 @@ beforeEach(async () => {
       body,
     });
     const result = reply(request.url!, body);
-    response.writeHead(result.status ?? 200, {
-      'Content-Type': 'application/json',
-      ...result.headers,
-    });
+    response.writeHead(result.status ?? 200, { 'Content-Type': 'application/json' });
     response.end(JSON.stringify(result.body));
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
@@ -335,22 +329,6 @@ describe('operator CLI (real subprocess and HTTP)', () => {
     expect(result.stderr).toContain('"status": "skipped"');
     expect(requests).toHaveLength(2);
   });
-  it('rejects redirects and preserves server authentication errors', async () => {
-    reply = () => ({ status: 302, body: {}, headers: { Location: 'https://untrusted.example' } });
-    const redirect = await run(['auth', 'status', '--json']);
-    expect(redirect.code).toBe(1);
-    expect(redirect.stdout).toBe('');
-    expect(JSON.parse(redirect.stderr)).toMatchObject({ error: 'redirect_rejected' });
-    reply = () => ({
-      status: 403,
-      body: { error: 'admin_required', message: 'The administrator role was revoked.' },
-    });
-    const revoked = await run(['auth', 'status', '--json']);
-    expect(revoked.code).toBe(1);
-    expect(revoked.stdout).toBe('');
-    expect(JSON.parse(revoked.stderr)).toMatchObject({ error: 'admin_required', status: 403 });
-    expect(requests).toHaveLength(2);
-  });
   it('exchanges piped API sessions only on explicit auth token invocation', async () => {
     reply = () => ({
       body: {
diff --git a/packages/void/test/integration/pg-test.test.ts b/packages/void/test/integration/pg-test.test.ts
index 762919c27..5c7763afd 100644
--- a/packages/void/test/integration/pg-test.test.ts
+++ b/packages/void/test/integration/pg-test.test.ts
@@ -24,7 +24,6 @@ describe('playground/pg-test', () => {
   let pgPort: number;
   let devChild: ReturnType<typeof spawn>;
   let BASE: string;
-  let serverOutput = () => '';
 
   beforeAll(async () => {
     // 1. Start PGlite + TCP server
@@ -75,7 +74,6 @@ describe('playground/pg-test', () => {
       return devChild;
     }, 30_000);
     BASE = server.base;
-    serverOutput = server.output;
   });
 
   afterAll(async () => {
@@ -94,9 +92,6 @@ describe('playground/pg-test', () => {
     } catch {
       // Ignore missing cleanup files between test runs.
     }
-    if (serverOutput().includes('error when starting dev server')) {
-      throw new Error(serverOutput());
-    }
   });
 
   it('renders the database page', async () => {
diff --git a/packages/void/test/integration/plugin-env-schema.test.ts b/packages/void/test/integration/plugin-env-schema.test.ts
index 4d376ed6e..08cb08702 100644
--- a/packages/void/test/integration/plugin-env-schema.test.ts
+++ b/packages/void/test/integration/plugin-env-schema.test.ts
@@ -6,16 +6,6 @@ import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { envClientFoldPlugin } from '../../src/plugin-env-client-fold.ts';
 import { envSchemaPlugin } from '../../src/plugin-env-schema.ts';
 
-/**
- * Integration coverage for the auto-discovery path of `envSchemaPlugin`.
- * Unit tests already cover `findEnvFile` and `generateEnvTypes` in isolation;
- * here we assert the plugin's `config()` hook glues them together correctly
- * (finds env.ts at the root, writes `.void/env.d.ts`, and produces content
- * that augments both `void/env` and `void/handler`). A silent regression in
- * this path would leave users without typed `env.X` / `c.env.X` access even
- * though `env.ts` exists.
- */
-
 const roots: Array<string> = [];
 
 function createTempRoot(): string {
@@ -140,15 +130,12 @@ describe('envSchemaPlugin auto-discovery', () => {
     expect(existsSync(dtsPath)).toBe(true);
 
     const dts = readFileSync(dtsPath, 'utf-8');
-    // Top-level export makes this a module augmentation (required; see the
-    // "declare module augmentation requires `export {}`" pitfall in AGENTS.md).
+    // `export {}` makes the file an augmentation instead of an ambient module.
     expect(dts).toContain('export {}');
-    // Augments both public type surfaces — env proxy and Hono c.env bindings.
     expect(dts).toContain('declare module "void/env"');
     expect(dts).toContain('declare module "void/handler"');
     expect(dts).toContain('interface ValidatedEnv extends _VoidEnvShape');
     expect(dts).toContain('interface CloudBindings extends _VoidEnvShape');
-    // Generated import path is relative from .void/ back to env.ts.
     expect(dts).toContain('typeof import("../env.ts")');
   });
 
@@ -349,10 +336,7 @@ describe('envSchemaPlugin auto-discovery', () => {
     });
   });
 
-  // The define-overlap warning runs in `configResolved`. We register the
-  // schema directly via `defineEnv` (rather than through a temp env.ts loaded
-  // by jiti) so the singleton the plugin reads matches the one the test
-  // mutated — jiti's own module instance is invisible to vitest imports.
+  // Register via defineEnv: jiti's env.ts module instance is invisible to Vitest.
   it('warns when vite `define` shadows a schema env key', async () => {
     const { defineEnv } = await import('../../src/runtime/env-public.ts');
     const { string } = await import('../../src/runtime/env-helpers.ts');
@@ -509,57 +493,59 @@ describe('envSchemaPlugin reserved __VOID_ names', () => {
     defineEnv({});
   });
 
-  for (const command of ['serve', 'build'] as const) {
-    for (const withEnvTs of [false, true]) {
-      it.each(['__VOID_PROXY_TOKEN', '__VOID_EMAIL_FROM'])(
-        `rejects %s in .env (${command}, env.ts: ${withEnvTs})`,
-        async (key) => {
-          const root = createTempRoot();
-          if (withEnvTs) {
-            writeFileSync(join(root, 'env.ts'), 'export default {};\n');
-          }
-          writeFileSync(join(root, '.env'), `API_URL=http://localhost\n${key}=local\n`);
-
-          await expect(runConfigFor(root, command)).rejects.toThrow(
-            `.env defines names reserved for Void: ${key}. Void sets these itself; remove them. ` +
-              'To trigger crons or queues locally, use the x-void-dev-trigger header printed at dev start.',
-          );
-        },
-      );
-    }
+  // The .env check does not depend on the command, so serve covers it.
+  for (const withEnvTs of [false, true]) {
+    it.each(['__VOID_PROXY_TOKEN', '__VOID_EMAIL_FROM'])(
+      `rejects %s in .env (env.ts: ${withEnvTs})`,
+      async (key) => {
+        const root = createTempRoot();
+        if (withEnvTs) {
+          writeFileSync(join(root, 'env.ts'), 'export default {};\n');
+        }
+        writeFileSync(join(root, '.env'), `API_URL=http://localhost\n${key}=local\n`);
+
+        await expect(runConfigFor(root, 'serve')).rejects.toThrow(
+          `.env defines names reserved for Void: ${key}. Void sets these itself; remove them. ` +
+            'To trigger crons or queues locally, use the x-void-dev-trigger header printed at dev start.',
+        );
+      },
+    );
+  }
 
-    // Wrangler loads these forms into the dev Worker too.
-    it.each([
-      ['export __VOID_PROXY_TOKEN=x', '__VOID_PROXY_TOKEN'],
-      ['__VOID_EMAIL_FROM: a@b.c', '__VOID_EMAIL_FROM'],
-    ])(`rejects the Wrangler-only line %s in .env (${command})`, async (line, key) => {
-      const root = createTempRoot();
-      writeFileSync(join(root, '.env'), `API_URL=http://localhost\n${line}\n`);
+  // Wrangler loads these forms into the dev Worker too.
+  it.each([
+    ['export __VOID_PROXY_TOKEN=x', '__VOID_PROXY_TOKEN'],
+    ['__VOID_EMAIL_FROM: a@b.c', '__VOID_EMAIL_FROM'],
+  ])('rejects the Wrangler-only line %s in .env', async (line, key) => {
+    const root = createTempRoot();
+    writeFileSync(join(root, '.env'), `API_URL=http://localhost\n${line}\n`);
 
-      await expect(runConfigFor(root, command)).rejects.toThrow(
-        `.env defines names reserved for Void: ${key}.`,
-      );
-    });
+    await expect(runConfigFor(root, 'serve')).rejects.toThrow(
+      `.env defines names reserved for Void: ${key}.`,
+    );
+  });
 
-    it(`ignores __VOID_ in a comment or a value (${command})`, async () => {
-      const root = createTempRoot();
-      writeFileSync(
-        join(root, '.env'),
-        '# __VOID_X=1\nAPI_URL=http://localhost/__VOID_X\nNOTE: __VOID_Y=2\n',
-      );
+  it('ignores __VOID_ in a comment or a value', async () => {
+    const root = createTempRoot();
+    writeFileSync(
+      join(root, '.env'),
+      '# __VOID_X=1\nAPI_URL=http://localhost/__VOID_X\nNOTE: __VOID_Y=2\n',
+    );
 
-      await expect(runConfigFor(root, command)).resolves.toBeUndefined();
-    });
+    await expect(runConfigFor(root, 'serve')).resolves.toBeUndefined();
+  });
 
-    it(`accepts a normal .env and a reserved name set only in the shell (${command})`, async () => {
-      const root = createTempRoot();
-      writeFileSync(join(root, '.env'), 'API_URL=http://localhost\n');
-      vi.stubEnv('__VOID_PROXY_TOKEN', 'from-shell');
+  it('accepts a normal .env and a reserved name set only in the shell', async () => {
+    const root = createTempRoot();
+    writeFileSync(join(root, '.env'), 'API_URL=http://localhost\n');
+    vi.stubEnv('__VOID_PROXY_TOKEN', 'from-shell');
 
-      await expect(runConfigFor(root, command)).resolves.toBeUndefined();
-    });
+    await expect(runConfigFor(root, 'serve')).resolves.toBeUndefined();
+  });
 
-    it(`rejects a reserved name declared in env.ts (${command})`, async () => {
+  it.each(['serve', 'build'] as const)(
+    'rejects a reserved name declared in env.ts (%s)',
+    async (command) => {
       const { defineEnv } = await import('../../src/runtime/env-public.ts');
       const { string } = await import('../../src/runtime/env-helpers.ts');
       const root = createTempRoot();
@@ -569,6 +555,6 @@ describe('envSchemaPlugin reserved __VOID_ names', () => {
       await expect(runConfigFor(root, command)).rejects.toThrow(
         'env.ts declares names reserved for Void: __VOID_X.',
       );
-    });
-  }
+    },
+  );
 });
diff --git a/packages/void/test/integration/queue-dispatch.test.ts b/packages/void/test/integration/queue-dispatch.test.ts
index bb2344dd2..5c33b06ef 100644
--- a/packages/void/test/integration/queue-dispatch.test.ts
+++ b/packages/void/test/integration/queue-dispatch.test.ts
@@ -71,17 +71,17 @@ describe('generated queue dispatch', () => {
       middleware: [],
       jobs: [],
       queues: [
+        {
+          filePath: 'order-emails.ts',
+          name: 'order-emails',
+          bindingName: 'QUEUE_ORDER_EMAILS',
+        },
         { filePath: 'emails.ts', name: 'emails', bindingName: 'QUEUE_EMAILS' },
         {
           filePath: 'nested/daily.ts',
           name: 'nested/daily',
           bindingName: 'CUSTOM_NESTED_QUEUE',
         },
-        {
-          filePath: 'order-emails.ts',
-          name: 'order-emails',
-          bindingName: 'QUEUE_ORDER_EMAILS',
-        },
       ],
       pages: { pages: [], layouts: [], namedLayouts: [] },
     };
diff --git a/packages/void/test/integration/react-router.test.ts b/packages/void/test/integration/react-router.test.ts
index f3107782d..f5402e3b0 100644
--- a/packages/void/test/integration/react-router.test.ts
+++ b/packages/void/test/integration/react-router.test.ts
@@ -9,7 +9,6 @@ let DEV_BASE: string;
 
 describe('playground/react-router dev', { retry: 2 }, () => {
   let child: ReturnType<typeof spawn>;
-  let stderr = '';
 
   beforeAll(async () => {
     const server = await startServer((port) => {
@@ -35,10 +34,6 @@ describe('playground/react-router dev', { retry: 2 }, () => {
           },
         },
       );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
       return child;
     }, 30_000);
     DEV_BASE = server.base;
@@ -48,9 +43,6 @@ describe('playground/react-router dev', { retry: 2 }, () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
   it('renders home page with SSR', async () => {
diff --git a/packages/void/test/integration/remote-bindings.test.ts b/packages/void/test/integration/remote-bindings.test.ts
deleted file mode 100644
index b40330c3f..000000000
--- a/packages/void/test/integration/remote-bindings.test.ts
+++ /dev/null
@@ -1,344 +0,0 @@
-import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
-import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
-import { ProxyClient } from '../../src/runtime/remote/client.ts';
-import { ProxyD1Database } from '../../src/runtime/remote/d1.ts';
-import { createRemoteEnv } from '../../src/runtime/remote/index.ts';
-import { ProxyKVNamespace } from '../../src/runtime/remote/kv.ts';
-import { ProxyR2Bucket } from '../../src/runtime/remote/r2.ts';
-
-const TOKEN = 'test-jwt';
-const PROJECT_ID = 'proj_test';
-
-// Lightweight mock proxy server that validates requests and returns
-// realistic responses matching the proxy worker's API shape.
-let server: Server;
-let baseUrl: string;
-
-function readBody(req: IncomingMessage): Promise<string> {
-  return new Promise((resolve) => {
-    const chunks: Array<Buffer> = [];
-    req.on('data', (c: Buffer) => chunks.push(c));
-    req.on('end', () => resolve(Buffer.concat(chunks).toString()));
-  });
-}
-
-beforeAll(
-  () =>
-    new Promise<void>((resolve) => {
-      server = createServer(async (req: IncomingMessage, res: ServerResponse) => {
-        const body = await readBody(req);
-        const json = body ? JSON.parse(body) : {};
-        const url = req.url ?? '';
-
-        // Validate auth header on every request
-        const auth = req.headers.authorization;
-        if (auth !== `Bearer ${TOKEN}`) {
-          res.writeHead(401);
-          res.end(JSON.stringify({ error: 'unauthorized' }));
-          return;
-        }
-
-        // Validate projectId on every request
-        if (json.projectId !== PROJECT_ID) {
-          res.writeHead(400);
-          res.end(JSON.stringify({ error: 'missing projectId' }));
-          return;
-        }
-
-        // D1 query
-        if (url === '/d1/query') {
-          const isWrite = json.method === 'run';
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(
-            JSON.stringify({
-              results: isWrite ? [] : [{ id: 1, name: 'alice' }],
-              meta: {
-                changes: isWrite ? 1 : 0,
-                last_row_id: isWrite ? 5 : 0,
-                duration: 0.1,
-              },
-              success: true,
-            }),
-          );
-          return;
-        }
-
-        // D1 batch
-        if (url === '/d1/batch') {
-          const statements = json.statements as Array<{ sql: string }>;
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(
-            JSON.stringify(
-              statements.map(() => ({
-                results: [],
-                meta: { changes: 0, last_row_id: 0, duration: 0.05 },
-                success: true,
-              })),
-            ),
-          );
-          return;
-        }
-
-        // KV get
-        if (url === '/kv/get') {
-          if (json.key === 'missing') {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end('null');
-            return;
-          }
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify('hello-world'));
-          return;
-        }
-
-        // KV put
-        if (url === '/kv/put') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: true }));
-          return;
-        }
-
-        // KV delete
-        if (url === '/kv/delete') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: true }));
-          return;
-        }
-
-        // KV list
-        if (url === '/kv/list') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(
-            JSON.stringify({
-              keys: [{ name: 'key1' }, { name: 'key2' }],
-              list_complete: true,
-            }),
-          );
-          return;
-        }
-
-        // R2 get
-        if (url === '/r2/get') {
-          if (json.key === 'missing') {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end('null');
-            return;
-          }
-          const body = Buffer.from('hello');
-          res.writeHead(200, {
-            'Content-Type': 'text/plain',
-            'Content-Length': String(body.length),
-            etag: '"abc123"',
-            'last-modified': new Date().toISOString(),
-          });
-          res.end(body);
-          return;
-        }
-
-        // R2 put
-        if (url === '/r2/put') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(
-            JSON.stringify({
-              key: json.key,
-              size: 5,
-              etag: '"abc123"',
-              uploaded: new Date().toISOString(),
-              version: 'v1',
-            }),
-          );
-          return;
-        }
-
-        // R2 delete
-        if (url === '/r2/delete') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: true }));
-          return;
-        }
-
-        // R2 list
-        if (url === '/r2/list') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(
-            JSON.stringify({
-              objects: [
-                {
-                  key: 'a.txt',
-                  size: 3,
-                  etag: '"e1"',
-                  uploaded: new Date().toISOString(),
-                  version: 'v1',
-                },
-                {
-                  key: 'b.txt',
-                  size: 4,
-                  etag: '"e2"',
-                  uploaded: new Date().toISOString(),
-                  version: 'v1',
-                },
-              ],
-              truncated: false,
-            }),
-          );
-          return;
-        }
-
-        res.writeHead(404);
-        res.end(JSON.stringify({ error: 'not found' }));
-      });
-
-      server.listen(0, '127.0.0.1', () => {
-        const addr = server.address() as { port: number };
-        baseUrl = `http://127.0.0.1:${addr.port}`;
-        resolve();
-      });
-    }),
-);
-
-afterAll(
-  () =>
-    new Promise<void>((resolve) => {
-      server.close(() => resolve());
-    }),
-);
-
-describe('Remote bindings integration', () => {
-  function makeClient() {
-    return new ProxyClient(baseUrl, TOKEN, PROJECT_ID);
-  }
-
-  describe('D1', () => {
-    it('executes a query and returns rows', async () => {
-      const db = new ProxyD1Database(makeClient(), 'DB');
-      const result = await db.prepare('SELECT * FROM users').all();
-      expect(result.results).toEqual([{ id: 1, name: 'alice' }]);
-      expect(result.success).toBe(true);
-      expect(result.meta.changes).toBe(0);
-    });
-
-    it('executes a write and returns meta', async () => {
-      const db = new ProxyD1Database(makeClient(), 'DB');
-      const result = await db.prepare('INSERT INTO users VALUES (?)').bind('bob').run();
-      expect(result.success).toBe(true);
-      expect(result.meta.changes).toBe(1);
-      expect(result.meta.last_row_id).toBe(5);
-    });
-
-    it('batches multiple statements', async () => {
-      const db = new ProxyD1Database(makeClient(), 'DB');
-      const results = await db.batch([
-        db.prepare('INSERT INTO a VALUES (1)') as unknown as D1PreparedStatement,
-        db.prepare('INSERT INTO b VALUES (2)') as unknown as D1PreparedStatement,
-      ]);
-      expect(results).toHaveLength(2);
-      expect(results[0].success).toBe(true);
-    });
-  });
-
-  describe('KV', () => {
-    it('gets a value', async () => {
-      const kv = new ProxyKVNamespace(makeClient(), 'KV');
-      const val = await kv.get('mykey');
-      expect(val).toBe('hello-world');
-    });
-
-    it('returns null for missing key', async () => {
-      const kv = new ProxyKVNamespace(makeClient(), 'KV');
-      const val = await kv.get('missing');
-      expect(val).toBeNull();
-    });
-
-    it('puts a value', async () => {
-      const kv = new ProxyKVNamespace(makeClient(), 'KV');
-      await expect(kv.put('key', 'value')).resolves.toBeUndefined();
-    });
-
-    it('deletes a key', async () => {
-      const kv = new ProxyKVNamespace(makeClient(), 'KV');
-      await expect(kv.delete('key')).resolves.toBeUndefined();
-    });
-
-    it('lists keys', async () => {
-      const kv = new ProxyKVNamespace(makeClient(), 'KV');
-      const result = await kv.list();
-      expect(result.keys).toEqual([{ name: 'key1' }, { name: 'key2' }]);
-      expect(result.list_complete).toBe(true);
-    });
-  });
-
-  describe('R2', () => {
-    it('gets an object with body', async () => {
-      const r2 = new ProxyR2Bucket(makeClient(), 'STORAGE');
-      const obj = await r2.get('file.txt');
-      expect(obj).not.toBeNull();
-      const text = await obj!.text();
-      expect(text).toBe('hello');
-      expect(obj!.key).toBe('file.txt');
-      expect(obj!.size).toBe(5);
-    });
-
-    it('returns null for missing object', async () => {
-      const r2 = new ProxyR2Bucket(makeClient(), 'STORAGE');
-      const obj = await r2.get('missing');
-      expect(obj).toBeNull();
-    });
-
-    it('puts an object', async () => {
-      const r2 = new ProxyR2Bucket(makeClient(), 'STORAGE');
-      const head = await r2.put('file.txt', 'hello');
-      expect(head).not.toBeNull();
-      expect(head!.key).toBe('file.txt');
-    });
-
-    it('deletes an object', async () => {
-      const r2 = new ProxyR2Bucket(makeClient(), 'STORAGE');
-      await expect(r2.delete('file.txt')).resolves.toBeUndefined();
-    });
-
-    it('lists objects', async () => {
-      const r2 = new ProxyR2Bucket(makeClient(), 'STORAGE');
-      const result = await r2.list();
-      expect(result.objects).toHaveLength(2);
-      expect(result.objects[0].key).toBe('a.txt');
-      expect(result.truncated).toBe(false);
-    });
-  });
-
-  describe('createRemoteEnv', () => {
-    it('wires all bindings through a live proxy', async () => {
-      const env = createRemoteEnv({
-        __VOID_PROXY_URL: baseUrl,
-        __VOID_TOKEN: TOKEN,
-        __VOID_PROJECT_ID: PROJECT_ID,
-        __VOID_REMOTE: '1',
-        DB: {},
-        KV: {},
-        STORAGE: {},
-      });
-
-      // D1
-      const db = env.DB as D1Database;
-      const rows = await db.prepare('SELECT 1').all();
-      expect(rows.success).toBe(true);
-
-      // KV
-      const kv = env.KV as KVNamespace;
-      const val = await kv.get('mykey');
-      expect(val).toBe('hello-world');
-
-      // R2
-      const r2 = env.STORAGE as R2Bucket;
-      const obj = await r2.get('file.txt');
-      expect(obj).not.toBeNull();
-    });
-  });
-
-  describe('auth validation', () => {
-    it('rejects requests with wrong token', async () => {
-      const client = new ProxyClient(baseUrl, 'wrong-token', PROJECT_ID);
-      const db = new ProxyD1Database(client, 'DB');
-      await expect(db.prepare('SELECT 1').all()).rejects.toThrow(/401/);
-    });
-  });
-});
diff --git a/packages/void/test/integration/resource-name-migration.test.ts b/packages/void/test/integration/resource-name-migration.test.ts
index 3038bfbb3..2b2ec5811 100644
--- a/packages/void/test/integration/resource-name-migration.test.ts
+++ b/packages/void/test/integration/resource-name-migration.test.ts
@@ -13,11 +13,12 @@ import spawn from 'cross-spawn';
 import { Miniflare, convertV4MiniflareOptions } from 'miniflare';
 import { build } from 'vite';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
+import { analyzeApplication } from '../../src/application-routing.ts';
 import { buildVoidManifest, collectWorkerFiles } from '../../src/cli/package.ts';
 import { syncWranglerDurableObjects, syncWranglerWebSockets } from '../../src/cli/wrangler.ts';
+import { readConfig } from '../../src/config.ts';
 import { scanDurableObjectModules } from '../../src/durable/scan.ts';
 import { compileRouteTable, compileWorkerEntry } from '../../src/router/compile.ts';
-import { scanRoutes } from '../../src/router/scan.ts';
 
 const repository = join(import.meta.dirname, '..', '..', '..', '..');
 const runtimePath = (file: string) => join(repository, 'packages/void/src/runtime', file);
@@ -136,7 +137,7 @@ export default defineRoom({
       await runtime?.dispose();
       runtime = undefined;
       const durableObjects = scanDurableObjectModules(directory);
-      const scan = await scanRoutes(directory);
+      const { scan } = await analyzeApplication(directory, { config: readConfig(directory) });
       syncWranglerDurableObjects(directory, durableObjects);
       syncWranglerWebSockets(directory, scan.websockets ?? []);
       const cloudflare = JSON.parse(readFileSync(join(directory, '.void-wrangler.jsonc'), 'utf8'));
diff --git a/packages/void/test/integration/spa-middleware-auth.test.ts b/packages/void/test/integration/spa-middleware-auth.test.ts
index b72aa48e2..928eecfce 100644
--- a/packages/void/test/integration/spa-middleware-auth.test.ts
+++ b/packages/void/test/integration/spa-middleware-auth.test.ts
@@ -49,7 +49,6 @@ const staleCloudflareAssets = {
 } as const;
 
 let child: ReturnType<typeof spawn> | undefined;
-let stderr = '';
 let previousVoidConfig: string | undefined;
 let middlewareBackedUp = false;
 let publicDirCreated = false;
@@ -111,7 +110,6 @@ function writeProtectedAsset(): void {
 
 async function startSpaDevServer(): Promise<string> {
   const server = await startServer((port) => {
-    stderr = '';
     child = spawn('vp', ['dev', '--host', '127.0.0.1', '--port', String(port), '--strictPort'], {
       cwd: playground.root,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -120,9 +118,6 @@ async function startSpaDevServer(): Promise<string> {
         VOID_INSPECTOR_PORT: 'false',
       },
     });
-    child.stderr!.on('data', (chunk: Buffer) => {
-      stderr += String(chunk);
-    });
     return child;
   }, 30_000);
   return server.base;
@@ -130,7 +125,6 @@ async function startSpaDevServer(): Promise<string> {
 
 async function startSpaPreviewServer(): Promise<string> {
   const server = await startServer((port) => {
-    stderr = '';
     child = spawn(
       'vp',
       ['preview', '--host', '127.0.0.1', '--port', String(port), '--strictPort'],
@@ -140,9 +134,6 @@ async function startSpaPreviewServer(): Promise<string> {
         env: { ...process.env, VOID_INSPECTOR_PORT: 'false' },
       },
     );
-    child.stderr!.on('data', (chunk: Buffer) => {
-      stderr += String(chunk);
-    });
     return child;
   }, 30_000);
   return server.base;
@@ -195,12 +186,6 @@ afterEach(async () => {
     publicDirCreated = false;
   }
   restoreVoidConfig();
-  if (
-    stderr.includes('error when starting dev server') ||
-    stderr.includes('error when starting preview server')
-  ) {
-    throw new Error(stderr);
-  }
 });
 
 describe('SPA asset routing policy', () => {
diff --git a/packages/void/test/integration/ssr-playground.test.ts b/packages/void/test/integration/ssr-playground.test.ts
index aabcd10ce..ef4b46deb 100644
--- a/packages/void/test/integration/ssr-playground.test.ts
+++ b/packages/void/test/integration/ssr-playground.test.ts
@@ -11,7 +11,6 @@ let PREVIEW_BASE: string;
 
 describe('playground/ssr dev', () => {
   let child: ReturnType<typeof spawn>;
-  let serverOutput = () => '';
 
   beforeAll(async () => {
     const server = await startServer((port) => {
@@ -40,16 +39,12 @@ describe('playground/ssr dev', () => {
       return child;
     }, 20_000);
     DEV_BASE = server.base;
-    serverOutput = server.output;
   });
 
   afterAll(async () => {
     if (child) {
       await killChild(child);
     }
-    if (serverOutput().includes('error when starting dev server')) {
-      throw new Error(serverOutput());
-    }
   });
 
   it('serves SSR output for / and non-root paths', async () => {
@@ -76,7 +71,6 @@ describe('playground/ssr dev', () => {
 
 describe('playground/ssr build + preview', () => {
   let child: ReturnType<typeof spawn>;
-  let serverOutput = () => '';
 
   beforeAll(async () => {
     rmSync(join(ROOT, 'playground/ssr/dist'), { recursive: true, force: true });
@@ -108,16 +102,12 @@ describe('playground/ssr build + preview', () => {
       return child;
     }, 20_000);
     PREVIEW_BASE = server.base;
-    serverOutput = server.output;
   });
 
   afterAll(async () => {
     if (child) {
       await killChild(child);
     }
-    if (serverOutput().includes('error when starting preview server')) {
-      throw new Error(serverOutput());
-    }
   });
 
   it('emits worker entry and client manifest', () => {
diff --git a/packages/void/test/integration/sveltekit.test.ts b/packages/void/test/integration/sveltekit.test.ts
index c36b2e098..15168e901 100644
--- a/packages/void/test/integration/sveltekit.test.ts
+++ b/packages/void/test/integration/sveltekit.test.ts
@@ -114,9 +114,6 @@ export function checkSchema() {
       await killChild(child);
     }
     fixture?.cleanup();
-    if (serverOutput().includes('error when starting dev server')) {
-      throw new Error(serverOutput());
-    }
   });
 
   it('syncs the generated Cloudflare config with inferred bindings', () => {
diff --git a/packages/void/test/integration/tanstack-start.test.ts b/packages/void/test/integration/tanstack-start.test.ts
index 981069075..5b9fdf326 100644
--- a/packages/void/test/integration/tanstack-start.test.ts
+++ b/packages/void/test/integration/tanstack-start.test.ts
@@ -9,7 +9,6 @@ let DEV_BASE: string;
 
 describe('playground/tanstack-start dev', () => {
   let child: ReturnType<typeof spawn>;
-  let stderr = '';
 
   beforeAll(async () => {
     // Another process can answer on the port before this server starts,
@@ -38,10 +37,6 @@ describe('playground/tanstack-start dev', () => {
             },
           },
         );
-        stderr = '';
-        child.stderr!.on('data', (chunk: Buffer) => {
-          stderr += String(chunk);
-        });
         return child;
       },
       20_000,
@@ -54,9 +49,6 @@ describe('playground/tanstack-start dev', () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
   it('renders home page with SSR', async () => {
diff --git a/packages/void/test/integration/trigger-auth.test.ts b/packages/void/test/integration/trigger-auth.test.ts
index eff43e6ab..f4e423e5e 100644
--- a/packages/void/test/integration/trigger-auth.test.ts
+++ b/packages/void/test/integration/trigger-auth.test.ts
@@ -187,6 +187,9 @@ describe('generated trigger auth', () => {
       expect((await dev.fetch(trigger(kind, { 'x-void-internal': dev.buildKey }), {})).status).toBe(
         401,
       );
+      expect((await dev.fetch(trigger(kind, { 'x-void-dev-trigger': 'wrong' }), {})).status).toBe(
+        401,
+      );
     },
   );
 });
diff --git a/packages/void/test/integration/typed-routing-runtime.test.ts b/packages/void/test/integration/typed-routing-runtime.test.ts
index 7df10e30b..2582f0aaa 100644
--- a/packages/void/test/integration/typed-routing-runtime.test.ts
+++ b/packages/void/test/integration/typed-routing-runtime.test.ts
@@ -5,8 +5,9 @@ import { fileURLToPath } from 'node:url';
 import { Miniflare, convertV4MiniflareOptions } from 'miniflare';
 import { build } from 'vite';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
+import { analyzeApplication } from '../../src/application-routing.ts';
+import { readConfig } from '../../src/config.ts';
 import { compileRouteTable, compileWorkerEntry } from '../../src/router/compile.ts';
-import { scanRoutes } from '../../src/router/scan.ts';
 
 const repository = join(import.meta.dirname, '..', '..', '..', '..');
 const source = (file: string) => join(repository, 'packages/void/src/runtime', file);
@@ -61,7 +62,7 @@ describe('typed routing in generated Workers', () => {
         join(pages, 'index.server.ts'),
         `export function loader() { return { title: 'real page loader' }; }\nexport const actions = { save: () => new Response('saved') };\n`,
       );
-      const scan = await scanRoutes(directory);
+      const { scan } = await analyzeApplication(directory, { config: readConfig(directory) });
       scan.pages.pages = [
         {
           pattern: '/',
diff --git a/packages/void/test/integration/vinext-app.test.ts b/packages/void/test/integration/vinext-app.test.ts
index f794015cd..ab6d8b74c 100644
--- a/packages/void/test/integration/vinext-app.test.ts
+++ b/packages/void/test/integration/vinext-app.test.ts
@@ -17,7 +17,6 @@ let DEV_BASE: string;
 
 describe('playground/vinext-app dev', () => {
   let child: ReturnType<typeof spawn>;
-  let serverOutput = () => '';
   let playground: IsolatedPlayground;
 
   beforeAll(async () => {
@@ -34,7 +33,6 @@ describe('playground/vinext-app dev', () => {
       return child;
     }, 30_000);
     DEV_BASE = server.base;
-    serverOutput = server.output;
   });
 
   afterAll(async () => {
@@ -42,9 +40,6 @@ describe('playground/vinext-app dev', () => {
       await killChild(child);
     }
     playground?.cleanup();
-    if (serverOutput().includes('error when starting dev server')) {
-      throw new Error(serverOutput());
-    }
   });
 
   it('renders home page with SSR', async () => {
diff --git a/packages/void/test/integration/vinext-pages.test.ts b/packages/void/test/integration/vinext-pages.test.ts
index e4d40bc8b..9bf555600 100644
--- a/packages/void/test/integration/vinext-pages.test.ts
+++ b/packages/void/test/integration/vinext-pages.test.ts
@@ -9,7 +9,6 @@ let DEV_BASE: string;
 
 describe('playground/vinext-pages dev', () => {
   let child: ReturnType<typeof spawn>;
-  let serverOutput = () => '';
 
   beforeAll(async () => {
     const server = await startServer((port) => {
@@ -38,16 +37,12 @@ describe('playground/vinext-pages dev', () => {
       return child;
     }, 20_000);
     DEV_BASE = server.base;
-    serverOutput = server.output;
   });
 
   afterAll(async () => {
     if (child) {
       await killChild(child);
     }
-    if (serverOutput().includes('error when starting dev server')) {
-      throw new Error(serverOutput());
-    }
   });
 
   it('renders home page with SSR', async () => {
diff --git a/packages/void/test/integration/websockets-playground.test.ts b/packages/void/test/integration/websockets-playground.test.ts
index 9f726843c..7c8e46738 100644
--- a/packages/void/test/integration/websockets-playground.test.ts
+++ b/packages/void/test/integration/websockets-playground.test.ts
@@ -70,7 +70,6 @@ function collectUnexpectedBrowserErrors(page: Page) {
 
 describe('playground/websockets', () => {
   let child: ReturnType<typeof spawn>;
-  let stderr = '';
 
   beforeAll(async () => {
     const playground = join(ROOT, 'playground/websockets');
@@ -108,10 +107,6 @@ describe('playground/websockets', () => {
           },
         },
       );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
       return child;
     }, 20_000);
     base = server.base;
@@ -141,9 +136,6 @@ describe('playground/websockets', () => {
       await killChild(child);
     }
     await browser?.close();
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
   it('chat reconnects to a fresh room and sends a typed message', async () => {
diff --git a/packages/void/test/unit/action-result.test.ts b/packages/void/test/unit/action-result.test.ts
index 3f29b7d24..c455d9543 100644
--- a/packages/void/test/unit/action-result.test.ts
+++ b/packages/void/test/unit/action-result.test.ts
@@ -69,40 +69,35 @@ describe('action result handling', () => {
     }
   });
 
-  it('returns call-site action errors instead of throwing them', async () => {
-    const error = new VoidActionError({
-      body: 'Missing',
-      status: 404,
-      statusText: 'Not Found',
-      url: '/users/1',
-    });
-    const router = routerWithVisit(
-      vi.fn(async () => {
-        throw error;
+  it.each([
+    [
+      'a VoidActionError',
+      new VoidActionError({
+        body: 'Missing',
+        status: 404,
+        statusText: 'Not Found',
+        url: '/users/1',
       }),
-    );
-
-    const result = await submitAction(router, '/users/1', { method: 'DELETE' });
-
-    expect(result).toEqual({ ok: false, error });
-  });
-
-  it('returns structurally equivalent call-site action errors', async () => {
-    const error = {
-      body: 'Conflict',
-      message: 'Action failed with 409 Conflict',
-      name: 'VoidActionError',
-      status: 409,
-      statusText: 'Conflict',
-      url: '/users',
-    } as VoidActionError;
+    ],
+    [
+      'a structurally equivalent error',
+      {
+        body: 'Conflict',
+        message: 'Action failed with 409 Conflict',
+        name: 'VoidActionError',
+        status: 409,
+        statusText: 'Conflict',
+        url: '/users',
+      } as VoidActionError,
+    ],
+  ])('returns call-site action errors instead of throwing them (%s)', async (_label, error) => {
     const router = routerWithVisit(
       vi.fn(async () => {
         throw error;
       }),
     );
 
-    const result = await submitAction(router, '/users', { method: 'POST' });
+    const result = await submitAction(router, error.url, { method: 'POST' });
 
     expect(result).toEqual({ ok: false, error });
   });
@@ -125,22 +120,6 @@ describe('action result handling', () => {
     await expect(submitAction(router, '/users', { method: 'POST' })).rejects.toBe(error);
   });
 
-  it('throws boundary action errors', async () => {
-    const error = new VoidActionError({
-      body: 'Boom',
-      status: 500,
-      statusText: 'Internal Server Error',
-      url: '/users',
-    });
-    const router = routerWithVisit(
-      vi.fn(async () => {
-        throw error;
-      }),
-    );
-
-    await expect(submitAction(router, '/users', { method: 'POST' })).rejects.toBe(error);
-  });
-
   it('detects abort errors', () => {
     expect(isAbortError(new DOMException('Navigation aborted', 'AbortError'))).toBe(true);
     expect(isAbortError(new Error('Boom'))).toBe(false);
diff --git a/packages/void/test/unit/affected-tests.test.ts b/packages/void/test/unit/affected-tests.test.ts
deleted file mode 100644
index 01cee5356..000000000
--- a/packages/void/test/unit/affected-tests.test.ts
+++ /dev/null
@@ -1,419 +0,0 @@
-import { execFileSync, spawnSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, relative } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { stripVTControlCharacters } from 'node:util';
-import { describe, expect, it } from 'vite-plus/test';
-import { deletedFiles, planAffectedTests, type TestFile } from '../../../../test/affected-tests.ts';
-import { changedFiles, createAffectedVcsProvider } from '../../../../test/affected-vcs.ts';
-
-const tests: Array<TestFile> = [
-  { path: 'packages/void/test/unit/router.test.ts', project: 'unit', source: '' },
-  { path: 'packages/react/test/unit/link.test.ts', project: 'unit', source: '' },
-  {
-    path: 'packages/react/test/integration/pages.test.ts',
-    project: 'parallel-integration',
-    source: "const fixture = 'playground/react-pages';",
-  },
-  {
-    path: 'packages/void/test/integration/spa.test.ts',
-    project: 'parallel-integration',
-    source: "const fixture = 'playground/spa';",
-  },
-  {
-    path: 'platform/packages/api/test/integration/account.test.ts',
-    project: 'platform-api-integration-threads',
-    source: '',
-  },
-  {
-    path: 'platform/packages/api/test/integration/timezone.test.ts',
-    project: 'platform-api-integration',
-    source: '',
-  },
-  { path: 'platform/packages/proxy/test/proxy.test.ts', project: 'platform-unit', source: '' },
-];
-
-// Fixture commits must not depend on the developer's Git identity or commit signing setup.
-const fixtureGit =
-  (cwd: string) =>
-  (...args: Array<string>) =>
-    execFileSync(
-      'git',
-      [
-        '-c',
-        'commit.gpgsign=false',
-        '-c',
-        'user.email=tests@example.com',
-        '-c',
-        'user.name=Tests',
-        ...args,
-      ],
-      { cwd, stdio: 'pipe' },
-    );
-
-describe('affected test planning', () => {
-  it('does not report provisional fixture ownership before test discovery', () => {
-    const plan = planAffectedTests(['package.json', 'playground/spa/src/index.ts'], []);
-    expect(plan.full).toBe(true);
-    expect(plan.reasons).toEqual([
-      'Deleted files, configuration, dependencies, or shared test tooling changed.',
-    ]);
-  });
-
-  it('leaves a changed test to the native import graph without adding integrations', () => {
-    const plan = planAffectedTests([tests[0].path], tests);
-    expect(plan.full).toBe(false);
-    expect(plan.build).toBe(false);
-    expect(plan.related).toEqual([tests[0].path]);
-    expect([...plan.forced]).toEqual([]);
-  });
-
-  it('adds SDK integrations and refreshes built public exports for SDK source changes', () => {
-    const plan = planAffectedTests(['packages/void/src/runtime/router.ts'], tests);
-    expect(plan.full).toBe(false);
-    expect(plan.build).toBe(true);
-    expect([...plan.forced]).toEqual(
-      tests.filter((test) => test.project === 'parallel-integration').map((test) => test.path),
-    );
-  });
-
-  it('selects filesystem consumers for a changed playground including Markdown content', () => {
-    const plan = planAffectedTests(['playground/react-pages/pages/index.md'], tests);
-    expect([...plan.forced]).toEqual([tests[2].path]);
-    expect(plan.build).toBe(false);
-  });
-
-  it('fails closed for a playground without an explicit filesystem consumer', () => {
-    const plan = planAffectedTests(['playground/new-app/src/index.ts'], tests);
-    expect([...plan.forced]).toEqual([tests[2].path, tests[3].path]);
-  });
-
-  it.each([
-    'platform/packages/api/src/index.ts',
-    'platform/packages/api/migrations/0001.sql',
-    'platform/packages/api/test/integration/setup.ts',
-  ])('covers both API pools for non-imported resources: %s', (path) => {
-    const plan = planAffectedTests([path], tests);
-    expect([...plan.forced]).toEqual([tests[4].path, tests[5].path]);
-  });
-
-  it('does not select another platform package for package-local fixtures', () => {
-    const plan = planAffectedTests(['platform/packages/proxy/test/fixture.json'], tests);
-    expect([...plan.forced]).toEqual([tests[6].path]);
-  });
-
-  it('normalizes Windows paths and deduplicates overlapping fallbacks', () => {
-    const plan = planAffectedTests(
-      ['packages\\void\\src\\index.ts', 'packages/react/src/index.ts'],
-      tests,
-    );
-    expect([...plan.forced]).toEqual([tests[2].path, tests[3].path]);
-    expect(plan.related[0]).toBe('packages/void/src/index.ts');
-  });
-
-  it.each([
-    'package.json',
-    'pnpm-lock.yaml',
-    'pnpm-workspace.yaml',
-    'packages/react/vite.config.ts',
-    'packages/react/tsconfig.json',
-    'test/browser-helpers.ts',
-    '.github/workflows/test.yml',
-    'scripts/build.mjs',
-    'new-tooling/file.txt',
-  ])('falls back to the full selection for unsafe changes: %s', (path) => {
-    expect(planAffectedTests([path], tests).full).toBe(true);
-  });
-
-  it('runs the full selection for deleted imports instead of trusting an incomplete graph', () => {
-    expect(
-      planAffectedTests(['packages/void/src/removed.ts'], tests, ['packages/void/src/removed.ts'])
-        .full,
-    ).toBe(true);
-  });
-
-  it('skips documentation but not fixture content or unknown Markdown templates', () => {
-    const plan = planAffectedTests(
-      ['docs/guide/testing.md', 'packages/void/README.md', 'AGENTS.md'],
-      tests,
-    );
-    expect(plan.full).toBe(false);
-    expect(plan.related).toEqual([]);
-    expect(planAffectedTests(['templates/new.md'], tests).full).toBe(true);
-  });
-
-  it('includes all owning tests for package fixtures read outside the import graph', () => {
-    expect([...planAffectedTests(['packages/void/test/fixtures/data.json'], tests).forced]).toEqual(
-      [tests[0].path, tests[3].path],
-    );
-  });
-});
-
-describe('Git change collection', () => {
-  it('includes staged, unstaged, untracked, deleted, renamed, and committed branch paths', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-affected-git-'));
-    const git = fixtureGit(root);
-    const write = (path: string, content = path) => writeFileSync(join(root, path), content);
-    try {
-      git('init', '--quiet');
-      for (const path of [
-        'staged.ts',
-        'unstaged.ts',
-        'deleted.ts',
-        'old name.ts',
-        'committed.ts',
-        'cancelled.ts',
-      ]) {
-        write(path);
-      }
-      git('add', '.');
-      git('commit', '--quiet', '--no-verify', '-m', 'Base.');
-      expect(await changedFiles(root)).toEqual([]);
-      const base = git('rev-parse', 'HEAD').toString().trim();
-      write('committed.ts', 'changed');
-      git('add', '.');
-      git('commit', '--quiet', '--no-verify', '-m', 'Branch change.');
-      write('staged.ts', 'changed');
-      git('add', 'staged.ts');
-      write('unstaged.ts', 'changed');
-      write('cancelled.ts', 'staged change');
-      git('add', 'cancelled.ts');
-      write('cancelled.ts');
-      mkdirSync(join(root, 'new folder'));
-      write('new folder/untracked.ts');
-      write('unicode λ.ts');
-      // Windows does not permit control characters in filenames.
-      const newlinePaths = process.platform === 'win32' ? [] : ['line\nbreak.ts'];
-      for (const path of newlinePaths) {
-        write(path);
-      }
-      git('rm', 'deleted.ts');
-      git('mv', 'old name.ts', 'new name.ts');
-      const local = [
-        'cancelled.ts',
-        'deleted.ts',
-        ...newlinePaths,
-        'new folder/untracked.ts',
-        'new name.ts',
-        'old name.ts',
-        'staged.ts',
-        'unstaged.ts',
-        'unicode λ.ts',
-      ].sort();
-      expect(await changedFiles(root)).toEqual(local);
-      expect(await changedFiles(root, base)).toEqual([...local, 'committed.ts'].sort());
-      expect(deletedFiles(root, local)).toEqual(['deleted.ts', 'old name.ts']);
-      await expect(changedFiles(root, 'missing-ref')).rejects.toThrow();
-      const provider = createAffectedVcsProvider();
-      const snapshot = await provider.findChangedFiles({ root, changedSince: true });
-      expect(snapshot.map((file) => relative(root, file).replaceAll('\\', '/')).sort()).toEqual(
-        local,
-      );
-      write('later.ts');
-      expect(await provider.findChangedFiles({ root, changedSince: true })).toEqual(snapshot);
-      expect(
-        await createAffectedVcsProvider().findChangedFiles({ root, changedSince: true }),
-      ).toContain(join(root, 'later.ts').replaceAll('\\', '/'));
-      const built = join(root, 'packages/void/dist/index.mjs').replaceAll('\\', '/');
-      provider.addRelatedFiles([built, built]);
-      expect(await provider.findChangedFiles({ root, changedSince: true })).toEqual([
-        ...snapshot,
-        built,
-      ]);
-      expect(await provider.findChangedFiles({ root, changedSince: base })).toContain(
-        join(root, 'committed.ts').replaceAll('\\', '/'),
-      );
-    } finally {
-      // Git integrations can finish background writes after the command exits.
-      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
-    }
-  });
-});
-
-it('previews the native transitive import graph without running test or setup code', () => {
-  const root = mkdtempSync(join(tmpdir(), 'void-affected-preview-'));
-  const repository = fileURLToPath(new URL('../../../../', import.meta.url));
-  const git = fixtureGit(root);
-  const write = (path: string, content: string) => writeFileSync(join(root, path), content);
-  try {
-    mkdirSync(join(root, 'packages/void/src'), { recursive: true });
-    mkdirSync(join(root, 'packages/void/test/unit'), { recursive: true });
-    symlinkSync(join(repository, 'node_modules'), join(root, 'node_modules'), 'junction');
-    write('.gitignore', 'node_modules\n');
-    write('package.json', '{"type":"module"}');
-    write(
-      'vite.config.ts',
-      "export default { test: { projects: [{ test: { name: 'unit', fsModuleCache: true, globalSetup: ['./setup.ts'], include: ['packages/*/test/unit/*.test.ts'] } }] } };",
-    );
-    write('setup.ts', "throw new Error('preview must not run setup');");
-    write('packages/void/src/leaf.ts', 'export const value = 1;');
-    write('packages/void/src/barrel.ts', "export { value } from './leaf.ts';");
-    write(
-      'packages/void/test/unit/affected.test.ts',
-      "import { value } from '../../src/barrel.ts'; throw new Error(`preview must not execute ${value}`);",
-    );
-    write(
-      'packages/void/test/unit/unrelated.test.ts',
-      "throw new Error('unrelated test must not execute');",
-    );
-    git('init', '--quiet');
-    git('add', '.');
-    git('commit', '--quiet', '--no-verify', '-m', 'Fixture.');
-    write('packages/void/src/leaf.ts', 'export const value = 2;');
-    const runner = new URL('../../../../test/affected.mjs', import.meta.url).href;
-    const output = execFileSync(
-      process.execPath,
-      [
-        '--input-type=module',
-        '-e',
-        `import { runAffected } from ${JSON.stringify(runner)}; await runAffected(${JSON.stringify(root)}, { list: true });`,
-      ],
-      { cwd: root, encoding: 'utf8', stdio: 'pipe', timeout: 15_000 },
-    );
-    expect(output).toContain('Selected 1/2 test files');
-    expect(output).toContain('Finding tests affected by changed imports...');
-    expect(output).toContain('[unit] packages/void/test/unit/affected.test.ts');
-    expect(output).not.toContain('[unit] packages/void/test/unit/unrelated.test.ts');
-    write('setup.ts', 'export default function setup() {}');
-    git('add', '.');
-    git('commit', '--quiet', '--no-verify', '-m', 'Prime fixture.');
-    const run = () =>
-      spawnSync(
-        process.execPath,
-        [
-          '--input-type=module',
-          '-e',
-          `import { runAffected } from ${JSON.stringify(runner)}; await runAffected(${JSON.stringify(root)}, {});`,
-        ],
-        { cwd: root, encoding: 'utf8', timeout: 15_000 },
-      );
-    write(
-      'packages/void/test/unit/affected.test.ts',
-      "import { expect, it } from 'vite-plus/test'; import { value } from '../../src/barrel.ts'; it('value', () => expect(value).toBe(2));",
-    );
-    const passed = run();
-    expect(passed.error).toBeUndefined();
-    expect(passed.stdout).toContain('Selected 1/2 test files');
-    expect(passed.status, passed.stderr).toBe(0);
-    write(
-      'packages/void/test/unit/affected.test.ts',
-      "import { expect, it } from 'vite-plus/test'; import { value } from '../../src/barrel.ts'; it('changed value', () => expect(value).toBe(3));",
-    );
-    const failed = run();
-    expect(failed.error).toBeUndefined();
-    expect(failed.status).toBe(1);
-    expect(failed.stdout + failed.stderr).toContain('expected 2 to be 3');
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-}, 20_000);
-
-it('executes conservative integration consumers without an import edge', () => {
-  const root = mkdtempSync(join(tmpdir(), 'void-affected-consumer-'));
-  const repository = fileURLToPath(new URL('../../../../', import.meta.url));
-  const git = fixtureGit(root);
-  const write = (path: string, content: string) => writeFileSync(join(root, path), content);
-  try {
-    mkdirSync(join(root, 'platform/packages/api/src'), { recursive: true });
-    mkdirSync(join(root, 'platform/packages/api/test/integration'), { recursive: true });
-    mkdirSync(join(root, 'packages/void/test/unit'), { recursive: true });
-    symlinkSync(join(repository, 'node_modules'), join(root, 'node_modules'), 'junction');
-    write('.gitignore', 'node_modules\n');
-    write('package.json', '{"type":"module"}');
-    write(
-      'vite.config.ts',
-      "export default { test: { projects: [{ test: { name: 'unit', include: ['packages/*/test/unit/*.test.ts'] } }, { test: { name: 'platform-api-integration', include: ['platform/packages/api/test/integration/*.test.ts'] } }] } };",
-    );
-    write('platform/packages/api/src/entry.ts', 'export const value = 1;');
-    write(
-      'platform/packages/api/test/integration/consumer.test.ts',
-      "import { expect, it } from 'vite-plus/test'; import { readFileSync } from 'node:fs'; it('filesystem consumer', () => expect(readFileSync('platform/packages/api/src/entry.ts', 'utf8')).toContain('value = 2'));",
-    );
-    write(
-      'packages/void/test/unit/unrelated.test.ts',
-      "throw new Error('unrelated test executed');",
-    );
-    git('init', '--quiet');
-    git('add', '.');
-    git('commit', '--quiet', '--no-verify', '-m', 'Fixture.');
-    write('platform/packages/api/src/entry.ts', 'export const value = 2;');
-    const runner = new URL('../../../../test/affected.mjs', import.meta.url).href;
-    const result = spawnSync(
-      process.execPath,
-      [
-        '--input-type=module',
-        '-e',
-        `import { runAffected } from ${JSON.stringify(runner)}; await runAffected(${JSON.stringify(root)}, {});`,
-      ],
-      { cwd: root, encoding: 'utf8', timeout: 15_000, env: { ...process.env, FORCE_COLOR: '1' } },
-    );
-    expect(result.error).toBeUndefined();
-    expect(result.status, result.stdout + result.stderr).toBe(0);
-    const output = stripVTControlCharacters(result.stdout);
-    expect(output).toContain('Selected 1/2 test files');
-    expect(output).toContain('Test Files  1 passed');
-    expect(output).toContain('Tests  1 passed');
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-}, 20_000);
-
-it.each([false, true])(
-  'skips reading test sources for a full fallback (unit-only: %s)',
-  (unit) => {
-    const root = mkdtempSync(join(tmpdir(), 'void-affected-full-'));
-    const repository = fileURLToPath(new URL('../../../../', import.meta.url));
-    const git = fixtureGit(root);
-    const write = (path: string, content: string) => writeFileSync(join(root, path), content);
-    try {
-      mkdirSync(join(root, 'packages/void/test/unit'), { recursive: true });
-      mkdirSync(join(root, 'packages/void/test/integration'), { recursive: true });
-      symlinkSync(join(repository, 'node_modules'), join(root, 'node_modules'), 'junction');
-      write('.gitignore', 'node_modules\n');
-      write('package.json', '{"type":"module"}');
-      write(
-        'vite.config.ts',
-        "export default { test: { projects: [{ test: { name: 'unit', include: ['packages/*/test/unit/*.test.ts'] } }, { test: { name: 'parallel-integration', include: ['packages/*/test/integration/*.test.ts'] } }] } };",
-      );
-      for (const file of ['unit', 'integration']) {
-        write(
-          `packages/void/test/${file}/unread.test.ts`,
-          "throw new Error('preview must not execute tests');",
-        );
-      }
-      git('init', '--quiet');
-      git('add', '.');
-      git('commit', '--quiet', '--no-verify', '-m', 'Fixture.');
-      write('package.json', '{"type":"module","private":true}');
-      const runner = new URL('../../../../test/affected.mjs', import.meta.url).href;
-      const output = execFileSync(
-        process.execPath,
-        [
-          '--input-type=module',
-          '-e',
-          `import fs from 'node:fs';
-          import { syncBuiltinESMExports } from 'node:module';
-          const original = fs.readFileSync;
-          fs.readFileSync = (path, ...options) => {
-            if (String(path).endsWith('.test.ts')) throw new Error('Full fallback must not read test sources');
-            return original(path, ...options);
-          };
-          syncBuiltinESMExports();
-          const { runAffected } = await import(${JSON.stringify(runner)});
-          await runAffected(${JSON.stringify(root)}, { list: true, unit: ${unit} });`,
-        ],
-        { cwd: root, encoding: 'utf8', stdio: 'pipe', timeout: 15_000 },
-      );
-      expect(output).toContain(`Selected ${unit ? '1/1' : '2/2'} test files`);
-      expect(output).toContain('[unit] packages/void/test/unit/unread.test.ts');
-      expect(output.includes('[parallel-integration]')).toBe(!unit);
-      expect(output).toContain('Initializing Vitest and discovering test files...');
-      expect(output.indexOf('Initializing Vitest')).toBeLessThan(output.indexOf('Selected'));
-      expect(output).not.toContain('Finding tests affected by changed imports');
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  },
-  20_000,
-);
diff --git a/packages/void/test/unit/ai.test.ts b/packages/void/test/unit/ai.test.ts
index 7effdf489..3d2b54db5 100644
--- a/packages/void/test/unit/ai.test.ts
+++ b/packages/void/test/unit/ai.test.ts
@@ -1,12 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 
-/**
- * Build a fake Workers AI binding (`env.AI`) for the P3 self-host backend.
- *
- * `gateway(id)` returns an object whose `getUrl(provider)` mock resolves to a
- * realistic AI Gateway URL derived from BOTH the gateway id and provider, so
- * the appended provider path can be asserted end-to-end.
- */
+/** Fake Workers AI binding (`env.AI`) whose gateway URLs include the gateway id and provider. */
 function makeDirectAi(
   opts: { getUrl?: (id: string, provider: string) => Promise<string>; run?: () => unknown } = {},
 ) {
@@ -24,23 +18,17 @@ function makeDirectAi(
 }
 
 describe('runtime ai', () => {
-  it.each([undefined, '1'])(
-    'rejects missing proxy metadata without sending credentials (legacy staging=%s)',
-    async (staging) => {
-      vi.resetModules();
-      const { envContext } = await import('../../src/runtime/env-raw.ts');
-      const { ai } = await import('../../src/runtime/ai.ts');
-      const request = vi.fn();
-      vi.stubGlobal('fetch', request);
-      await envContext.run(
-        { __VOID_TOKEN: 'token', __VOID_PROJECT_ID: 'project', __VOID_STAGING: staging },
-        async () => {
-          await expect(ai.run('@cf/meta/llama', {})).rejects.toThrow('No connected platform proxy');
-        },
-      );
-      expect(request).not.toHaveBeenCalled();
-    },
-  );
+  it('rejects missing proxy metadata without sending credentials', async () => {
+    vi.resetModules();
+    const { envContext } = await import('../../src/runtime/env-raw.ts');
+    const { ai } = await import('../../src/runtime/ai.ts');
+    const request = vi.fn();
+    vi.stubGlobal('fetch', request);
+    await envContext.run({ __VOID_TOKEN: 'token', __VOID_PROJECT_ID: 'project' }, async () => {
+      await expect(ai.run('@cf/meta/llama', {})).rejects.toThrow('No connected platform proxy');
+    });
+    expect(request).not.toHaveBeenCalled();
+  });
   afterEach(() => {
     vi.restoreAllMocks();
     vi.unstubAllGlobals();
@@ -151,38 +139,6 @@ describe('runtime ai', () => {
     });
   });
 
-  it('returns non-2xx provider responses for HTTP proxy requests', async () => {
-    vi.resetModules();
-    const { envContext } = await import('../../src/runtime/env-raw.ts');
-    const { ai } = await import('../../src/runtime/ai.ts');
-
-    const fetchMock = vi.fn(
-      async (_url: string | URL | Request, _init?: RequestInit) =>
-        new Response(JSON.stringify({ error: { message: 'Invalid API key' } }), {
-          status: 401,
-          headers: { 'content-type': 'application/json' },
-        }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    await envContext.run(
-      {
-        __VOID_TOKEN: 'void-token',
-        __VOID_PROJECT_ID: 'proj_1',
-        __VOID_PROXY_URL: 'https://proxy.test',
-        OPENAI_API_KEY: 'sk-test',
-      },
-      async () => {
-        const response = await ai.provider('openai').fetch('/chat/completions', {
-          body: { model: 'gpt-4o', messages: [{ role: 'user', content: 'Hello' }] },
-        });
-
-        expect(response.status).toBe(401);
-        expect(await response.json()).toEqual({ error: { message: 'Invalid API key' } });
-      },
-    );
-  });
-
   it('returns non-2xx provider responses for service-binding proxy requests', async () => {
     vi.resetModules();
     const { envContext } = await import('../../src/runtime/env-raw.ts');
@@ -357,9 +313,6 @@ describe('runtime ai', () => {
     );
   });
 
-  // P3 self-host backend: only `env.AI` is bound (no Void proxy/token). Inference
-  // runs directly against the user's Workers AI binding, and `ai.provider().fetch`
-  // routes through the user's OWN AI Gateway using a project provider secret.
   describe('direct AI backend (self-host, env.AI only)', () => {
     it('selects the direct backend when only env.AI is present (ai.run → directAi.run)', async () => {
       vi.resetModules();
@@ -426,12 +379,10 @@ describe('runtime ai', () => {
           const response = await ai.provider('openai').fetch('/chat/completions', {
             body: { model: 'gpt-4o', messages: [{ role: 'user', content: 'Hello' }] },
           });
-          // Gateway response passes through untouched.
           expect(await response.json()).toEqual({ id: 'chatcmpl_direct' });
         },
       );
 
-      // Resolved the URL from the user's OWN gateway (awaited getUrl), not the Void proxy.
       expect(direct.gateway).toHaveBeenCalledWith('my-gw');
       expect(direct.gateway.mock.results[0].value.getUrl).toHaveBeenCalledWith('openai');
 
@@ -444,113 +395,46 @@ describe('runtime ai', () => {
       const headers = new Headers(init.headers);
       expect(headers.get('authorization')).toBe('Bearer sk-test');
       expect(headers.get('content-type')).toBe('application/json');
-      // Self-host path must NOT attach managed metering / projectId headers.
       expect(headers.get('cf-aig-metadata-projectId')).toBeNull();
       expect(headers.get('cf-aig-metadata')).toBeNull();
-
-      // Real provider payload — NOT the proxy envelope ({ action, provider, providerKey, ... }).
-      const sent = JSON.parse(init.body as string);
-      expect(sent).toEqual({ model: 'gpt-4o', messages: [{ role: 'user', content: 'Hello' }] });
-      expect(sent).not.toHaveProperty('action');
-      expect(sent).not.toHaveProperty('provider');
-      expect(sent).not.toHaveProperty('providerKey');
-    });
-
-    it('sends the provider-native auth header for a non-Bearer provider (anthropic → x-api-key, no Bearer)', async () => {
-      vi.resetModules();
-      const { envContext } = await import('../../src/runtime/env-raw.ts');
-      const { ai } = await import('../../src/runtime/ai.ts');
-
-      const fetchMock = vi.fn(
-        async (_url: string | URL | Request, _init?: RequestInit) =>
-          new Response(JSON.stringify({ id: 'msg_direct' }), {
-            headers: { 'content-type': 'application/json' },
-          }),
-      );
-      vi.stubGlobal('fetch', fetchMock);
-
-      const direct = makeDirectAi();
-
-      await envContext.run(
-        { AI: direct.AI, __VOID_AI_GATEWAY: 'my-gw', ANTHROPIC_API_KEY: 'sk-ant-test' },
-        async () => {
-          await ai.provider('anthropic').fetch('/v1/messages', {
-            body: { model: 'claude-3-5-sonnet', messages: [{ role: 'user', content: 'Hi' }] },
-          });
-        },
-      );
-
-      expect(direct.gateway.mock.results[0].value.getUrl).toHaveBeenCalledWith('anthropic');
-      const init = fetchMock.mock.calls[0][1]!;
-      const headers = new Headers(init.headers);
-      // Anthropic authenticates with `x-api-key` and NO prefix — sending
-      // `Authorization: Bearer <key>` 401s at the gateway pass-through.
-      expect(headers.get('x-api-key')).toBe('sk-ant-test');
-      expect(headers.get('authorization')).toBeNull();
-    });
-
-    it('sends the provider-native auth header for parallel (x-api-key, no Bearer)', async () => {
-      vi.resetModules();
-      const { envContext } = await import('../../src/runtime/env-raw.ts');
-      const { ai } = await import('../../src/runtime/ai.ts');
-
-      const fetchMock = vi.fn(
-        async (_url: string | URL | Request, _init?: RequestInit) =>
-          new Response(JSON.stringify({ id: 'task_run_direct' }), {
-            headers: { 'content-type': 'application/json' },
-          }),
-      );
-      vi.stubGlobal('fetch', fetchMock);
-
-      const direct = makeDirectAi();
-
-      await envContext.run(
-        { AI: direct.AI, __VOID_AI_GATEWAY: 'my-gw', PARALLEL_API_KEY: 'pk-test' },
-        async () => {
-          await ai.provider('parallel').fetch('/v1/tasks/runs', {
-            body: { input: 'What is the capital of France?' },
-          });
-        },
-      );
-
-      expect(direct.gateway.mock.results[0].value.getUrl).toHaveBeenCalledWith('parallel');
-      const init = fetchMock.mock.calls[0][1]!;
-      const headers = new Headers(init.headers);
-      // Parallel's AI Gateway authenticates with `x-api-key` and NO prefix —
-      // sending `Authorization: Bearer <key>` 401s at the gateway pass-through.
-      expect(headers.get('x-api-key')).toBe('pk-test');
-      expect(headers.get('authorization')).toBeNull();
+      expect(JSON.parse(init.body as string)).toEqual({
+        model: 'gpt-4o',
+        messages: [{ role: 'user', content: 'Hello' }],
+      });
     });
 
-    it('sends a prefixed non-Bearer auth header (deepgram → Authorization: Token)', async () => {
-      vi.resetModules();
-      const { envContext } = await import('../../src/runtime/env-raw.ts');
-      const { ai } = await import('../../src/runtime/ai.ts');
-
-      const fetchMock = vi.fn(
-        async (_url: string | URL | Request, _init?: RequestInit) =>
-          new Response(JSON.stringify({ ok: true }), {
-            headers: { 'content-type': 'application/json' },
-          }),
-      );
-      vi.stubGlobal('fetch', fetchMock);
+    it.each([
+      ['anthropic', 'ANTHROPIC_API_KEY', 'x-api-key', 'sk-test', null],
+      ['deepgram', 'DEEPGRAM_API_KEY', 'authorization', 'Token sk-test', 'Token sk-test'],
+      ['parallel', 'PARALLEL_API_KEY', 'x-api-key', 'sk-test', null],
+    ] as const)(
+      'sends the provider-native auth header for %s',
+      async (provider, keyEnv, header, value, authorization) => {
+        vi.resetModules();
+        const { envContext } = await import('../../src/runtime/env-raw.ts');
+        const { ai } = await import('../../src/runtime/ai.ts');
+
+        const fetchMock = vi.fn(
+          async (_url: string | URL | Request, _init?: RequestInit) => new Response('ok'),
+        );
+        vi.stubGlobal('fetch', fetchMock);
 
-      const direct = makeDirectAi();
+        const direct = makeDirectAi();
 
-      await envContext.run(
-        { AI: direct.AI, __VOID_AI_GATEWAY: 'my-gw', DEEPGRAM_API_KEY: 'dg-test' },
-        async () => {
-          await ai
-            .provider('deepgram')
-            .fetch('/v1/listen', { body: { url: 'https://example.com/a.wav' } });
-        },
-      );
+        await envContext.run(
+          { AI: direct.AI, __VOID_AI_GATEWAY: 'my-gw', [keyEnv]: 'sk-test' },
+          async () => {
+            await ai.provider(provider).fetch('/v1/test', { body: { input: 'Hi' } });
+          },
+        );
 
-      const init = fetchMock.mock.calls[0][1]!;
-      const headers = new Headers(init.headers);
-      // Deepgram uses the `Token ` scheme, not `Bearer `.
-      expect(headers.get('authorization')).toBe('Token dg-test');
-    });
+        expect(direct.gateway.mock.results[0].value.getUrl).toHaveBeenCalledWith(provider);
+        const headers = new Headers(fetchMock.mock.calls[0][1]!.headers);
+        // `Authorization: Bearer <key>` 401s at the gateway pass-through for these providers.
+        expect(headers.get(header)).toBe(value);
+        expect(headers.get('authorization')).toBe(authorization);
+      },
+    );
 
     it('resolves to 501 when no AI gateway is configured', async () => {
       vi.resetModules();
@@ -590,7 +474,6 @@ describe('runtime ai', () => {
 
       const direct = makeDirectAi();
 
-      // Gateway present + safe path, but OPENAI_API_KEY is absent.
       await envContext.run({ AI: direct.AI, __VOID_AI_GATEWAY: 'my-gw' }, async () => {
         const response = await ai.provider('openai').fetch('/chat/completions', {
           body: { model: 'gpt-4o' },
@@ -601,7 +484,6 @@ describe('runtime ai', () => {
       });
 
       expect(fetchMock).not.toHaveBeenCalled();
-      // Key check happens before the gateway lookup.
       expect(direct.gateway).not.toHaveBeenCalled();
     });
 
@@ -662,40 +544,9 @@ describe('runtime ai', () => {
       );
 
       expect(fetchMock).not.toHaveBeenCalled();
-      // Path is rejected before any gateway lookup or network call.
       expect(direct.gateway).not.toHaveBeenCalled();
     });
 
-    it('serializes a direct JSON body as real application/json (not the proxy envelope)', async () => {
-      vi.resetModules();
-      const { envContext } = await import('../../src/runtime/env-raw.ts');
-      const { ai } = await import('../../src/runtime/ai.ts');
-
-      const fetchMock = vi.fn(
-        async (_url: string | URL | Request, _init?: RequestInit) => new Response('ok'),
-      );
-      vi.stubGlobal('fetch', fetchMock);
-
-      const direct = makeDirectAi();
-
-      await envContext.run(
-        { AI: direct.AI, __VOID_AI_GATEWAY: 'my-gw', OPENAI_API_KEY: 'sk-test' },
-        async () => {
-          await ai.provider('openai').fetch('/chat/completions', {
-            body: { model: 'gpt-4o', messages: [{ role: 'user', content: 'Hello' }] },
-          });
-        },
-      );
-
-      const init = fetchMock.mock.calls[0][1]!;
-      expect(typeof init.body).toBe('string');
-      expect(new Headers(init.headers).get('content-type')).toBe('application/json');
-      expect(JSON.parse(init.body as string)).toEqual({
-        model: 'gpt-4o',
-        messages: [{ role: 'user', content: 'Hello' }],
-      });
-    });
-
     it('forwards a direct multipart/form-data body untouched (fetch sets the boundary)', async () => {
       vi.resetModules();
       const { envContext } = await import('../../src/runtime/env-raw.ts');
@@ -739,21 +590,6 @@ describe('runtime ai', () => {
 });
 
 describe('AI usage-limit rejections', () => {
-  it('supports Promise.all and repeated awaits without repeating inference', async () => {
-    vi.resetModules();
-    const { envContext } = await import('../../src/runtime/env-raw.ts');
-    const { ai } = await import('../../src/runtime/ai.ts');
-    const direct = makeDirectAi();
-    await envContext.run({ AI: direct.AI }, async () => {
-      const first = ai.run('model', {});
-      const second = ai.run('model', {});
-      expect(first).toBeInstanceOf(Promise);
-      expect(await Promise.all([first, second])).toEqual([{ ok: true }, { ok: true }]);
-      expect(await first).toEqual({ ok: true });
-      expect(direct.run).toHaveBeenCalledTimes(2);
-    });
-  });
-
   it('preserves ordinary inference failures', async () => {
     vi.resetModules();
     const { envContext } = await import('../../src/runtime/env-raw.ts');
@@ -834,7 +670,6 @@ describe('AI usage-limit rejections', () => {
                 : method === 'toMarkdown'
                   ? ai.toMarkdown({ name: 'test.txt', blob: new Blob(['text']) })
                   : ai[method]('model', {});
-          expect(op).toBeInstanceOf(Promise);
           await expect(op).rejects.toBeInstanceOf(UsageLimit);
           await expect(op).rejects.toMatchObject({
             resource: 'ai',
diff --git a/packages/void/test/unit/ai.typecheck.ts b/packages/void/test/unit/ai.typecheck.ts
index 45f08c0f1..a89f24a20 100644
--- a/packages/void/test/unit/ai.typecheck.ts
+++ b/packages/void/test/unit/ai.typecheck.ts
@@ -1,4 +1,4 @@
-import { expectTypeOf, it } from 'vite-plus/test';
+import { expectTypeOf } from 'vite-plus/test';
 import type { ai } from '../../src/runtime/ai.ts';
 
 declare const client: typeof ai;
@@ -10,27 +10,15 @@ expectTypeOf(client.image(model, {})).toEqualTypeOf<Promise<Response>>();
 expectTypeOf(client.provider('openai').fetch('/chat/completions')).toEqualTypeOf<
   Promise<Response>
 >();
-// @ts-expect-error Operations use the standard Promise API.
-result.match({ ok: (value: unknown) => value, limited: () => null });
 
-it('types provider fetch calls', () => {
-  type ProviderMethod = typeof ai.provider;
-  const provider = undefined as unknown as ProviderMethod;
-
-  const assertTypes = () => {
-    provider('openai').fetch('/chat/completions', {
-      body: {
-        model: 'gpt-4o',
-        messages: [{ role: 'user', content: 'Hello' }],
-      },
-    });
-    provider('custom', { apiKeyEnv: 'CUSTOM_AI_KEY' }).fetch('/v1/respond', {
-      method: 'POST',
-      headers: { 'x-test': '1' },
-      body: new Uint8Array([1, 2]),
-    });
-  };
-
-  expectTypeOf(assertTypes).toBeFunction();
-  expectTypeOf(provider).toBeFunction();
+client.provider('openai').fetch('/chat/completions', {
+  body: {
+    model: 'gpt-4o',
+    messages: [{ role: 'user', content: 'Hello' }],
+  },
+});
+client.provider('custom', { apiKeyEnv: 'CUSTOM_AI_KEY' }).fetch('/v1/respond', {
+  method: 'POST',
+  headers: { 'x-test': '1' },
+  body: new Uint8Array([1, 2]),
 });
diff --git a/packages/void/test/unit/application-analysis-consumers.test.ts b/packages/void/test/unit/application-analysis-consumers.test.ts
index 4e16b4607..af07de712 100644
--- a/packages/void/test/unit/application-analysis-consumers.test.ts
+++ b/packages/void/test/unit/application-analysis-consumers.test.ts
@@ -1,23 +1,17 @@
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import type { Plugin, ResolvedConfig } from 'vite';
+import type { ResolvedConfig } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
-import { analyzeApplicationSync } from '../../src/application-analysis.ts';
-import { computeDesiredCloudflareResources } from '../../src/cli/deploy.ts';
+import { computeDesiredCloudflareResources } from '../../src/cli/deploy-resources.ts';
 import { buildFrameworkManifest, buildVoidManifest } from '../../src/cli/package.ts';
 import { readConfig, type VoidConfig } from '../../src/config.ts';
-import { validateMigrations } from '../../src/migrations/validate.ts';
 
 type CloudflarePluginConfig = {
   config: (resolved: Record<string, unknown>) => Record<string, unknown>;
 };
 
-vi.mock('@cloudflare/vite-plugin', () => ({
-  cloudflare(pluginConfig: CloudflarePluginConfig): Array<Plugin> {
-    return [{ name: 'mock:cloudflare', api: { pluginConfig } } as Plugin];
-  },
-}));
+vi.mock('@cloudflare/vite-plugin', () => import('../helpers/cloudflare-vite-plugin.ts'));
 
 const roots: Array<string> = [];
 
@@ -183,26 +177,15 @@ export const load = () => ({ storage, kv });`,
         },
         framework,
       );
-      const config = readConfig(root);
       const resources = await computeDesiredCloudflareResources(
         root,
-        config,
+        readConfig(root),
         join(root, 'wrangler.jsonc'),
       );
-      const application = analyzeApplicationSync(root, { config, environment: 'prod' });
-      const common = {
-        bindings: application.bindings,
-        dialect: application.dialect,
-        migrations: validateMigrations(application.migrations),
-      };
-      const manifests = [
-        buildVoidManifest(common),
-        buildFrameworkManifest({ ...common, frameworkName: 'sveltekit', workerMain: 'index.js' }),
-      ];
       const emitted = await pluginConfig(root);
 
-      expect(application.bindings.needsD1).toBe(false);
-      expect(application.authEnabled).toBe(false);
+      expect(resources.analysis.bindings.needsD1).toBe(false);
+      expect(resources.analysis.authEnabled).toBe(false);
       expect(resources.desired.kvNamespaces).toEqual([]);
       expect(resources.migrations).toHaveLength(1);
       if (database === 'sqlite') {
@@ -222,17 +205,6 @@ export const load = () => ({ storage, kv });`,
         );
         expect(emitted.d1_databases).toBeUndefined();
       }
-      for (const manifest of manifests) {
-        expect(manifest.version).toBe(3);
-        expect(manifest.assetManifestVersion).toBe(2);
-        expect(manifest.bindings.d1).toEqual(database === 'sqlite' ? ['DB'] : undefined);
-        expect(manifest.bindings.hyperdrive).toEqual(
-          database === 'pg' ? ['HYPERDRIVE'] : undefined,
-        );
-        expect(manifest.migrations).toEqual(
-          expect.objectContaining({ dialect: application.dialect, pending: 1 }),
-        );
-      }
     },
   );
 });
diff --git a/packages/void/test/unit/application-analysis.test.ts b/packages/void/test/unit/application-analysis.test.ts
index 4e0d722dd..292500eed 100644
--- a/packages/void/test/unit/application-analysis.test.ts
+++ b/packages/void/test/unit/application-analysis.test.ts
@@ -3,9 +3,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
 import { analyzeApplicationSync } from '../../src/application-analysis.ts';
-import { applyBindingOverrides, needsApplicationDatabase } from '../../src/application-features.ts';
 import type { VoidConfig } from '../../src/config.ts';
-import { inferBindingsFromSource } from '../../src/inference/walk.ts';
 
 const roots: Array<string> = [];
 
@@ -124,8 +122,6 @@ describe('shared application analysis', () => {
       'auth requires a D1 database',
       'checked-in migrations need a D1 database',
     ]);
-    expect(analysis.reasons.queues).toEqual(['queues/events.ts requires QUEUE_EVENTS']);
-    expect(analysis.reasons.email).toEqual(['email/ contains inbound email handlers']);
   });
 
   it('includes migration-only database requirements without inventing source inference', () => {
@@ -209,7 +205,6 @@ describe('shared application analysis', () => {
     });
     expect(analysis.authEnabled).toBe(true);
     expect(analysis.needsDatabase).toBe(true);
-    expect(analysis.reasons.sandbox).toEqual(['void.config.ts enables Sandbox']);
   });
 
   it('explains explicitly enabled resources without inventing source usage', () => {
@@ -221,49 +216,11 @@ describe('shared application analysis', () => {
       },
     });
     expect(analysis.bindingNames).toEqual({ d1: 'CUSTOM_DB' });
+    expect(analysis.bindings).toMatchObject({ needsAI: true, needsEmail: true });
     expect(analysis.reasons).toMatchObject({
       database: ['inference.bindings.db enables a D1 database'],
       kv: ['inference.bindings.kv enables KV'],
       r2: ['inference.bindings.storage enables R2'],
-      ai: ['inference.bindings.ai enables Workers AI'],
-      email: ['inference.bindings.email enables email'],
     });
   });
 });
-
-describe('shared application feature policy', () => {
-  it('overrides only explicitly named flags and does not mutate inference', () => {
-    const inferred = inferBindingsFromSource(
-      'import { db } from "void/db"; import { kv } from "void/kv"; import { storage } from "void/storage"; import { auth } from "void/auth"; import { sandbox } from "void/sandbox"; import { queues } from "void/queues";',
-      'features.ts',
-    );
-    const snapshot = { ...inferred };
-    expect(
-      applyBindingOverrides(inferred, { db: false, kv: 'CACHE', ai: true, email: false }),
-    ).toMatchObject({
-      needsD1: false,
-      needsKV: true,
-      needsR2: true,
-      needsAuth: true,
-      needsSandbox: true,
-      needsQueues: true,
-      needsAI: true,
-      needsEmail: false,
-    });
-    expect(inferred).toEqual(snapshot);
-    expect(applyBindingOverrides(inferred, {})).toEqual(inferred);
-    expect(applyBindingOverrides(inferred)).toEqual(inferred);
-  });
-
-  it.each([
-    [{ needsD1: false, needsAuth: false }, 0, false],
-    [{ needsD1: true, needsAuth: false }, 0, true],
-    [{ needsD1: false, needsAuth: true }, 0, true],
-    [{ needsD1: false, needsAuth: false }, 1, true],
-  ] as const)(
-    'shares database requirement across consumers: %j with %i migrations',
-    (bindings, migrationCount, expected) => {
-      expect(needsApplicationDatabase(bindings, migrationCount)).toBe(expected);
-    },
-  );
-});
diff --git a/packages/void/test/unit/assemble-manifest.test.ts b/packages/void/test/unit/assemble-manifest.test.ts
index 9b0b49af3..a733d5266 100644
--- a/packages/void/test/unit/assemble-manifest.test.ts
+++ b/packages/void/test/unit/assemble-manifest.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vite-plus/test';
-import { assembleVoidManifest } from '../../src/cli/deploy.ts';
+import { assembleVoidManifest } from '../../src/cli/deploy-managed-static.ts';
 import type { InferredBindings } from '../../src/inference/walk.ts';
-import type { PageDefinition, PageScanResult } from '../../src/pages/types.ts';
+import { makePage, makeScan } from '../helpers/page-scan.ts';
 
 // Minimal all-false bindings — `manifest.pages` emission is independent of
 // bindings, so this is the smallest valid `buildVoidManifest` input.
@@ -33,32 +33,6 @@ it('disables managed ISR policies and edge prerendering with routing.isr false',
   expect(manifest.pages).toEqual([{ pattern: '/' }]);
 });
 
-function makePage(pattern: string, revalidate?: number): PageDefinition {
-  return {
-    pattern,
-    params: [],
-    catchAll: false,
-    componentPath: `${pattern}.vue`,
-    serverPath: `${pattern}.server.ts`,
-    methods: ['GET'],
-    componentId: pattern.replace(/^\//, ''),
-    revalidate,
-    ssrMode: 'auto',
-    prerenderMode: 'auto',
-    renderMode: 'server',
-    shouldPrerender: false,
-  };
-}
-
-function makeScan(pages: Array<PageDefinition>): PageScanResult {
-  return { pages, layouts: [], namedLayouts: [] };
-}
-
-// This is the production seam `runFullDeploy` uses to forward `pageScan` into
-// `manifest.pages`. If the `pages: collectPages(pageScan)` injection is dropped
-// from `assembleVoidManifest`, the first assertion below fails (`.toEqual`
-// mismatch) and the second fails (`pages` stays undefined) — so this test goes
-// RED the moment the wiring regresses.
 describe('assembleVoidManifest', () => {
   it('forwards the page scan into manifest.pages (ordered, raw patterns, ISR TTL preserved)', () => {
     const pageScan = makeScan([
@@ -74,25 +48,18 @@ describe('assembleVoidManifest', () => {
     ]);
   });
 
-  it('omits manifest.pages when the scan has no pages', () => {
-    expect(
-      assembleVoidManifest(makeScan([]), false, { bindings: MINIMAL_BINDINGS }).pages,
-    ).toBeUndefined();
-    expect(assembleVoidManifest(null, false, { bindings: MINIMAL_BINDINGS }).pages).toBeUndefined();
-  });
-
-  it('emits manifest.pages for a void app (isFrameworkMode = false)', () => {
-    const scan = makeScan([makePage('/isr', 60)]);
-    expect(assembleVoidManifest(scan, false, { bindings: MINIMAL_BINDINGS }).pages).toEqual([
-      { pattern: '/isr', revalidate: 60 },
-    ]);
-  });
-
-  it('omits manifest.pages in framework mode even with a populated scan (isFrameworkMode = true)', () => {
+  it('omits manifest.pages and pathRevalidate in framework mode', () => {
     // `pages` is a Void pages-mode concept: a Class-A framework routed through
     // runFullDeploy must NOT emit it, even when it happens to have a pages/ dir.
     const scan = makeScan([makePage('/isr', 60)]);
-    expect(assembleVoidManifest(scan, true, { bindings: MINIMAL_BINDINGS }).pages).toBeUndefined();
+    const manifest = assembleVoidManifest(
+      scan,
+      true,
+      { bindings: MINIMAL_BINDINGS },
+      { '/blog/*': 3600 },
+    );
+    expect(manifest.pages).toBeUndefined();
+    expect(manifest.pathRevalidate).toBeUndefined();
   });
 
   it('ships the RAW object config as manifest.pathRevalidate; those pages stay inherit-eligible', () => {
@@ -124,18 +91,4 @@ describe('assembleVoidManifest', () => {
     ]);
     expect(manifest.pathRevalidate).toBeUndefined();
   });
-
-  it('omits manifest.pathRevalidate in framework mode even with an object config', () => {
-    const scan = makeScan([makePage('/blog/:slug')]);
-    const manifest = assembleVoidManifest(
-      scan,
-      true,
-      { bindings: MINIMAL_BINDINGS },
-      {
-        '/blog/*': 3600,
-      },
-    );
-    expect(manifest.pages).toBeUndefined();
-    expect(manifest.pathRevalidate).toBeUndefined();
-  });
 });
diff --git a/packages/void/test/unit/asset-hashing.test.ts b/packages/void/test/unit/asset-hashing.test.ts
deleted file mode 100644
index 7366b61b8..000000000
--- a/packages/void/test/unit/asset-hashing.test.ts
+++ /dev/null
@@ -1,167 +0,0 @@
-import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { hash as blake3hash } from 'blake3-jit';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-
-// `vi.mock` is hoisted above all imports — declare the mock before importing
-// `node:fs` consumers so the spy is in place when `package.ts` resolves its
-// `import { readFileSync } from 'node:fs'` binding. We re-export every other
-// member of the real module via `actual` so existsSync/readdirSync etc.
-// continue to work end-to-end against the temp directory.
-vi.mock('node:fs', async () => {
-  const actual = await vi.importActual<typeof import('node:fs')>('node:fs');
-  return {
-    ...actual,
-    readFileSync: vi.fn(actual.readFileSync),
-  };
-});
-
-const fsModule = await import('node:fs');
-const readFileSyncMock = fsModule.readFileSync as unknown as ReturnType<typeof vi.fn>;
-
-const {
-  collectAndHashAssets,
-  computeAssetHash,
-  computeAssetHashes,
-  computeMd5,
-  getAssetContentType,
-} = await import('../../src/cli/package.ts');
-
-const TMP = join(import.meta.dirname, '.tmp-asset-hashing-test');
-
-beforeEach(() => {
-  mkdirSync(TMP, { recursive: true });
-  readFileSyncMock.mockClear();
-});
-
-afterEach(() => {
-  rmSync(TMP, { recursive: true, force: true });
-});
-
-describe('computeMd5', () => {
-  it('matches Node crypto.createHash("md5") for raw bytes', () => {
-    // Sanity: empty string MD5 is the well-known constant.
-    expect(computeMd5(Buffer.from(''))).toBe('d41d8cd98f00b204e9800998ecf8427e');
-  });
-
-  it('returns 32 lowercase hex chars', () => {
-    const md5 = computeMd5(Buffer.from('something'));
-    expect(md5).toHaveLength(32);
-    expect(md5).toMatch(/^[0-9a-f]{32}$/);
-  });
-
-  it('hashes raw content (not base64+ext)', () => {
-    // MD5 must operate on raw bytes — independent of any extension/base64
-    // wrapping that BLAKE3 uses. Pin a known fixture.
-    expect(computeMd5(Buffer.from('hello\n'))).toBe('b1946ac92492d2347c6235b4d2611184');
-  });
-});
-
-describe('computeAssetHashes', () => {
-  it('returns both BLAKE3 and MD5 for known fixtures', () => {
-    // Fixture: file content "hello\n" with extension "js".
-    // Expected values pinned from a fresh local computation against
-    // blake3-jit and node:crypto md5.
-    const content = Buffer.from('hello\n');
-    const filePath = 'test.js';
-    const { blake3, md5 } = computeAssetHashes(content, filePath);
-    expect(blake3).toBe('dc6c72af24e164d6188743458a7da473');
-    expect(md5).toBe('b1946ac92492d2347c6235b4d2611184');
-  });
-
-  it('matches the standalone computeAssetHash + computeMd5 outputs', () => {
-    const content = Buffer.from('some asset bytes');
-    const filePath = 'foo/bar.css';
-    const both = computeAssetHashes(content, filePath);
-    expect(both.blake3).toBe(computeAssetHash(content, filePath));
-    expect(both.md5).toBe(computeMd5(content));
-  });
-});
-
-describe('BLAKE3 wire compatibility', () => {
-  it('matches Wrangler\'s hashFile output for "const x = 1;\\n" / .js', () => {
-    // Regression test for the existing CF-compatible recipe:
-    //   blake3(base64(content) + extension).hex().slice(0, 32)
-    // Bit-for-bit compatible with workers-sdk's pages/hash.ts:hashFile.
-    const content = Buffer.from('const x = 1;\n');
-    const filePath = 'foo.js';
-
-    // Direct computation (independent of computeAssetHash) to lock the
-    // algorithm in place even if the helper changes shape.
-    const base64 = content.toString('base64');
-    const ext = 'js';
-    const input = new TextEncoder().encode(base64 + ext);
-    const expected = Buffer.from(blake3hash(input)).toString('hex').slice(0, 32);
-
-    expect(expected).toBe('3725f96aa779d1959d5942b1b4e04567');
-    expect(computeAssetHash(content, filePath)).toBe(expected);
-    expect(computeAssetHashes(content, filePath).blake3).toBe(expected);
-  });
-});
-
-describe('collectAndHashAssets — v2 manifest entries', () => {
-  it('emits { blake3, md5, size, hash } per entry', async () => {
-    writeFileSync(join(TMP, 'a.js'), 'hello\n');
-
-    const { assetManifest } = await collectAndHashAssets(TMP);
-
-    const entry = assetManifest['/a.js'];
-    expect(entry).toBeDefined();
-    expect(entry.blake3).toBe('dc6c72af24e164d6188743458a7da473');
-    expect(entry.md5).toBe('b1946ac92492d2347c6235b4d2611184');
-    expect(entry.size).toBe(Buffer.from('hello\n').length);
-    // Deprecated v1 alias — must equal blake3 for one release so existing
-    // consumers reading entry.hash keep working.
-    expect(entry.hash).toBe(entry.blake3);
-  });
-
-  it('reads each file from disk exactly once', async () => {
-    writeFileSync(join(TMP, 'a.js'), 'one');
-    writeFileSync(join(TMP, 'b.css'), 'two');
-    writeFileSync(join(TMP, 'c.html'), 'three');
-
-    // Mock state was cleared in beforeEach; collectAndHashAssets is the only
-    // call into readFileSync from this point. The mocked fn delegates to the
-    // real implementation so file content still flows through correctly.
-    const { assetManifest } = await collectAndHashAssets(TMP);
-
-    // Filter mock calls to just the assets we wrote (createAssetsIgnoreFunction
-    // does NOT readFileSync .assetsignore unless it exists, but be defensive).
-    const assetReads = readFileSyncMock.mock.calls.filter(([p]: Array<unknown>) => {
-      const path = String(p);
-      return path.endsWith('a.js') || path.endsWith('b.css') || path.endsWith('c.html');
-    });
-    expect(assetReads).toHaveLength(3);
-    // No duplicate path should appear twice — proves single-pass.
-    const paths = assetReads.map(([p]: Array<unknown>) => String(p));
-    expect(new Set(paths).size).toBe(3);
-
-    // Manifest should still be populated correctly (sanity).
-    expect(Object.keys(assetManifest).sort()).toEqual(['/a.js', '/b.css', '/c.html']);
-  });
-});
-
-describe('getAssetContentType', () => {
-  it('returns text/markdown for .md files', () => {
-    expect(getAssetContentType('/guide/github-actions-cache.md')).toBe(
-      'text/markdown; charset=utf-8',
-    );
-  });
-
-  it('returns text/markdown for .markdown files', () => {
-    expect(getAssetContentType('/notes.markdown')).toBe('text/markdown; charset=utf-8');
-  });
-
-  it('returns text/yaml for .yaml and .yml files', () => {
-    expect(getAssetContentType('/config.yaml')).toBe('text/yaml; charset=utf-8');
-    expect(getAssetContentType('/config.yml')).toBe('text/yaml; charset=utf-8');
-  });
-
-  it('returns application/toml for .toml files', () => {
-    expect(getAssetContentType('/config.toml')).toBe('application/toml');
-  });
-
-  it('returns application/octet-stream for unknown extensions', () => {
-    expect(getAssetContentType('/file.xyz')).toBe('application/octet-stream');
-  });
-});
diff --git a/packages/void/test/unit/auth-callback.test.ts b/packages/void/test/unit/auth-callback.test.ts
index 23b8dd644..513d2ef2b 100644
--- a/packages/void/test/unit/auth-callback.test.ts
+++ b/packages/void/test/unit/auth-callback.test.ts
@@ -86,7 +86,7 @@ describe('awaitBrowserCallback', () => {
     await expect(resultPromise).resolves.toEqual({ linked: 'abc' });
   });
 
-  it('renders the failure page and rejects when finalize throws (F3 regression pin)', async () => {
+  it('renders the failure page and rejects when finalize throws', async () => {
     const finalizeError = new Error('exchange blew up');
     const finalize = vi.fn(async () => {
       throw finalizeError;
@@ -141,26 +141,6 @@ describe('awaitBrowserCallback', () => {
     expect(params.get('link_code')).toBe('real');
   });
 
-  it('renders 403 and rejects when describeError returns a message', async () => {
-    const { resultPromise, callbackPromise, state } = startCallback({
-      describeError: (p) => (p.get('error') ? 'GitHub authorization failed.' : null),
-    });
-    const callback = await callbackPromise;
-
-    // Attach the rejection assertion before triggering the request so the
-    // handler is in place when the promise settles (no unhandled rejection).
-    const rejection = expect(resultPromise).rejects.toThrow('GitHub authorization failed.');
-
-    const hit = new URL(callback);
-    hit.searchParams.set('state', state);
-    hit.searchParams.set('error', 'access_denied');
-
-    const res = await fetch(hit);
-    expect(res.status).toBe(403);
-
-    await rejection;
-  });
-
   it('rejects after the timeout elapses', async () => {
     const resultPromise = awaitBrowserCallback({
       state: 'timeout-state',
diff --git a/packages/void/test/unit/auth-client-frameworks.test.ts b/packages/void/test/unit/auth-client-frameworks.test.ts
index 07cb21166..389dfa47e 100644
--- a/packages/void/test/unit/auth-client-frameworks.test.ts
+++ b/packages/void/test/unit/auth-client-frameworks.test.ts
@@ -1,12 +1,17 @@
 import { describe, expect, it, vi } from 'vite-plus/test';
 
 const mocks = vi.hoisted(() => ({
+  client: vi.fn((options?: unknown) => ({ framework: 'client', options })),
   react: vi.fn((options?: unknown) => ({ framework: 'react', options })),
   solid: vi.fn((options?: unknown) => ({ framework: 'solid', options })),
   svelte: vi.fn((options?: unknown) => ({ framework: 'svelte', options })),
   vue: vi.fn((options?: unknown) => ({ framework: 'vue', options })),
 }));
 
+vi.mock('better-auth/client', () => ({
+  createAuthClient: mocks.client,
+}));
+
 vi.mock('better-auth/react', () => ({
   createAuthClient: mocks.react,
 }));
@@ -23,36 +28,17 @@ vi.mock('better-auth/solid', () => ({
   createAuthClient: mocks.solid,
 }));
 
-describe('framework-specific client runtimes', () => {
-  it('re-exports the React Better Auth client', async () => {
-    const { auth: reactAuth, createAuthClient: createReactAuthClient } =
-      await import('../../src/runtime/client-react.ts');
-    expect(createReactAuthClient).toBe(mocks.react);
-    expect(mocks.react).toHaveBeenCalledWith({ basePath: '/api/auth' });
-    expect(reactAuth).toEqual({ framework: 'react', options: { basePath: '/api/auth' } });
-  });
-
-  it('re-exports the Vue Better Auth client', async () => {
-    const { auth: vueAuth, createAuthClient: createVueAuthClient } =
-      await import('../../src/runtime/client-vue.ts');
-    expect(createVueAuthClient).toBe(mocks.vue);
-    expect(mocks.vue).toHaveBeenCalledWith({ basePath: '/api/auth' });
-    expect(vueAuth).toEqual({ framework: 'vue', options: { basePath: '/api/auth' } });
-  });
-
-  it('re-exports the Svelte Better Auth client', async () => {
-    const { auth: svelteAuth, createAuthClient: createSvelteAuthClient } =
-      await import('../../src/runtime/client-svelte.ts');
-    expect(createSvelteAuthClient).toBe(mocks.svelte);
-    expect(mocks.svelte).toHaveBeenCalledWith({ basePath: '/api/auth' });
-    expect(svelteAuth).toEqual({ framework: 'svelte', options: { basePath: '/api/auth' } });
-  });
-
-  it('re-exports the Solid Better Auth client', async () => {
-    const { auth: solidAuth, createAuthClient: createSolidAuthClient } =
-      await import('../../src/runtime/client-solid.ts');
-    expect(createSolidAuthClient).toBe(mocks.solid);
-    expect(mocks.solid).toHaveBeenCalledWith({ basePath: '/api/auth' });
-    expect(solidAuth).toEqual({ framework: 'solid', options: { basePath: '/api/auth' } });
+describe('client runtimes', () => {
+  it.each([
+    ['default', 'client', () => import('../../src/runtime/client.ts')],
+    ['React', 'react', () => import('../../src/runtime/client-react.ts')],
+    ['Vue', 'vue', () => import('../../src/runtime/client-vue.ts')],
+    ['Svelte', 'svelte', () => import('../../src/runtime/client-svelte.ts')],
+    ['Solid', 'solid', () => import('../../src/runtime/client-solid.ts')],
+  ] as const)('re-exports the %s Better Auth client', async (_name, framework, load) => {
+    const { auth, createAuthClient } = await load();
+    expect(createAuthClient).toBe(mocks[framework]);
+    expect(mocks[framework]).toHaveBeenCalledWith({ basePath: '/api/auth' });
+    expect(auth).toEqual({ framework, options: { basePath: '/api/auth' } });
   });
 });
diff --git a/packages/void/test/unit/auth-client.test.ts b/packages/void/test/unit/auth-client.test.ts
deleted file mode 100644
index 4e0a782ce..000000000
--- a/packages/void/test/unit/auth-client.test.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-
-const { createAuthClientMock } = vi.hoisted(() => ({
-  createAuthClientMock: vi.fn((options?: unknown) => ({ options })),
-}));
-
-vi.mock('better-auth/client', () => ({
-  createAuthClient: createAuthClientMock,
-}));
-
-beforeEach(() => {
-  vi.resetModules();
-});
-
-describe('auth-client runtime', () => {
-  it("re-exports Better Auth's createAuthClient", async () => {
-    const { createAuthClient } = await import('../../src/runtime/auth-client.ts');
-    expect(createAuthClient).toBe(createAuthClientMock);
-  });
-
-  it("creates the default auth client with Void's base path", async () => {
-    const { auth } = await import('../../src/runtime/auth-client.ts');
-    expect(createAuthClientMock).toHaveBeenCalledWith({ basePath: '/api/auth' });
-    expect(auth).toEqual({ options: { basePath: '/api/auth' } });
-  });
-});
diff --git a/packages/void/test/unit/auth-context.test.ts b/packages/void/test/unit/auth-context.test.ts
index 1e0b49e10..a09d6b903 100644
--- a/packages/void/test/unit/auth-context.test.ts
+++ b/packages/void/test/unit/auth-context.test.ts
@@ -1,4 +1,3 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
 import { describe, expect, it, vi } from 'vite-plus/test';
 import {
   authContext,
@@ -8,8 +7,6 @@ import {
   type AuthUser,
 } from '../../src/runtime/auth.ts';
 
-const AUTH_CONTEXT_SYMBOL = Symbol.for('void.authContext.v1');
-
 describe('authContext', () => {
   it('runs callback with provided store and exposes it via getUser/getSession', () => {
     const user = {
@@ -40,69 +37,22 @@ describe('authContext', () => {
       expect(getUser()).toBe(user);
       expect(getSession()).toBe(state);
     });
+    authContext.run({ user: null, state: null }, () => {
+      expect(getUser()).toBeNull();
+    });
 
     expect(getUser()).toBeNull();
     expect(getSession()).toBeNull();
   });
 
-  it('is registered on globalThis under Symbol.for("void.authContext.v1")', () => {
-    const stored = (globalThis as Record<symbol, unknown>)[AUTH_CONTEXT_SYMBOL];
-    expect(stored).toBe(authContext);
-    expect(stored).toBeInstanceOf(AsyncLocalStorage);
-  });
-
   it('returns the same ALS instance across module re-evaluations', async () => {
-    // Regression guard for the original bug: when auth.ts is loaded twice
-    // (e.g. once by void's bundled runtime, once by Vite's SSR module runner
-    // resolving `void/auth` for user code), both evaluations must share one
-    // AsyncLocalStorage. Otherwise middleware writes to one instance and
-    // user-land getUser() reads another, always returning null.
-    //
-    // vi.resetModules() drops the module cache so the next dynamic import
-    // re-evaluates auth.ts top-to-bottom — exactly the dual-load scenario.
+    // resetModules re-evaluates auth.ts, like a second module load.
     vi.resetModules();
     const first = await import('../../src/runtime/auth.ts');
     vi.resetModules();
     const second = await import('../../src/runtime/auth.ts');
 
     expect(first.authContext).toBe(second.authContext);
-
-    // And the statically-imported binding at the top of this file is the same
-    // instance as both re-evaluated copies — covers user-land import paths.
     expect(authContext).toBe(first.authContext);
   });
-
-  it('propagates store across a re-evaluated import boundary', async () => {
-    // Tightens the previous test: the bug only surfaces when one side writes
-    // and the other reads. Write through the statically-imported authContext,
-    // read through a re-evaluated copy of getUser.
-    vi.resetModules();
-    const fresh = await import('../../src/runtime/auth.ts');
-
-    const user = {
-      id: 'u2',
-      email: 'c@d.e',
-      emailVerified: false,
-      name: 'B',
-      image: null,
-      createdAt: new Date(0),
-      updatedAt: new Date(0),
-    } satisfies AuthUser;
-    const state = {
-      user,
-      session: {
-        id: 's2',
-        token: 't2',
-        userId: user.id,
-        expiresAt: new Date(0),
-        createdAt: new Date(0),
-        updatedAt: new Date(0),
-      },
-    } satisfies AuthState;
-
-    authContext.run({ user, state }, () => {
-      expect(fresh.getUser()).toBe(user);
-      expect(fresh.getSession()).toBe(state);
-    });
-  });
 });
diff --git a/packages/void/test/unit/auth-legacy.test.ts b/packages/void/test/unit/auth-legacy.test.ts
index 5f3806c0c..298a71efc 100644
--- a/packages/void/test/unit/auth-legacy.test.ts
+++ b/packages/void/test/unit/auth-legacy.test.ts
@@ -92,12 +92,9 @@ describe('retired unscoped credentials', () => {
     expect(getApiUrl(state.home)).toBe('https://platform.example.test');
     expect(getToken(state.home)).toBe('ci-token');
   });
-  it.each([
-    { account: 'token', apiUrl: 'https://api.void.cloud' },
-    { account: 'stagingToken', apiUrl: 'https://api.staging.void.cloud' },
-  ])(
+  it.each([{ account: 'token' }, { account: 'stagingToken' }])(
     'ignores the $account keychain destination until explicitly connected',
-    async ({ account, apiUrl }) => {
+    async ({ account }) => {
       const root = mkdtempSync(join(tmpdir(), 'void-auth-retired-project-'));
       directories.push(root);
       state.passwords.set(`dev.void.cli:${account}`, 'retired-token');
@@ -131,23 +128,6 @@ describe('retired unscoped credentials', () => {
     expect(state.passwords.size).toBe(0);
   });
 
-  it.each([
-    { account: 'token', apiUrl: 'https://api.void.cloud' },
-    { account: 'stagingToken', apiUrl: 'https://api.staging.void.cloud' },
-  ])('ignores token-only file destination $apiUrl', async ({ account, apiUrl }) => {
-    const root = mkdtempSync(join(tmpdir(), 'void-auth-retired-project-'));
-    directories.push(root);
-    mkdirSync(join(state.home, '.void'));
-    writeFileSync(
-      join(state.home, '.void', 'config.json'),
-      JSON.stringify({ [account]: 'retired-token' }),
-    );
-    const { getAccountCredential, getApiUrl, getToken } = await import('../../src/cli/auth.ts');
-    expect(() => getAccountCredential()).toThrow('void connect');
-    expect(() => getApiUrl(root)).toThrow('void connect');
-    expect(getToken(root)).toBeNull();
-  });
-
   it('uses and removes only the modern credential for the selected origin', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-auth-retired-project-'));
     directories.push(root);
@@ -253,7 +233,7 @@ describe('retired unscoped credentials', () => {
     });
     expect(state.passwords.size).toBe(0);
     expect(
-      attachSelectedPlatform(root, { projectId: 'project', slug: 'app' }, getApiUrl(root)),
+      attachSelectedPlatform({ projectId: 'project', slug: 'app' }, getApiUrl(root)),
     ).toMatchObject({
       applicationDomain: 'apps.example.test',
       platformUrl: 'https://platform.example.test',
diff --git a/packages/void/test/unit/auth-link.test.ts b/packages/void/test/unit/auth-link.test.ts
index d1b6b70bd..8cc82288c 100644
--- a/packages/void/test/unit/auth-link.test.ts
+++ b/packages/void/test/unit/auth-link.test.ts
@@ -54,10 +54,7 @@ describe('ordinary account linking CLI', () => {
       expect.any(Function),
     );
     expect(state.link).toHaveBeenCalledWith('company');
-    expect(state.open).toHaveBeenCalledWith(
-      'https://api.example.com/auth/link?id=proof',
-      expect.any(Function),
-    );
+    expect(state.open).toHaveBeenCalledWith('https://api.example.com/auth/link?id=proof');
   });
   it('refuses linking or saving a login into a different account', async () => {
     state.who
diff --git a/packages/void/test/unit/auth-login.test.ts b/packages/void/test/unit/auth-login.test.ts
index 62c81e39c..50489119c 100644
--- a/packages/void/test/unit/auth-login.test.ts
+++ b/packages/void/test/unit/auth-login.test.ts
@@ -1,20 +1,19 @@
+import { createHash } from 'node:crypto';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
+import { runPlatformLogin } from '../../src/cli/auth.ts';
+
 vi.mock('../../src/cli/keyring.ts', () => ({
   readKeyringPassword: () => null,
   writeKeyringPassword: () => true,
 }));
+vi.mock('node:child_process', () => ({
+  execFile: (...args: Array<unknown>) => mockExecFile(...args),
+}));
+
 const accessJwt =
   'header.' +
   Buffer.from(JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 3600 })).toString('base64url') +
   '.signature';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
-let registry: string;
-import { createHash } from 'node:crypto';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { runLogin, runPlatformLogin } from '../../src/cli/auth.ts';
-
 const mockExecFile = vi.fn();
 const exchangeRequests: Array<{
   url: string;
@@ -32,34 +31,9 @@ function codeChallengeFor(verifier: string): string {
     .replaceAll('=', '');
 }
 
-vi.mock('node:child_process', () => ({
-  execFile: (...args: Array<unknown>) => mockExecFile(...args),
-}));
-
 beforeEach(() => {
   mockExecFile.mockReset();
   exchangeRequests.length = 0;
-  process.env.VOID_API_URL = 'https://api.test';
-  registry = mkdtempSync(join(tmpdir(), 'void-login-connections-'));
-  process.env.VOID_PLATFORM_REGISTRY_DIR = registry;
-  savePlatformConnection({
-    accountId: null,
-    apiUrl: 'https://api.test',
-    applicationDomain: 'apps.example.test',
-    displayName: 'Test',
-    installationId: null,
-    kind: 'connected',
-    proxyUrl: 'https://proxy.example.test',
-  });
-  savePlatformConnection({
-    accountId: null,
-    apiUrl: 'https://api.staging.void.cloud',
-    applicationDomain: 'apps.example.test',
-    displayName: 'Test',
-    installationId: null,
-    kind: 'connected',
-    proxyUrl: 'https://proxy.example.test',
-  });
 
   vi.stubGlobal('fetch', async (input: RequestInfo | URL, init?: RequestInit) => {
     const url =
@@ -80,15 +54,12 @@ beforeEach(() => {
 });
 
 afterEach(() => {
-  rmSync(registry, { recursive: true, force: true });
-  delete process.env.VOID_PLATFORM_REGISTRY_DIR;
   vi.unstubAllGlobals();
-  delete process.env.VOID_API_URL;
   delete process.env.CF_ACCESS_TOKEN;
   delete process.env.VOID_ACCESS_ORIGIN;
 });
 
-describe('runLogin', () => {
+describe('runPlatformLogin', () => {
   it('keeps explicit platform login and code exchange on the selected origin', async () => {
     let ready!: (url: string) => void;
     const urlReady = new Promise<string>((resolve) => {
@@ -109,7 +80,7 @@ describe('runLogin', () => {
       resolveLoginUrl = resolve;
     });
 
-    const loginPromise = runLogin('/project', 'github', resolveLoginUrl);
+    const loginPromise = runPlatformLogin('https://api.test', 'github', resolveLoginUrl);
     const loginUrl = new URL(await loginUrlPromise);
     const redirect = loginUrl.searchParams.get('redirect');
 
@@ -123,13 +94,6 @@ describe('runLogin', () => {
     expect(state).toEqual(expect.any(String));
     expect(state).toHaveLength(64);
 
-    const attackUrl = new URL(redirectUrl);
-    attackUrl.searchParams.set('token', 'attacker-controlled-token');
-    attackUrl.searchParams.set('state', 'wrong-state');
-
-    const attackResponse = await fetch(attackUrl);
-    expect(attackResponse.status).toBe(400);
-
     const validUrl = new URL(redirectUrl);
     validUrl.searchParams.set('code', 'real-code');
 
@@ -167,7 +131,7 @@ describe('runLogin', () => {
       resolveLoginUrl = resolve;
     });
 
-    const loginPromise = runLogin('/project', 'github', resolveLoginUrl);
+    const loginPromise = runPlatformLogin('https://api.test', 'github', resolveLoginUrl);
     const loginUrl = new URL(await loginUrlPromise);
     const redirect = loginUrl.searchParams.get('redirect');
 
@@ -188,7 +152,7 @@ describe('runLogin', () => {
     await expect(loginPromise).resolves.toBe('real-token');
   });
 
-  it('shows the failure page and throws when the code exchange fails (F3 regression)', async () => {
+  it('shows the failure page and throws when the code exchange fails', async () => {
     // Override fetch so the localhost callback still hits the real server, but
     // the API token exchange returns a non-ok response (expired code, etc.).
     vi.stubGlobal('fetch', async (input: RequestInfo | URL, init?: RequestInit) => {
@@ -205,7 +169,7 @@ describe('runLogin', () => {
       resolveLoginUrl = resolve;
     });
 
-    const loginPromise = runLogin('/project', 'github', resolveLoginUrl);
+    const loginPromise = runPlatformLogin('https://api.test', 'github', resolveLoginUrl);
     // Attach the rejection assertion up front so the exchange failure doesn't
     // surface as an unhandled rejection.
     const rejection = expect(loginPromise).rejects.toThrow(/Failed to exchange login code/);
@@ -218,8 +182,6 @@ describe('runLogin', () => {
     validUrl.searchParams.set('code', 'real-code');
 
     const validResponse = await fetch(validUrl);
-    // The exchange ran INSIDE the request handler and failed → failure page,
-    // never the success page.
     expect(validResponse.status).toBe(400);
     const body = await validResponse.text();
     expect(body).not.toContain('successful');
@@ -229,16 +191,16 @@ describe('runLogin', () => {
   });
 
   it('sends Cloudflare Access headers when exchanging a staging login code', async () => {
-    process.env.VOID_API_URL = 'https://api.staging.void.cloud';
+    const apiUrl = 'https://api.staging.void.cloud';
     process.env.CF_ACCESS_TOKEN = accessJwt;
-    process.env.VOID_ACCESS_ORIGIN = process.env.VOID_API_URL;
+    process.env.VOID_ACCESS_ORIGIN = apiUrl;
 
     let resolveLoginUrl!: (url: string) => void;
     const loginUrlPromise = new Promise<string>((resolve) => {
       resolveLoginUrl = resolve;
     });
 
-    const loginPromise = runLogin('/project', 'github', resolveLoginUrl);
+    const loginPromise = runPlatformLogin(apiUrl, 'github', resolveLoginUrl);
     const loginUrl = new URL(await loginUrlPromise);
     const redirect = loginUrl.searchParams.get('redirect');
     expect(redirect).toBeTruthy();
diff --git a/packages/void/test/unit/auth-middleware.test.ts b/packages/void/test/unit/auth-middleware.test.ts
index 942cb973e..70904fc37 100644
--- a/packages/void/test/unit/auth-middleware.test.ts
+++ b/packages/void/test/unit/auth-middleware.test.ts
@@ -1,5 +1,5 @@
 import { Hono } from 'hono';
-import { beforeEach, describe, expect, it, vi } from 'vite-plus/test';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 
 const mocks = vi.hoisted(() => ({
   betterAuth: vi.fn(),
@@ -21,13 +21,7 @@ const authRuntimeOptions: VoidAuthRuntimeOptions = {
   providers: null,
 };
 
-const runtime = createVoidAuthRuntime(
-  'sqlite',
-  async () => {
-    throw new Error('Unexpected database resolution.');
-  },
-  async () => {},
-);
+const runtime = createVoidAuthRuntime('sqlite', async () => {});
 
 function createApp(sessionResult: { response: AuthState | null; headers: Headers }): Hono {
   mocks.getSession.mockResolvedValue(sessionResult);
@@ -47,6 +41,10 @@ beforeEach(() => {
   mocks.getSession.mockReset();
 });
 
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
 describe('runVoidAuthMiddleware response headers', () => {
   it('adds auth headers to an immutable response without changing its body or status', async () => {
     const authHeaders = new Headers();
@@ -101,21 +99,18 @@ describe('runVoidAuthMiddleware response headers', () => {
     await expect(response.text()).resolves.toBe('ok');
   });
 
-  it.each(['public, max-age=60', 'private', 'no-store', 'no-cache'])(
-    'preserves an anonymous application cache policy: %s',
-    async (policy) => {
-      const app = createApp({
-        response: null,
-        headers: new Headers({ 'cache-control': 'no-store', pragma: 'no-cache' }),
-      });
-      app.get('/public', (c) => c.text('content', 200, { 'cache-control': policy }));
-      const response = await app.request('http://localhost/public', undefined, {
-        BETTER_AUTH_SECRET: 'test-secret',
-      });
-      expect(response.headers.get('cache-control')).toBe(policy);
-      expect(response.headers.has('pragma')).toBe(false);
-    },
-  );
+  it('preserves an anonymous application cache policy', async () => {
+    const app = createApp({
+      response: null,
+      headers: new Headers({ 'cache-control': 'no-store', pragma: 'no-cache' }),
+    });
+    app.get('/public', (c) => c.text('content', 200, { 'cache-control': 'public, max-age=60' }));
+    const response = await app.request('http://localhost/public', undefined, {
+      BETTER_AUTH_SECRET: 'test-secret',
+    });
+    expect(response.headers.get('cache-control')).toBe('public, max-age=60');
+    expect(response.headers.has('pragma')).toBe(false);
+  });
 
   it.each(['cookie', 'authorization', 'cf-access-jwt-assertion'])(
     'keeps the session lookup private for requests with %s',
@@ -245,26 +240,18 @@ describe('cross-origin cookie sessions', () => {
 
   it('ignores the cookie on a WebSocket upgrade from another origin', async () => {
     mockAuth();
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    try {
-      await expect(
-        sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
-      ).resolves.toBeNull();
-    } finally {
-      warn.mockRestore();
-    }
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await expect(
+      sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
+    ).resolves.toBeNull();
   });
 
   it('ignores the cookie on a WebSocket upgrade from a plain http page on the same host', async () => {
     mockAuth();
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    try {
-      await expect(
-        sessionCookieFor(upgradeRequest({ origin: 'http://app.void.app' })),
-      ).resolves.toBeNull();
-    } finally {
-      warn.mockRestore();
-    }
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await expect(
+      sessionCookieFor(upgradeRequest({ origin: 'http://app.void.app' })),
+    ).resolves.toBeNull();
   });
 
   it('keeps the cookie when Vite HTTPS hands the upgrade over as http', async () => {
@@ -321,43 +308,31 @@ describe('cross-origin cookie sessions', () => {
 
     mocks.getSession.mockClear();
     mockAuth({ advanced: { disableOriginCheck: true, disableCSRFCheck: false } });
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    try {
-      await expect(
-        sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
-      ).resolves.toBeNull();
-    } finally {
-      warn.mockRestore();
-    }
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await expect(
+      sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
+    ).resolves.toBeNull();
   });
 
   it('ignores the cookie for an opaque origin that is not same-origin', async () => {
     mockAuth();
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    try {
-      await expect(
-        sessionCookieFor(upgradeRequest({ origin: 'null', 'sec-fetch-site': 'same-site' })),
-      ).resolves.toBeNull();
-    } finally {
-      warn.mockRestore();
-    }
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await expect(
+      sessionCookieFor(upgradeRequest({ origin: 'null', 'sec-fetch-site': 'same-site' })),
+    ).resolves.toBeNull();
   });
 
   it('leaves a cross-origin WebSocket upgrade without a user in the middleware', async () => {
     mockAuth();
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
     const app = routeApp();
     app.get('/chat/general', (c) => c.json({ user: c.get('user') }));
-    try {
-      const response = await app.request(
-        upgradeRequest({ origin: 'https://evil.void.app' }),
-        undefined,
-        env,
-      );
-      await expect(response.json()).resolves.toEqual({ user: null });
-    } finally {
-      warn.mockRestore();
-    }
+    const response = await app.request(
+      upgradeRequest({ origin: 'https://evil.void.app' }),
+      undefined,
+      env,
+    );
+    await expect(response.json()).resolves.toEqual({ user: null });
   });
 
   it('does not sign in a cross-origin POST but keeps its raw cookies', async () => {
@@ -369,23 +344,20 @@ describe('cross-origin cookie sessions', () => {
       return c.json({ id: requireAuth(c).id, cookie });
     });
     app.post('/api/whoami', (c) => c.json({ user: c.get('user'), cookie: c.req.header('cookie') }));
-    try {
-      const init = {
-        method: 'POST',
-        headers: { cookie: 'session=victim', origin: 'https://evil.void.app' },
-        body: '{}',
-      };
-      const denied = await app.request('https://app.void.app/api/profile', init, env);
-      expect(denied.status).toBe(401);
-
-      const whoami = await app.request('https://app.void.app/api/whoami', init, env);
-      await expect(whoami.json()).resolves.toEqual({ user: null, cookie: 'session=victim' });
-      expect(warn).toHaveBeenCalledTimes(2);
-      expect(String(warn.mock.calls[0]![0])).toContain('https://evil.void.app');
-      expect(String(warn.mock.calls[0]![0])).toContain('trustedOrigins');
-    } finally {
-      warn.mockRestore();
-    }
+    const init = {
+      method: 'POST',
+      headers: { cookie: 'session=victim', origin: 'https://evil.void.app' },
+      body: '{}',
+    };
+    const denied = await app.request('https://app.void.app/api/profile', init, env);
+    expect(denied.status).toBe(401);
+    expect(await denied.text()).toBe('Unauthorized');
+
+    const whoami = await app.request('https://app.void.app/api/whoami', init, env);
+    await expect(whoami.json()).resolves.toEqual({ user: null, cookie: 'session=victim' });
+    expect(warn).toHaveBeenCalledTimes(2);
+    expect(String(warn.mock.calls[0]![0])).toContain('https://evil.void.app');
+    expect(String(warn.mock.calls[0]![0])).toContain('trustedOrigins');
   });
 
   it.each([
@@ -397,17 +369,13 @@ describe('cross-origin cookie sessions', () => {
     const warn = vi.spyOn(console, 'warn');
     const app = routeApp();
     app.on(method, '/api/profile', (c) => c.json({ id: requireAuth(c).id }));
-    try {
-      const response = await app.request(
-        'https://app.void.app/api/profile',
-        { method, headers: { cookie: 'session=victim', ...headers } },
-        env,
-      );
-      expect(response.status).toBe(200);
-      await expect(response.json()).resolves.toEqual({ id: 'victim' });
-      expect(warn).not.toHaveBeenCalled();
-    } finally {
-      warn.mockRestore();
-    }
+    const response = await app.request(
+      'https://app.void.app/api/profile',
+      { method, headers: { cookie: 'session=victim', ...headers } },
+      env,
+    );
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ id: 'victim' });
+    expect(warn).not.toHaveBeenCalled();
   });
 });
diff --git a/packages/void/test/unit/auth-migrations.test.ts b/packages/void/test/unit/auth-migrations.test.ts
index 3ce6b7220..ee85acf59 100644
--- a/packages/void/test/unit/auth-migrations.test.ts
+++ b/packages/void/test/unit/auth-migrations.test.ts
@@ -76,15 +76,6 @@ describe('auth migration runner', () => {
           if (sql.includes('current_schema')) {
             return [{ schema: 'public' }] as unknown as Array<T>;
           }
-          if (sql.includes('information_schema.tables')) {
-            return [] as Array<T>;
-          }
-          if (sql.includes('information_schema.columns')) {
-            return [] as Array<T>;
-          }
-          if (sql.includes('pg_indexes')) {
-            return [] as Array<T>;
-          }
           return [] as Array<T>;
         },
         async run(sql: string) {
@@ -115,9 +106,6 @@ describe('auth migration runner', () => {
           if (sql === "PRAGMA table_info('user')") {
             return [{ name: 'id' }] as unknown as Array<T>;
           }
-          if (sql === "PRAGMA index_list('user')") {
-            return [] as Array<T>;
-          }
           return [] as Array<T>;
         },
         async run() {},
diff --git a/packages/void/test/unit/auth-require.test.ts b/packages/void/test/unit/auth-require.test.ts
deleted file mode 100644
index 322fbc3fd..000000000
--- a/packages/void/test/unit/auth-require.test.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { HTTPException } from 'hono/http-exception';
-import { describe, expect, it } from 'vite-plus/test';
-import { requireAuth, type AuthUser } from '../../src/runtime/auth.ts';
-
-function mockContext(user: AuthUser | null): Parameters<typeof requireAuth>[0] {
-  return {
-    get(key: string) {
-      if (key === 'user') {
-        return user;
-      }
-      return undefined;
-    },
-  } as unknown as Parameters<typeof requireAuth>[0];
-}
-
-describe('requireAuth', () => {
-  it('returns user when present', () => {
-    const user: AuthUser = {
-      id: 'u1',
-      createdAt: new Date('2026-03-09T00:00:00Z'),
-      updatedAt: new Date('2026-03-09T00:00:00Z'),
-      email: 'test@test.com',
-      emailVerified: true,
-      name: 'Test',
-      image: null,
-    };
-    expect(requireAuth(mockContext(user))).toBe(user);
-  });
-
-  it('throws HTTPException 401 when user is null', () => {
-    expect(() => requireAuth(mockContext(null))).toThrow(HTTPException);
-    expect(() => requireAuth(mockContext(null))).toThrow('Unauthorized');
-  });
-});
diff --git a/packages/void/test/unit/auth-router.test.ts b/packages/void/test/unit/auth-router.test.ts
index 5ae3cbc68..cc65f336d 100644
--- a/packages/void/test/unit/auth-router.test.ts
+++ b/packages/void/test/unit/auth-router.test.ts
@@ -94,8 +94,6 @@ describe('void auth destination routing', () => {
 
   it.each(['whoami', 'link', 'token'])('rejects the retired auth %s shortcut', (command) => {
     expect(() => parseAuthArgs([command])).toThrow('void auth <login|status|logout>');
-    expect(mocks.account).not.toHaveBeenCalled();
-    expect(mocks.cloudflare).not.toHaveBeenCalled();
   });
 
   it('validates explicit targets', () => {
diff --git a/packages/void/test/unit/auth-token-storage.test.ts b/packages/void/test/unit/auth-token-storage.test.ts
index 40e30bc02..01b7ad893 100644
--- a/packages/void/test/unit/auth-token-storage.test.ts
+++ b/packages/void/test/unit/auth-token-storage.test.ts
@@ -1,7 +1,14 @@
-import { afterEach, describe, expect, it } from 'vite-plus/test';
+import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { savePlatformToken } from '../../src/cli/auth.ts';
 import { platformCredentialAccount } from '../../src/cli/platform-registry.ts';
 
+const keyringWrite = vi.hoisted(() => vi.fn(() => true));
+vi.mock('../../src/cli/keyring.ts', () => ({
+  readKeyringPassword: () => null,
+  writeKeyringPassword: keyringWrite,
+  deleteKeyringPassword: () => false,
+}));
+
 afterEach(() => {
   delete process.env.VOID_API_URL;
 });
@@ -9,22 +16,19 @@ afterEach(() => {
 describe('auth token storage', () => {
   it('stores explicit connection credentials under that origin despite an environment override', () => {
     process.env.VOID_API_URL = 'https://other.example.com';
-    let account: string | undefined;
-    savePlatformToken('secret-token', 'https://platform.example.com', {
-      keyringSet: (value) => {
-        account = value;
-        return true;
-      },
-    });
-    expect(account).toBe(platformCredentialAccount('https://platform.example.com'));
+    savePlatformToken('secret-token', 'https://platform.example.com');
+    expect(keyringWrite).toHaveBeenCalledWith(
+      'dev.void.cli',
+      platformCredentialAccount('https://platform.example.com'),
+      'secret-token',
+    );
   });
   it('refuses to fall back to a plaintext config file when the keychain is unavailable', () => {
     process.env.VOID_API_URL = 'https://platform.example.com';
+    keyringWrite.mockReturnValueOnce(false);
 
-    expect(() =>
-      savePlatformToken('secret-token', 'https://platform.example.com', {
-        keyringSet: () => false,
-      }),
-    ).toThrow('Refusing to store your platform token in plaintext');
+    expect(() => savePlatformToken('secret-token', 'https://platform.example.com')).toThrow(
+      'Refusing to store your platform token in plaintext',
+    );
   });
 });
diff --git a/packages/void/test/unit/better-auth.test.ts b/packages/void/test/unit/better-auth.test.ts
index 3b505c8d8..5737289db 100644
--- a/packages/void/test/unit/better-auth.test.ts
+++ b/packages/void/test/unit/better-auth.test.ts
@@ -1,26 +1,10 @@
-import { describe, expect, it, vi } from 'vite-plus/test';
+import { describe, expect, it } from 'vite-plus/test';
 import { voidAuthPassword } from '../../src/runtime/better-auth-shared.ts';
 import { resolveVoidAuthOptions } from '../../src/runtime/better-auth.ts';
 
 describe('resolveVoidAuthOptions', () => {
-  it('starts authentication on the primary for current revocation state', async () => {
-    const primary = { prepare: vi.fn() };
-    const binding = {
-      withSession: vi.fn().mockReturnValue(primary),
-    };
-
-    const { options } = await resolveVoidAuthOptions(
-      new Request('https://example.com/api/auth'),
-      { DB: binding as unknown as D1Database, BETTER_AUTH_SECRET: 'secret' },
-      { dialect: 'sqlite', providers: null },
-    );
-
-    expect(binding.withSession).toHaveBeenCalledExactlyOnceWith('first-primary');
-    expect(options.database).toBe(primary);
-  });
-
   it('defaults to email auth when no providers are configured', async () => {
-    const { options } = await resolveVoidAuthOptions(
+    const options = await resolveVoidAuthOptions(
       new Request('https://example.com/api/auth'),
       {
         BETTER_AUTH_SECRET: 'secret',
@@ -40,7 +24,7 @@ describe('resolveVoidAuthOptions', () => {
   });
 
   it('resolves configured social providers from standardized env vars', async () => {
-    const { options } = await resolveVoidAuthOptions(
+    const options = await resolveVoidAuthOptions(
       new Request('https://example.com/api/auth'),
       {
         BETTER_AUTH_SECRET: 'secret',
@@ -73,7 +57,7 @@ describe('resolveVoidAuthOptions', () => {
   });
 
   it('preserves the default password handler when email auth is customized', async () => {
-    const { options } = await resolveVoidAuthOptions(
+    const options = await resolveVoidAuthOptions(
       new Request('https://example.com/api/auth'),
       {
         BETTER_AUTH_SECRET: 'secret',
@@ -98,30 +82,25 @@ describe('resolveVoidAuthOptions', () => {
     });
   });
 
-  it.each(['github', 'google'] as const)(
-    'requires both standardized credential names for %s',
-    async (provider) => {
-      const prefix = provider.toUpperCase();
-      const legacy = {
-        [`${prefix}_OAUTH_ID`]: 'old-id',
-        [`${prefix}_OAUTH_SECRET`]: 'old-secret',
-      };
-      for (const credentials of [
-        legacy,
-        { ...legacy, [`AUTH_${prefix}_CLIENT_ID`]: 'new-id' },
-        { ...legacy, [`AUTH_${prefix}_CLIENT_SECRET`]: 'new-secret' },
-      ]) {
-        await expect(
-          resolveVoidAuthOptions(
-            new Request('https://example.com/api/auth'),
-            { BETTER_AUTH_SECRET: 'secret', ...credentials },
-            { dialect: 'sqlite', providers: [provider] },
-            {} as never,
-          ),
-        ).rejects.toThrow(`Set AUTH_${prefix}_CLIENT_ID and AUTH_${prefix}_CLIENT_SECRET`);
-      }
-    },
-  );
+  it('requires both standardized credential names for a social provider', async () => {
+    const legacy = { GITHUB_OAUTH_ID: 'old-id', GITHUB_OAUTH_SECRET: 'old-secret' };
+    for (const credentials of [
+      legacy,
+      { ...legacy, AUTH_GITHUB_CLIENT_ID: 'new-id' },
+      { ...legacy, AUTH_GITHUB_CLIENT_SECRET: 'new-secret' },
+    ]) {
+      await expect(
+        resolveVoidAuthOptions(
+          new Request('https://example.com/api/auth'),
+          { BETTER_AUTH_SECRET: 'secret', ...credentials },
+          { dialect: 'sqlite', providers: ['github'] },
+          {} as never,
+        ),
+      ).rejects.toThrow(
+        "auth: Missing credentials for provider 'github'. Set AUTH_GITHUB_CLIENT_ID and AUTH_GITHUB_CLIENT_SECRET",
+      );
+    }
+  });
 
   it('preserves a custom password handler when email auth is customized', async () => {
     const password = {
@@ -133,7 +112,7 @@ describe('resolveVoidAuthOptions', () => {
       },
     };
 
-    const { options } = await resolveVoidAuthOptions(
+    const options = await resolveVoidAuthOptions(
       new Request('https://example.com/api/auth'),
       {
         BETTER_AUTH_SECRET: 'secret',
@@ -157,22 +136,6 @@ describe('resolveVoidAuthOptions', () => {
     });
   });
 
-  it('throws when a configured provider is missing env credentials', async () => {
-    await expect(
-      resolveVoidAuthOptions(
-        new Request('https://example.com/api/auth'),
-        {
-          BETTER_AUTH_SECRET: 'secret',
-        },
-        {
-          dialect: 'sqlite',
-          providers: ['google'],
-        },
-        {} as never,
-      ),
-    ).rejects.toThrow("auth: Missing credentials for provider 'google'");
-  });
-
   it('requires BETTER_AUTH_SECRET in production when none is set', async () => {
     await expect(
       resolveVoidAuthOptions(
@@ -189,19 +152,8 @@ describe('resolveVoidAuthOptions', () => {
     ).rejects.toThrow('auth: Missing Better Auth secret. Set BETTER_AUTH_SECRET.');
   });
 
-  it('rejects a localhost request without BETTER_AUTH_SECRET in production', async () => {
-    await expect(
-      resolveVoidAuthOptions(
-        new Request('http://localhost:3000/api/auth'),
-        {},
-        { dialect: 'sqlite', providers: null },
-        {} as never,
-      ),
-    ).rejects.toThrow('auth: Missing Better Auth secret. Set BETTER_AUTH_SECRET.');
-  });
-
   it('uses the fallback only in dev, regardless of the request host', async () => {
-    const { options } = await resolveVoidAuthOptions(
+    const options = await resolveVoidAuthOptions(
       new Request('https://example.com/api/auth'),
       {},
       {
@@ -216,7 +168,7 @@ describe('resolveVoidAuthOptions', () => {
   });
 
   it('prefers BETTER_AUTH_SECRET over the dev fallback', async () => {
-    const { options } = await resolveVoidAuthOptions(
+    const options = await resolveVoidAuthOptions(
       new Request('http://localhost:3000/api/auth'),
       { BETTER_AUTH_SECRET: 'configured-secret' },
       { dialect: 'sqlite', providers: null, dev: true },
@@ -296,20 +248,20 @@ describe('resolveVoidAuthOptions auth rate limits', () => {
   }
 
   it('limits auth requests per Cloudflare client IP on a deployed Worker', async () => {
-    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }));
+    const options = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }));
     expect(options.rateLimit?.enabled).toBe(true);
     expect(options.advanced?.ipAddress?.ipAddressHeaders).toEqual(['cf-connecting-ip']);
   });
 
   it('leaves the dev server unlimited', async () => {
-    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+    const options = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
       dev: true,
     });
     expect(options.rateLimit).toBeUndefined();
   });
 
   it('does not trust the Cloudflare IP header outside a Worker', async () => {
-    const { options } = await resolve(plainRequest({ 'cf-connecting-ip': '203.0.113.7' }));
+    const options = await resolve(plainRequest({ 'cf-connecting-ip': '203.0.113.7' }));
     expect(options.rateLimit).toBeUndefined();
     expect(options.advanced).toBeUndefined();
   });
@@ -317,27 +269,27 @@ describe('resolveVoidAuthOptions auth rate limits', () => {
   it.each(['127.0.0.1', '::1', '::ffff:127.0.0.1'])(
     'leaves a local preview from %s unlimited',
     async (ip) => {
-      const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': ip }));
+      const options = await resolve(edgeRequest({ 'cf-connecting-ip': ip }));
       expect(options.rateLimit).toBeUndefined();
       expect(options.advanced).toBeUndefined();
     },
   );
 
   it('does not share one bucket for requests without a client IP', async () => {
-    const { options } = await resolve(edgeRequest({}));
+    const options = await resolve(edgeRequest({}));
     expect(options.rateLimit).toBeUndefined();
     expect(options.advanced).toBeUndefined();
   });
 
   it('keeps an explicit rateLimit setting', async () => {
-    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+    const options = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
       userConfig: { rateLimit: { enabled: false, window: 60 } },
     });
     expect(options.rateLimit).toEqual({ enabled: false, window: 60 });
   });
 
   it('adds the client IP header next to other advanced settings', async () => {
-    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+    const options = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
       userConfig: { advanced: { cookiePrefix: 'x' } },
     });
     expect(options.advanced).toEqual({
@@ -348,7 +300,7 @@ describe('resolveVoidAuthOptions auth rate limits', () => {
 
   it('keeps an explicit ipAddress setting', async () => {
     const ipAddress = { ipAddressHeaders: ['x-real-ip'], ipv6Subnet: 48 };
-    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+    const options = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
       userConfig: { advanced: { ipAddress } },
     });
     expect(options.advanced?.ipAddress).toBe(ipAddress);
diff --git a/packages/void/test/unit/build-client.test.ts b/packages/void/test/unit/build-client.test.ts
index 88cb0e8c1..171c81c2b 100644
--- a/packages/void/test/unit/build-client.test.ts
+++ b/packages/void/test/unit/build-client.test.ts
@@ -23,9 +23,8 @@ const projectId = 'proj_test';
 function makeClient(): PlatformClient {
   return new PlatformClient(token, { apiUrl });
 }
-function jsonResponse(body: unknown, status = 200): Response {
+function jsonResponse(body: unknown): Response {
   return new Response(JSON.stringify(body), {
-    status,
     headers: { 'content-type': 'application/json' },
   });
 }
@@ -41,14 +40,6 @@ describe('PlatformClient.listBuilds', () => {
     expect((init as RequestInit).headers).toMatchObject({ Authorization: 'Bearer auth-token-x' });
     expect(result.map((b) => b.id)).toEqual(['b1', 'b2']);
   });
-
-  it('maps a non-ok response to PlatformApiError', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ error: 'forbidden' }, 403));
-    await expect(makeClient().listBuilds(projectId)).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 403,
-    });
-  });
 });
 
 describe('PlatformClient.getBuildLogs', () => {
@@ -71,12 +62,4 @@ describe('PlatformClient.getBuildLogs', () => {
     expect(result.terminal).toBe(false);
     expect(result.lines[0]!.line).toBe('a');
   });
-
-  it('maps a non-ok response to PlatformApiError', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ error: 'build not found' }, 404));
-    await expect(makeClient().getBuildLogs(projectId, 'nope', 0)).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 404,
-    });
-  });
 });
diff --git a/packages/void/test/unit/build-logs-follow.test.ts b/packages/void/test/unit/build-logs-follow.test.ts
index a88226eb7..fa5f7ecd5 100644
--- a/packages/void/test/unit/build-logs-follow.test.ts
+++ b/packages/void/test/unit/build-logs-follow.test.ts
@@ -2,11 +2,12 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { stripVTControlCharacters } from 'node:util';
-import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
-const registries: Array<string> = [];
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { followBuildLogs, isFatalFollowError, runBuildCommand } from '../../src/cli/build-cmd.ts';
 import { PlatformApiError, PlatformClient, type BuildLogsResponse } from '../../src/cli/client.ts';
+import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
+
+const registries: Array<string> = [];
 
 afterEach(() => {
   for (const registry of registries.splice(0)) {
@@ -195,49 +196,6 @@ describe('followBuildLogs', () => {
     ).rejects.toThrow('unauthorized');
   });
 
-  it('under the real predicate, a 426 cli_outdated rethrows (surfacing the upgrade message)', async () => {
-    await expect(
-      followBuildLogs({
-        fetchPage: () =>
-          Promise.reject(
-            apiError(426, '{"error":"cli_outdated","message":"Upgrade: npm i -g void@latest"}'),
-          ),
-        write: () => {},
-        sleep: () => Promise.resolve(),
-        since: 1,
-        status: 'building',
-        pollMs: 0,
-        isFatal: isFatalFollowError,
-      }),
-    ).rejects.toThrow('Upgrade: npm i -g void@latest');
-  });
-
-  it('under the real predicate, a 429 is retried (not fatal)', async () => {
-    let call = 0;
-    const retries: Array<unknown> = [];
-    const result = await followBuildLogs({
-      fetchPage: () => {
-        call += 1;
-        if (call === 1) {
-          return Promise.reject(apiError(429, '{"error":"rate_limited"}'));
-        }
-        return Promise.resolve(
-          page({ lastSeq: 5, status: 'complete', terminal: true, logsComplete: true }),
-        );
-      },
-      write: () => {},
-      sleep: () => Promise.resolve(),
-      since: 4,
-      status: 'building',
-      pollMs: 0,
-      isFatal: isFatalFollowError,
-      onRetry: (err) => retries.push(err),
-    });
-
-    expect(retries).toHaveLength(1); // the 429 was retried, not thrown
-    expect(result).toEqual({ status: 'complete', terminal: true });
-  });
-
   it('keeps reading terminal pages until delayed final logs are captured', async () => {
     const pages = [
       page({ status: 'complete', terminal: true, logsComplete: false, lastSeq: 2 }),
diff --git a/packages/void/test/unit/cf-access.test.ts b/packages/void/test/unit/cf-access.test.ts
index 39997f5d1..4360f57c1 100644
--- a/packages/void/test/unit/cf-access.test.ts
+++ b/packages/void/test/unit/cf-access.test.ts
@@ -345,7 +345,7 @@ describe('origin-scoped self-hosted Access login', () => {
   });
 });
 
-describe('ensureCloudflaredToken', () => {
+describe('ensurePlatformAccessToken defaults', () => {
   it.each([
     'https://api.void.cloud',
     'https://api.staging.void.cloud',
@@ -357,8 +357,8 @@ describe('ensureCloudflaredToken', () => {
     vi.stubEnv('CF_ACCESS_TOKEN', 'unscoped-token');
     vi.stubEnv('VOID_ACCESS_ORIGIN', '');
     vi.stubEnv('VOID_ACCESS_CREDENTIALS', '');
-    const { ensureCloudflaredToken } = await import('../../src/cli/cf-access.ts');
-    ensureCloudflaredToken(origin);
+    const { ensurePlatformAccessToken } = await import('../../src/cli/cf-access.ts');
+    ensurePlatformAccessToken(origin);
     expect(spawnSyncMock).not.toHaveBeenCalled();
     expect(cfAccessHeaders(process.env, origin)).toEqual({});
     vi.unstubAllEnvs();
diff --git a/packages/void/test/unit/cf-build-output.test.ts b/packages/void/test/unit/cf-build-output.test.ts
index 4f47395fc..59a1e118a 100644
--- a/packages/void/test/unit/cf-build-output.test.ts
+++ b/packages/void/test/unit/cf-build-output.test.ts
@@ -20,6 +20,7 @@ import { toSlash } from 'pathslash';
 import { createBuilder } from 'vite';
 import { afterEach, expect, it, vi } from 'vite-plus/test';
 import {
+  type CfBuildOutput,
   prepareCfBuildOutput,
   prepareCfFrameworkBuildOutput,
   prepareCfStaticBuildOutput,
@@ -49,6 +50,33 @@ function worker(config: Record<string, unknown>): string {
   return output;
 }
 
+/** Run `check` against the prepared output, then dispose it. */
+async function withPrepared(
+  pending: Promise<CfBuildOutput | null>,
+  check: (prepared: CfBuildOutput) => unknown,
+): Promise<CfBuildOutput> {
+  const prepared = await pending;
+  if (!prepared) {
+    throw new Error('Expected cf build output.');
+  }
+  try {
+    await check(prepared);
+  } finally {
+    await prepared.dispose();
+  }
+  return prepared;
+}
+
+function expectCfDryRun(directory: string, command = ['workers', 'versions', 'create']) {
+  const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
+  const dryRun = spawnSync(process.execPath, [cf, ...command, '--prebuilt', '--dry-run'], {
+    cwd: directory,
+    encoding: 'utf8',
+  });
+  expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
+  return dryRun;
+}
+
 it(
   'preserves additional module types from a real Cloudflare Vite build',
   async () => {
@@ -99,12 +127,7 @@ export default { fetch() {
     expect(
       readdirSync(output, { recursive: true }).some((name) => String(name).endsWith('.css')),
     ).toBe(true);
-    const prepared = await prepareCfBuildOutput(output, 'account-id');
-    expect(prepared).not.toBeNull();
-    if (!prepared) {
-      return;
-    }
-    try {
+    await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
       const built = await readBuildOutput(prepared.directory);
       const manifest = built.workers.default.config.manifest!;
       expect(manifest.type).toBe('complete');
@@ -130,16 +153,8 @@ export default { fetch() {
       }
       expect(manifest.modules['.vite/manifest.json']).toBeUndefined();
       expect(Object.keys(manifest.modules).some((name) => name.endsWith('.css'))).toBe(false);
-      const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-      const dryRun = spawnSync(
-        process.execPath,
-        [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-        { cwd: prepared.directory, encoding: 'utf8' },
-      );
-      expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-    } finally {
-      prepared.dispose();
-    }
+      expectCfDryRun(prepared.directory);
+    });
   },
   CF_BUILD_TIMEOUT_MS,
 );
@@ -162,32 +177,21 @@ it(
     const client = join(dirname(output), 'client');
     mkdirSync(client);
     writeFileSync(join(client, 'index.html'), '<h1>hello</h1>');
-    const prepared = await prepareCfBuildOutput(output, 'account-id');
-    expect(prepared).not.toBeNull();
-    if (!prepared) {
-      return;
-    }
-    try {
-      const built = await readBuildOutput(prepared.directory);
-      expect(built.rootConfig.accountId).toBe('account-id');
-      expect(built.workers.default.config.env?.CACHE).toEqual({ type: 'kv', id: 'namespace-id' });
-      expect(built.workers.default.config.manifest?.mainModule).toBe('index.js');
-      expect(built.workers.default.assetsDir).toBeDefined();
-      const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-      const dryRun = spawnSync(
-        process.execPath,
-        [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-        {
-          cwd: prepared.directory,
-          encoding: 'utf8',
-        },
-      );
-      expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-      expect(dryRun.stdout).toContain('--dry-run: exiting now.');
-    } finally {
-      prepared.dispose();
-    }
-    expect(existsSync(prepared.directory)).toBe(false);
+    const disposed = await withPrepared(
+      prepareCfBuildOutput(output, 'account-id'),
+      async (prepared) => {
+        const built = await readBuildOutput(prepared.directory);
+        expect(built.rootConfig.accountId).toBe('account-id');
+        expect(built.workers.default.config.env?.CACHE).toEqual({
+          type: 'kv',
+          id: 'namespace-id',
+        });
+        expect(built.workers.default.config.manifest?.mainModule).toBe('index.js');
+        expect(built.workers.default.assetsDir).toBeDefined();
+        expect(expectCfDryRun(prepared.directory).stdout).toContain('--dry-run: exiting now.');
+      },
+    );
+    expect(existsSync(disposed.directory)).toBe(false);
     expect(existsSync(join(output, 'wrangler.json'))).toBe(true);
   },
   CF_BUILD_TIMEOUT_MS,
@@ -222,36 +226,23 @@ it(
     writeFileSync(join(output, 'index.html'), '<h1>public</h1>');
     writeFileSync(join(output, '.assetsignore'), '_worker.js\n__original.js\n');
 
-    const prepared = await prepareCfFrameworkBuildOutput({
-      projectRoot: root,
-      configPath: join(root, 'wrangler.json'),
-      accountId: 'account-id',
-    });
-    expect(prepared).not.toBeNull();
-    if (!prepared) {
-      return;
-    }
-    try {
-      const built = await readBuildOutput(prepared.directory);
-      expect(built.workers.default.config.manifest?.mainModule).toBe('index.js');
-      const assets = getWorkerAssetsDir(prepared.directory);
-      expect(readFileSync(join(assets, 'index.html'), 'utf8')).toContain('public');
-      expect(existsSync(join(assets, '_worker.js'))).toBe(false);
-      expect(existsSync(join(assets, '__original.js'))).toBe(false);
-      expect(existsSync(join(assets, '.assetsignore'))).toBe(false);
-      const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-      const dryRun = spawnSync(
-        process.execPath,
-        [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-        {
-          cwd: prepared.directory,
-          encoding: 'utf8',
-        },
-      );
-      expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-    } finally {
-      prepared.dispose();
-    }
+    await withPrepared(
+      prepareCfFrameworkBuildOutput({
+        projectRoot: root,
+        configPath: join(root, 'wrangler.json'),
+        accountId: 'account-id',
+      }),
+      async (prepared) => {
+        const built = await readBuildOutput(prepared.directory);
+        expect(built.workers.default.config.manifest?.mainModule).toBe('index.js');
+        const assets = getWorkerAssetsDir(prepared.directory);
+        expect(readFileSync(join(assets, 'index.html'), 'utf8')).toContain('public');
+        expect(existsSync(join(assets, '_worker.js'))).toBe(false);
+        expect(existsSync(join(assets, '__original.js'))).toBe(false);
+        expect(existsSync(join(assets, '.assetsignore'))).toBe(false);
+        expectCfDryRun(prepared.directory);
+      },
+    );
   },
   CF_BUILD_TIMEOUT_MS,
 );
@@ -271,27 +262,14 @@ it(
     );
     writeFileSync(join(output, 'assets/message.js'), 'export const message = "nested entry";\n');
     rmSync(join(output, 'index.js'));
-    const prepared = await prepareCfBuildOutput(output, 'account-id');
-    expect(prepared).not.toBeNull();
-    if (!prepared) {
-      return;
-    }
-    try {
+    await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
       const built = await readBuildOutput(prepared.directory);
       expect(built.workers.default.config.manifest).toMatchObject({
         mainModule: 'assets/index-hash.js',
         modules: { 'assets/message.js': { type: 'esm' } },
       });
-      const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-      const dryRun = spawnSync(
-        process.execPath,
-        [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-        { cwd: prepared.directory, encoding: 'utf8' },
-      );
-      expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-    } finally {
-      prepared.dispose();
-    }
+      expectCfDryRun(prepared.directory);
+    });
   },
   CF_BUILD_TIMEOUT_MS,
 );
@@ -317,44 +295,22 @@ it('reports a missing built entry', async () => {
   );
 });
 
-it(
-  'preserves binary font modules in a deployable Worker bundle',
-  async () => {
-    const output = worker({
-      name: 'void-test',
-      compatibility_date: '2026-09-29',
-      main: 'index.js',
+it('preserves binary font modules in a deployable Worker bundle', async () => {
+  const output = worker({ name: 'void-test', compatibility_date: '2026-09-29', main: 'index.js' });
+  mkdirSync(join(output, 'assets'));
+  writeFileSync(
+    join(output, 'index.js'),
+    "import font from './assets/font.woff2'; export default { fetch() { return new Response(String(font.byteLength)) } };\n",
+  );
+  writeFileSync(join(output, 'assets/font.woff2'), Buffer.from([1, 2, 3]));
+  await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
+    const built = await readBuildOutput(prepared.directory);
+    expect(built.workers.default.config.manifest).toMatchObject({
+      mainModule: 'index.js',
+      modules: { 'assets/font.woff2': { type: 'data' } },
     });
-    mkdirSync(join(output, 'assets'));
-    writeFileSync(
-      join(output, 'index.js'),
-      "import font from './assets/font.woff2'; export default { fetch() { return new Response(String(font.byteLength)) } };\n",
-    );
-    writeFileSync(join(output, 'assets/font.woff2'), Buffer.from([1, 2, 3]));
-    const prepared = await prepareCfBuildOutput(output, 'account-id');
-    expect(prepared).not.toBeNull();
-    if (!prepared) {
-      return;
-    }
-    try {
-      const built = await readBuildOutput(prepared.directory);
-      expect(built.workers.default.config.manifest).toMatchObject({
-        mainModule: 'index.js',
-        modules: { 'assets/font.woff2': { type: 'data' } },
-      });
-      const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-      const dryRun = spawnSync(
-        process.execPath,
-        [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-        { cwd: prepared.directory, encoding: 'utf8' },
-      );
-      expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-    } finally {
-      prepared.dispose();
-    }
-  },
-  CF_BUILD_TIMEOUT_MS,
-);
+  });
+});
 
 it('names the file when a plugin emits an unsupported module', async () => {
   const output = worker({ name: 'void-test', compatibility_date: '2026-09-29', main: 'index.js' });
@@ -364,7 +320,7 @@ it('names the file when a plugin emits an unsupported module', async () => {
   );
 });
 
-it('preserves worker settings that the previous bridge dropped', async () => {
+it('preserves limits and placement', async () => {
   const output = worker({
     name: 'void-test',
     compatibility_date: '2026-09-29',
@@ -372,18 +328,11 @@ it('preserves worker settings that the previous bridge dropped', async () => {
     limits: { cpu_ms: 100 },
     placement: { mode: 'smart' },
   });
-  const prepared = await prepareCfBuildOutput(output, 'account-id');
-  expect(prepared).not.toBeNull();
-  if (!prepared) {
-    return;
-  }
-  try {
+  await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
     const built = await readBuildOutput(prepared.directory);
     expect(built.workers.default.config.limits).toEqual({ cpuMs: 100 });
     expect(built.workers.default.config.placement).toEqual({ mode: 'smart' });
-  } finally {
-    prepared.dispose();
-  }
+  });
 });
 
 it(
@@ -398,12 +347,7 @@ it(
       keep_assets: true,
       vars: { EDITED: 'current' },
     });
-    const prepared = await prepareCfBuildOutput(output, 'account-id');
-    expect(prepared).not.toBeNull();
-    if (!prepared) {
-      return;
-    }
-    try {
+    await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
       const built = await readBuildOutput(prepared.directory);
       expect(built.workers.default.config.env).toMatchObject({
         EDITED: { type: 'text', value: 'current' },
@@ -412,19 +356,8 @@ it(
         keep_bindings: ['plain_text', 'json', 'secret_text', 'secret_key'],
         keep_assets: true,
       });
-      const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-      const dryRun = spawnSync(
-        process.execPath,
-        [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-        {
-          cwd: prepared.directory,
-          encoding: 'utf8',
-        },
-      );
-      expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-    } finally {
-      prepared.dispose();
-    }
+      expectCfDryRun(prepared.directory);
+    });
   },
   CF_BUILD_TIMEOUT_MS,
 );
@@ -448,12 +381,7 @@ it('deploys Worker Workflow declarations through cf build output', async () => {
     join(output, 'index.js'),
     'export class Flow { async run() {} }\nexport default { fetch() { return new Response("ok") } };\n',
   );
-  const prepared = await prepareCfBuildOutput(output, 'account-id');
-  expect(prepared).not.toBeNull();
-  if (!prepared) {
-    return;
-  }
-  try {
+  await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
     const built = await readBuildOutput(prepared.directory);
     expect(built.workers.default.config.env?.FLOW).toEqual({
       type: 'workflow',
@@ -467,19 +395,8 @@ it('deploys Worker Workflow declarations through cf build output', async () => {
       schedules: '0 * * * *',
       limits: { steps: 100 },
     });
-    const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-    const dryRun = spawnSync(
-      process.execPath,
-      [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-      {
-        cwd: prepared.directory,
-        encoding: 'utf8',
-      },
-    );
-    expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-  } finally {
-    prepared.dispose();
-  }
+    expectCfDryRun(prepared.directory);
+  });
 }, 15_000);
 
 it('copies an internal symlinked Worker module into the prebuilt artifact', async () => {
@@ -489,20 +406,13 @@ it('copies an internal symlinked Worker module into the prebuilt artifact', asyn
     main: 'index.js',
   });
   symlinkSync('index.js', join(output, 'chunk.js'));
-  const prepared = await prepareCfBuildOutput(output, 'account-id');
-  expect(prepared).not.toBeNull();
-  if (!prepared) {
-    return;
-  }
-  try {
+  await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
     const built = await readBuildOutput(prepared.directory);
     expect(built.workers.default.config.manifest?.modules['chunk.js']).toEqual({ type: 'esm' });
     expect(
       existsSync(join(prepared.directory, '.cloudflare/output/v0/workers/default/bundle/chunk.js')),
     ).toBe(true);
-  } finally {
-    prepared.dispose();
-  }
+  });
 });
 
 it('keeps Durable Objects, Queue triggers, and Containers in cf prebuilt output', async () => {
@@ -520,12 +430,7 @@ it('keeps Durable Objects, Queue triggers, and Containers in cf prebuilt output'
       consumers: [{ queue: 'jobs', max_batch_size: 10 }],
     },
   });
-  const prepared = await prepareCfBuildOutput(output, 'account-id');
-  expect(prepared).not.toBeNull();
-  if (!prepared) {
-    return;
-  }
-  try {
+  await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
     const built = await readBuildOutput(prepared.directory);
     expect(built.workers.default.config.exports?.Counter).toEqual(
       expect.objectContaining({ type: 'durable-object', storage: 'sqlite' }),
@@ -538,16 +443,8 @@ it('keeps Durable Objects, Queue triggers, and Containers in cf prebuilt output'
       expect.objectContaining({ type: 'queue', name: 'jobs' }),
     );
     expect(built.containers).toHaveLength(1);
-    const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-    const dryRun = spawnSync(
-      process.execPath,
-      [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-      { cwd: prepared.directory, encoding: 'utf8' },
-    );
-    expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-  } finally {
-    prepared.dispose();
-  }
+    expectCfDryRun(prepared.directory);
+  });
 }, 15_000);
 
 it('bundles a generated static Worker and staged assets into prebuilt cf output', async () => {
@@ -583,30 +480,21 @@ it('bundles a generated static Worker and staged assets into prebuilt cf output'
       },
     }),
   );
-  const prepared = await prepareCfStaticBuildOutput({
-    projectRoot: root,
-    configPath,
-    assetsDirectory: assets,
-    accountId: 'account-id',
-  });
-  expect(prepared).not.toBeNull();
-  if (!prepared) {
-    return;
-  }
-  try {
-    const built = await readBuildOutput(prepared.directory);
-    expect(built.workers.default.config.manifest?.mainModule).toBe('index.js');
-    expect(built.workers.default.assetsDir).toBeDefined();
-    expect(prepared.assetsDirectory).toBe(toSlash(assets));
-    const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-    const dryRun = spawnSync(process.execPath, [cf, 'deploy', '--prebuilt', '--dry-run'], {
-      cwd: prepared.directory,
-      encoding: 'utf8',
-    });
-    expect(dryRun.status, `${dryRun.stdout}\n${dryRun.stderr}`).toBe(0);
-  } finally {
-    prepared.dispose();
-  }
+  await withPrepared(
+    prepareCfStaticBuildOutput({
+      projectRoot: root,
+      configPath,
+      assetsDirectory: assets,
+      accountId: 'account-id',
+    }),
+    async (prepared) => {
+      const built = await readBuildOutput(prepared.directory);
+      expect(built.workers.default.config.manifest?.mainModule).toBe('index.js');
+      expect(built.workers.default.assetsDir).toBeDefined();
+      expect(prepared.assetsDirectory).toBe(toSlash(assets));
+      expectCfDryRun(prepared.directory, ['deploy']);
+    },
+  );
 });
 
 it.skipIf(process.platform === 'win32')(
@@ -625,16 +513,13 @@ it.skipIf(process.platform === 'win32')(
           scheduling_policy: 'durable_object',
           images: {
             default: {
-              dockerfile: join(outputDirectory(), 'Dockerfile'),
-              build_context: outputDirectory(),
+              dockerfile: join(tmpdir(), 'Dockerfile'),
+              build_context: tmpdir(),
             },
           },
         },
       ],
     });
-    function outputDirectory() {
-      return tmpdir();
-    }
     const log = join(dirname(output), 'docker.log');
     const binary = join(dirname(output), 'docker-stub');
     writeFileSync(
@@ -646,13 +531,8 @@ it.skipIf(process.platform === 'win32')(
     );
     chmodSync(binary, 0o755);
     vi.stubEnv('WRANGLER_DOCKER_BIN', binary);
-    const prepared = await prepareCfBuildOutput(output, 'account-id');
-    expect(prepared).not.toBeNull();
-    if (!prepared) {
-      return;
-    }
     let tag: string;
-    try {
+    await withPrepared(prepareCfBuildOutput(output, 'account-id'), async (prepared) => {
       const built = await readBuildOutput(prepared.directory);
       const container = built.containers[0]!.config;
       expect(container.schedulingPolicy).toBe('durable-object');
@@ -665,19 +545,8 @@ it.skipIf(process.platform === 'win32')(
         throw new Error('Expected a prepared local image');
       }
       tag = image.localReference;
-      const cf = join(dirname(fileURLToPath(import.meta.resolve('cf/package.json'))), 'bin', 'cf');
-      const dryRun = spawnSync(
-        process.execPath,
-        [cf, 'workers', 'versions', 'create', '--prebuilt', '--dry-run'],
-        {
-          cwd: prepared.directory,
-          encoding: 'utf8',
-        },
-      );
-      expect(dryRun.status, dryRun.stdout + dryRun.stderr).toBe(0);
-    } finally {
-      await prepared.dispose();
-    }
+      expectCfDryRun(prepared.directory);
+    });
     const calls = readFileSync(log, 'utf8')
       .trim()
       .split('\n')
diff --git a/packages/void/test/unit/cf-version-runner.test.ts b/packages/void/test/unit/cf-version-runner.test.ts
index a2b277b01..6b6446ae7 100644
--- a/packages/void/test/unit/cf-version-runner.test.ts
+++ b/packages/void/test/unit/cf-version-runner.test.ts
@@ -1,6 +1,6 @@
 import childProcess, { execFile } from 'node:child_process';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { createServer } from 'node:http';
+import { createServer, type Server } from 'node:http';
 import { syncBuiltinESMExports } from 'node:module';
 import { connect, type AddressInfo } from 'node:net';
 import { tmpdir } from 'node:os';
@@ -20,10 +20,7 @@ import {
   deployCloudflareVersionTriggers,
   encodeCloudflareVersionMessage,
 } from '../../../deploy-cloudflare/src/version.ts';
-import {
-  operationFixture,
-  operationFixtureRequest,
-} from '../../../deploy-cloudflare/test/operation-fixture.ts';
+import { operationFixture } from '../../../deploy-cloudflare/test/operation-fixture.ts';
 import { voidSecretDraftVersion } from '../../../deploy-cloudflare/test/secret-draft-fixture.ts';
 import { prepareCfBuildOutput } from '../../src/cli/cf-build-output.ts';
 import { uploadPinnedCloudflareVersion } from '../../src/cli/cf-version-api.ts';
@@ -36,6 +33,7 @@ import {
 } from '../../src/cli/cf-version-runner.ts';
 
 const roots: Array<string> = [];
+const cleanups: Array<() => unknown> = [];
 const pinnedCfVersion = JSON.parse(
   readFileSync(fileURLToPath(import.meta.resolve('cf/package.json')), 'utf8'),
 ).version as string;
@@ -46,6 +44,51 @@ const cfUserAgent = `cf-cli/${pinnedCfVersion} void/${voidVersion}`;
 // second when idle and several seconds on a busy machine, which can pass Vitest's 5s default.
 const REAL_CF_TIMEOUT_MS = process.platform === 'win32' ? 20_000 : 15_000;
 
+afterEach(async () => {
+  vi.restoreAllMocks();
+  syncBuiltinESMExports();
+  for (const cleanup of cleanups.splice(0).reverse()) {
+    await cleanup();
+  }
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+/** Serve a fake Cloudflare API until the test ends and return its base URL. */
+async function listen(server: Server): Promise<string> {
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  cleanups.push(
+    () =>
+      new Promise<void>((resolve) => {
+        server.close(() => resolve());
+        server.closeAllConnections();
+      }),
+  );
+  return `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
+}
+
+/** The real pinned cf, whose child sees only a synthetic token and the fake API. */
+function pinnedCf(apiBaseUrl: string, accountId = 'account-id', env: NodeJS.ProcessEnv = {}) {
+  return createCfCommand({
+    accountId,
+    apiBaseUrl,
+    verifyUploader: () => true,
+    env: () => ({
+      PATH: process.env.PATH,
+      SYSTEMROOT: process.env.SYSTEMROOT,
+      WINDIR: process.env.WINDIR,
+      TMP: process.env.TMP,
+      TEMP: process.env.TEMP,
+      CI: 'true',
+      CLOUDFLARE_API_TOKEN: 'synthetic-token',
+      CLOUDFLARE_ACCOUNT_ID: accountId,
+      CLOUDFLARE_API_BASE_URL: apiBaseUrl,
+      ...env,
+    }),
+  });
+}
+
 it(
   'reads the exact immutable SDK draft source through the real pinned cf HTTP transport',
   async () => {
@@ -53,30 +96,18 @@ it(
     const draft = voidSecretDraftVersion();
     const requests: Array<string> = [];
     const userAgents: Array<string | undefined> = [];
-    const server = createServer((request, response) => {
-      requests.push(request.url ?? '');
-      userAgents.push(request.headers['user-agent']);
-      request.resume();
-      response.writeHead(200, { 'Content-Type': 'application/json' });
-      response.end(JSON.stringify({ success: true, errors: [], messages: [], result: draft }));
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const apiBaseUrl = await listen(
+      createServer((request, response) => {
+        requests.push(request.url ?? '');
+        userAgents.push(request.headers['user-agent']);
+        request.resume();
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({ success: true, errors: [], messages: [], result: draft }));
+      }),
+    );
     try {
-      const apiBaseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-      const command = createCfCommand({
-        accountId: 'test-account',
-        apiBaseUrl,
-        verifyUploader: () => true,
-        env: () => ({
-          PATH: process.env.PATH,
-          SYSTEMROOT: process.env.SYSTEMROOT,
-          WINDIR: process.env.WINDIR,
-          CI: 'true',
-          CLI_VERSION: 'inherited-version void/stale',
-          CLOUDFLARE_API_TOKEN: 'synthetic-token',
-          CLOUDFLARE_ACCOUNT_ID: 'test-account',
-          CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-        }),
+      const command = pinnedCf(apiBaseUrl, 'test-account', {
+        CLI_VERSION: 'inherited-version void/stale',
       });
       const commands: Array<{ args: Array<string>; bounds: unknown }> = [];
       const runner = createCfVersionRunner({
@@ -109,22 +140,11 @@ it(
       expect(commands[0]!.bounds).toMatchObject({ timeoutMs: 30_000, maxOutputBytes: 1024 * 1024 });
       expect(JSON.stringify(result)).not.toContain('synthetic-token');
     } finally {
-      await new Promise<void>((resolve) => {
-        server.close(() => resolve());
-        server.closeAllConnections();
-      });
       await prepared.dispose();
     }
   },
   REAL_CF_TIMEOUT_MS,
 );
-afterEach(() => {
-  vi.restoreAllMocks();
-  syncBuiltinESMExports();
-  for (const root of roots.splice(0)) {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
 
 it(
   'preserves real cf provider codes so a missing Worker can reach its first upload',
@@ -132,80 +152,44 @@ it(
     const root = mkdtempSync(join(tmpdir(), 'void-cf-missing-worker-'));
     roots.push(root);
     const requests: Array<string> = [];
-    const server = createServer((request, response) => {
-      requests.push(request.url ?? '');
-      request.resume();
-      response.writeHead(404, { 'Content-Type': 'application/json' });
-      response.end(
-        JSON.stringify({
-          success: false,
-          errors: [{ code: 10007, message: 'The given script does not exist.' }],
-          result: null,
-        }),
-      );
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const apiBaseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-      const script = `
-      import { createCfCommand } from ${JSON.stringify(new URL('../../src/cli/cf-version-runner.ts', import.meta.url).href)};
-      const command = createCfCommand({
-        accountId: 'test-account', apiBaseUrl: ${JSON.stringify(apiBaseUrl)},
-        env: () => process.env, verifyUploader: () => true,
-      });
-      console.log(JSON.stringify(await command(
-        ['workers', 'deployments', 'list', '--worker', 'missing-worker'],
-        { cwd: ${JSON.stringify(root)}, capture: true },
-      )));
-    `;
-      const stdout = await new Promise<string>((resolve, reject) => {
-        execFile(
-          process.execPath,
-          ['--input-type=module', '-e', script],
-          {
-            cwd: root,
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              TMP: process.env.TMP,
-              TEMP: process.env.TEMP,
-              CI: 'true',
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-            },
-          },
-          (error, stdout, stderr) => (error ? reject(new Error(stderr)) : resolve(stdout)),
+    const apiBaseUrl = await listen(
+      createServer((request, response) => {
+        requests.push(request.url ?? '');
+        request.resume();
+        response.writeHead(404, { 'Content-Type': 'application/json' });
+        response.end(
+          JSON.stringify({
+            success: false,
+            errors: [{ code: 10007, message: 'The given script does not exist.' }],
+            result: null,
+          }),
         );
-      });
-      const missing = JSON.parse(stdout);
-      expect(missing.status).toBe(1);
-      expect(missing.errorCode).toBe(10007);
-      expect(requests).toEqual([
-        '/client/v4/accounts/test-account/workers/scripts/missing-worker/deployments',
-      ]);
-      const operations: Array<string> = [];
-      const result = await activateCloudflareVersion({
-        workerName: 'missing-worker',
-        message: 'review',
-        verifyUploader: () => true,
-        verifyInheritedSecrets: true,
-        runWrangler: operationFixture((args) => {
-          operations.push(args.slice(0, 2).join(' '));
-          return args[1] === 'upload'
-            ? { status: 1, stdout: '', stderr: 'Test stopped before uploading.' }
-            : missing;
-        }),
-      });
-      expect(result).toMatchObject({ ok: false, reason: 'upload-failed' });
-      expect(operations).toEqual(['deployments status', 'versions list', 'versions upload']);
-    } finally {
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
-    }
+      }),
+    );
+    const missing = await pinnedCf(apiBaseUrl, 'test-account')(
+      ['workers', 'deployments', 'list', '--worker', 'missing-worker'],
+      { cwd: root, capture: true },
+    );
+    expect(missing.status).toBe(1);
+    expect(missing.errorCode).toBe(10007);
+    expect(requests).toEqual([
+      '/client/v4/accounts/test-account/workers/scripts/missing-worker/deployments',
+    ]);
+    const operations: Array<string> = [];
+    const result = await activateCloudflareVersion({
+      workerName: 'missing-worker',
+      message: 'review',
+      verifyUploader: () => true,
+      verifyInheritedSecrets: true,
+      runWrangler: operationFixture((args) => {
+        operations.push(args.slice(0, 2).join(' '));
+        return args[1] === 'upload'
+          ? { status: 1, stdout: '', stderr: 'Test stopped before uploading.' }
+          : missing;
+      }),
+    });
+    expect(result).toMatchObject({ ok: false, reason: 'upload-failed' });
+    expect(operations).toEqual(['deployments status', 'versions list', 'versions upload']);
   },
   REAL_CF_TIMEOUT_MS,
 );
@@ -216,39 +200,23 @@ it(
     const prepared = await output();
     const requests: Array<string> = [];
     const userAgents: Array<string | undefined> = [];
-    const server = createServer((request, response) => {
-      requests.push(request.url ?? '');
-      userAgents.push(request.headers['user-agent']);
-      request.resume();
-      response.writeHead(404, { 'Content-Type': 'application/json' });
-      response.end(
-        JSON.stringify({
-          success: false,
-          errors: [{ code: 10007, message: 'The given script does not exist.' }],
-          result: null,
-        }),
-      );
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const apiBaseUrl = await listen(
+      createServer((request, response) => {
+        requests.push(request.url ?? '');
+        userAgents.push(request.headers['user-agent']);
+        request.resume();
+        response.writeHead(404, { 'Content-Type': 'application/json' });
+        response.end(
+          JSON.stringify({
+            success: false,
+            errors: [{ code: 10007, message: 'The given script does not exist.' }],
+            result: null,
+          }),
+        );
+      }),
+    );
     try {
-      const apiBaseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-      const command = createCfCommand({
-        accountId: 'account-id',
-        apiBaseUrl,
-        verifyUploader: () => true,
-        env: () => ({
-          PATH: process.env.PATH,
-          SYSTEMROOT: process.env.SYSTEMROOT,
-          WINDIR: process.env.WINDIR,
-          TMP: process.env.TMP,
-          TEMP: process.env.TEMP,
-          CI: 'true',
-          CLOUDFLARE_API_TOKEN: 'synthetic-token',
-          CLOUDFLARE_ACCOUNT_ID: 'account-id',
-          CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-        }),
-      });
-      const result = await command(['workers', 'versions', 'create', '--prebuilt'], {
+      const result = await pinnedCf(apiBaseUrl)(['workers', 'versions', 'create', '--prebuilt'], {
         cwd: prepared.directory,
         capture: true,
       });
@@ -264,9 +232,6 @@ it(
       expect(userAgents).toEqual([cfUserAgent]);
     } finally {
       prepared.dispose();
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
     }
   },
   REAL_CF_TIMEOUT_MS,
@@ -277,44 +242,28 @@ it(
   async () => {
     const prepared = await output();
     const requests: Array<{ method: string; path: string }> = [];
-    const server = createServer((request, response) => {
-      requests.push({ method: request.method!, path: request.url! });
-      request.resume();
-      response.writeHead(200, { 'Content-Type': 'application/json' });
-      response.end(
-        JSON.stringify({
-          success: true,
-          errors: [],
-          messages: [],
-          result: {
-            default_environment: {
-              environment: 'production',
-              script: { id: 'void-test', last_deployed_from: 'api' },
+    const apiBaseUrl = await listen(
+      createServer((request, response) => {
+        requests.push({ method: request.method!, path: request.url! });
+        request.resume();
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(
+          JSON.stringify({
+            success: true,
+            errors: [],
+            messages: [],
+            result: {
+              default_environment: {
+                environment: 'production',
+                script: { id: 'void-test', last_deployed_from: 'api' },
+              },
             },
-          },
-        }),
-      );
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+          }),
+        );
+      }),
+    );
     try {
-      const apiBaseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-      const command = createCfCommand({
-        accountId: 'account-id',
-        apiBaseUrl,
-        verifyUploader: () => true,
-        env: () => ({
-          PATH: process.env.PATH,
-          SYSTEMROOT: process.env.SYSTEMROOT,
-          WINDIR: process.env.WINDIR,
-          TMP: process.env.TMP,
-          TEMP: process.env.TEMP,
-          CI: 'true',
-          CLOUDFLARE_API_TOKEN: 'synthetic-token',
-          CLOUDFLARE_ACCOUNT_ID: 'account-id',
-          CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-        }),
-      });
-      const result = await command(['workers', 'versions', 'create', '--prebuilt'], {
+      const result = await pinnedCf(apiBaseUrl)(['workers', 'versions', 'create', '--prebuilt'], {
         cwd: prepared.directory,
         capture: true,
       });
@@ -328,10 +277,6 @@ it(
       ]);
     } finally {
       prepared.dispose();
-      await new Promise<void>((resolve) => {
-        server.close(() => resolve());
-        server.closeAllConnections();
-      });
     }
   },
   REAL_CF_TIMEOUT_MS,
@@ -417,25 +362,9 @@ it('uploads an ordinary API-origin revision with genuine cf reads and UUID-pinne
     response.writeHead(200, { 'Content-Type': 'application/json' });
     response.end(JSON.stringify({ success: true, errors: [], messages: [], result }));
   });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const apiBaseUrl = await listen(server);
   try {
-    const apiBaseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-    const command = createCfCommand({
-      accountId: 'account-id',
-      apiBaseUrl,
-      verifyUploader: () => true,
-      env: () => ({
-        PATH: process.env.PATH,
-        SYSTEMROOT: process.env.SYSTEMROOT,
-        WINDIR: process.env.WINDIR,
-        TMP: process.env.TMP,
-        TEMP: process.env.TEMP,
-        CI: 'true',
-        CLOUDFLARE_API_TOKEN: 'synthetic-token',
-        CLOUDFLARE_ACCOUNT_ID: 'account-id',
-        CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-      }),
-    });
+    const command = pinnedCf(apiBaseUrl);
     const calls: Array<Array<string>> = [];
     const runCf: Parameters<typeof createCfVersionRunner>[0]['runCf'] = async (args, options) => {
       calls.push(args);
@@ -537,10 +466,6 @@ it('uploads an ordinary API-origin revision with genuine cf reads and UUID-pinne
     expect(readFileSync(getWorkerConfigPath(prepared.directory), 'utf8')).toBe(originalConfig);
   } finally {
     prepared.dispose();
-    await new Promise<void>((resolve) => {
-      server.close(() => resolve());
-      server.closeAllConnections();
-    });
   }
 }, 30_000);
 
@@ -554,55 +479,19 @@ it(
       number: 1,
       modules: [{ name: 'index.js', content_base64: 'a'.repeat(2 * 1024 * 1024) }],
     };
-    const server = createServer((request, response) => {
-      request.resume();
-      response.writeHead(200, { 'Content-Type': 'application/json' });
-      response.end(JSON.stringify({ success: true, errors: [], result: [version] }));
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const apiBaseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-      const script = `
-      import { createCfCommand } from ${JSON.stringify(new URL('../../src/cli/cf-version-runner.ts', import.meta.url).href)};
-      const command = createCfCommand({
-        accountId: 'test-account', apiBaseUrl: ${JSON.stringify(apiBaseUrl)},
-        env: () => process.env, verifyUploader: () => true,
-      });
-      const result = await command(
-        ['workers', 'versions', 'list', '--worker-id', 'large-worker', '--per-page', '10'],
-        { cwd: ${JSON.stringify(root)}, capture: true },
-      );
-      console.log(JSON.stringify({ status: result.status, length: result.stdout.length, error: result.error }));
-    `;
-      const stdout = await new Promise<string>((resolve, reject) => {
-        execFile(
-          process.execPath,
-          ['--input-type=module', '-e', script],
-          {
-            cwd: root,
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              TMP: process.env.TMP,
-              TEMP: process.env.TEMP,
-              CI: 'true',
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-            },
-          },
-          (error, stdout, stderr) => (error ? reject(new Error(stderr)) : resolve(stdout)),
-        );
-      });
-      expect(JSON.parse(stdout)).toEqual({ status: 0, length: expect.any(Number), error: null });
-      expect((JSON.parse(stdout) as { length: number }).length).toBeGreaterThan(1024 * 1024);
-    } finally {
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
-    }
+    const apiBaseUrl = await listen(
+      createServer((request, response) => {
+        request.resume();
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({ success: true, errors: [], result: [version] }));
+      }),
+    );
+    const result = await pinnedCf(apiBaseUrl, 'test-account')(
+      ['workers', 'versions', 'list', '--worker-id', 'large-worker', '--per-page', '10'],
+      { cwd: root, capture: true },
+    );
+    expect(result).toMatchObject({ status: 0, error: null });
+    expect(result.stdout.length).toBeGreaterThan(1024 * 1024);
   },
   REAL_CF_TIMEOUT_MS,
 );
@@ -900,137 +789,130 @@ async function verifyPinnedUpload(atomic: boolean): Promise<void> {
         }),
       );
     });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const uploaded = await uploadPinnedCloudflareVersion({
-        output: prepared,
-        accountId: 'account-id',
-        apiBaseUrl: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-        workerName: 'void-test',
-        token: 'synthetic-token',
-        atomic,
-        verifyUploader: () => true,
-      });
-      expect(uploaded.id).toBe('22222222-2222-4222-8222-222222222222');
-      expect(requests.map(({ userAgent }) => userAgent)).toEqual(
-        requests.map(() => `void/${voidVersion}`),
-      );
-      const upload = requests.find(({ url }) =>
-        url.endsWith(atomic ? '/versions?deploy=true' : '/versions'),
-      );
-      expect(upload).toBeDefined();
-      const body = JSON.parse(upload!.body);
-      expect(body.bindings).toEqual(
-        expect.arrayContaining([
-          { name: 'AUTH_SECRET', type: 'inherit', version_id: activeVersionId },
-          { name: 'KEY', type: 'inherit', version_id: activeVersionId },
-          { name: 'DASHBOARD_VAR', type: 'inherit', version_id: activeVersionId },
-          { name: 'APP_VERSION', type: 'version_metadata' },
-          { name: 'JOBS', type: 'queue', queue_name: 'jobs', delivery_delay: 7 },
-          { name: 'AI', type: 'ai' },
-          { name: 'POSTGRES', type: 'hyperdrive', id: 'a'.repeat(32) },
-          {
-            name: 'SERVICE',
-            type: 'service',
-            service: 'utility-worker',
-            entrypoint: 'Rpc',
-            props: { enabled: true },
-          },
-          {
-            name: 'MAIL',
-            type: 'send_email',
-            allowed_destination_addresses: ['fixture@example.test'],
-            allowed_sender_addresses: ['sender@example.test'],
-          },
-          { name: 'METRICS', type: 'analytics_engine', dataset: 'metrics' },
-          { name: 'VECTORS', type: 'vectorize', index_name: 'vectors' },
-          { name: 'BROWSER', type: 'browser' },
-          { name: 'IMAGES', type: 'images' },
-          {
-            name: 'DISPATCH',
-            type: 'dispatch_namespace',
-            namespace: 'dispatch',
-            outbound: { worker: { service: 'outbound-worker' }, params: [{ name: 'tenant' }] },
-          },
-          {
-            name: 'WORKFLOW',
-            type: 'workflow',
-            workflow_name: 'external-workflow',
-            script_name: 'external-worker',
-          },
-          {
-            name: 'LOCAL_WORKFLOW',
-            type: 'workflow',
-            workflow_name: 'local-workflow',
-            class_name: 'LocalJob',
-          },
-        ]),
-      );
-      expect(body.modules).toEqual([expect.objectContaining({ name: 'index.js' })]);
-      expect(body.exports).toEqual({
-        LocalJob: { type: 'workflow', name: 'local-workflow' },
-        ExportOnlyJob: { type: 'workflow', name: 'export-only-workflow' },
-        Rpc: { type: 'worker', cache: { enabled: false } },
-        Departed: { type: 'durable-object', state: 'transferred', transferred_to: 'target-worker' },
-        Arriving: {
-          type: 'durable-object',
-          state: 'expecting-transfer',
-          storage: 'sqlite',
-          transfer_from: 'source-worker',
+    const uploaded = await uploadPinnedCloudflareVersion({
+      output: prepared,
+      accountId: 'account-id',
+      apiBaseUrl: await listen(server),
+      workerName: 'void-test',
+      token: 'synthetic-token',
+      atomic,
+      verifyUploader: () => true,
+    });
+    expect(uploaded.id).toBe('22222222-2222-4222-8222-222222222222');
+    expect(requests.map(({ userAgent }) => userAgent)).toEqual(
+      requests.map(() => `void/${voidVersion}`),
+    );
+    const upload = requests.find(({ url }) =>
+      url.endsWith(atomic ? '/versions?deploy=true' : '/versions'),
+    );
+    expect(upload).toBeDefined();
+    const body = JSON.parse(upload!.body);
+    expect(body.bindings).toEqual(
+      expect.arrayContaining([
+        { name: 'AUTH_SECRET', type: 'inherit', version_id: activeVersionId },
+        { name: 'KEY', type: 'inherit', version_id: activeVersionId },
+        { name: 'DASHBOARD_VAR', type: 'inherit', version_id: activeVersionId },
+        { name: 'APP_VERSION', type: 'version_metadata' },
+        { name: 'JOBS', type: 'queue', queue_name: 'jobs', delivery_delay: 7 },
+        { name: 'AI', type: 'ai' },
+        { name: 'POSTGRES', type: 'hyperdrive', id: 'a'.repeat(32) },
+        {
+          name: 'SERVICE',
+          type: 'service',
+          service: 'utility-worker',
+          entrypoint: 'Rpc',
+          props: { enabled: true },
         },
-      });
-      expect(readFileSync(getWorkerConfigPath(prepared.directory), 'utf8')).toBe(
-        originalWorkerConfig,
-      );
-      expect(worker.exports.LocalJob).toEqual({
-        type: 'workflow',
-        name: 'local-workflow',
-        limits: { steps: 7 },
-        concurrency: { limit: 2 },
-        schedules: ['0 * * * *'],
-        defaultRetention: { successRetention: '1 day', errorRetention: '3 days' },
-      });
-      expect(body.assets).toEqual({
-        jwt: 'completion-token',
-        config: { not_found_handling: 'none' },
-      });
-      expect(body.bindings).toContainEqual({ name: 'ASSETS', type: 'assets' });
-      expect(body.containers).toBeUndefined();
-      expect(requests.some(({ url }) => url.includes('/containers/'))).toBe(false);
-      const session = requests.find(({ url }) => url.endsWith('/assets-upload-session'));
-      const manifest = JSON.parse(session!.body).manifest as Record<string, { hash: string }>;
-      expect(Object.keys(manifest)).toEqual(
-        expect.arrayContaining([
-          '/index.html',
-          '/module.js',
-          '/style.css',
-          '/image.png',
-          '/opaque.unknown',
-        ]),
-      );
-      expect(Object.keys(manifest)).toHaveLength(5);
-      const assetUploads = requests.filter(({ url }) => url.includes('/assets/upload'));
-      for (const [name, contentType, contents] of [
-        ['index.html', 'text/html', Buffer.from('<h1>Public</h1>')],
-        ['module.js', 'text/javascript', Buffer.from('export const ready = true;')],
-        ['style.css', 'text/css', Buffer.from('body { color: red; }')],
-        ['image.png', 'image/png', Buffer.from([137, 80, 78, 71])],
-        ['opaque.unknown', 'application/null', Buffer.from('opaque')],
-      ] as const) {
-        const hash = manifest[`/${name}`].hash;
-        const upload = assetUploads.find(({ body }) => body.includes(`name="${hash}"`));
-        expect(upload?.body).toContain(`filename="${hash}"`);
-        expect(upload?.body).toContain(`Content-Type: ${contentType}`);
-        expect(upload?.body).toContain(contents.toString('base64'));
-      }
-      expect(assetUploads.map(({ authorization }) => authorization)).toEqual(
-        Array(5).fill('Bearer asset-token'),
-      );
-    } finally {
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
+        {
+          name: 'MAIL',
+          type: 'send_email',
+          allowed_destination_addresses: ['fixture@example.test'],
+          allowed_sender_addresses: ['sender@example.test'],
+        },
+        { name: 'METRICS', type: 'analytics_engine', dataset: 'metrics' },
+        { name: 'VECTORS', type: 'vectorize', index_name: 'vectors' },
+        { name: 'BROWSER', type: 'browser' },
+        { name: 'IMAGES', type: 'images' },
+        {
+          name: 'DISPATCH',
+          type: 'dispatch_namespace',
+          namespace: 'dispatch',
+          outbound: { worker: { service: 'outbound-worker' }, params: [{ name: 'tenant' }] },
+        },
+        {
+          name: 'WORKFLOW',
+          type: 'workflow',
+          workflow_name: 'external-workflow',
+          script_name: 'external-worker',
+        },
+        {
+          name: 'LOCAL_WORKFLOW',
+          type: 'workflow',
+          workflow_name: 'local-workflow',
+          class_name: 'LocalJob',
+        },
+      ]),
+    );
+    expect(body.modules).toEqual([expect.objectContaining({ name: 'index.js' })]);
+    expect(body.exports).toEqual({
+      LocalJob: { type: 'workflow', name: 'local-workflow' },
+      ExportOnlyJob: { type: 'workflow', name: 'export-only-workflow' },
+      Rpc: { type: 'worker', cache: { enabled: false } },
+      Departed: { type: 'durable-object', state: 'transferred', transferred_to: 'target-worker' },
+      Arriving: {
+        type: 'durable-object',
+        state: 'expecting-transfer',
+        storage: 'sqlite',
+        transfer_from: 'source-worker',
+      },
+    });
+    expect(readFileSync(getWorkerConfigPath(prepared.directory), 'utf8')).toBe(
+      originalWorkerConfig,
+    );
+    expect(worker.exports.LocalJob).toEqual({
+      type: 'workflow',
+      name: 'local-workflow',
+      limits: { steps: 7 },
+      concurrency: { limit: 2 },
+      schedules: ['0 * * * *'],
+      defaultRetention: { successRetention: '1 day', errorRetention: '3 days' },
+    });
+    expect(body.assets).toEqual({
+      jwt: 'completion-token',
+      config: { not_found_handling: 'none' },
+    });
+    expect(body.bindings).toContainEqual({ name: 'ASSETS', type: 'assets' });
+    expect(body.containers).toBeUndefined();
+    expect(requests.some(({ url }) => url.includes('/containers/'))).toBe(false);
+    const session = requests.find(({ url }) => url.endsWith('/assets-upload-session'));
+    const manifest = JSON.parse(session!.body).manifest as Record<string, { hash: string }>;
+    expect(Object.keys(manifest)).toEqual(
+      expect.arrayContaining([
+        '/index.html',
+        '/module.js',
+        '/style.css',
+        '/image.png',
+        '/opaque.unknown',
+      ]),
+    );
+    expect(Object.keys(manifest)).toHaveLength(5);
+    const assetUploads = requests.filter(({ url }) => url.includes('/assets/upload'));
+    for (const [name, contentType, contents] of [
+      ['index.html', 'text/html', Buffer.from('<h1>Public</h1>')],
+      ['module.js', 'text/javascript', Buffer.from('export const ready = true;')],
+      ['style.css', 'text/css', Buffer.from('body { color: red; }')],
+      ['image.png', 'image/png', Buffer.from([137, 80, 78, 71])],
+      ['opaque.unknown', 'application/null', Buffer.from('opaque')],
+    ] as const) {
+      const hash = manifest[`/${name}`].hash;
+      const upload = assetUploads.find(({ body }) => body.includes(`name="${hash}"`));
+      expect(upload?.body).toContain(`filename="${hash}"`);
+      expect(upload?.body).toContain(`Content-Type: ${contentType}`);
+      expect(upload?.body).toContain(contents.toString('base64'));
     }
+    expect(assetUploads.map(({ authorization }) => authorization)).toEqual(
+      Array(5).fill('Bearer asset-token'),
+    );
   } finally {
     prepared.dispose();
   }
@@ -1136,12 +1018,12 @@ it.each(['missing', 'owned', 'foreign', 'malformed', 'unrelated 404'] as const)(
         }),
       );
     });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const apiBaseUrl = await listen(server);
     try {
       const upload = uploadPinnedCloudflareVersion({
         output: prepared,
         accountId: 'account-id',
-        apiBaseUrl: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
+        apiBaseUrl,
         workerName: 'void-test',
         token: 'synthetic-token',
         atomic: true,
@@ -1161,9 +1043,6 @@ it.each(['missing', 'owned', 'foreign', 'malformed', 'unrelated 404'] as const)(
       expect(requests[1]?.path).toBe('/client/v4/accounts/account-id/workflows/jobs');
     } finally {
       prepared.dispose();
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
     }
   },
 );
@@ -1362,23 +1241,24 @@ async function containerOutput() {
   return prepared;
 }
 
-async function verifyContainerUpload(
-  mode:
-    | 'create'
-    | 'existing'
-    | 'pending'
-    | 'image-error'
-    | 'foreign'
-    | 'lost-readback'
-    | 'local'
-    | 'lost-image-metadata'
-    | 'foreign-namespace'
-    | 'settings-change'
-    | 'keys-change'
-    | 'omitted-defaults'
-    | 'readiness-failure'
-    | 'key-order',
-) {
+type ContainerMode =
+  | 'create'
+  | 'existing'
+  | 'pending'
+  | 'image-error'
+  | 'foreign'
+  | 'lost-readback'
+  | 'local'
+  | 'lost-image-metadata'
+  | 'foreign-namespace'
+  | 'settings-change'
+  | 'keys-change'
+  | 'omitted-defaults'
+  | 'readiness-failure'
+  | 'key-order';
+
+/** A pinned Sandbox output and a fake Containers and Workers API that records each request. */
+async function containerApi(mode: ContainerMode) {
   const prepared = await containerOutput();
   const built = await readBuildOutput(prepared.directory);
   const existing = [
@@ -1452,8 +1332,7 @@ async function verifyContainerUpload(
           : {}),
       }
     : undefined;
-  let imageAttempts = 0;
-  let versionVisibleAttempts = 0;
+  const counts = { imageAttempts: 0, versionVisibleAttempts: 0 };
   let applicationReads = 0;
   const originalApplication = structuredClone(application);
   const server = createServer(async (request, response) => {
@@ -1487,7 +1366,7 @@ async function verifyContainerUpload(
         status:
           mode === 'image-error'
             ? 'error'
-            : mode === 'pending' && ++imageAttempts === 1
+            : mode === 'pending' && ++counts.imageAttempts === 1
               ? 'pending'
               : 'ready',
       };
@@ -1497,7 +1376,7 @@ async function verifyContainerUpload(
         urls: ['https://22222222-void-test.account.workers.dev'],
       };
     } else if (row.url.endsWith(`/scripts/void-test/versions/${uploadedPinnedVersion}`)) {
-      if (mode === 'pending' && ++versionVisibleAttempts === 1) {
+      if (mode === 'pending' && ++counts.versionVisibleAttempts === 1) {
         status = 404;
         code = 100146;
       } else {
@@ -1553,33 +1432,27 @@ async function verifyContainerUpload(
       }),
     );
   });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const runCf = vi.fn(() => ({
-    status: 0,
-    stdout: 'Pushed image: registry.cloudflare.com/account-id/sandbox:fixture\n',
-    stderr: '',
-  }));
-  const inspect =
-    mode === 'local'
-      ? vi
-          .spyOn(childProcess, 'execFile')
-          .mockImplementation((_file, _args, _options, callback) => {
-            (callback as (error: null, stdout: string, stderr: string) => void)(
-              null,
-              JSON.stringify([containerImage]),
-              '',
-            );
-            return {} as ReturnType<typeof execFile>;
-          })
-      : undefined;
-  syncBuiltinESMExports();
-  try {
-    const changedSettings = mode === 'settings-change' || mode === 'keys-change';
-    if (changedSettings || mode === 'readiness-failure') {
+  return {
+    prepared,
+    existing,
+    expectedImages,
+    requests,
+    counts,
+    originalApplication,
+    application: () => application,
+    apiBaseUrl: await listen(server),
+  };
+}
+
+it.each(['settings-change', 'keys-change', 'readiness-failure'] as const)(
+  'leaves the live Sandbox application unchanged when activation stops: %s',
+  async (mode) => {
+    const api = await containerApi(mode);
+    try {
+      const changedSettings = mode !== 'readiness-failure';
       const commands: Array<Array<string>> = [];
-      const configPath = join(roots.at(-1)!, 'dist/ssr/wrangler.json');
       const runner = createCfVersionRunner({
-        output: prepared,
+        output: api.prepared,
         workerName: 'void-test',
         verifyResources: async () => ({ status: 0, stdout: '', stderr: '' }),
         runCf: (args) => {
@@ -1602,7 +1475,7 @@ async function verifyContainerUpload(
         },
         pinnedUpload: {
           accountId: 'account-id',
-          apiBaseUrl: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
+          apiBaseUrl: api.apiBaseUrl,
           getToken: async () => 'synthetic-token',
           verifyUploader: () => true,
         },
@@ -1611,7 +1484,7 @@ async function verifyContainerUpload(
       const result = await activateCloudflareVersion({
         runWrangler: runner,
         workerName: 'void-test',
-        configPath,
+        configPath: join(roots.at(-1)!, 'dist/ssr/wrangler.json'),
         verifyUploader: () => true,
         message: 'Verify Container candidate isolation.',
         readinessAttempts: 1,
@@ -1622,8 +1495,8 @@ async function verifyContainerUpload(
         reason: changedSettings ? 'upload-failed' : 'readiness-failed',
       });
       expect(readiness).toHaveBeenCalledTimes(changedSettings ? 0 : 1);
-      expect(requests.filter((row) => row.method === 'PATCH')).toEqual([]);
-      expect(application).toEqual(originalApplication);
+      expect(api.requests.filter((row) => row.method === 'PATCH')).toEqual([]);
+      expect(api.application()).toEqual(api.originalApplication);
       expect(
         commands.some((args) => args.slice(0, 3).join(' ') === 'workers deployments create'),
       ).toBe(false);
@@ -1632,14 +1505,53 @@ async function verifyContainerUpload(
           'diagnostic',
           expect.stringContaining('settings differ from the live application'),
         );
-        expect(requests.every((row) => row.method === 'GET')).toBe(true);
+        expect(api.requests.every((row) => row.method === 'GET')).toBe(true);
       }
-      return;
+    } finally {
+      api.prepared.dispose();
     }
+  },
+);
+
+it.each([
+  'create',
+  'existing',
+  'pending',
+  'image-error',
+  'foreign',
+  'lost-readback',
+  'local',
+  'lost-image-metadata',
+  'foreign-namespace',
+  'omitted-defaults',
+  'key-order',
+] as const)('preserves pinned Sandbox image and application lifecycle: %s', async (mode) => {
+  const { prepared, requests, counts, existing, expectedImages, apiBaseUrl } =
+    await containerApi(mode);
+  const runCf = vi.fn(() => ({
+    status: 0,
+    stdout: 'Pushed image: registry.cloudflare.com/account-id/sandbox:fixture\n',
+    stderr: '',
+  }));
+  const inspect =
+    mode === 'local'
+      ? vi
+          .spyOn(childProcess, 'execFile')
+          .mockImplementation((_file, _args, _options, callback) => {
+            (callback as (error: null, stdout: string, stderr: string) => void)(
+              null,
+              JSON.stringify([containerImage]),
+              '',
+            );
+            return {} as ReturnType<typeof execFile>;
+          })
+      : undefined;
+  syncBuiltinESMExports();
+  try {
     const upload = uploadPinnedCloudflareVersion({
       output: prepared,
       accountId: 'account-id',
-      apiBaseUrl: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
+      apiBaseUrl,
       workerName: 'void-test',
       token: 'synthetic-token',
       atomic: true,
@@ -1711,8 +1623,8 @@ async function verifyContainerUpload(
       }
       expect(requests.at(-1)?.method).toBe('GET');
       if (mode === 'pending') {
-        expect(imageAttempts).toBe(2);
-        expect(versionVisibleAttempts).toBe(2);
+        expect(counts.imageAttempts).toBe(2);
+        expect(counts.versionVisibleAttempts).toBe(2);
       }
       if (mode === 'local') {
         expect(runCf).toHaveBeenCalledWith(
@@ -1744,28 +1656,8 @@ async function verifyContainerUpload(
     inspect?.mockRestore();
     syncBuiltinESMExports();
     prepared.dispose();
-    await new Promise<void>((resolve, reject) =>
-      server.close((error) => (error ? reject(error) : resolve())),
-    );
   }
-}
-
-it.each([
-  'create',
-  'existing',
-  'pending',
-  'image-error',
-  'foreign',
-  'lost-readback',
-  'local',
-  'lost-image-metadata',
-  'foreign-namespace',
-  'settings-change',
-  'keys-change',
-  'omitted-defaults',
-  'readiness-failure',
-  'key-order',
-] as const)('preserves pinned Sandbox image and application lifecycle: %s', verifyContainerUpload);
+});
 
 it.each([false, true])(
   'publishes the intended custom domain before pinned-secret bootstrap readiness (atomic=%s)',
@@ -1808,7 +1700,7 @@ it.each([false, true])(
         }),
       );
     });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const apiBaseUrl = await listen(server);
     try {
       const pinActiveSecrets = createActiveSecretPinner({
         output: prepared,
@@ -1862,7 +1754,7 @@ it.each([false, true])(
         }),
         pinnedUpload: {
           accountId: 'account-id',
-          apiBaseUrl: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
+          apiBaseUrl,
           getToken: async () => 'synthetic-token',
           verifyUploader: () => true,
         },
@@ -1890,9 +1782,6 @@ it.each([false, true])(
       });
       expect(events).toEqual(['activate', 'publish-domain', 'readiness']);
     } finally {
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
       await prepared.dispose();
     }
   },
@@ -1950,7 +1839,7 @@ it(
       verifyUploader: () => true,
       env: () => env,
     });
-    const result = await command(['--version'], { cwd: root, capture: true });
+    const result = await command(['--version'], { cwd: root, capture: false });
     expect(result.status, result.stderr).toBe(0);
     expect(result.stdout).not.toContain('UNPINNED_PROJECT_CF_EXECUTED');
     expect(result.stdout.trim()).toBe(`${pinnedCfVersion} void/${voidVersion}`);
@@ -1959,24 +1848,6 @@ it(
   REAL_CF_TIMEOUT_MS,
 );
 
-it(
-  'captures noninteractive cf output when Void owns the terminal',
-  async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-cf-quiet-command-'));
-    roots.push(root);
-    const command = createCfCommand({
-      accountId: 'test-account',
-      apiBaseUrl: 'https://api.cloudflare.com/client/v4',
-      verifyUploader: () => true,
-      env: () => ({ PATH: process.env.PATH, CI: 'true' }),
-    });
-    const result = await command(['--version'], { cwd: root, capture: false });
-    expect(result.status, result.stderr).toBe(0);
-    expect(result.stdout).toContain(pinnedCfVersion);
-  },
-  REAL_CF_TIMEOUT_MS,
-);
-
 it.each([
   { diagnostic: 'synthetic provider failure [10007]', args: ['--version'] },
   {
@@ -2089,70 +1960,24 @@ it('uses the configured HTTP proxy for direct cf activation reads', async () =>
     upstream.on('close', () => tunnels.delete(upstream));
     upstream.on('error', () => socket.destroy());
   });
-  await Promise.all([
-    new Promise<void>((resolve) => api.listen(0, '127.0.0.1', resolve)),
-    new Promise<void>((resolve) => proxy.listen(0, '127.0.0.1', resolve)),
-  ]);
-  try {
-    const proxyUrl = `http://127.0.0.1:${(proxy.address() as AddressInfo).port}`;
-    const apiBaseUrl = 'http://cf-proxy-test.invalid/client/v4';
-    const script = `
-      import { createCfCommand } from ${JSON.stringify(new URL('../../src/cli/cf-version-runner.ts', import.meta.url).href)};
-      const command = createCfCommand({
-        accountId: 'test-account', apiBaseUrl: ${JSON.stringify(apiBaseUrl)},
-        env: () => process.env, verifyUploader: () => true,
-      });
-      const result = await command(
-        ['workers', 'versions', 'list', '--worker-id', 'proxy-worker'],
-        { cwd: ${JSON.stringify(root)}, capture: true },
-      );
-      console.log(JSON.stringify({ status: result.status, stdout: result.stdout }));
-    `;
-    const stdout = await new Promise<string>((resolve, reject) => {
-      execFile(
-        process.execPath,
-        ['--input-type=module', '-e', script],
-        {
-          cwd: root,
-          timeout: 20_000,
-          env: {
-            PATH: process.env.PATH,
-            SYSTEMROOT: process.env.SYSTEMROOT,
-            WINDIR: process.env.WINDIR,
-            TMP: process.env.TMP,
-            TEMP: process.env.TEMP,
-            CI: 'true',
-            HTTP_PROXY: proxyUrl,
-            NO_PROXY: '',
-            CLOUDFLARE_API_TOKEN: 'synthetic-token',
-            CLOUDFLARE_ACCOUNT_ID: 'test-account',
-            CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-          },
-        },
-        (error, stdout, stderr) =>
-          error ? reject(new Error(`${error.message}\n${stderr}`)) : resolve(stdout),
-      );
-    });
-    const result = JSON.parse(stdout) as { status: number; stdout: string };
-    expect(result.status).toBe(0);
-    expect(result.stdout).toContain('00000000-0000-0000-0000-000000000001');
-    expect(requests).toEqual([
-      'http://cf-proxy-test.invalid/client/v4/accounts/test-account/workers/workers/proxy-worker/versions',
-    ]);
-  } finally {
+  await listen(api);
+  const proxyUrl = new URL(await listen(proxy)).origin;
+  // Open tunnels keep the servers from closing.
+  cleanups.push(() => {
     for (const tunnel of tunnels) {
       tunnel.destroy();
     }
-    await Promise.all(
-      [api, proxy].map(
-        (server) =>
-          new Promise<void>((resolve, reject) => {
-            server.close((error) => (error ? reject(error) : resolve()));
-            server.closeAllConnections();
-          }),
-      ),
-    );
-  }
+  });
+  const apiBaseUrl = 'http://cf-proxy-test.invalid/client/v4';
+  const result = await pinnedCf(apiBaseUrl, 'test-account', { HTTP_PROXY: proxyUrl, NO_PROXY: '' })(
+    ['workers', 'versions', 'list', '--worker-id', 'proxy-worker'],
+    { cwd: root, capture: true },
+  );
+  expect(result.status, result.stderr).toBe(0);
+  expect(result.stdout).toContain('00000000-0000-0000-0000-000000000001');
+  expect(requests).toEqual([
+    'http://cf-proxy-test.invalid/client/v4/accounts/test-account/workers/workers/proxy-worker/versions',
+  ]);
 }, 30_000);
 
 it('preserves activation metadata and sorts cf version history for the existing protocol', async () => {
@@ -2191,20 +2016,12 @@ it('preserves activation metadata and sorts cf version history for the existing
         };
       },
     });
-    const common = ['-c', 'generated.json', '--env=', '--name', 'void-test'];
-    const deployment = await runner(
-      operationFixtureRequest(['deployments', 'status', ...common, '--json']),
-      {
-        capture: true,
-      },
-    );
+    const target = { configPath: 'generated.json', workerName: 'void-test' };
+    const deployment = await runner({ type: 'deployments.status', ...target }, { capture: true });
     expect(deployment.data).toEqual({
       versions: [{ version_id: 'one', percentage: 100 }],
     });
-    const versions = await runner(
-      operationFixtureRequest(['versions', 'list', ...common, '--json']),
-      { capture: true },
-    );
+    const versions = await runner({ type: 'versions.list', ...target }, { capture: true });
     expect((versions.data as Array<{ id: string }>).map((item: { id: string }) => item.id)).toEqual(
       ['one', 'two'],
     );
@@ -2220,16 +2037,12 @@ it('preserves activation metadata and sorts cf version history for the existing
       '1',
     ]);
     await runner(
-      operationFixtureRequest([
-        'versions',
-        'upload',
-        ...common,
-        '--message',
-        'void:metadata',
-        '--preview-alias',
-        'void-ready',
-        '--strict',
-      ]),
+      {
+        type: 'versions.upload',
+        ...target,
+        message: 'void:metadata',
+        previewAlias: 'void-ready',
+      },
       { capture: true },
     );
     expect(calls.at(-1)).toEqual([
@@ -2243,15 +2056,12 @@ it('preserves activation metadata and sorts cf version history for the existing
       'void-ready',
     ]);
     await runner(
-      operationFixtureRequest([
-        'versions',
-        'deploy',
-        '00000000-0000-0000-0000-000000000001@100',
-        ...common,
-        '--message',
-        'void:metadata',
-        '--yes',
-      ]),
+      {
+        type: 'versions.deploy',
+        ...target,
+        message: 'void:metadata',
+        versions: [{ versionId: '00000000-0000-0000-0000-000000000001', percentage: 100 }],
+      },
       { capture: false },
     );
     const deployArgs = calls.at(-1)!;
@@ -2292,7 +2102,7 @@ it.each(['newest-first', 'oldest-first'] as const)(
         },
       });
       const result = await runner(
-        operationFixtureRequest(['versions', 'list', '--name', 'void-test']),
+        { type: 'versions.list', workerName: 'void-test' },
         { capture: true },
       );
       expect(
@@ -2331,15 +2141,7 @@ it('applies the immutable trigger snapshot through a private cf output copy', as
       },
     });
     const result = await runner(
-      operationFixtureRequest([
-        'triggers',
-        'deploy',
-        '-c',
-        triggerConfig,
-        '--env=',
-        '--name',
-        'void-test',
-      ]),
+      { type: 'triggers.deploy', configPath: triggerConfig, workerName: 'void-test' },
       { capture: false },
     );
     expect(result.status).toBe(0);
@@ -2464,29 +2266,12 @@ it(
         }),
       );
     });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const apiBaseUrl = await listen(server);
     try {
-      const apiBaseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-      const command = createCfCommand({
-        accountId: 'account-id',
-        apiBaseUrl,
-        verifyUploader: () => true,
-        env: () => ({
-          PATH: process.env.PATH,
-          SYSTEMROOT: process.env.SYSTEMROOT,
-          WINDIR: process.env.WINDIR,
-          TMP: process.env.TMP,
-          TEMP: process.env.TEMP,
-          CI: 'true',
-          CLOUDFLARE_API_TOKEN: 'synthetic-token',
-          CLOUDFLARE_ACCOUNT_ID: 'account-id',
-          CLOUDFLARE_API_BASE_URL: apiBaseUrl,
-        }),
-      });
       const runner = createCfVersionRunner({
         output: prepared,
         workerName: 'void-test',
-        runCf: command,
+        runCf: pinnedCf(apiBaseUrl),
         verifyResources: async () => ({ status: 0, stdout: '', stderr: '' }),
       });
       const result = await deployCloudflareVersionTriggers({
@@ -2521,9 +2306,6 @@ it(
       expect(readFileSync(getWorkerConfigPath(prepared.directory), 'utf8')).toBe(original);
     } finally {
       prepared.dispose();
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
     }
   },
   REAL_CF_TIMEOUT_MS,
@@ -2666,18 +2448,28 @@ it('uses cf for Queue triggers, consumer cleanup, and version binding reads', as
       },
     });
     const invalid = await runner(
-      operationFixtureRequest(['versions', 'deploy', 'invalid@100', '--name', 'void-test']),
       {
-        capture: true,
+        type: 'versions.deploy',
+        workerName: 'void-test',
+        versions: [{ versionId: 'invalid', percentage: 100 }],
       },
+      { capture: true },
     );
     expect(invalid.status).toBe(1);
-    const triggerArgs = ['triggers', 'deploy', '-c', triggerConfig, '--name', 'void-test'];
-    expect((await runner(operationFixtureRequest(triggerArgs), { capture: false })).status).toBe(0);
-    const removeArgs = ['queues', 'consumer', 'remove', 'jobs', 'void-test'];
-    expect((await runner(operationFixtureRequest(removeArgs), { capture: false })).status).toBe(0);
-    const viewArgs = ['versions', 'view', 'version-id', '--name', 'void-test'];
-    const version = await runner(operationFixtureRequest(viewArgs), { capture: true });
+    const trigger = await runner(
+      { type: 'triggers.deploy', configPath: triggerConfig, workerName: 'void-test' },
+      { capture: false },
+    );
+    expect(trigger.status).toBe(0);
+    const remove = await runner(
+      { type: 'queues.consumer.remove', queueName: 'jobs', workerName: 'void-test' },
+      { capture: false },
+    );
+    expect(remove.status).toBe(0);
+    const version = await runner(
+      { type: 'versions.view', versionId: 'version-id', workerName: 'void-test' },
+      { capture: true },
+    );
     expect(
       (version.data as { resources: { bindings: Array<unknown> } }).resources.bindings,
     ).toEqual([{ name: 'SECRET', type: 'secret_text' }]);
@@ -2710,20 +2502,21 @@ it('accepts only the staged static assets directory already sealed into prebuilt
         return { status: 0, stdout: '', stderr: '' };
       },
     });
-    const common = ['--name', 'void-test', '--assets'];
     expect(
       (
-        await runner(operationFixtureRequest(['versions', 'upload', ...common, '/staged/assets']), {
-          capture: true,
-        })
+        await runner(
+          { type: 'versions.upload', workerName: 'void-test', assetsDirectory: '/staged/assets' },
+          { capture: true },
+        )
       ).status,
     ).toBe(0);
     expect(calls.at(-1)?.slice(0, 4)).toEqual(['workers', 'versions', 'create', '--prebuilt']);
     expect(
       (
-        await runner(operationFixtureRequest(['deploy', ...common, '/wrong/assets']), {
-          capture: true,
-        })
+        await runner(
+          { type: 'worker.deploy', workerName: 'void-test', assetsDirectory: '/wrong/assets' },
+          { capture: true },
+        )
       ).status,
     ).toBe(1);
     expect(calls).toHaveLength(1);
@@ -2766,33 +2559,18 @@ it.each(['r2', 'queue'] as const)(
         verifyResources: verifier,
       });
       expect(
-        (
-          await runner(operationFixtureRequest(['versions', 'upload', '--name', 'void-test']), {
-            capture: true,
-          })
-        ).status,
+        (await runner({ type: 'versions.upload', workerName: 'void-test' }, { capture: true }))
+          .status,
       ).toBe(1);
       expect(
-        (
-          await runner(operationFixtureRequest(['deploy', '--name', 'void-test']), {
-            capture: true,
-          })
-        ).status,
+        (await runner({ type: 'worker.deploy', workerName: 'void-test' }, { capture: true }))
+          .status,
       ).toBe(1);
       expect(
         (
           await runner(
-            operationFixtureRequest([
-              'triggers',
-              'deploy',
-              '-c',
-              triggerConfig,
-              '--name',
-              'void-test',
-            ]),
-            {
-              capture: true,
-            },
+            { type: 'triggers.deploy', configPath: triggerConfig, workerName: 'void-test' },
+            { capture: true },
           )
         ).status,
       ).toBe(1);
@@ -2836,11 +2614,8 @@ it('uploads when existing R2 and Queue bindings are verified by exact identity',
       }),
     });
     expect(
-      (
-        await runner(operationFixtureRequest(['versions', 'upload', '--name', 'void-test']), {
-          capture: true,
-        })
-      ).status,
+      (await runner({ type: 'versions.upload', workerName: 'void-test' }, { capture: true }))
+        .status,
     ).toBe(0);
     expect(cfCalls).toEqual([
       ['r2', 'buckets', 'get', 'bucket', '--cf-r2-jurisdiction', 'eu'],
diff --git a/packages/void/test/unit/cli-help.test.ts b/packages/void/test/unit/cli-help.test.ts
index cddee050c..75be922b3 100644
--- a/packages/void/test/unit/cli-help.test.ts
+++ b/packages/void/test/unit/cli-help.test.ts
@@ -1,6 +1,5 @@
 import { note } from '@voidzero-dev/vite-plus-prompts';
 import { beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { parseEmailArgs } from '../../src/cli/email-args.ts';
 import { getHelpPath, hasHelpPage, printHelpPage } from '../../src/cli/help.ts';
 
 vi.mock('@voidzero-dev/vite-plus-prompts', () => ({
@@ -125,16 +124,7 @@ describe('rendered help advertises the flags the parser honours', () => {
     return lines.join('\n').replace(/\u001b\[[0-9;]*m/g, '');
   }
 
-  // `void email logs --limit <n>` is parsed, honoured, and documented in the
-  // CLI reference, but the help page was built with the shared project-only
-  // helper, so the flag was invisible in every help surface. Nothing asserted
-  // rendered help content before, so nothing would have caught it.
-  it('shows --limit on `email logs`, which is the only email flag that does anything', () => {
-    expect(parseEmailArgs(['logs', '--limit', '7'])).toMatchObject({
-      subcommand: 'logs',
-      limit: 7,
-    });
-
+  it('shows --limit and --project on `email logs`', () => {
     const page = render(['email', 'logs']);
 
     expect(page).toContain('--limit <n>');
@@ -158,14 +148,10 @@ describe('rendered help advertises the flags the parser honours', () => {
     }
   });
 
-  // Mode B: `status` / `setup` read the local project + wrangler session, never a Void
-  // project, so their pages carry `--platform cloudflare` and no `--project`.
+  // `status` / `setup` read the local project + wrangler session, never a Void project,
+  // so their pages carry `--platform cloudflare` and no `--project`.
   it('shows --platform cloudflare, and no --project, on `email status` and `email setup`', () => {
     for (const sub of ['status', 'setup']) {
-      expect(parseEmailArgs([sub, '--platform', 'cloudflare'])).toMatchObject({
-        subcommand: sub,
-        platform: 'cloudflare',
-      });
       const page = render(['email', sub]);
       expect(page).toContain(`void email ${sub} --platform cloudflare`);
       expect(page).toContain('--platform cloudflare');
@@ -181,16 +167,6 @@ describe('rendered help advertises the flags the parser honours', () => {
   // group entry is on the email page, and every verb keeps its own page so the
   // printed `void help email domain <command>` hint actually resolves.
   it('lists `email domain` on the email page and resolves the domain help pages', () => {
-    expect(
-      parseEmailArgs(['domain', 'add', 'acme.com', '--subdomain', 'mail', '--project', 'acme']),
-    ).toMatchObject({
-      subcommand: 'domain',
-      domainVerb: 'add',
-      domain: 'acme.com',
-      subdomain: 'mail',
-      projectSlug: 'acme',
-    });
-
     const group = render(['email']);
     expect(group).toContain('domain <add|status|list|sync|rotate-secret|remove>');
 
diff --git a/packages/void/test/unit/cli-outdated.test.ts b/packages/void/test/unit/cli-outdated.test.ts
index 260b58a5f..2a6fd0d7d 100644
--- a/packages/void/test/unit/cli-outdated.test.ts
+++ b/packages/void/test/unit/cli-outdated.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vite-plus/test';
-import { isCliOutdatedError, PlatformApiError, readCliVersion } from '../../src/cli/client.ts';
+import { isCliOutdatedError, PlatformApiError } from '../../src/cli/client.ts';
 import { formatStreamDeployError } from '../../src/cli/deploy-errors.ts';
 
 const OUTDATED_BODY = JSON.stringify({
@@ -12,9 +12,6 @@ const OUTDATED_BODY = JSON.stringify({
 describe('PlatformApiError + cli_outdated', () => {
   it('overrides the default message with the server-supplied upgrade text on 426', () => {
     const err = new PlatformApiError('Deploy failed', 426, OUTDATED_BODY);
-    // Default would be `Deploy failed: 426 {...json...}` — readers shouldn't
-    // see raw JSON. Server message wins so the actionable upgrade line is
-    // up front.
     expect(err.message).not.toContain('426');
     expect(err.message).not.toContain('{');
     expect(err.message).toContain('npm i -g void@latest');
@@ -54,8 +51,6 @@ describe('formatStreamDeployError + cli_outdated', () => {
   it('surfaces the server message verbatim with no HTTP wrapper', () => {
     const err = new PlatformApiError('Deploy failed', 426, OUTDATED_BODY);
     const formatted = formatStreamDeployError(err, null, null);
-    // Should NOT contain the standard "Deploy failed (HTTP 426)" wrapper
-    // because that buries the actionable line.
     expect(formatted.message).not.toContain('Deploy failed (HTTP 426)');
     expect(formatted.message).toContain('npm i -g void@latest');
   });
@@ -68,25 +63,3 @@ describe('formatStreamDeployError + cli_outdated', () => {
     expect(formatted.message).toContain('Detailed log: /tmp/log.txt');
   });
 });
-
-describe('readCliVersion', () => {
-  // The CLI must NEVER emit the literal string "unknown" as its version
-  // header — the platform's gate rejects unparseable headers as
-  // cli_outdated, which would brick the CLI on any packaging error.
-  // Failure path returns null and the ctor omits the header entirely.
-  it('returns a parseable semver triplet in the test environment', () => {
-    const v = readCliVersion();
-    // Test runs from a real package root, so version must be readable.
-    expect(v).not.toBeNull();
-    expect(v).toMatch(/^\d+\.\d+\.\d+/);
-    // Critical regression guard: never the literal string "unknown".
-    expect(v).not.toBe('unknown');
-  });
-
-  it('return type allows null (caller must handle missing version)', () => {
-    // This is a type-level assertion — if the return type ever drifts
-    // back to `string`, this assignment will fail typecheck.
-    const v: string | null = readCliVersion();
-    expect(v === null || typeof v === 'string').toBe(true);
-  });
-});
diff --git a/packages/void/test/unit/client-platform-version.test.ts b/packages/void/test/unit/client-platform-version.test.ts
index 0748212f2..212c32549 100644
--- a/packages/void/test/unit/client-platform-version.test.ts
+++ b/packages/void/test/unit/client-platform-version.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { MIN_PLATFORM_VERSION, PlatformClient } from '../../src/cli/client.ts';
+import { PlatformClient } from '../../src/cli/client.ts';
 import {
   isPlatformDiscoveryRequest,
   platformDiscoveryResponse,
@@ -9,9 +9,10 @@ import {
 // Access challenge fails the way it does for a CLI that has none.
 vi.mock('../../src/cli/cf-access.ts', async (importOriginal) => ({
   ...(await importOriginal<typeof import('../../src/cli/cf-access.ts')>()),
-  ensureCloudflaredToken: vi.fn(),
-  ensurePlatformAccessToken: vi.fn(() => {
-    throw new Error('platform: Cloudflare Access authentication is required.');
+  ensurePlatformAccessToken: vi.fn((_apiUrl: string, challenged?: boolean) => {
+    if (challenged) {
+      throw new Error('platform: Cloudflare Access authentication is required.');
+    }
   }),
 }));
 
@@ -52,10 +53,6 @@ function client(options: { checkPlatformVersion?: boolean } = {}): PlatformClien
 }
 
 describe('minimum platform version', () => {
-  it('declares 0.27.0 as the minimum', () => {
-    expect(MIN_PLATFORM_VERSION).toBe('0.27.0');
-  });
-
   it.each(['0.27.0', '0.28.0', '1.0.0', 'hosted'])(
     'accepts a platform reporting %s',
     async (version) => {
diff --git a/packages/void/test/unit/client-subpath-exports.test.ts b/packages/void/test/unit/client-subpath-exports.test.ts
index 962d2b057..411222769 100644
--- a/packages/void/test/unit/client-subpath-exports.test.ts
+++ b/packages/void/test/unit/client-subpath-exports.test.ts
@@ -8,25 +8,12 @@ describe('client package exports', () => {
       readFileSync(join(import.meta.dirname, '../../package.json'), 'utf-8'),
     );
 
-    expect(packageJson.exports['./client/react']).toEqual({
-      import: './dist/runtime/client-react.mjs',
-      require: './dist/runtime/client-react.mjs',
-      types: './dist/runtime/client-react.d.mts',
-    });
-    expect(packageJson.exports['./client/vue']).toEqual({
-      import: './dist/runtime/client-vue.mjs',
-      require: './dist/runtime/client-vue.mjs',
-      types: './dist/runtime/client-vue.d.mts',
-    });
-    expect(packageJson.exports['./client/svelte']).toEqual({
-      import: './dist/runtime/client-svelte.mjs',
-      require: './dist/runtime/client-svelte.mjs',
-      types: './dist/runtime/client-svelte.d.mts',
-    });
-    expect(packageJson.exports['./client/solid']).toEqual({
-      import: './dist/runtime/client-solid.mjs',
-      require: './dist/runtime/client-solid.mjs',
-      types: './dist/runtime/client-solid.d.mts',
-    });
+    for (const framework of ['react', 'vue', 'svelte', 'solid']) {
+      expect(packageJson.exports[`./client/${framework}`]).toEqual({
+        import: `./dist/runtime/client-${framework}.mjs`,
+        require: `./dist/runtime/client-${framework}.mjs`,
+        types: `./dist/runtime/client-${framework}.d.mts`,
+      });
+    }
   });
 });
diff --git a/packages/void/test/unit/cloudflare-classify.test.ts b/packages/void/test/unit/cloudflare-classify.test.ts
index 9b0e1f132..3ae2d588b 100644
--- a/packages/void/test/unit/cloudflare-classify.test.ts
+++ b/packages/void/test/unit/cloudflare-classify.test.ts
@@ -2,11 +2,21 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
+import { analyzeApplicationSync } from '../../src/application-analysis.ts';
 import { classifyCloudflareDeployApp } from '../../src/cli/cloudflare-deploy/classify.ts';
 import type { VoidConfig } from '../../src/config.ts';
 
 const roots: Array<string> = [];
 
+function classify(root: string, config: VoidConfig) {
+  return classifyCloudflareDeployApp(
+    root,
+    config,
+    {},
+    analyzeApplicationSync(root, { config, environment: 'prod' }),
+  );
+}
+
 afterEach(() => {
   for (const root of roots.splice(0)) {
     rmSync(root, { recursive: true, force: true });
@@ -23,18 +33,14 @@ describe('classifyCloudflareDeployApp', () => {
     );
     mkdirSync(join(root, 'src/routes'), { recursive: true });
 
-    expect(classifyCloudflareDeployApp(root, {} as VoidConfig, {})).toEqual({ supported: true });
+    expect(classify(root, {} as VoidConfig)).toEqual({ supported: true });
   });
 
   it('describes an unresolved static output without claiming static deploys are unsupported', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-cloudflare-classify-'));
     roots.push(root);
 
-    const result = classifyCloudflareDeployApp(
-      root,
-      { inference: { appType: 'static' } } as VoidConfig,
-      {},
-    );
+    const result = classify(root, { inference: { appType: 'static' } } as VoidConfig);
 
     expect(result).toEqual({
       supported: false,
diff --git a/packages/void/test/unit/cloudflare-deploy.test.ts b/packages/void/test/unit/cloudflare-deploy.test.ts
index 7ba30a2dc..fe8bef57a 100644
--- a/packages/void/test/unit/cloudflare-deploy.test.ts
+++ b/packages/void/test/unit/cloudflare-deploy.test.ts
@@ -13,6 +13,7 @@ import { stripVTControlCharacters } from 'node:util';
 import {
   CloudflareWorkerInspectionError,
   parseCloudflareVersionMessage,
+  parseRootWranglerConfig,
   type CloudflareOperation,
 } from '@void/deploy-cloudflare';
 import { log } from '@voidzero-dev/vite-plus-prompts';
@@ -24,35 +25,39 @@ import {
   operationFixtureRequest,
 } from '../../../deploy-cloudflare/test/operation-fixture.ts';
 import { readCloudflareLink } from '../../src/cli/cloudflare-link.ts';
+import { verifyGeneratedDeployConfig } from '../../src/cli/deploy-artifact-validation.ts';
 import {
-  assertMigrationsProduceAuthSchema,
-  assertNoConfigOverrideInProjectDotenv,
   assertWranglerUploaderUnchanged,
-  checkWranglerMigrationApplySet,
-  compareWranglerMigrationPaths,
-  computeDesiredCloudflareResources,
-  deployChildEnv,
-  DEPLOY_PASSTHROUGH_ASSERT_FIELDS,
   DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS,
-  DEPLOY_WHOLE_OBJECT_PINNED_FIELDS,
-  ensureCloudflareAuthSecret,
-  formatCloudflareActivationError,
   hashWranglerUploader,
-  parseRootWranglerConfig,
-  prepareCloudflareFrameworkArtifact,
   reconstructExpectedDurableObjectState,
-  runCloudflareDeploy,
-  runWranglerAuthToken,
   snapshotBindingIdentities,
   snapshotPassthroughIdentities,
   snapshotPassthroughRawFields,
+} from '../../src/cli/deploy-binding-snapshot.ts';
+import {
+  ensureCloudflareAuthSecret,
+  runWranglerAuthToken,
+} from '../../src/cli/deploy-cloudflare-auth.ts';
+import { formatCloudflareActivationError } from '../../src/cli/deploy-cloudflare-helpers.ts';
+import { prepareCloudflareFrameworkArtifact } from '../../src/cli/deploy-cloudflare-static.ts';
+import { runCloudflareDeploy } from '../../src/cli/deploy-cloudflare.ts';
+import {
+  assertMigrationsProduceAuthSchema,
+  checkWranglerMigrationApplySet,
+  compareWranglerMigrationPaths,
   validateAuthMigrationSchema,
-  verifyGeneratedDeployConfig,
-  type CloudflareDeployDeps,
-  type DeployWranglerRun,
-  type DeployWranglerRunResult,
-  type EmittedWorkerVarsResult,
-} from '../../src/cli/deploy.ts';
+} from '../../src/cli/deploy-migrations.ts';
+import { computeDesiredCloudflareResources } from '../../src/cli/deploy-resources.ts';
+import {
+  assertNoConfigOverrideInProjectDotenv,
+  deployChildEnv,
+} from '../../src/cli/deploy-transport.ts';
+import type {
+  CloudflareDeployDeps,
+  DeployWranglerRun,
+  DeployWranglerRunResult,
+} from '../../src/cli/deploy-types.ts';
 import { SENDING_FREE_PLAN_HINT, type EmailDns } from '../../src/cli/email-cloudflare.ts';
 import { runEmailCloudflareCommand } from '../../src/cli/email.ts';
 import {
@@ -63,10 +68,12 @@ import {
 } from '../../src/cli/env-schema-probe.ts';
 import {
   dischargeSelfHostEnvContext,
+  type EmittedWorkerVarsResult,
   type SelfHostEnvContext,
   type SelfHostSchemaFacts,
 } from '../../src/cli/env-validation.ts';
 import type { CliLogger } from '../../src/cli/log-file.ts';
+import { migrateLegacyVoidConfig } from '../../src/cli/migrate.ts';
 import { FRAMEWORK_PRESETS } from '../../src/cli/preset.ts';
 import { provisionCloudflareResources, type ProvisionResult } from '../../src/cli/provision.ts';
 import {
@@ -99,7 +106,7 @@ function makeProject(files: Record<string, string>): string {
 
 afterEach(() => {
   removeProjectFixture();
-  delete process.env.DATABASE_URL;
+  vi.unstubAllEnvs();
 });
 
 const silentCliLog: CliLogger = {
@@ -348,11 +355,8 @@ const srcEnvPublic = srcFileUrl('runtime', 'env-public.ts');
 const srcEnvHelpers = srcFileUrl('runtime', 'env-helpers.ts');
 
 /**
- * Cloudflare credentials held by the parent, including Wrangler's canonical names +
- * deprecated `CF_*` aliases and Void's readiness JWT.
- * Mirrors `WRANGLER_AUTH_CREDENTIAL_ENV_VARS` in deploy.ts. Every child that runs untrusted
- * project code (env-schema probes, `vite build`, `drizzle-kit generate`) must see NONE of
- * these; the Wrangler runner keeps only the credentials Wrangler itself needs.
+ * Cloudflare credentials the parent may hold: Wrangler's names, their `CF_*` aliases and Void's
+ * readiness JWT. Children that run project code must see none of them.
  */
 const WRANGLER_AUTH_VARS = [
   'CLOUDFLARE_API_TOKEN',
@@ -369,39 +373,16 @@ const WRANGLER_AUTH_VARS = [
   'CF_ACCESS_TOKEN',
 ];
 
-/** Set every Cloudflare credential on the parent for the duration of `run`, then restore. */
-async function withWranglerCredentials(run: () => Promise<void>): Promise<void> {
-  const saved: Record<string, string | undefined> = {};
+/** Set every Cloudflare credential on the parent; the top-level `afterEach` restores them. */
+function stubWranglerCredentials(): void {
   for (const name of WRANGLER_AUTH_VARS) {
-    saved[name] = process.env[name];
-    process.env[name] = `secret-${name}`;
-  }
-  try {
-    await run();
-  } finally {
-    for (const name of WRANGLER_AUTH_VARS) {
-      if (saved[name] === undefined) {
-        delete process.env[name];
-      } else {
-        process.env[name] = saved[name];
-      }
-    }
+    vi.stubEnv(name, `secret-${name}`);
   }
 }
 
 /**
- * Write a `.void/better-auth-schema.ts` fixture whose `migrationSchema` literal matches the
- * shape the build emits (`JSON.stringify(resolveVoidAuthMigrationSchema(...), null, 2)`), so
- * the post-build auth check reads ground truth exactly as it would after a real build.
- */
-/**
- * A field of the emitted artifact. A bare string is the plain case; the object form carries the
- * `required` / `unique` / `references` metadata the real build emits (see
- * `playground/kitchen-sink/.void/better-auth-schema.ts`, e.g. `user.email` is
- * `{ required: true, unique: true }` and `session.userId` references `user.id`).
- *
- * `required` defaults to true because that is what the real build emits for all but a handful
- * of optional fields (`user.image`, `session.ipAddress`, …).
+ * A field of the emitted auth schema: a bare name, or the `required` / `unique` / `references`
+ * metadata the real build emits. `required` defaults to true, as it does for most build fields.
  */
 type AuthSchemaField =
   | string
@@ -412,6 +393,10 @@ type AuthSchemaField =
       references?: { table: string; field: string; onDelete?: string };
     };
 
+/**
+ * Write a `.void/better-auth-schema.ts` fixture in the shape the build emits, so the post-build
+ * auth check reads it as it would after a real build.
+ */
 function writeAuthSchemaArtifact(
   root: string,
   tables: Array<{ name: string; fields: Array<AuthSchemaField> }>,
@@ -448,11 +433,7 @@ function writeAuthSchemaArtifact(
   );
 }
 
-/**
- * Build a seam bag whose default seams all PASS, recording a call trace so tests
- * assert ordering + that later steps are skipped on an exit. Individual seams are
- * overridable per test.
- */
+/** Deploy seams that all pass by default and record a call trace; tests override single seams. */
 function harness(overrides: Partial<CloudflareDeployDeps> = {}): {
   deps: CloudflareDeployDeps;
   trace: Array<string>;
@@ -468,8 +449,7 @@ function harness(overrides: Partial<CloudflareDeployDeps> = {}): {
     if (args[0] === 'whoami') {
       return { ...cleanExit, stdout: '{"loggedIn":true,"accounts":[]}' };
     }
-    // `d1 migrations list` (the post-apply pending verify) must print wrangler's affirmative
-    // "no pending" sentinel under the pinned WRANGLER_LOG=log, else the B3 check fails closed.
+    // The post-apply pending check requires this affirmative "no pending" marker.
     if (args[0] === 'd1' && args[1] === 'migrations' && args[2] === 'list') {
       return { ...cleanExit, stdout: '✅ No migrations to apply!\n' };
     }
@@ -487,10 +467,8 @@ function harness(overrides: Partial<CloudflareDeployDeps> = {}): {
     prepareFrameworkArtifact: async () => {
       trace.push('prepare-framework');
     },
-    // Stand in for the version upload + activation with one `deploy` spawn through the runner
-    // the deploy handed over (`options.runWrangler` — a test's own `runWrangler` override, else
-    // the recorder above), so a test that swaps the runner still observes whether the deploy
-    // happened. Dedicated suites in packages/deploy-cloudflare exercise the real activation.
+    // One `deploy` call through the runner the deploy passed in, so a test that swaps the runner
+    // still sees whether the upload happened. packages/deploy-cloudflare tests the real activation.
     activateVersion: async (options) => {
       if (!options.verifyUploader()) {
         return { ok: false, reason: 'uploader-changed' };
@@ -521,61 +499,37 @@ function harness(overrides: Partial<CloudflareDeployDeps> = {}): {
         previousVersionId: null,
       };
     },
-    // Stub the wrangler-uploader hash so orchestration tests never hash the real ~18MB bundle
-    // twice; a constant means the pre-build and post-build snapshots match (an unchanged uploader).
-    // Dedicated tests inject a stateful stub that changes across the build to drive the fail path.
+    // A constant hash: the uploader never changes unless a test says so.
     hashWranglerUploader: () => 'uploader-hash-unchanged',
     provision: (async (_root, configPath): Promise<ProvisionResult> => {
       trace.push('provision');
       return { resources: [], configPath, accountIdWritten: false };
     }) as CloudflareDeployDeps['provision'],
-    // Stub the isolated env-schema probe so orchestration tests never spawn a child; the
-    // env-insensitive facts (server and required key names) are returned inline. Silent
-    // (no trace) — it runs pre-build and is not a step these tests order around.
     resolveSchemaFacts: (() => okSchemaFacts()) as CloudflareDeployDeps['resolveSchemaFacts'],
-    // Stub the isolated emitted-var validation probe (F3) so orchestration tests never spawn a
-    // child; by default nothing is invalid. Only invoked when the schema facts declare a schema.
-    // Dedicated tests inject a failing set to exercise the invalid-value fail-closed path.
     validateEmittedVars: (async () => ({
       kind: 'invalid-keys',
       invalidKeys: [],
     })) as CloudflareDeployDeps['validateEmittedVars'],
-    // Stub the emitted-vars read so orchestration tests need no real dist/ssr/wrangler.json;
-    // dedicated tests inject the REAL vars a build would emit. Silent.
     readEmittedWorkerVars: (() => emittedVars()) as CloudflareDeployDeps['readEmittedWorkerVars'],
-    // Parent-side gate discharge (the wrangler `secret list` comparison). Dedicated tests
-    // inject a throwing stub or exercise the real derive+discharge units directly.
     dischargeSelfHostEnv: (async () => {
       trace.push('gate');
-      return { hasSchema: false, remoteSecretNames: null };
     }) as CloudflareDeployDeps['dischargeSelfHostEnv'],
-    // Persistent auth-secret provisioning. Dedicated tests exercise the real
-    // list/put/verify lifecycle; orchestration tests record only its position.
     ensureAuthSecret: (async () => {
       trace.push('auth-secret');
       return { created: false };
     }) as CloudflareDeployDeps['ensureAuthSecret'],
     assertDurableObjectLifecycle: async () => {},
-    // The stubbed build never writes dist/ssr/wrangler.json, so the real config
-    // verification would have nothing to read — pass it by default; dedicated tests
-    // exercise the real verifier and the fail-closed branch.
+    // The stubbed build writes no generated config, so the real verifier would have nothing to read.
     verifyDeployConfig: () => ({ ok: true }),
     resolveGeneratedConfigPath: (root) => join(root, 'dist/ssr/wrangler.json'),
-    // Stub the migration gate so orchestration tests never spawn drizzle-kit; dedicated
-    // tests inject a throwing stub (drift) or exercise the real pure gates (journal /
-    // destructive) directly.
     assertMigrationsDeployable: () => {
       trace.push('migrate-gate');
     },
-    // Stub the migration apply-set equality gate so orchestration tests need no on-disk
-    // migration dir; a dedicated suite exercises the real `checkWranglerMigrationApplySet`.
     checkMigrationApplySet: async () => ({ ok: true }),
     applyPostgresMigrations: async () => {
       trace.push('postgres-migrate');
       return [];
     },
-    // Stub auth-schema validation so orchestration tests never load Better Auth; dedicated
-    // tests exercise the real `validateAuthMigrationSchema` + `assertMigrationsProduceAuthSchema`.
     validateAuthMigrations: async () => {},
     ...overrides,
   };
@@ -602,8 +556,17 @@ describe('existing Cloudflare site handoff', () => {
       }),
     });
   }
+  /** The site after the deploy target moved its settings into void.config.ts. */
+  function migratedSite() {
+    const root = site();
+    migrateLegacyVoidConfig(root);
+    return root;
+  }
   function build(root: string) {
-    const config = parseRootWranglerConfig(join(root, 'wrangler.jsonc'));
+    const typed = existsSync(join(root, 'void.config.ts'));
+    const config = parseRootWranglerConfig(
+      join(root, typed ? '.void-wrangler.jsonc' : 'wrangler.jsonc'),
+    );
     config.triggers = { crons: [] };
     config.queues = { consumers: [], producers: [] };
     config.durable_objects = { bindings: [] };
@@ -719,17 +682,13 @@ describe('existing Cloudflare site handoff', () => {
         : originalRunner(operationFixtureRequest(args), options),
     );
     vi.stubEnv('CLOUDFLARE_API_TOKEN', 'synthetic-invalid-token');
-    try {
-      await expect(
-        withTerminal(true, () =>
-          runCloudflareDeploy(root, { reuseExistingWorker: true }, silentCliLog, deps),
-        ),
-      ).rejects.toThrow('Cloudflare credentials from CLOUDFLARE_API_TOKEN were rejected');
-      expect(readExistingWorker).toHaveBeenCalledTimes(1);
-      expect(wranglerArgs.some((args) => args[0] === 'login')).toBe(false);
-    } finally {
-      vi.unstubAllEnvs();
-    }
+    await expect(
+      withTerminal(true, () =>
+        runCloudflareDeploy(root, { reuseExistingWorker: true }, silentCliLog, deps),
+      ),
+    ).rejects.toThrow('Cloudflare credentials from CLOUDFLARE_API_TOKEN were rejected');
+    expect(readExistingWorker).toHaveBeenCalledTimes(1);
+    expect(wranglerArgs.some((args) => args[0] === 'login')).toBe(false);
   });
   it('does not repeat login when the Worker read still fails after sign-in', async () => {
     const root = site();
@@ -877,7 +836,7 @@ describe('existing Cloudflare site handoff', () => {
     expect(readCloudflareLink(root)).toBeNull();
   });
   it('retains the link guard after a failed build and verifies the Worker again on retry', async () => {
-    const root = site();
+    const root = migratedSite();
     mkdirSync(join(root, 'pages'));
     writeFileSync(join(root, 'pages/index.tsx'), 'export default () => null;');
     writeFileSync(join(root, 'pages/index.server.ts'), 'export const prerender = true;');
@@ -1109,7 +1068,7 @@ describe('existing Cloudflare site handoff', () => {
   it.each(['prerender', 'markdown', 'revalidate'])(
     'keeps the declined ISR choice on subsequent deploys for a %s site',
     async (mode) => {
-      const root = site();
+      const root = migratedSite();
       mkdirSync(join(root, 'pages'));
       if (mode === 'markdown') {
         writeFileSync(join(root, 'pages/index.md'), '# Home');
@@ -1138,7 +1097,9 @@ describe('existing Cloudflare site handoff', () => {
       expect(wranglerArgs.some((args) => ['kv', 'containers', 'secret'].includes(args[0]!))).toBe(
         false,
       );
-      expect(parseRootWranglerConfig(join(root, 'wrangler.jsonc')).kv_namespaces).toBeUndefined();
+      expect(
+        parseRootWranglerConfig(join(root, '.void-wrangler.jsonc')).kv_namespaces,
+      ).toBeUndefined();
       expect(
         parseRootWranglerConfig(join(root, 'dist/ssr/wrangler.json')).kv_namespaces,
       ).toBeUndefined();
@@ -1152,7 +1113,7 @@ describe('existing Cloudflare site handoff', () => {
       const { desired } = await computeDesiredCloudflareResources(
         root,
         readConfig(root),
-        join(root, 'wrangler.jsonc'),
+        join(root, '.void-wrangler.jsonc'),
       );
       expect(desired.kvNamespaces).toEqual([]);
     },
@@ -1207,7 +1168,7 @@ describe('existing Cloudflare site handoff', () => {
   });
 
   it('rejects an ISR namespace added by the build during handoff', async () => {
-    const root = site();
+    const root = migratedSite();
     mkdirSync(join(root, 'pages'));
     writeFileSync(join(root, 'pages/index.md'), '# Home');
     const { deps, trace } = harness({
@@ -1239,6 +1200,7 @@ describe('existing Cloudflare site handoff', () => {
       if (configured) {
         writeFileSync(join(root, 'void.json'), JSON.stringify({ routing: { isr: true } }));
       }
+      migrateLegacyVoidConfig(root);
       const confirmIsrSetup = vi.fn().mockResolvedValue(true);
       const provision = vi
         .fn<NonNullable<CloudflareDeployDeps['provision']>>()
@@ -1313,7 +1275,7 @@ describe('existing Cloudflare site handoff', () => {
   );
 
   it('reuses the cache recorded before a provisioning failure when retrying the handoff', async () => {
-    const root = site();
+    const root = migratedSite();
     mkdirSync(join(root, 'pages'));
     writeFileSync(join(root, 'pages/index.md'), '# Home');
     const confirmIsrSetup = vi.fn().mockResolvedValue(true);
@@ -1936,6 +1898,7 @@ describe('runCloudflareDeploy — PostgreSQL checked-in migrations', () => {
   }
 
   it('requires DATABASE_URL before any account operation when pg migrations are checked in', async () => {
+    vi.stubEnv('DATABASE_URL', undefined);
     const root = pgProject({
       'db/migrations/0000_init.sql': 'CREATE TABLE notes (id integer primary key);',
     });
@@ -1949,7 +1912,7 @@ describe('runCloudflareDeploy — PostgreSQL checked-in migrations', () => {
   });
 
   it('validates and applies pg migrations before uploading the Worker', async () => {
-    process.env.DATABASE_URL = 'postgresql://prod.example/app';
+    vi.stubEnv('DATABASE_URL', 'postgresql://prod.example/app');
     const root = pgProject({
       'db/migrations/0000_init.sql': 'CREATE TABLE notes (id integer primary key);',
     });
@@ -1980,13 +1943,13 @@ describe('runCloudflareDeploy — PostgreSQL checked-in migrations', () => {
     const { deps, wranglerArgs, exitCalls } = harness();
     await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
     expect(exitCalls).toEqual([]);
-    // Reached the upload, and no D1 migrate ran (a pg app has no desired.d1).
+    // Reached the upload, and no D1 command ran (a pg app has no desired.d1).
     expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(true);
-    expect(wranglerArgs.some((a) => a[0] === 'd1' && a[2] === 'apply')).toBe(false);
+    expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
   });
 
   it('applies a pg migration added by the build before uploading', async () => {
-    process.env.DATABASE_URL = 'postgresql://prod.example/app';
+    vi.stubEnv('DATABASE_URL', 'postgresql://prod.example/app');
     const root = pgProject();
     const { deps, trace, wranglerArgs, exitCalls } = harness({
       runBuild: () => {
@@ -2047,8 +2010,8 @@ function kvAndIsrProject(workerName: string, wrangler: Record<string, unknown> =
 }
 
 describe('computeDesiredCloudflareResources — suffixed names survive the 63-char cap', () => {
-  // 61 is already over budget for `-isr-cache`; 62+ used to lose BOTH suffixes, so
-  // `KV` and `ISR_CACHE` asked for one title and landed on one namespace.
+  // From 61 chars the cap must trim the worker name, not the suffix, or `KV` and `ISR_CACHE`
+  // would ask for one title and land on one namespace.
   for (const length of [61, 62, 63, 70, 100]) {
     it(`keeps KV and ISR_CACHE on distinct titles for a ${length}-char worker name`, async () => {
       const workerName = workerNameOfLength(length);
@@ -2439,10 +2402,8 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
       'wrangler.jsonc': JSON.stringify({ account_id: 'acc123' }),
       'dist/index.html': '<h1>Access</h1>',
     });
-    const previousId = process.env.CF_ACCESS_CLIENT_ID;
-    const previousSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    process.env.CF_ACCESS_CLIENT_ID = 'service-id';
-    process.env.CF_ACCESS_CLIENT_SECRET = 'service-secret';
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', 'service-id');
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'service-secret');
     let readinessHeaders: Readonly<Record<string, string>> | undefined;
     const { deps, exitCalls } = harness({
       activateVersion: async (options) => {
@@ -2458,25 +2419,12 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
       },
     });
 
-    try {
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-      expect(exitCalls).toEqual([]);
-      expect(readinessHeaders).toEqual({
-        'CF-Access-Client-Id': 'service-id',
-        'CF-Access-Client-Secret': 'service-secret',
-      });
-    } finally {
-      if (previousId === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_ID;
-      } else {
-        process.env.CF_ACCESS_CLIENT_ID = previousId;
-      }
-      if (previousSecret === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_SECRET;
-      } else {
-        process.env.CF_ACCESS_CLIENT_SECRET = previousSecret;
-      }
-    }
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    expect(exitCalls).toEqual([]);
+    expect(readinessHeaders).toEqual({
+      'CF-Access-Client-Id': 'service-id',
+      'CF-Access-Client-Secret': 'service-secret',
+    });
   });
 
   it('passes a short-lived Access user JWT to the guarded readiness probe', async () => {
@@ -2486,14 +2434,10 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
       'wrangler.jsonc': JSON.stringify({ account_id: 'acc123' }),
       'dist/index.html': '<h1>Access</h1>',
     });
-    const previousToken = process.env.CF_ACCESS_TOKEN;
-    const previousId = process.env.CF_ACCESS_CLIENT_ID;
-    const previousSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    const previousSubdomain = process.env.CLOUDFLARE_WORKERS_SUBDOMAIN;
-    delete process.env.CF_ACCESS_CLIENT_ID;
-    delete process.env.CF_ACCESS_CLIENT_SECRET;
-    process.env.CF_ACCESS_TOKEN = 'short-lived-user-jwt';
-    process.env.CLOUDFLARE_WORKERS_SUBDOMAIN = 'developer-platform-experience';
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', undefined);
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', undefined);
+    vi.stubEnv('CF_ACCESS_TOKEN', 'short-lived-user-jwt');
+    vi.stubEnv('CLOUDFLARE_WORKERS_SUBDOMAIN', 'developer-platform-experience');
     let readinessHeaders: Readonly<Record<string, string>> | undefined;
     let readinessHeadersWorkersDevSubdomain: string | undefined;
     const { deps, exitCalls } = harness({
@@ -2509,33 +2453,10 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
       },
     });
 
-    try {
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-      expect(exitCalls).toEqual([]);
-      expect(readinessHeaders).toEqual({ 'cf-access-token': 'short-lived-user-jwt' });
-      expect(readinessHeadersWorkersDevSubdomain).toBe('developer-platform-experience');
-    } finally {
-      if (previousToken === undefined) {
-        delete process.env.CF_ACCESS_TOKEN;
-      } else {
-        process.env.CF_ACCESS_TOKEN = previousToken;
-      }
-      if (previousId === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_ID;
-      } else {
-        process.env.CF_ACCESS_CLIENT_ID = previousId;
-      }
-      if (previousSecret === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_SECRET;
-      } else {
-        process.env.CF_ACCESS_CLIENT_SECRET = previousSecret;
-      }
-      if (previousSubdomain === undefined) {
-        delete process.env.CLOUDFLARE_WORKERS_SUBDOMAIN;
-      } else {
-        process.env.CLOUDFLARE_WORKERS_SUBDOMAIN = previousSubdomain;
-      }
-    }
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    expect(exitCalls).toEqual([]);
+    expect(readinessHeaders).toEqual({ 'cf-access-token': 'short-lived-user-jwt' });
+    expect(readinessHeadersWorkersDevSubdomain).toBe('developer-platform-experience');
   });
 
   it('builds and deploys an unconfigured Vite SPA', async () => {
@@ -2560,42 +2481,27 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
   });
 
   it('scrubs stale managed markers from a native static build', async () => {
-    const savedProjectId = process.env.VOID_DEPLOY_PROJECT_ID;
-    const savedManagedBuild = process.env.VOID_DEPLOY_BUILD;
-    process.env.VOID_DEPLOY_PROJECT_ID = 'stale-managed-project';
-    process.env.VOID_DEPLOY_BUILD = '1';
+    vi.stubEnv('VOID_DEPLOY_PROJECT_ID', 'stale-managed-project');
+    vi.stubEnv('VOID_DEPLOY_BUILD', '1');
     let buildEnvSeen: NodeJS.ProcessEnv = {};
-    try {
-      const root = makeProject({
-        'package.json': JSON.stringify({ name: 'viteapp', dependencies: { vite: '6.0.0' } }),
-        'void.json': JSON.stringify({}),
-        'wrangler.jsonc': JSON.stringify({ account_id: 'acc123' }),
-        'index.html': '<!doctype html><div id="app"></div>',
-      });
-      const { deps } = harness({
-        runStaticBuild: (_command, env) => {
-          buildEnvSeen = { ...env };
-          mkdirSync(join(root, 'dist'), { recursive: true });
-          writeFileSync(join(root, 'dist/index.html'), '<h1>Built</h1>');
-        },
-      });
+    const root = makeProject({
+      'package.json': JSON.stringify({ name: 'viteapp', dependencies: { vite: '6.0.0' } }),
+      'void.json': JSON.stringify({}),
+      'wrangler.jsonc': JSON.stringify({ account_id: 'acc123' }),
+      'index.html': '<!doctype html><div id="app"></div>',
+    });
+    const { deps } = harness({
+      runStaticBuild: (_command, env) => {
+        buildEnvSeen = { ...env };
+        mkdirSync(join(root, 'dist'), { recursive: true });
+        writeFileSync(join(root, 'dist/index.html'), '<h1>Built</h1>');
+      },
+    });
 
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
 
-      expect(buildEnvSeen.VOID_DEPLOY_PROJECT_ID).toBeUndefined();
-      expect(buildEnvSeen.VOID_DEPLOY_BUILD).toBeUndefined();
-    } finally {
-      if (savedProjectId === undefined) {
-        delete process.env.VOID_DEPLOY_PROJECT_ID;
-      } else {
-        process.env.VOID_DEPLOY_PROJECT_ID = savedProjectId;
-      }
-      if (savedManagedBuild === undefined) {
-        delete process.env.VOID_DEPLOY_BUILD;
-      } else {
-        process.env.VOID_DEPLOY_BUILD = savedManagedBuild;
-      }
-    }
+    expect(buildEnvSeen.VOID_DEPLOY_PROJECT_ID).toBeUndefined();
+    expect(buildEnvSeen.VOID_DEPLOY_BUILD).toBeUndefined();
   });
 
   it('rejects a forged candidate receipt written by a static build hook', async () => {
@@ -2638,28 +2544,14 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
   });
 
   it('authenticates an env-pinned static deploy before its config file exists', async () => {
-    const saved = process.env.CLOUDFLARE_ACCOUNT_ID;
-    process.env.CLOUDFLARE_ACCOUNT_ID = 'env-account';
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', 'env-account');
     const root = makeProject({
       'package.json': JSON.stringify({ name: 'static-env-app' }),
       'void.json': JSON.stringify({}),
       'public/index.html': '<h1>Static</h1>',
     });
     const { deps, wranglerArgs, exitCalls } = harness();
-    try {
-      await runCloudflareDeploy(
-        root,
-        { platform: 'cloudflare', dir: 'public' },
-        silentCliLog,
-        deps,
-      );
-    } finally {
-      if (saved === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = saved;
-      }
-    }
+    await runCloudflareDeploy(root, { platform: 'cloudflare', dir: 'public' }, silentCliLog, deps);
 
     expect(exitCalls).toEqual([]);
     expect(wranglerArgs.find((args) => args[0] === 'whoami')).toEqual([
@@ -2755,7 +2647,7 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
   });
 
   it('deploys a PostgreSQL app with auth after migrations and secret setup', async () => {
-    process.env.DATABASE_URL = 'postgresql://prod.example/app';
+    vi.stubEnv('DATABASE_URL', 'postgresql://prod.example/app');
     const root = makeProject({
       'package.json': JSON.stringify({ name: 'pgauth' }),
       'void.json': JSON.stringify({ database: 'pg', auth: {} }),
@@ -2971,11 +2863,9 @@ describe('runCloudflareDeploy — static, SPA, and SSG apps', () => {
     expect(trace).toContain('wrangler:deploy');
   });
 
-  it('A1: rejects a PRESENT-but-EMPTY migrations_pattern ("") before any account op', async () => {
-    // `migrations_pattern: ""` is present-but-empty. readStoredResourceName collapses it to
-    // `undefined` (== absent), so a length-based guard would wave it through as "default" — but
-    // wrangler 4.131 takes its non-default branch for ANY value that is not `undefined`, so an
-    // empty pattern diverges from the flat `*.sql` set this backend validates. Reject on presence.
+  it('rejects a PRESENT-but-EMPTY migrations_pattern ("") before any account op', async () => {
+    // Wrangler treats any pattern other than `undefined` as custom, so an empty one diverges from
+    // the flat `*.sql` set this backend validates.
     const root = d1Project({
       ...PROVISIONED_D1,
       d1_databases: [
@@ -3112,42 +3002,24 @@ describe('runCloudflareDeploy — preflight', () => {
   });
 
   it('exits when no account is pinned (no account_id, no CLOUDFLARE_ACCOUNT_ID)', async () => {
-    const savedAccount = process.env.CLOUDFLARE_ACCOUNT_ID;
-    delete process.env.CLOUDFLARE_ACCOUNT_ID;
-    try {
-      const root = d1Project({ ...PROVISIONED_D1, account_id: undefined });
-      const { deps, exitCalls } = harness();
-      await expect(
-        runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-      ).rejects.toBeInstanceOf(ExitError);
-      expect(exitCalls).toEqual([1]);
-    } finally {
-      if (savedAccount === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = savedAccount;
-      }
-    }
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', undefined);
+    const root = d1Project({ ...PROVISIONED_D1, account_id: undefined });
+    const { deps, exitCalls } = harness();
+    await expect(
+      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
+    ).rejects.toBeInstanceOf(ExitError);
+    expect(exitCalls).toEqual([1]);
   });
 
   it('authenticates an env-pinned Worker deploy before its config file exists', async () => {
-    const saved = process.env.CLOUDFLARE_ACCOUNT_ID;
-    process.env.CLOUDFLARE_ACCOUNT_ID = 'env-account';
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', 'env-account');
     const root = makeProject({
       'package.json': JSON.stringify({ name: 'worker-env-app' }),
       'void.json': JSON.stringify({}),
       'routes/index.ts': `export const GET = () => new Response('ok');`,
     });
     const { deps, wranglerArgs, exitCalls } = harness();
-    try {
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    } finally {
-      if (saved === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = saved;
-      }
-    }
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
 
     expect(exitCalls).toEqual([]);
     expect(wranglerArgs.find((args) => args[0] === 'whoami')).toEqual([
@@ -3276,40 +3148,31 @@ describe('runCloudflareDeploy — preflight', () => {
   });
 
   it('discovers and persists the only account on a first deploy', async () => {
-    const savedAccount = process.env.CLOUDFLARE_ACCOUNT_ID;
-    delete process.env.CLOUDFLARE_ACCOUNT_ID;
-    try {
-      const root = d1Project({ ...PROVISIONED_D1, account_id: undefined });
-      const { deps, exitCalls, wranglerArgs } = harness({
-        runWrangler: operationFixture((args) => {
-          wranglerArgs.push([...args]);
-          if (args[0] === 'whoami') {
-            return {
-              ...cleanExit,
-              stdout: JSON.stringify({
-                loggedIn: true,
-                accounts: [{ id: 'discovered-account', name: 'My account' }],
-              }),
-            };
-          }
-          return cleanExit;
-        }),
-      });
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', undefined);
+    const root = d1Project({ ...PROVISIONED_D1, account_id: undefined });
+    const { deps, exitCalls, wranglerArgs } = harness({
+      runWrangler: operationFixture((args) => {
+        wranglerArgs.push([...args]);
+        if (args[0] === 'whoami') {
+          return {
+            ...cleanExit,
+            stdout: JSON.stringify({
+              loggedIn: true,
+              accounts: [{ id: 'discovered-account', name: 'My account' }],
+            }),
+          };
+        }
+        return cleanExit;
+      }),
+    });
 
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
 
-      expect(exitCalls).toEqual([]);
-      expect(parseRootWranglerConfig(join(root, 'wrangler.jsonc'))).toMatchObject({
-        account_id: 'discovered-account',
-      });
-      expect(wranglerArgs.filter((args) => args[0] === 'whoami')).toHaveLength(2);
-    } finally {
-      if (savedAccount === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = savedAccount;
-      }
-    }
+    expect(exitCalls).toEqual([]);
+    expect(parseRootWranglerConfig(join(root, 'wrangler.jsonc'))).toMatchObject({
+      account_id: 'discovered-account',
+    });
+    expect(wranglerArgs.filter((args) => args[0] === 'whoami')).toHaveLength(2);
   });
 });
 
@@ -3494,58 +3357,13 @@ describe('runCloudflareDeploy — backwards-compatible provision flag', () => {
 });
 
 describe('runCloudflareDeploy — secrets gate', () => {
-  it('blocks when a schema-declared server key is present in the REAL emitted vars', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, trace, exitCalls } = harness({
-      resolveSchemaFacts: (() =>
-        okSchemaFacts({
-          hasSchema: true,
-          serverKeys: ['API_TOKEN'],
-          requiredKeys: ['API_TOKEN'],
-        })) as CloudflareDeployDeps['resolveSchemaFacts'],
-      readEmittedWorkerVars: (() =>
-        emittedVars({
-          API_TOKEN: 'sk-live-xyz',
-          APP_NAME: 'demo',
-        })) as CloudflareDeployDeps['readEmittedWorkerVars'],
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(trace).not.toContain('wrangler:deploy');
-  });
-
-  it('allows emitted client-prefixed vars', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, trace } = harness({
-      resolveSchemaFacts: (() =>
-        okSchemaFacts({
-          hasSchema: true,
-          serverKeys: [],
-          requiredKeys: [],
-        })) as CloudflareDeployDeps['resolveSchemaFacts'],
-      readEmittedWorkerVars: (() =>
-        emittedVars({
-          VITE_API_ORIGIN: 'https://example.com',
-        })) as CloudflareDeployDeps['readEmittedWorkerVars'],
-    });
-    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    expect(trace).toContain('wrangler:deploy');
-  });
-
   it('blocks with exit(1) when the gate discharge throws (missing required secret); never deploys or migrates remote', async () => {
     const { SelfHostEnvValidationError } = await import('../../src/cli/env-validation.ts');
     const root = d1Project(PROVISIONED_D1);
     const { deps, trace, wranglerArgs, exitCalls } = harness({
       dischargeSelfHostEnv: (async () => {
         trace.push('gate');
-        throw new SelfHostEnvValidationError('env: missing required secret STRIPE_KEY', {
-          valid: false,
-          missing: ['STRIPE_KEY'],
-          invalid: [],
-          values: new Map(),
-        });
+        throw new SelfHostEnvValidationError('env: missing required secret STRIPE_KEY');
       }) as CloudflareDeployDeps['dischargeSelfHostEnv'],
     });
     await expect(
@@ -3564,7 +3382,7 @@ describe('runCloudflareDeploy — secrets gate', () => {
     const root = d1Project(PROVISIONED_D1);
     const { deps, exitCalls } = harness({
       dischargeSelfHostEnv: (async () => {
-        throw new SelfHostFirstDeployError('worker not deployed yet', ['STRIPE_KEY'], 1);
+        throw new SelfHostFirstDeployError('worker not deployed yet');
       }) as CloudflareDeployDeps['dischargeSelfHostEnv'],
     });
     await expect(
@@ -3655,10 +3473,7 @@ describe('runCloudflareDeploy — secrets gate', () => {
           serverKeys: ['API_TOKEN'],
           requiredKeys: ['API_TOKEN'],
         })) as CloudflareDeployDeps['resolveSchemaFacts'],
-      dischargeSelfHostEnv: async () => ({
-        hasSchema: true,
-        remoteSecretNames: ['API_TOKEN'],
-      }),
+      dischargeSelfHostEnv: async () => {},
       activateVersion: async (options) => {
         explicitBootstrapProof = options.allowFirstDeploymentBootstrap;
         return activateCloudflareVersionPrimitive({
@@ -3687,29 +3502,6 @@ describe('runCloudflareDeploy — secrets gate', () => {
   });
 });
 
-describe('runCloudflareDeploy — pg/Hyperdrive app skips D1 migrations', () => {
-  it('does not call `d1 migrations apply` for a PostgreSQL app', async () => {
-    const root = makeProject({
-      'package.json': JSON.stringify({ name: 'pgapp' }),
-      'void.json': JSON.stringify({ database: 'pg' }),
-      'routes/index.ts': `export const GET = () => new Response('ok');`,
-      'wrangler.jsonc': JSON.stringify(
-        {
-          account_id: 'acc123',
-          name: 'pgapp',
-          hyperdrive: [{ binding: 'HYPERDRIVE', id: REAL_KV_ID }],
-        },
-        null,
-        2,
-      ),
-    });
-    const { deps, wranglerArgs, trace } = harness();
-    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
-    expect(trace).toContain('wrangler:deploy');
-  });
-});
-
 describe('runCloudflareDeploy — D1 migrations_dir gate', () => {
   it('does not reprovision an already configured D1 database on a normal deploy', async () => {
     const root = d1Project(PROVISIONED_D1);
@@ -3721,21 +3513,6 @@ describe('runCloudflareDeploy — D1 migrations_dir gate', () => {
     expect(trace).toContain('wrangler:deploy');
   });
 
-  it('rechecks replication for an existing D1 database when provisioning is requested', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, trace } = harness();
-
-    await runCloudflareDeploy(
-      root,
-      { platform: 'cloudflare', provision: true },
-      silentCliLog,
-      deps,
-    );
-
-    expect(trace).toContain('provision');
-    expect(trace).toContain('wrangler:deploy');
-  });
-
   it('automatically reconciles a missing migrations_dir before applying D1 migrations', async () => {
     const root = d1Project(
       {
@@ -3884,7 +3661,7 @@ describe('runCloudflareDeploy — pre-build queue existence probe', () => {
       toSlash(join(root, 'wrangler.jsonc')),
       '--env=',
     ]);
-    // The probe runs at step 4 — ahead of the build and everything downstream of it.
+    // The probe runs before the build and everything after it.
     expect(trace.indexOf('wrangler:queues')).toBeLessThan(trace.indexOf('build'));
     expect(trace).toContain('wrangler:deploy');
   });
@@ -4118,21 +3895,6 @@ describe('runCloudflareDeploy — skipped desired resource is fatal', () => {
   });
 });
 
-describe('runCloudflareDeploy — generated config verification', () => {
-  it('fails closed after build when the generated config mismatches; never deploys', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, trace, exitCalls } = harness({
-      verifyDeployConfig: () => ({ ok: false, reason: 'account mismatch' }),
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(trace).toContain('build'); // build ran
-    expect(trace).not.toContain('wrangler:deploy'); // deploy blocked
-  });
-});
-
 describe('runCloudflareDeploy — non-Cloudflare target guard', () => {
   for (const target of ['node', 'bun', 'deno'] as const) {
     it(`rejects the "${target}" target before any account/provision op`, async () => {
@@ -4172,56 +3934,47 @@ describe('runCloudflareDeploy — worker-name override (WRANGLER_CI_OVERRIDE_NAM
   });
 
   it('ignores an ambient WRANGLER_CI_OVERRIDE_NAME — deploys the derived (non-override) name', async () => {
-    const saved = process.env.WRANGLER_CI_OVERRIDE_NAME;
-    process.env.WRANGLER_CI_OVERRIDE_NAME = 'evil-name';
-    try {
-      // Root config has NO top-level name → the worker name is derived from package.json,
-      // NOT the ambient override.
-      const root = makeProject({
-        'package.json': JSON.stringify({ name: 'myapp' }),
-        'void.json': JSON.stringify({}),
-        'routes/index.ts': `export const GET = (c) => c.env.DB.prepare('SELECT 1').first();`,
-        'wrangler.jsonc': JSON.stringify(
-          {
-            account_id: 'acc123',
-            d1_databases: [
-              {
-                binding: 'DB',
-                database_name: 'myapp-db',
-                database_id: REAL_D1_ID,
-                migrations_dir: './db/migrations',
-              },
-            ],
-          },
-          null,
-          2,
-        ),
-      });
-      let deployedWorker: unknown;
-      const cliLog: CliLogger = {
-        ...silentCliLog,
-        info(event: string, fields?: Record<string, unknown>) {
-          if (event === 'cloudflare_deploy_end') {
-            deployedWorker = fields?.worker;
-          }
+    vi.stubEnv('WRANGLER_CI_OVERRIDE_NAME', 'evil-name');
+    // Root config has NO top-level name → the worker name is derived from package.json,
+    // NOT the ambient override.
+    const root = makeProject({
+      'package.json': JSON.stringify({ name: 'myapp' }),
+      'void.json': JSON.stringify({}),
+      'routes/index.ts': `export const GET = (c) => c.env.DB.prepare('SELECT 1').first();`,
+      'wrangler.jsonc': JSON.stringify(
+        {
+          account_id: 'acc123',
+          d1_databases: [
+            {
+              binding: 'DB',
+              database_name: 'myapp-db',
+              database_id: REAL_D1_ID,
+              migrations_dir: './db/migrations',
+            },
+          ],
         },
-      };
-      const { deps, trace } = harness();
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, cliLog, deps);
-      expect(trace).toContain('wrangler:deploy');
-      expect(deployedWorker).toBe('myapp');
-      // The pinned root config name is the derived name, never the override.
-      const written = JSON.parse(readFileSync(join(root, 'wrangler.jsonc'), 'utf-8')) as {
-        name?: string;
-      };
-      expect(written.name).toBe('myapp');
-    } finally {
-      if (saved === undefined) {
-        delete process.env.WRANGLER_CI_OVERRIDE_NAME;
-      } else {
-        process.env.WRANGLER_CI_OVERRIDE_NAME = saved;
-      }
-    }
+        null,
+        2,
+      ),
+    });
+    let deployedWorker: unknown;
+    const cliLog: CliLogger = {
+      ...silentCliLog,
+      info(event: string, fields?: Record<string, unknown>) {
+        if (event === 'cloudflare_deploy_end') {
+          deployedWorker = fields?.worker;
+        }
+      },
+    };
+    const { deps, trace } = harness();
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, cliLog, deps);
+    expect(trace).toContain('wrangler:deploy');
+    expect(deployedWorker).toBe('myapp');
+    // The pinned root config name is the derived name, never the override.
+    const written = JSON.parse(readFileSync(join(root, 'wrangler.jsonc'), 'utf-8')) as {
+      name?: string;
+    };
+    expect(written.name).toBe('myapp');
   });
 });
 
@@ -4275,23 +4028,14 @@ describe('runCloudflareDeploy — build-config override fences', () => {
   });
 
   it('fails closed on an ambient CLOUDFLARE_ENV (non-top-level target)', async () => {
-    const saved = process.env.CLOUDFLARE_ENV;
-    process.env.CLOUDFLARE_ENV = 'staging';
-    try {
-      const root = d1Project(PROVISIONED_D1);
-      const { deps, trace, exitCalls } = harness();
-      await expect(
-        runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-      ).rejects.toBeInstanceOf(ExitError);
-      expect(exitCalls).toEqual([1]);
-      expect(trace).toEqual([]);
-    } finally {
-      if (saved === undefined) {
-        delete process.env.CLOUDFLARE_ENV;
-      } else {
-        process.env.CLOUDFLARE_ENV = saved;
-      }
-    }
+    vi.stubEnv('CLOUDFLARE_ENV', 'staging');
+    const root = d1Project(PROVISIONED_D1);
+    const { deps, trace, exitCalls } = harness();
+    await expect(
+      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
+    ).rejects.toBeInstanceOf(ExitError);
+    expect(exitCalls).toEqual([1]);
+    expect(trace).toEqual([]);
   });
 });
 
@@ -4350,8 +4094,7 @@ describe('runCloudflareDeploy — D1 migrate targets the unique validated entry'
       runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
     ).rejects.toBeInstanceOf(ExitError);
     expect(exitCalls).toEqual([1]);
-    // The migrate-target gate runs POST-build now, so the build ran — but it fails closed
-    // before any `d1 migrations apply` and before the deploy.
+    // The migrate-target gate runs post-build, before any `d1 migrations apply` or deploy.
     expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
     expect(trace).toContain('build');
     expect(trace).not.toContain('wrangler:deploy');
@@ -4429,74 +4172,14 @@ describe('runCloudflareDeploy — wrangler implicit provisioning disabled on dep
   });
 });
 
-// ---------------------------------------------------------------------------
-// The pass-through assert-set is DERIVED from the wrangler binding registry
-// (FRIENDLY_BINDING_NAMES) minus the fields Void's own build emits — so it is
-// complete-by-construction (every capability field is covered) and a new registry
-// field fails CLOSED (asserted until explicitly excluded).
-// ---------------------------------------------------------------------------
-
-describe('DEPLOY_PASSTHROUGH_ASSERT_FIELDS — registry-derived composition', () => {
-  it('covers the capability singletons + the `unsafe` escape hatch (previously unguarded)', () => {
-    for (const field of ['browser', 'images', 'stream', 'media', 'websearch', 'unsafe']) {
-      expect(DEPLOY_PASSTHROUGH_ASSERT_FIELDS).toContain(field);
-    }
-  });
-
-  it('excludes every id-pinned + Void-emitted + bundled-content field (no double-assert)', () => {
-    for (const field of ['d1_databases', 'kv_namespaces', 'r2_buckets', 'hyperdrive']) {
-      expect(DEPLOY_PASSTHROUGH_ASSERT_FIELDS).not.toContain(field);
-    }
-    for (const field of ['ai', 'durable_objects', 'assets', 'vars']) {
-      expect(DEPLOY_PASSTHROUGH_ASSERT_FIELDS).not.toContain(field);
-    }
-  });
-
+// The pass-through assert-set is every registry field minus these exclusions, so a typo here
+// would silently assert a field Void emits.
+describe('DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS', () => {
   it('every excluded field is a REAL registry key (no typos)', () => {
     for (const field of DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS) {
       expect(FRIENDLY_BINDING_NAMES).toHaveProperty(field);
     }
   });
-
-  it('EXCLUDE ∪ ASSERT === keys(FRIENDLY_BINDING_NAMES) — a new registry field forces a choice', () => {
-    const union = new Set<string>([
-      ...DEPLOY_PASSTHROUGH_ASSERT_FIELDS,
-      ...DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS,
-    ]);
-    expect([...union].sort()).toEqual(Object.keys(FRIENDLY_BINDING_NAMES).sort());
-    // Partition (no field is both asserted and excluded).
-    for (const field of DEPLOY_PASSTHROUGH_ASSERT_FIELDS) {
-      expect(DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS.has(field)).toBe(false);
-    }
-  });
-
-  it('whole-object-pins unsafe, the tail-consumer fields, the traffic-attachment fields, and addresses (the entry pin cannot see them)', () => {
-    expect([...DEPLOY_WHOLE_OBJECT_PINNED_FIELDS].sort()).toEqual([
-      'addresses',
-      'preview_urls',
-      'route',
-      'routes',
-      'streaming_tail_consumers',
-      'tail_consumers',
-      'unsafe',
-      'workers_dev',
-    ]);
-    // `unsafe` stays in the assert-set (drift invariant) but is routed to the whole-object pin.
-    expect(DEPLOY_PASSTHROUGH_ASSERT_FIELDS).toContain('unsafe');
-    // The tail-consumer + traffic-attachment + inbound-mail fields are NOT bindings, so the
-    // assert-set structurally cannot see them — only the whole-object pin covers them.
-    for (const field of [
-      'tail_consumers',
-      'streaming_tail_consumers',
-      'routes',
-      'route',
-      'workers_dev',
-      'preview_urls',
-      'addresses',
-    ]) {
-      expect(FRIENDLY_BINDING_NAMES).not.toHaveProperty(field);
-    }
-  });
 });
 
 describe('verifyGeneratedDeployConfig', () => {
@@ -4509,15 +4192,6 @@ describe('verifyGeneratedDeployConfig', () => {
     });
   }
 
-  it('passes when account_id and name match the pinned target', () => {
-    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp' });
-    expect(verifyGeneratedDeployConfig(root, { accountId: 'acc123', workerName: 'myapp' })).toEqual(
-      {
-        ok: true,
-      },
-    );
-  });
-
   it('accepts comments and trailing commas in a generated JSONC config', () => {
     const root = deployConfigProject({ account_id: 'acc123', name: 'myapp' });
     writeFileSync(
@@ -4712,9 +4386,8 @@ describe('verifyGeneratedDeployConfig', () => {
   });
 
   it('passes with the full non-id binding set a real build emits (allow-list is exercised)', () => {
-    // The critical no-regression shape: every id-bearing binding matches the snapshot, and the
-    // artifact ALSO carries the ai/queues/DO/vars/empty-array bindings a real Class-A build emits.
-    // None of those non-id bindings is in the snapshot, yet the check must not reject them.
+    // Every id-bearing binding matches the snapshot, and the artifact also carries the non-id
+    // bindings a real Class-A build emits. None of those is in the snapshot; none may be rejected.
     const snapshot = snapshotBindingIdentities({
       d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: REAL_D1_ID }],
       kv_namespaces: [{ binding: 'KV', id: REAL_KV_ID }],
@@ -4867,33 +4540,11 @@ describe('verifyGeneratedDeployConfig', () => {
     expect(result.reason).toMatch(/EXTRA_KV/);
   });
 
-  // --- Pass-through assert-set completeness (fields Void never emits) + queue ⊆ desired ---
-
-  it('passes the full kitchen-sink shape (empty resource arrays, DO/containers, desired queues)', () => {
-    // The critical no-regression: a real Class-A artifact carries empty assert-set arrays
-    // (services/vectorize/…), durable_objects/containers/migrations, and a queues block whose
-    // names Void derived from source. NONE may be rejected by the new assertions.
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      ...KITCHEN_SINK_NON_ID_BINDINGS,
-      d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: REAL_D1_ID }],
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { d1: { binding: 'DB', name: 'myapp-db' }, kvNamespaces: [], queues: ['jobs'] },
-      bindingIdentitySnapshot: snapshotBindingIdentities({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: REAL_D1_ID }],
-      }),
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(KITCHEN_SINK_NON_ID_BINDINGS),
-    });
-    expect(result).toEqual({ ok: true });
-  });
+  // --- Pass-through bindings (fields Void never emits) and queues ---
 
   it('fails closed when the build injects a services binding absent from the root snapshot', () => {
     // Root had no `services` pre-build; the artifact adds one binding to another same-account
-    // worker — a capability the source never asked for. (Reverting assertion A lets it through.)
+    // worker — a capability the source never asked for.
     const root = deployConfigProject({
       account_id: 'acc123',
       name: 'myapp',
@@ -4928,20 +4579,6 @@ describe('verifyGeneratedDeployConfig', () => {
     }
   });
 
-  it('passes a user hand-declared services binding present in the root snapshot, unchanged', () => {
-    // The legitimate-extra case: a user's own `services` binding was present before the build and
-    // the build left it untouched — completeness must NOT false-positive on a legit pass-through.
-    const rootConfig = { services: [{ binding: 'MY_SVC', service: 'my-other-worker' }] };
-    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp', ...rootConfig });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-    });
-    expect(result).toEqual({ ok: true });
-  });
-
   // --- Reverse-presence: a root-declared pass-through binding the build DROPPED is rejected ---
 
   it('fails closed when the build DROPS a root-declared services binding from the emitted config', () => {
@@ -4986,8 +4623,7 @@ describe('verifyGeneratedDeployConfig', () => {
   });
 
   it('passes when every pinned passthrough binding is still present in the emitted config', () => {
-    // No-regression for the reverse loop: all root-declared pass-through bindings survive the build
-    // byte-identical, so neither the forward nor the reverse loop objects.
+    // Every root-declared pass-through binding survives the build byte-identical.
     const rootConfig = {
       services: [{ binding: 'SVC', service: 'worker-a' }],
       mtls_certificates: [{ binding: 'CERT', certificate_id: 'cert-1' }],
@@ -5072,18 +4708,6 @@ describe('verifyGeneratedDeployConfig', () => {
     expect(result.reason).toMatch(/producer and a consumer/);
   });
 
-  it('passes when there are no desired queues and none are emitted', () => {
-    // No-regression: an app with no queues emits no `queues` field, and the per-group check has
-    // nothing to require — the empty desired set passes.
-    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp' });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-    });
-    expect(result).toEqual({ ok: true });
-  });
-
   it('does NOT reject an unknown/future resource field the emitted artifact declares (fail-open)', () => {
     // A field not in the assert-set must never false-positive — a future wrangler resource field
     // Void does not know about is simply not asserted.
@@ -5165,25 +4789,7 @@ describe('verifyGeneratedDeployConfig', () => {
     }
   });
 
-  it('passes a byte-identical pass-through entry (no normalizer key is added to a present entry)', () => {
-    // The real toolchain leaves a present pass-through entry byte-identical, so exact equality holds
-    // for a legitimate build — no regression from the exact-compare tightening.
-    const rootConfig = { services: [{ binding: 'MY_SVC', service: 'my-worker' }] };
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      services: [{ binding: 'MY_SVC', service: 'my-worker' }],
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-    });
-    expect(result).toEqual({ ok: true });
-  });
-
-  // --- Capability singletons + the `unsafe` escape hatch (previously unguarded fields) ---
+  // --- Capability singletons + the `unsafe` escape hatch ---
 
   it('fails closed when the build injects a capability singleton absent from the root', () => {
     for (const field of ['browser', 'images', 'stream', 'media', 'websearch'] as const) {
@@ -5204,60 +4810,6 @@ describe('verifyGeneratedDeployConfig', () => {
     }
   });
 
-  it('fails closed when the build injects an `unsafe` object absent from the root (metadata bindings)', () => {
-    // `unsafe.metadata.bindings` is never entry-iterated, yet wrangler applies it LAST at upload,
-    // OVERWRITING the whole uploaded bindings array. The whole-object pin catches an injected
-    // `unsafe` even when its capability lives under `.metadata`, not `.bindings`.
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      unsafe: { metadata: { bindings: [{ name: 'X', type: 'service', service: 'evil' }] } },
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities({}),
-      passthroughRawFields: snapshotPassthroughRawFields({}),
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/unsafe/);
-  });
-
-  it('fails closed when the build rewrites a root-declared `unsafe` object', () => {
-    // The whole `unsafe` object is pinned, so any rewrite (here the nested binding `.type`) fails.
-    const rootConfig = { unsafe: { bindings: [{ name: 'X', type: 'secret_text' }] } };
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      unsafe: { bindings: [{ name: 'X', type: 'plain_text' }] },
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-      passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/unsafe/);
-  });
-
-  it('passes a root-declared `unsafe` object emitted byte-identical', () => {
-    const rootConfig = {
-      unsafe: { metadata: { bindings: [{ name: 'X', type: 'service', service: 'my-worker' }] } },
-    };
-    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp', ...rootConfig });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-      passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
-    });
-    expect(result).toEqual({ ok: true });
-  });
-
   it('accepts clean artifacts without optional bindings or traffic attachments', () => {
     const root = deployConfigProject({ account_id: 'acc123', name: 'myapp' });
     const result = verifyGeneratedDeployConfig(root, {
@@ -5270,7 +4822,7 @@ describe('verifyGeneratedDeployConfig', () => {
     expect(result).toEqual({ ok: true });
   });
 
-  // --- FALSE-POSITIVE LOCKS: the normalizer defaults that MUST keep passing ---
+  // --- Normalizer defaults that must keep passing ---
 
   it('passes empty-array assert fields the normalizer default-fills (services:[] / vectorize:[] / …)', () => {
     const root = deployConfigProject({
@@ -5306,192 +4858,93 @@ describe('verifyGeneratedDeployConfig', () => {
     expect(result).toEqual({ ok: true });
   });
 
-  // --- Traffic attachment (routes / route / workers_dev / preview_urls — Void emits none) ---
-
-  it('fails closed when the build injects a routes entry absent from the root (traffic hijack)', () => {
-    // The build attaches the worker to a production hostname/path the account controls by injecting
-    // `routes`. The root declared none, so the whole-object pin rejects it.
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      routes: [{ pattern: 'victim.example.com/*', zone_name: 'victim.example.com' }],
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities({}),
-      passthroughRawFields: snapshotPassthroughRawFields({}),
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/routes/);
-  });
+  // --- Whole-object fields: `unsafe` (wrangler applies its metadata over every uploaded binding),
+  // the traffic attachment and tail consumers. None is an entry the binding pin can see. ---
 
-  it('fails closed when the build injects a single `route` string absent from the root', () => {
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      route: 'victim.example.com/*',
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities({}),
-      passthroughRawFields: snapshotPassthroughRawFields({}),
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/route/);
-  });
-
-  it('passes a root-declared routes emitted byte-identical', () => {
-    // A user who legitimately declared `routes` in wrangler.jsonc: the build spreads it verbatim, so
-    // the emitted value is byte-identical and passes. (Verified against a real build.)
-    const rootConfig = {
-      routes: [{ pattern: 'app.example.com/*', zone_name: 'app.example.com' }],
-    };
-    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp', ...rootConfig });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-      passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
-    });
-    expect(result).toEqual({ ok: true });
-  });
-
-  it('fails closed when the build flips a root-declared workers_dev from false to true', () => {
-    // `workers_dev:false` is non-empty (isEmptyPassthroughValue(false) is false), so a root that
-    // declared it false and an emitted `true` are deepEqual-compared — flipping the public exposure
-    // is rejected. (A real build emits a declared `workers_dev:false` byte-identical.)
-    const rootConfig = { workers_dev: false };
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      workers_dev: true,
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-      passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/workers_dev/);
-  });
-
-  it('fails closed when the build injects workers_dev:true on a root that declared none', () => {
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      workers_dev: true,
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities({}),
-      passthroughRawFields: snapshotPassthroughRawFields({}),
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/workers_dev/);
-  });
-
-  it('passes a root-declared workers_dev:false emitted byte-identical', () => {
-    const rootConfig = { workers_dev: false, preview_urls: false };
-    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp', ...rootConfig });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-      passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
-    });
-    expect(result).toEqual({ ok: true });
-  });
-
-  // --- Tail consumers (log/request forwarding — not "bindings", so the assert-set can't see them) ---
-
-  for (const field of ['tail_consumers', 'streaming_tail_consumers'] as const) {
-    it(`fails closed when the build injects a ${field} entry absent from the root`, () => {
-      const root = deployConfigProject({
-        account_id: 'acc123',
-        name: 'myapp',
-        [field]: [{ service: 'evil-log-collector' }],
-      });
-      const result = verifyGeneratedDeployConfig(root, {
-        accountId: 'acc123',
-        workerName: 'myapp',
-        desired: { kvNamespaces: [], queues: [] },
-        passthroughIdentitySnapshot: snapshotPassthroughIdentities({}),
-        passthroughRawFields: snapshotPassthroughRawFields({}),
-      });
-      expect(result.ok).toBe(false);
-      expect(result.reason).toMatch(new RegExp(field));
-    });
-
-    it(`passes a root-declared ${field} emitted byte-identical`, () => {
-      const rootConfig = { [field]: [{ service: 'my-log-collector' }] };
-      const root = deployConfigProject({ account_id: 'acc123', name: 'myapp', ...rootConfig });
-      const result = verifyGeneratedDeployConfig(root, {
-        accountId: 'acc123',
-        workerName: 'myapp',
-        desired: { kvNamespaces: [], queues: [] },
-        passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-        passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
-      });
-      expect(result).toEqual({ ok: true });
-    });
-
-    it(`passes an emitted ${field} default-filled to an empty array`, () => {
-      const root = deployConfigProject({
-        account_id: 'acc123',
-        name: 'myapp',
-        [field]: [],
-      });
-      const result = verifyGeneratedDeployConfig(root, {
-        accountId: 'acc123',
-        workerName: 'myapp',
-        desired: { kvNamespaces: [], queues: [] },
-        passthroughIdentitySnapshot: snapshotPassthroughIdentities({}),
-        passthroughRawFields: snapshotPassthroughRawFields({}),
-      });
-      expect(result).toEqual({ ok: true });
-    });
-  }
-
-  // --- Symmetric empty check: a non-empty root emitted back EMPTY is a REMOVAL (rejected) ---
-
-  it('fails closed when the build empties a root-declared tail_consumers (disabling audit forwarding)', () => {
-    // The source forwarded logs to an audit collector; the build rewrote it to `[]`, which wrangler
-    // uploads as an explicit empty array — silently disabling the forwarding. The symmetric check
-    // rejects an emptied emitted value whenever the root declared a non-empty one.
-    const rootConfig = { tail_consumers: [{ service: 'audit-collector' }] };
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      tail_consumers: [],
-    });
-    const result = verifyGeneratedDeployConfig(root, {
-      accountId: 'acc123',
-      workerName: 'myapp',
-      desired: { kvNamespaces: [], queues: [] },
-      passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
-      passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/tail_consumers/);
-  });
-
-  it('fails closed when the build empties a root-declared streaming_tail_consumers', () => {
-    const rootConfig = { streaming_tail_consumers: [{ service: 'audit-collector' }] };
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      streaming_tail_consumers: [],
-    });
+  it.each<{
+    change: string;
+    rootConfig: Record<string, unknown>;
+    emitted: Record<string, unknown>;
+    reason: RegExp;
+  }>([
+    {
+      change: 'injects an `unsafe` object (metadata bindings)',
+      rootConfig: {},
+      emitted: {
+        unsafe: { metadata: { bindings: [{ name: 'X', type: 'service', service: 'evil' }] } },
+      },
+      reason: /unsafe/,
+    },
+    {
+      change: 'rewrites a root-declared `unsafe` object',
+      rootConfig: { unsafe: { bindings: [{ name: 'X', type: 'secret_text' }] } },
+      emitted: { unsafe: { bindings: [{ name: 'X', type: 'plain_text' }] } },
+      reason: /unsafe/,
+    },
+    {
+      change: 'empties a root-declared `unsafe` object',
+      rootConfig: { unsafe: { bindings: [{ name: 'X', type: 'plain_text' }] } },
+      emitted: { unsafe: { bindings: [] } },
+      reason: /unsafe/,
+    },
+    {
+      change: 'injects a routes entry',
+      rootConfig: {},
+      emitted: { routes: [{ pattern: 'victim.example.com/*', zone_name: 'victim.example.com' }] },
+      reason: /routes/,
+    },
+    {
+      change: 'injects a single `route` string',
+      rootConfig: {},
+      emitted: { route: 'victim.example.com/*' },
+      reason: /route/,
+    },
+    {
+      // `false` is a declared value, so flipping it is compared, not treated as empty.
+      change: 'flips a root-declared workers_dev from false to true',
+      rootConfig: { workers_dev: false },
+      emitted: { workers_dev: true },
+      reason: /workers_dev/,
+    },
+    {
+      change: 'injects workers_dev:true',
+      rootConfig: {},
+      emitted: { workers_dev: true },
+      reason: /workers_dev/,
+    },
+    {
+      change: 'injects preview_urls:true',
+      rootConfig: {},
+      emitted: { preview_urls: true },
+      reason: /preview_urls/,
+    },
+    {
+      change: 'injects a tail_consumers entry',
+      rootConfig: {},
+      emitted: { tail_consumers: [{ service: 'evil-log-collector' }] },
+      reason: /tail_consumers/,
+    },
+    {
+      change: 'injects a streaming_tail_consumers entry',
+      rootConfig: {},
+      emitted: { streaming_tail_consumers: [{ service: 'evil-log-collector' }] },
+      reason: /streaming_tail_consumers/,
+    },
+    {
+      // An emitted `[]` is uploaded as-is, which would silently disable the forwarding.
+      change: 'empties a root-declared tail_consumers',
+      rootConfig: { tail_consumers: [{ service: 'audit-collector' }] },
+      emitted: { tail_consumers: [] },
+      reason: /tail_consumers/,
+    },
+    {
+      change: 'empties a root-declared streaming_tail_consumers',
+      rootConfig: { streaming_tail_consumers: [{ service: 'audit-collector' }] },
+      emitted: { streaming_tail_consumers: [] },
+      reason: /streaming_tail_consumers/,
+    },
+  ])('fails closed when the build $change', ({ rootConfig, emitted, reason }) => {
+    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp', ...emitted });
     const result = verifyGeneratedDeployConfig(root, {
       accountId: 'acc123',
       workerName: 'myapp',
@@ -5500,16 +4953,57 @@ describe('verifyGeneratedDeployConfig', () => {
       passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
     });
     expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/streaming_tail_consumers/);
+    expect(result.reason).toMatch(reason);
   });
 
-  it('fails closed when the build empties a root-declared unsafe object', () => {
-    const rootConfig = { unsafe: { bindings: [{ name: 'X', type: 'plain_text' }] } };
-    const root = deployConfigProject({
-      account_id: 'acc123',
-      name: 'myapp',
-      unsafe: { bindings: [] },
-    });
+  it.each<{ value: string; rootConfig: Record<string, unknown>; emitted: Record<string, unknown> }>(
+    [
+      {
+        value: 'a root-declared `unsafe` object emitted byte-identical',
+        rootConfig: {
+          unsafe: {
+            metadata: { bindings: [{ name: 'X', type: 'service', service: 'my-worker' }] },
+          },
+        },
+        emitted: {
+          unsafe: {
+            metadata: { bindings: [{ name: 'X', type: 'service', service: 'my-worker' }] },
+          },
+        },
+      },
+      {
+        value: 'root-declared routes emitted byte-identical',
+        rootConfig: { routes: [{ pattern: 'app.example.com/*', zone_name: 'app.example.com' }] },
+        emitted: { routes: [{ pattern: 'app.example.com/*', zone_name: 'app.example.com' }] },
+      },
+      {
+        value: 'a root-declared workers_dev:false and preview_urls:false emitted byte-identical',
+        rootConfig: { workers_dev: false, preview_urls: false },
+        emitted: { workers_dev: false, preview_urls: false },
+      },
+      {
+        value: 'a root-declared tail_consumers emitted byte-identical',
+        rootConfig: { tail_consumers: [{ service: 'my-log-collector' }] },
+        emitted: { tail_consumers: [{ service: 'my-log-collector' }] },
+      },
+      {
+        value: 'a root-declared streaming_tail_consumers emitted byte-identical',
+        rootConfig: { streaming_tail_consumers: [{ service: 'my-log-collector' }] },
+        emitted: { streaming_tail_consumers: [{ service: 'my-log-collector' }] },
+      },
+      {
+        value: 'an emitted tail_consumers default-filled to an empty array',
+        rootConfig: {},
+        emitted: { tail_consumers: [] },
+      },
+      {
+        value: 'an emitted streaming_tail_consumers default-filled to an empty array',
+        rootConfig: {},
+        emitted: { streaming_tail_consumers: [] },
+      },
+    ],
+  )('passes $value', ({ rootConfig, emitted }) => {
+    const root = deployConfigProject({ account_id: 'acc123', name: 'myapp', ...emitted });
     const result = verifyGeneratedDeployConfig(root, {
       accountId: 'acc123',
       workerName: 'myapp',
@@ -5517,8 +5011,7 @@ describe('verifyGeneratedDeployConfig', () => {
       passthroughIdentitySnapshot: snapshotPassthroughIdentities(rootConfig),
       passthroughRawFields: snapshotPassthroughRawFields(rootConfig),
     });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/unsafe/);
+    expect(result).toEqual({ ok: true });
   });
 
   // --- External Durable Object (`script_name` targets another worker's DOs) ---
@@ -6180,15 +5673,9 @@ describe('verifyGeneratedDeployConfig', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Binding-identity pin: the id-bearing binding identities are snapshotted from the
-// root config AFTER provision/drift resolves them and BEFORE the (untrusted) build.
-// A compromised build dependency can only edit FILES (its credentials are scrubbed),
-// so it could rewrite `wrangler.jsonc`'s `d1_databases[DB].database_id` — keeping the
-// binding + database_name — to redirect the privileged remote migrate / deploy to a
-// DIFFERENT same-account resource. The migrate assert (step 9) and the emitted-config
-// check (step 10) both compare against the pre-build snapshot, mirroring the account_id pin.
-// ---------------------------------------------------------------------------
+// The id-bearing binding identities are pinned after provisioning and before the untrusted
+// build. A build can only edit files, so the remote migrate and the emitted-config check
+// compare against that pre-build snapshot rather than the (rewritable) root config.
 
 describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   /** The deploy pointer + emitted top-level config the CF plugin leaves behind after a build. */
@@ -6220,21 +5707,6 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
     d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: REAL_D1_ID }],
   };
 
-  it('passes a normal deploy where the build leaves the pinned binding ids unchanged', async () => {
-    // The critical no-regression case: provision-written id present pre-build, unchanged by the
-    // build → the migrate assert AND the emitted-config check both match the snapshot.
-    const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
-    const { deps, wranglerArgs, exitCalls } = harness({
-      runBuild: () => writeEmittedDeployArtifact(root, EMITTED_D1),
-      verifyDeployConfig: verifyGeneratedDeployConfig,
-    });
-    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    expect(exitCalls).toEqual([]);
-    // The remote migrate ran (identity pin matched) and the deploy proceeded.
-    expect(wranglerArgs.some((a) => a[0] === 'd1' && a[2] === 'apply')).toBe(true);
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(true);
-  });
-
   it('fails closed BEFORE the remote migrate when the build rewrites the D1 database_id', async () => {
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     const { deps, wranglerArgs, exitCalls } = harness({
@@ -6255,17 +5727,14 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
       runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
     ).rejects.toBeInstanceOf(ExitError);
     expect(exitCalls).toEqual([1]);
-    // The migrate seam was NOT invoked — no `d1 migrations apply`, no `d1 migrations list` — and
-    // nothing deployed. (Reverting the pin lets `d1 migrations apply` run against the wrong DB.)
+    // No `d1 migrations apply` / `list` ran against the swapped database, and nothing deployed.
     expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
     expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
   });
 
   it('fails closed at the emitted-config check when the build rewrites the D1 id in BOTH the root config and the artifact', async () => {
-    // No checked-in migrations → the remote-migrate assert is skipped, so the tamper must be
-    // caught at step 10. A CONSISTENT rewrite (root + emitted both carry the new id) would defeat
-    // a post-build root re-read; the pre-build snapshot still catches it. (Reverting the pin —
-    // which compared the artifact against a post-build root re-read — lets this deploy.)
+    // No checked-in migrations, so only the emitted-config check can catch it. A consistent
+    // rewrite would fool a post-build root re-read; the pre-build snapshot still catches it.
     const root = d1Project(PROVISIONED_D1);
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () => {
@@ -6287,8 +5756,7 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed at the emitted-config check when the build consistently rewrites a KV namespace id', async () => {
-    // A non-D1 id-bearing binding (KV) rewritten in BOTH root + artifact — caught at step 10
-    // against the snapshot, exactly as D1 is. No migrations → the D1 migrate seam is skipped.
+    // KV is pinned the same way as D1.
     const root = makeProject({
       'package.json': JSON.stringify({ name: 'myapp' }),
       'void.json': JSON.stringify({}),
@@ -6333,8 +5801,6 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('still rejects a build that swaps the account_id in the emitted config (account pin intact)', async () => {
-    // The account_id defense must survive the refactor: the real verifier still fails closed on a
-    // mismatched emitted account_id, before the binding-identity block runs.
     const root = d1Project(PROVISIONED_D1);
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () => writeEmittedDeployArtifact(root, { ...EMITTED_D1, account_id: 'other-acc' }),
@@ -6348,12 +5814,8 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('passes a normal deploy whose artifact carries supported non-id bindings', async () => {
-    // No-regression at the full-flow level: the pinned DB id is unchanged AND the emitted artifact
-    // carries the non-id bindings this source actually emits. The completeness check must wave the
-    // ai/queues/vars/empty-array bindings through and let the deploy proceed. The `queues/jobs.ts`
-    // source makes the emitted `jobs` queue a Void-derived binding (desired ⊇ emitted), and the
-    // `routes/ai.ts` source makes the pre-build inference report needsAI=true — the SAME signal that
-    // authorizes the emitted `{binding:'AI'}` ai binding, exactly as a real AI-using build's does.
+    // The pinned DB id is unchanged and the artifact carries the non-id bindings this source emits.
+    // `queues/jobs.ts` makes `jobs` a derived queue, and `routes/ai.ts` authorizes the AI binding.
     const root = d1Project(PROVISIONED_D1, {
       ...INIT_MIGRATION,
       'queues/jobs.ts': 'export default {};',
@@ -6362,11 +5824,7 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
     });
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () =>
-        // This project imports no `void/sandbox`, so a real build emits no container application;
-        // drop the kitchen-sink fixture's sandbox container (JSON.stringify omits `undefined`) so
-        // the reconstructed (empty) container set matches the emitted (absent) one. It also has no
-        // `crons/` dir, so a real build emits no `triggers.crons`; drop the fixture's schedule so the
-        // reconstructed (empty) cron set matches the emitted (absent) one.
+        // No sandbox, Durable Objects or crons in this source, so drop those fixture fields.
         writeEmittedDeployArtifact(root, {
           ...KITCHEN_SINK_NON_ID_BINDINGS,
           durable_objects: undefined,
@@ -6404,10 +5862,7 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed at the emitted-config check when the build ADDS an id-bearing binding absent from the snapshot', async () => {
-    // The root config (and thus the pre-build snapshot) has ONLY DB. The build injects an EXTRA_KV
-    // into the emitted artifact — a same-account data store the deployed worker would gain access
-    // to. The per-desired loop only walks {DB}; completeness is what rejects the injected binding.
-    // (Reverting the completeness check lets EXTRA_KV through and the deploy runs.)
+    // The snapshot has only DB; the build injects an EXTRA_KV the deployed worker would gain.
     const root = d1Project(PROVISIONED_D1);
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () =>
@@ -6425,45 +5880,8 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
     expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
   });
 
-  it('fails closed at the emitted-config check when the build rewrites a NON-desired binding id', async () => {
-    // A hand-declared, non-desired EXTRA_DB is pinned pre-build (widened snapshot). The build
-    // rewrites its id in BOTH the root config and the emitted artifact — a consistent rewrite a
-    // post-build root re-read could not catch, and one the per-desired {DB} loop never inspects.
-    // Only the pre-build snapshot + completeness catch it. (Reverting the check lets the deploy run.)
-    const root = d1Project({
-      ...PROVISIONED_D1,
-      d1_databases: [
-        ...PROVISIONED_D1.d1_databases,
-        { binding: 'EXTRA_DB', database_name: 'extra', database_id: REAL_KV_ID },
-      ],
-    });
-    const { deps, wranglerArgs, exitCalls } = harness({
-      runBuild: () => {
-        rewriteRootConfig(root, (c) => {
-          (c.d1_databases as Array<Record<string, unknown>>)[1].database_id = OTHER_D1_ID;
-        });
-        writeEmittedDeployArtifact(root, {
-          ...EMITTED_D1,
-          d1_databases: [
-            { binding: 'DB', database_name: 'myapp-db', database_id: REAL_D1_ID },
-            { binding: 'EXTRA_DB', database_name: 'extra', database_id: OTHER_D1_ID },
-          ],
-        });
-      },
-      verifyDeployConfig: verifyGeneratedDeployConfig,
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
-  });
-
   it('fails closed at the emitted-config check when the build injects a services binding', async () => {
-    // The root config (and pre-build passthrough snapshot) has NO services. The build injects a
-    // services binding to another same-account worker into the emitted artifact — a capability the
-    // deployed worker would gain that the source never asked for. No checked-in migrations, so the
-    // catch happens at step 10. (Reverting assertion A lets EVIL through and the deploy runs.)
+    // The root has no services; the build injects a binding to another same-account worker.
     const root = d1Project(PROVISIONED_D1);
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () =>
@@ -6482,8 +5900,7 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed at the emitted-config check when the build injects a queue not in the desired set', async () => {
-    // No queues/ source → desired.queues is empty. The build injects a queue producer into the
-    // emitted artifact. (Reverting assertion B lets the injected queue deploy.)
+    // No queues/ source, so desired.queues is empty.
     const root = d1Project(PROVISIONED_D1);
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () =>
@@ -6501,8 +5918,6 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('passes when a user hand-declared passthrough binding (services) is present pre-build and unchanged', async () => {
-    // A hand-declared services binding is in the root config BEFORE the build (so the passthrough
-    // snapshot pins it) and the build leaves it untouched — the deploy must NOT be blocked.
     const root = d1Project({
       ...PROVISIONED_D1,
       services: [{ binding: 'MY_SVC', service: 'my-other-worker' }],
@@ -6521,8 +5936,7 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed at the emitted-config check when the build injects an unsafe object', async () => {
-    // The root has no `unsafe`, so the whole-object pin (populated end-to-end from the pre-build
-    // root config) rejects an injected `unsafe.metadata` before the credentialed deploy binds it.
+    // Proves the whole-object pin is wired end to end from the pre-build root config.
     const root = d1Project(PROVISIONED_D1);
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () =>
@@ -6539,81 +5953,8 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
     expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
   });
 
-  it('fails closed at the emitted-config check when the build injects a tail_consumers entry', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, wranglerArgs, exitCalls } = harness({
-      runBuild: () =>
-        writeEmittedDeployArtifact(root, {
-          ...EMITTED_D1,
-          tail_consumers: [{ service: 'evil-log-collector' }],
-        }),
-      verifyDeployConfig: verifyGeneratedDeployConfig,
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
-  });
-
-  it('fails closed at the emitted-config check when the build injects an external durable_object', async () => {
-    // Void's own DOs are always LOCAL; an emitted DO carrying `script_name` binds another worker's
-    // Durable Objects. The end-to-end raw-field pin rejects it before the deploy.
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, wranglerArgs, exitCalls } = harness({
-      runBuild: () =>
-        writeEmittedDeployArtifact(root, {
-          ...EMITTED_D1,
-          durable_objects: {
-            bindings: [{ name: 'EXT', class_name: 'Other', script_name: 'someone-elses-worker' }],
-          },
-        }),
-      verifyDeployConfig: verifyGeneratedDeployConfig,
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
-  });
-
-  it('passes a normal deploy whose artifact carries Void’s own ai binding', async () => {
-    // No-regression: the emitted `ai:{binding:'AI'}` a real build emits must pass the
-    // raw-field pins end-to-end. The `queues/jobs.ts` source makes `jobs` a Void-derived queue, and
-    // the `routes/ai.ts` source makes the pre-build inference report needsAI=true — the SAME signal
-    // that authorizes the emitted `{binding:'AI'}` ai binding.
-    const root = d1Project(PROVISIONED_D1, {
-      ...INIT_MIGRATION,
-      'queues/jobs.ts': 'export default {};',
-      'routes/ai.ts':
-        "import { ai } from 'void/ai';\nexport const GET = () => ai.run('@cf/x', {});",
-    });
-    const { deps, wranglerArgs, exitCalls } = harness({
-      runBuild: () =>
-        // This project imports no `void/sandbox`, so a real build emits no container application;
-        // drop the kitchen-sink fixture's sandbox container (JSON.stringify omits `undefined`) so
-        // the reconstructed (empty) container set matches the emitted (absent) one. It also has no
-        // `crons/` dir, so a real build emits no `triggers.crons`; drop the fixture's schedule so the
-        // reconstructed (empty) cron set matches the emitted (absent) one.
-        writeEmittedDeployArtifact(root, {
-          ...KITCHEN_SINK_NON_ID_BINDINGS,
-          durable_objects: undefined,
-          migrations: undefined,
-          containers: undefined,
-          triggers: undefined,
-          ...EMITTED_D1,
-        }),
-      verifyDeployConfig: verifyGeneratedDeployConfig,
-    });
-    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    expect(exitCalls).toEqual([]);
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(true);
-  });
-
   it('fails closed when the build modifies the wrangler uploader (before any credentialed run)', async () => {
-    // The build overwrote the wrangler bundle the post-build remote migrate / deploy execute, so
-    // the post-build hash differs from the pre-build snapshot. The deploy refuses before running
-    // the uploader with the Cloudflare token — no `wrangler deploy` is reached.
+    // The post-build uploader hash differs from the pre-build one, so no credentialed run happens.
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     let built = false;
     const { deps, wranglerArgs, exitCalls } = harness({
@@ -6632,8 +5973,6 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed when the wrangler uploader cannot be hashed (unverifiable binary)', async () => {
-    // The uploader could not be resolved/read (the hash seam returns undefined) — refuse to deploy
-    // a binary that cannot be verified rather than skipping the check.
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     const { deps, wranglerArgs, exitCalls } = harness({
       runBuild: () => writeEmittedDeployArtifact(root, EMITTED_D1),
@@ -6648,18 +5987,13 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed BEFORE the remote D1 migrate when a post-build step mutates the uploader', async () => {
-    // The early post-build check passes (the build left the uploader clean), then a POST-build
-    // project step — modelled by the migration gate, which runs after the secret gate and before the
-    // remote migrate — overwrites the bundle. The re-check immediately before `d1 migrations apply`
-    // catches it, so no credentialed D1 run and no deploy happen. (A single early check would miss
-    // this interleaving.)
+    // Project code after the build (modelled by the migration gate) overwrites the uploader; the
+    // re-check right before `d1 migrations apply` catches it.
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     let uploaderTampered = false;
     const { deps, wranglerArgs, exitCalls } = harness({
       hashWranglerUploader: () => (uploaderTampered ? 'tampered' : 'clean'),
       assertMigrationsDeployable: () => {
-        // Stands in for post-build project code (drizzle-kit loading db/schema.ts) overwriting the
-        // hashed wrangler bundle after the build and after the secret-list check.
         uploaderTampered = true;
       },
     });
@@ -6673,9 +6007,7 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed BEFORE the deploy when a post-build step mutates the uploader (no-migration app)', async () => {
-    // No checked-in migrations → the remote-migrate path is skipped, so the deploy is the first
-    // credentialed run after the build. A post-build project step mutates the uploader; the re-check
-    // immediately before `wrangler deploy` fails closed.
+    // Without migrations the upload is the first credentialed run after the build.
     const root = d1Project(PROVISIONED_D1);
     let uploaderTampered = false;
     const { deps, wranglerArgs, exitCalls } = harness({
@@ -6691,12 +6023,9 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
     expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
   });
 
-  it('proceeds through every credentialed spawn when the uploader stays unchanged (no regression)', async () => {
-    // The uploader hash is stable across the build and every post-build step, so all four per-spawn
-    // re-checks (secret list, D1 apply, D1 list, deploy) pass and the deploy runs to completion.
+  it('proceeds through every credentialed spawn when the uploader stays unchanged', async () => {
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     const { deps, wranglerArgs, exitCalls } = harness({
-      // Default constant-hash stub keeps the uploader unchanged across all spawns.
       runBuild: () => writeEmittedDeployArtifact(root, EMITTED_D1),
       verifyDeployConfig: verifyGeneratedDeployConfig,
     });
@@ -6708,11 +6037,8 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed BEFORE whoami when the pre-build env-schema probe mutates the uploader', async () => {
-    // The uploader baseline is captured at the START of the deploy — before the env-schema probe,
-    // which runs project code (the user's Vite config + env.ts). A probe that overwrites the hashed
-    // wrangler bundle is caught by the re-check immediately before `whoami`, the FIRST credentialed
-    // run — so no credentialed wrangler call ever executes the tampered bundle. Proves the baseline
-    // is snapshotted before the first project-code execution.
+    // The uploader baseline is taken before the env-schema probe runs project code, so a probe
+    // that overwrites the uploader is caught before `whoami`, the first credentialed run.
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     let probed = false;
     const { deps, trace, wranglerArgs, exitCalls } = harness({
@@ -6733,10 +6059,7 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 
   it('fails closed BEFORE the provisioner when the uploader changes after whoami (--provision)', async () => {
-    // Defense-in-depth for the pre-build sequence: the baseline holds through `whoami`, then the
-    // uploader changes before the credentialed provisioner runs. The re-check immediately before the
-    // provision call fails closed against the same baseline, so `wrangler <res> create` never
-    // executes the tampered bundle.
+    // The uploader changes after `whoami`; the re-check right before provisioning catches it.
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     let tampered = false;
     const { deps, trace, exitCalls } = harness({
@@ -6762,13 +6085,9 @@ describe('runCloudflareDeploy — id-bearing binding identity pin', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Config laundering by a probe that runs project code around the build:
-//   • the PRE-BUILD env-schema probe (step 3c) rewriting the root config before an
-//     authenticated Cloudflare command or automatic provisioning runs;
-//   • the POST-build validate-emitted probe (step 8b) rewriting the root worker `name`,
-//     which the secrets gate resolves the worker from.
-// ---------------------------------------------------------------------------
+// Probes that run project code around the build may rewrite the root config: the pre-build
+// env-schema probe before any credentialed command, and the post-build emitted-var probe before
+// the secrets gate resolves the worker name.
 
 describe('runCloudflareDeploy — config laundering by a build-adjacent probe', () => {
   /** Read → mutate → rewrite the root wrangler.jsonc, standing in for a tampering probe. */
@@ -6782,7 +6101,7 @@ describe('runCloudflareDeploy — config laundering by a build-adjacent probe',
     writeFileSync(configPath, JSON.stringify(config, null, 2));
   }
 
-  // --- FIX 2: a PRE-BUILD probe that laundered the root config ---
+  // --- The pre-build probe rewrites the root config ---
 
   it('fails closed before whoami when the pre-build probe SWAPS a binding id', async () => {
     // The env-schema probe rewrites the provisioned DB id in the root config. Reject it before the
@@ -6805,89 +6124,6 @@ describe('runCloudflareDeploy — config laundering by a build-adjacent probe',
     expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
   });
 
-  it('fails closed before whoami when the pre-build probe ADDS an id-bearing binding', async () => {
-    // The probe injects an EXTRA_KV the source never declared — a same-account data store the
-    // deployed worker would gain. The desired loop only walks {DB}; the pre-probe snapshot is what
-    // rejects the injected binding.
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, trace, wranglerArgs, exitCalls } = harness({
-      resolveSchemaFacts: (() => {
-        rewriteRootConfig(root, (c) => {
-          c.kv_namespaces = [{ binding: 'EXTRA_KV', id: OTHER_KV_ID }];
-        });
-        return okSchemaFacts();
-      }) as CloudflareDeployDeps['resolveSchemaFacts'],
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(trace).not.toContain('build');
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
-  });
-
-  it('fails closed before whoami when the pre-build probe INJECTS a services binding', async () => {
-    // A pass-through binding Void never emits — the probe grants the deployed worker a service
-    // binding to another same-account worker. Caught by the pass-through snapshot comparison.
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, trace, wranglerArgs, exitCalls } = harness({
-      resolveSchemaFacts: (() => {
-        rewriteRootConfig(root, (c) => {
-          c.services = [{ binding: 'EVIL', service: 'someone-elses-worker' }];
-        });
-        return okSchemaFacts();
-      }) as CloudflareDeployDeps['resolveSchemaFacts'],
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(trace).not.toContain('build');
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
-  });
-
-  it('passes when the pre-build probe leaves the root config untouched', async () => {
-    const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
-    const { deps, wranglerArgs, exitCalls } = harness();
-    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    expect(exitCalls).toEqual([]);
-    expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(true);
-  });
-
-  it('fails closed before whoami when the pre-build probe injects `addresses`, `services` or `routes` — with --provision too', async () => {
-    // The post-probe laundering guard compares the WHOLE root config, so it is provision-
-    // independent: an injected `addresses` entry is an `added` plan change wrangler applies with
-    // no prompt, even in CI — the account's inbound mail for that address would be routed to the
-    // deployed worker. `--provision` must not open a path around it.
-    const injections: Array<(c: Record<string, unknown>) => void> = [
-      (c) => {
-        c.addresses = ['ceo@acme.com'];
-      },
-      (c) => {
-        c.services = [{ binding: 'EVIL', service: 'someone-elses-worker' }];
-      },
-      (c) => {
-        c.routes = [{ pattern: 'acme.com/*', zone_name: 'acme.com' }];
-      },
-    ];
-    for (const inject of injections) {
-      const root = d1Project(PROVISIONED_D1);
-      const { deps, trace, wranglerArgs, exitCalls } = harness({
-        resolveSchemaFacts: (() => {
-          rewriteRootConfig(root, inject);
-          return okSchemaFacts();
-        }) as CloudflareDeployDeps['resolveSchemaFacts'],
-      });
-      await expect(
-        runCloudflareDeploy(root, { platform: 'cloudflare', provision: true }, silentCliLog, deps),
-      ).rejects.toBeInstanceOf(ExitError);
-      expect(exitCalls).toEqual([1]);
-      expect(trace).not.toContain('wrangler:whoami');
-      expect(trace).not.toContain('build');
-      expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
-    }
-  });
-
   it('automatic provisioning rejects a probe rewrite before creating resources', async () => {
     const root = d1Project({ account_id: 'acc123', name: 'myapp' });
     const { deps, trace, wranglerArgs, exitCalls } = harness({
@@ -6907,10 +6143,9 @@ describe('runCloudflareDeploy — config laundering by a build-adjacent probe',
     expect(wranglerArgs.some((a) => a[0] === 'deploy')).toBe(false);
   });
 
-  // --- FIX 1: a POST-build probe that rewrote the pinned worker NAME ---
+  // --- The post-build probe rewrites the pinned worker name ---
 
-  // Schema facts declaring one required secret that is ABSENT from the (empty) emitted vars, so the
-  // real gate reaches the worker-name reconcile + the (stubbed) remote secret list.
+  // One required secret absent from the emitted vars, so the real gate reaches the remote list.
   function requiredSecretFacts(): EnvSchemaProbeResult {
     return okSchemaFacts({
       hasSchema: true,
@@ -6919,9 +6154,8 @@ describe('runCloudflareDeploy — config laundering by a build-adjacent probe',
     });
   }
 
-  // The real gate, but with the remote `wrangler secret list` stubbed to report the secret EXISTS.
-  // If the name reconcile is ever removed, this stub would discharge the missing secret against the
-  // WRONG worker and the deploy would proceed — so these tests fail loudly on a regression.
+  // The real gate with a remote secret list that reports the secret present for any worker, so
+  // only the worker-name check can stop a deploy against the wrong worker.
   const dischargeWithSecretPresent = ((
     ctx: SelfHostEnvContext,
     opts: Parameters<typeof dischargeSelfHostEnvContext>[1],
@@ -6936,9 +6170,7 @@ describe('runCloudflareDeploy — config laundering by a build-adjacent probe',
     })) as CloudflareDeployDeps['dischargeSelfHostEnv'];
 
   it('fails closed BEFORE deploy when the post-build probe rewrites the pinned worker name', async () => {
-    // The deploy pins name "myapp" at step 5. The emitted-var probe (step 8b, project code) rewrites
-    // the root config `name` to "evil-worker". The secrets gate resolves the worker from that name,
-    // so it would list secrets for the WRONG worker; the reconcile fails it closed before any deploy.
+    // The deploy pinned "myapp"; the probe renames the root config worker to "evil-worker".
     const root = d1Project(PROVISIONED_D1);
     const { deps, trace, wranglerArgs, exitCalls } = harness({
       resolveSchemaFacts: (() =>
@@ -6961,8 +6193,6 @@ describe('runCloudflareDeploy — config laundering by a build-adjacent probe',
   });
 
   it('passes when the post-build probe leaves the pinned worker name intact', async () => {
-    // No-regression: the emitted-var probe does not touch the name, so the config name still equals
-    // the pinned "myapp"; the gate discharges the (stubbed-present) remote secret and the deploy runs.
     const root = d1Project(PROVISIONED_D1);
     const { deps, wranglerArgs, exitCalls } = harness({
       resolveSchemaFacts: (() =>
@@ -6975,39 +6205,12 @@ describe('runCloudflareDeploy — config laundering by a build-adjacent probe',
   });
 });
 
-// ---------------------------------------------------------------------------
-// Managed deploy must NOT eagerly load the provision lifecycle (proper-lockfile
-// → signal-exit patches process.emit / reallyExit ON IMPORT). deploy.ts is
-// imported by cli.ts for every deploy, so its module-scope import of
-// ./provision.ts must be TYPE-ONLY; the runtime values load via a dynamic
-// import() inside the Cloudflare fork only. Assert that at the source level so a
-// regression re-introducing a static runtime import fails fast (a real
-// module-registry check would be polluted by this test file's own provision
-// import, and a subprocess check would be slow/flaky).
-// ---------------------------------------------------------------------------
-
-describe('runCloudflareDeploy — managed path does not import the provision module', () => {
+describe('runCloudflareDeploy — env-schema probe loads lazily', () => {
   const deploySource = readdirSync(join(import.meta.dirname, '../../src/cli'))
     .filter((file) => file === 'deploy.ts' || (file.startsWith('deploy-') && file.endsWith('.ts')))
     .map((file) => readFileSync(join(import.meta.dirname, '../../src/cli', file), 'utf-8'))
     .join('\n');
 
-  it('imports ./provision.ts as TYPE-ONLY at module scope (dynamic import inside the fork)', () => {
-    // Every static `... from './provision.ts'` at module scope must be `import type`.
-    // `[^']*?` keeps each clause from spanning across a previous `from '...'`.
-    const staticImports = [
-      ...deploySource.matchAll(/^import\s+([^']*?)\s+from\s+'\.\/provision\.ts';/gm),
-    ];
-    expect(staticImports.length).toBeGreaterThan(0);
-    for (const [, clause] of staticImports) {
-      expect(clause.startsWith('type')).toBe(true);
-    }
-  });
-
-  it('loads the provision module via a dynamic import()', () => {
-    expect(deploySource).toMatch(/await import\('\.\/provision\.ts'\)/);
-  });
-
   it('loads the env-schema probe via a dynamic import() (never a static module-scope import)', () => {
     // deploy.ts must only `import type` from the probe at module scope; the runtime helper
     // loads via dynamic import() inside the fork, so a managed deploy never pulls the probe in.
@@ -7069,9 +6272,9 @@ describe('runCloudflareDeploy — framework artifact guard', () => {
           serverKeys: ['API_TOKEN'],
           requiredKeys: ['API_TOKEN'],
         })) as CloudflareDeployDeps['resolveSchemaFacts'],
-      prepareFrameworkArtifact: (async (...args) => {
+      prepareFrameworkArtifact: (async (options) => {
         trace.push('prepare-framework');
-        requiredSecretNames = args[7];
+        requiredSecretNames = options.requiredSecretNames;
       }) as CloudflareDeployDeps['prepareFrameworkArtifact'],
     });
     await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
@@ -7207,17 +6410,17 @@ describe('runCloudflareDeploy — framework artifact guard', () => {
       ].join('\n'),
     });
 
-    await prepareCloudflareFrameworkArtifact(
+    await prepareCloudflareFrameworkArtifact({
       root,
-      join(root, 'wrangler.jsonc'),
-      'acc123',
-      'skapp',
-      readConfig(root),
-      { name: 'sveltekit', class: 'b' },
-      FRAMEWORK_PRESETS.sveltekit,
-      ['API_TOKEN'],
-      { binding: 'AI' },
-    );
+      configPath: join(root, 'wrangler.jsonc'),
+      accountId: 'acc123',
+      workerName: 'skapp',
+      voidConfig: readConfig(root),
+      framework: { name: 'sveltekit', class: 'b' },
+      preset: FRAMEWORK_PRESETS.sveltekit,
+      requiredSecretNames: ['API_TOKEN'],
+      ai: { binding: 'AI' },
+    });
 
     const wrapper = readFileSync(join(root, '.svelte-kit/cloudflare/_worker.js'), 'utf-8');
     expect(wrapper).toContain('import original from "./__original.js";');
@@ -7268,15 +6471,15 @@ describe('runCloudflareDeploy — framework artifact guard', () => {
     });
     const pointerBefore = readFileSync(join(root, '.wrangler/deploy/config.json'), 'utf-8');
 
-    await prepareCloudflareFrameworkArtifact(
+    await prepareCloudflareFrameworkArtifact({
       root,
-      join(root, 'wrangler.jsonc'),
-      'acc123',
-      'tanstack-app',
-      readConfig(root),
-      { name: 'tanstack-start', class: 'a' },
-      FRAMEWORK_PRESETS['tanstack-start'],
-    );
+      configPath: join(root, 'wrangler.jsonc'),
+      accountId: 'acc123',
+      workerName: 'tanstack-app',
+      voidConfig: readConfig(root),
+      framework: { name: 'tanstack-start', class: 'a' },
+      preset: FRAMEWORK_PRESETS['tanstack-start'],
+    });
 
     expect(readFileSync(join(root, '.wrangler/deploy/config.json'), 'utf-8')).toBe(pointerBefore);
     expect(readFileSync(join(root, 'dist/server/index.js'), 'utf-8')).toContain(
@@ -7312,13 +6515,13 @@ describe('runCloudflareDeploy — framework artifact guard', () => {
         [`${preset.assetsDir}/client.js`]: 'console.log("client");',
       });
 
-      await prepareCloudflareFrameworkArtifact(
+      await prepareCloudflareFrameworkArtifact({
         root,
-        join(root, 'wrangler.jsonc'),
-        'acc123',
-        'framework-app',
-        readConfig(root),
-        {
+        configPath: join(root, 'wrangler.jsonc'),
+        accountId: 'acc123',
+        workerName: 'framework-app',
+        voidConfig: readConfig(root),
+        framework: {
           name,
           class: ['tanstack-start', 'react-router', 'vinext-app', 'vinext-pages'].includes(name)
             ? 'a'
@@ -7327,7 +6530,7 @@ describe('runCloudflareDeploy — framework artifact guard', () => {
               : 'c',
         },
         preset,
-      );
+      });
 
       const entry = readFileSync(join(root, preset.workerDir, preset.workerMain), 'utf8');
       expect(entry).toContain('handleFrameworkIsr');
@@ -7355,15 +6558,15 @@ describe('runCloudflareDeploy — framework artifact guard', () => {
         'export default { fetch() { return new Response("page"); } };',
       [`${preset.assetsDir}/client.js`]: 'console.log("client");',
     });
-    await prepareCloudflareFrameworkArtifact(
+    await prepareCloudflareFrameworkArtifact({
       root,
-      join(root, 'wrangler.jsonc'),
-      'acc123',
-      'framework-app',
-      readConfig(root),
-      { name: 'tanstack-start', class: 'a' },
+      configPath: join(root, 'wrangler.jsonc'),
+      accountId: 'acc123',
+      workerName: 'framework-app',
+      voidConfig: readConfig(root),
+      framework: { name: 'tanstack-start', class: 'a' },
       preset,
-    );
+    });
     const entry = readFileSync(join(root, preset.workerDir, preset.workerMain), 'utf8');
     expect(entry).not.toContain('handleFrameworkIsr');
   });
@@ -7375,15 +6578,15 @@ describe('runCloudflareDeploy — framework artifact guard', () => {
       'wrangler.jsonc': JSON.stringify({ account_id: 'acc123', name: 'nuxt-app' }),
     });
     const prepare = () =>
-      prepareCloudflareFrameworkArtifact(
+      prepareCloudflareFrameworkArtifact({
         root,
-        join(root, 'wrangler.jsonc'),
-        'acc123',
-        'nuxt-app',
-        readConfig(root),
-        { name: 'nuxt', class: 'c' },
-        FRAMEWORK_PRESETS.nuxt,
-      );
+        configPath: join(root, 'wrangler.jsonc'),
+        accountId: 'acc123',
+        workerName: 'nuxt-app',
+        voidConfig: readConfig(root),
+        framework: { name: 'nuxt', class: 'c' },
+        preset: FRAMEWORK_PRESETS.nuxt,
+      });
     await expect(prepare()).rejects.toThrow('did not emit its Worker entry');
 
     mkdirSync(join(root, '.output/server'), { recursive: true });
@@ -7436,46 +6639,37 @@ describe('runCloudflareDeploy — stale deploy pointer', () => {
 
 describe('runCloudflareDeploy — env-only account pin', () => {
   it('persists CLOUDFLARE_ACCOUNT_ID into the root config and reaches deploy without --provision', async () => {
-    const saved = process.env.CLOUDFLARE_ACCOUNT_ID;
-    process.env.CLOUDFLARE_ACCOUNT_ID = 'env-acc-999';
-    try {
-      const root = makeProject({
-        'package.json': JSON.stringify({ name: 'myapp' }),
-        'void.json': JSON.stringify({}),
-        'routes/index.ts': `export const GET = (c) => c.env.DB.prepare('SELECT 1').first();`,
-        // Root config has NO account_id — only the env var pins the account.
-        'wrangler.jsonc': JSON.stringify(
-          {
-            name: 'myapp',
-            d1_databases: [
-              {
-                binding: 'DB',
-                database_name: 'myapp-db',
-                database_id: REAL_D1_ID,
-                migrations_dir: './db/migrations',
-              },
-            ],
-          },
-          null,
-          2,
-        ),
-      });
-      const { deps, trace } = harness();
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-      // Reaches deploy (does not false-stop on a missing generated account_id)...
-      expect(trace).toContain('wrangler:deploy');
-      // ...because the env pin was persisted into the root config the build reads.
-      const written = JSON.parse(readFileSync(join(root, 'wrangler.jsonc'), 'utf-8')) as {
-        account_id?: string;
-      };
-      expect(written.account_id).toBe('env-acc-999');
-    } finally {
-      if (saved === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = saved;
-      }
-    }
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', 'env-acc-999');
+    const root = makeProject({
+      'package.json': JSON.stringify({ name: 'myapp' }),
+      'void.json': JSON.stringify({}),
+      'routes/index.ts': `export const GET = (c) => c.env.DB.prepare('SELECT 1').first();`,
+      // Root config has NO account_id — only the env var pins the account.
+      'wrangler.jsonc': JSON.stringify(
+        {
+          name: 'myapp',
+          d1_databases: [
+            {
+              binding: 'DB',
+              database_name: 'myapp-db',
+              database_id: REAL_D1_ID,
+              migrations_dir: './db/migrations',
+            },
+          ],
+        },
+        null,
+        2,
+      ),
+    });
+    const { deps, trace } = harness();
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    // Reaches deploy (does not false-stop on a missing generated account_id)...
+    expect(trace).toContain('wrangler:deploy');
+    // ...because the env pin was persisted into the root config the build reads.
+    const written = JSON.parse(readFileSync(join(root, 'wrangler.jsonc'), 'utf-8')) as {
+      account_id?: string;
+    };
+    expect(written.account_id).toBe('env-acc-999');
   });
 });
 
@@ -7503,9 +6697,8 @@ describe('runCloudflareDeploy — migrations dir / count / auth', () => {
     const root = d1Project(PROVISIONED_D1); // migrations_dir set, but NO .sql files
     const { deps, wranglerArgs, trace } = harness();
     await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    // B2: the managed drift/journal gate runs for EVERY D1 app (a schema.ts with no
-    // generated migration is drift), but wrangler 4.131 hard-fails on an empty/absent
-    // folder — so the apply/list is skipped.
+    // The drift/journal gate runs for every D1 app, but wrangler fails on an empty or absent
+    // migrations folder, so the apply/list is skipped.
     expect(trace).toContain('migrate-gate');
     expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
     expect(trace).toContain('wrangler:deploy');
@@ -7663,10 +6856,7 @@ describe('runCloudflareDeploy — migrations dir / count / auth', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// B5: auth schema derived from resolveVoidAuthMigrationSchema, validated by
-// applying migrations to an in-memory SQLite DB (not a CREATE TABLE token search)
-// ---------------------------------------------------------------------------
+// The auth schema is checked by applying the migrations to an in-memory SQLite database.
 
 describe('assertMigrationsProduceAuthSchema', () => {
   /** A required column with no constraint attached — presence is all that is asserted. */
@@ -7762,22 +6952,6 @@ describe('assertMigrationsProduceAuthSchema', () => {
   const SESSION_WITH_FK =
     'CREATE TABLE "session" (id text primary key, userId text REFERENCES "user"(id) ON DELETE CASCADE);';
 
-  it('rejects when the migrations create the right names but no UNIQUE constraint on user.email', async () => {
-    await expect(
-      assertMigrationsProduceAuthSchema(
-        [
-          {
-            name: '0000.sql',
-            sql:
-              'CREATE TABLE "user" (id text primary key, email text, name text);\n' +
-              SESSION_WITH_FK,
-          },
-        ],
-        constrained,
-      ),
-    ).rejects.toThrow(/UNIQUE.*email|email/);
-  });
-
   it('names the offending table and column when the UNIQUE constraint is missing', async () => {
     await expect(
       assertMigrationsProduceAuthSchema(
@@ -8072,16 +7246,9 @@ describe('assertMigrationsProduceAuthSchema', () => {
     );
   });
 
-  // -------------------------------------------------------------------------
-  // PARENT KEY VALIDITY, decided by SQLite itself (`PRAGMA foreign_key_check`)
-  // rather than by re-deriving its rules here. A parent key must be a PRIMARY
-  // KEY, or a UNIQUE index that MATCHES the reference (collation included); an
-  // omitted target column resolves only to the parent's PRIMARY KEY. Anything
-  // else yields a foreign key that `CREATE TABLE` accepts, that
-  // `PRAGMA foreign_key_list` echoes back as valid, and that fails at PREPARE
-  // time under `foreign_keys=ON` — i.e. auth broken in production after a
-  // green deploy.
-  // -------------------------------------------------------------------------
+  // A parent key must be a PRIMARY KEY or a UNIQUE index matching the reference (collation
+  // included). Otherwise `CREATE TABLE` accepts the foreign key, but every statement on the child
+  // fails at prepare time under `foreign_keys=ON`. SQLite itself decides (`foreign_key_check`).
 
   /** The parent key is a UNIQUE index, but declared under a DIFFERENT collation. */
   it('fails closed when the parent id is only unique under a differing COLLATE', async () => {
@@ -8159,16 +7326,9 @@ describe('assertMigrationsProduceAuthSchema', () => {
     );
   });
 
-  // -------------------------------------------------------------------------
-  // An auth reference must be its OWN single-column foreign key. SQLite applies
-  // MATCH SIMPLE: a COMPOSITE foreign key is skipped ENTIRELY whenever any of
-  // its child columns is NULL, so a composite constraint that merely happens to
-  // include the required column still lets an orphaned auth row in. `PRAGMA
-  // foreign_key_list` returns one row per COLUMN (rows of one constraint share
-  // an `id`), so a per-row match would accept it through a single member, and
-  // `PRAGMA foreign_key_check` cannot catch it either — it reports orphaned
-  // DATA, and the freshly-migrated database holds no rows.
-  // -------------------------------------------------------------------------
+  // An auth reference must be its own single-column foreign key: under MATCH SIMPLE a composite
+  // key is skipped whenever any child column is NULL. `foreign_key_list` lists one row per column
+  // and `foreign_key_check` only finds orphaned rows, so neither catches it on an empty database.
 
   const COMPOSITE_PARENT =
     'CREATE TABLE "user" (id text NOT NULL, tenant text, email text UNIQUE, name text, ' +
@@ -8667,27 +7827,12 @@ describe('runCloudflareDeploy — remote migration gates', () => {
       runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
     ).rejects.toBeInstanceOf(ExitError);
     expect(exitCalls).toEqual([1]);
-    // The gate runs POST-build now (against the live files), so the build ran — but it fires
-    // BEFORE the remote apply: no d1 call, no deploy.
+    // The gate runs post-build against the live files, before the remote apply.
     expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
     expect(trace).toContain('build');
     expect(trace).not.toContain('wrangler:deploy');
   });
 
-  it('runs the real gate: a destructive migration without the pragma fails closed', async () => {
-    const root = d1Project(PROVISIONED_D1, {
-      'db/migrations/0000_init.sql': 'DROP TABLE notes;',
-    });
-    // No db/schema.ts → the drift check short-circuits (no drizzle-kit spawn); the real
-    // destructive-op validation runs and rejects the un-pragma'd DROP.
-    const { deps, wranglerArgs, exitCalls } = harness({ assertMigrationsDeployable: undefined });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
-  });
-
   it('fails closed when remote still has pending migrations after apply (declined prompt)', async () => {
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     const localTrace: Array<string> = [];
@@ -8711,14 +7856,13 @@ describe('runCloudflareDeploy — remote migration gates', () => {
       runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
     ).rejects.toBeInstanceOf(ExitError);
     expect(exitCalls).toEqual([1]);
-    // The remote apply/list runs AFTER the build now; reached the list-verify, then failed
-    // closed before DEPLOYING (the build already ran, but the deploy never does).
+    // Reached the post-apply list, then failed closed before the deploy.
     expect(localTrace).toContain('wrangler:d1:list');
     expect(localTrace).toContain('build');
     expect(localTrace).not.toContain('wrangler:deploy');
   });
 
-  it('fails closed when the pending-verify prints NO recognizable marker (B3, reduced log level)', async () => {
+  it('fails closed when the pending-verify prints NO recognizable marker (reduced log level)', async () => {
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     const localTrace: Array<string> = [];
     const { deps, exitCalls } = harness({
@@ -8744,31 +7888,9 @@ describe('runCloudflareDeploy — remote migration gates', () => {
     expect(localTrace).toContain('build');
     expect(localTrace).not.toContain('wrangler:deploy');
   });
-
-  it('fails closed (B1) when wrangler would apply a stray seed.sql not in the validated set', async () => {
-    const root = d1Project(PROVISIONED_D1, {
-      'db/migrations/0000_init.sql': `CREATE TABLE notes (id integer primary key);`,
-      // `collectMigrations` skips seed.sql, but wrangler's `*.sql` glob would apply it.
-      'db/migrations/seed.sql': `INSERT INTO notes VALUES (1);`,
-    });
-    // Use the REAL apply-set gate (override the harness stub) so it enumerates the dir.
-    const { deps, wranglerArgs, trace, exitCalls } = harness({
-      checkMigrationApplySet: checkWranglerMigrationApplySet,
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    // The apply-set gate runs POST-build now (it enumerates the live dir), so the build ran —
-    // but it rejects before any `d1 migrations apply`.
-    expect(wranglerArgs.some((a) => a[0] === 'd1')).toBe(false);
-    expect(trace).toContain('build');
-  });
 });
 
-// ---------------------------------------------------------------------------
-// B1: the exact set wrangler will apply must equal the gated source set
-// ---------------------------------------------------------------------------
+// The exact set wrangler will apply must equal the gated source set.
 
 describe('checkWranglerMigrationApplySet', () => {
   function configFor(dir: string, pattern?: string): Record<string, unknown> {
@@ -8852,7 +7974,7 @@ describe('checkWranglerMigrationApplySet', () => {
     }
   });
 
-  it('A1: rejects when wrangler would apply in a DIFFERENT order (unpadded numeric prefix)', async () => {
+  it('rejects when wrangler would apply in a DIFFERENT order (unpadded numeric prefix)', async () => {
     // `2_*.sql` and `10_*.sql` sort DIFFERENTLY for wrangler (numeric: 2 < 10) than for Void's
     // collectMigrations (lexicographic: "10" < "2"). The set is equal but the apply ORDER
     // diverges, so remote D1 would receive them out of the validated order — reject.
@@ -8878,7 +8000,7 @@ describe('checkWranglerMigrationApplySet', () => {
     }
   });
 
-  it('A1: passes with zero-padded prefixes (numeric order == lexicographic order)', async () => {
+  it('passes with zero-padded prefixes (numeric order == lexicographic order)', async () => {
     const root = makeProject({
       'wrangler.jsonc': '{}',
       'db/migrations/0002_early.sql': 'CREATE TABLE a (id integer);',
@@ -8937,7 +8059,7 @@ describe('checkWranglerMigrationApplySet', () => {
     }
   });
 
-  it('A1: fails closed (defense in depth) on a PRESENT-but-EMPTY migrations_pattern ("")', async () => {
+  it('fails closed (defense in depth) on a PRESENT-but-EMPTY migrations_pattern ("")', async () => {
     const root = makeProject({
       'wrangler.jsonc': '{}',
       'db/migrations/0000_init.sql': 'CREATE TABLE a (id integer);',
@@ -9011,7 +8133,7 @@ describe('compareWranglerMigrationPaths (wrangler 4.131 numeric-prefix comparato
 // ---------------------------------------------------------------------------
 // Post-build ground-truth secret gate: the parent builds the values-free context
 // from the REAL emitted `vars` + the env-insensitive required names, then
-// discharges it. A required secret shipped EMPTY fails closed post-build; a
+// discharges it. A server key shipped as a plaintext var fails closed post-build; a
 // pre-build schema-probe failure fails closed before any account op.
 // ---------------------------------------------------------------------------
 
@@ -9036,26 +8158,35 @@ describe('runCloudflareDeploy — post-build ground-truth secret gate', () => {
     expect(trace).not.toContain('wrangler:deploy');
   });
 
-  it('rejects a schema-declared server key emitted as a plaintext Worker var', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    const { deps, trace, exitCalls } = harness({
-      resolveSchemaFacts: (() =>
-        okSchemaFacts({
-          hasSchema: true,
-          requiredKeys: ['API_TOKEN'],
-          serverKeys: ['API_TOKEN'],
-        })) as CloudflareDeployDeps['resolveSchemaFacts'],
-      readEmittedWorkerVars: (() =>
-        emittedVars({ API_TOKEN: 'secret' })) as CloudflareDeployDeps['readEmittedWorkerVars'],
-    });
+  it.each([
+    { shipped: 'a value', value: 'secret' },
+    { shipped: 'an empty value', value: '' },
+    { shipped: 'a null value', value: null },
+  ])(
+    'rejects a schema-declared server key emitted as a plaintext Worker var with $shipped',
+    async ({ value }) => {
+      const root = d1Project(PROVISIONED_D1);
+      // The plaintext server-key gate checks presence, so empty and null values fail closed too.
+      const { deps, trace, wranglerArgs, exitCalls } = harness({
+        resolveSchemaFacts: (() =>
+          okSchemaFacts({
+            hasSchema: true,
+            requiredKeys: ['API_TOKEN'],
+            serverKeys: ['API_TOKEN'],
+          })) as CloudflareDeployDeps['resolveSchemaFacts'],
+        readEmittedWorkerVars: (() =>
+          emittedVars({ API_TOKEN: value })) as CloudflareDeployDeps['readEmittedWorkerVars'],
+      });
 
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(trace).toContain('build');
-    expect(trace).not.toContain('wrangler:deploy');
-  });
+      await expect(
+        runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
+      ).rejects.toBeInstanceOf(ExitError);
+      expect(exitCalls).toEqual([1]);
+      expect(trace).toContain('build');
+      expect(trace).not.toContain('wrangler:deploy');
+      expect(wranglerArgs.some((a) => a[0] === 'secret')).toBe(false);
+    },
+  );
 
   it('allows an emitted VITE_* client value', async () => {
     const root = d1Project(PROVISIONED_D1);
@@ -9134,7 +8265,6 @@ describe('runCloudflareDeploy — post-build ground-truth secret gate', () => {
       })) as CloudflareDeployDeps['validateEmittedVars'],
       dischargeSelfHostEnv: (async (ctx: SelfHostEnvContext) => {
         captured = ctx;
-        return { hasSchema: true, remoteSecretNames: null };
       }) as CloudflareDeployDeps['dischargeSelfHostEnv'],
     });
 
@@ -9160,72 +8290,19 @@ describe('runCloudflareDeploy — post-build ground-truth secret gate', () => {
       dischargeSelfHostEnv: (async (ctx: SelfHostEnvContext) => {
         trace.push('gate');
         captured = ctx;
-        return { hasSchema: true, remoteSecretNames: ['STRIPE_KEY'] };
       }) as CloudflareDeployDeps['dischargeSelfHostEnv'],
     });
     await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
     // STRIPE_KEY is absent from the emitted vars → the gate sees it as absentRequired (the
-    // remote secret discharges it); nothing is present-empty/invalid.
+    // remote secret discharges it); nothing is invalid.
     expect(captured).toEqual({
       hasSchema: true,
-      presentEmptyRequired: [],
-      presentEmptySources: {},
       absentRequired: ['STRIPE_KEY'],
       invalidKeys: [],
     });
     expect(trace).toContain('wrangler:deploy');
   });
 
-  it('fails closed when a required secret is shipped EMPTY in the REAL vars (shadows the remote secret)', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    // Use the REAL discharge (dischargeSelfHostEnv undefined) so the present-empty fence runs.
-    const { deps, trace, wranglerArgs, exitCalls } = harness({
-      resolveSchemaFacts: (() =>
-        okSchemaFacts({
-          hasSchema: true,
-          requiredKeys: ['STRIPE_KEY'],
-          serverKeys: ['STRIPE_KEY'],
-        })) as CloudflareDeployDeps['resolveSchemaFacts'],
-      readEmittedWorkerVars: (() =>
-        emittedVars({ STRIPE_KEY: '' })) as CloudflareDeployDeps['readEmittedWorkerVars'],
-      dischargeSelfHostEnv: undefined,
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    // The gate runs POST-build (ground truth), so the build already ran; a shipped-empty
-    // required secret fails closed BEFORE any wrangler secret list and before deploy.
-    expect(trace).toContain('build');
-    expect(trace).not.toContain('wrangler:deploy');
-    expect(wranglerArgs.some((a) => a[0] === 'secret')).toBe(false);
-  });
-
-  it('fails closed when a required secret is shipped NULL in the REAL vars (shadows like empty)', async () => {
-    const root = d1Project(PROVISIONED_D1);
-    // A parsed wrangler.json var can be `null`; the schema validators bucket null as "missing"
-    // (not "invalid"), so without the empty-shadow fence it would slip past every gate while
-    // still shadowing the remote secret. Use the REAL discharge so the fence runs.
-    const { deps, trace, wranglerArgs, exitCalls } = harness({
-      resolveSchemaFacts: (() =>
-        okSchemaFacts({
-          hasSchema: true,
-          requiredKeys: ['STRIPE_KEY'],
-          serverKeys: ['STRIPE_KEY'],
-        })) as CloudflareDeployDeps['resolveSchemaFacts'],
-      readEmittedWorkerVars: (() =>
-        emittedVars({ STRIPE_KEY: null })) as CloudflareDeployDeps['readEmittedWorkerVars'],
-      dischargeSelfHostEnv: undefined,
-    });
-    await expect(
-      runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps),
-    ).rejects.toBeInstanceOf(ExitError);
-    expect(exitCalls).toEqual([1]);
-    expect(trace).toContain('build');
-    expect(wranglerArgs.some((a) => a[0] === 'secret')).toBe(false);
-    expect(trace).not.toContain('wrangler:deploy');
-  });
-
   it('fails closed when the build emits a MALFORMED vars field (array/scalar)', async () => {
     const root = d1Project(PROVISIONED_D1);
     const { deps, trace, exitCalls } = harness({
@@ -9296,27 +8373,18 @@ describe('runCloudflareDeploy — schema probe runs under the build NODE_ENV', (
   });
 
   it('pins NODE_ENV=production for the BUILD too (vite only defaults it when unset)', async () => {
-    const savedNodeEnv = process.env.NODE_ENV;
     // An ambient NODE_ENV=development would otherwise make `vite build` evaluate a development
     // schema while the probe (pinned production) derives a production one.
-    process.env.NODE_ENV = 'development';
+    vi.stubEnv('NODE_ENV', 'development');
     let buildNodeEnv: string | undefined = 'UNSET';
-    try {
-      const root = d1Project(PROVISIONED_D1);
-      const { deps } = harness({
-        runBuild: (env) => {
-          buildNodeEnv = env.NODE_ENV;
-        },
-      });
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-      expect(buildNodeEnv).toBe('production');
-    } finally {
-      if (savedNodeEnv === undefined) {
-        delete process.env.NODE_ENV;
-      } else {
-        process.env.NODE_ENV = savedNodeEnv;
-      }
-    }
+    const root = d1Project(PROVISIONED_D1);
+    const { deps } = harness({
+      runBuild: (env) => {
+        buildNodeEnv = env.NODE_ENV;
+      },
+    });
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    expect(buildNodeEnv).toBe('production');
   });
 
   it('marks both schema probes and the build as a Cloudflare deploy build', async () => {
@@ -9340,41 +8408,26 @@ describe('runCloudflareDeploy — schema probe runs under the build NODE_ENV', (
   });
 
   it('scrubs stale managed markers from native probes and the build', async () => {
-    const savedProjectId = process.env.VOID_DEPLOY_PROJECT_ID;
-    const savedManagedBuild = process.env.VOID_DEPLOY_BUILD;
-    process.env.VOID_DEPLOY_PROJECT_ID = 'stale-managed-project';
-    process.env.VOID_DEPLOY_BUILD = '1';
+    vi.stubEnv('VOID_DEPLOY_PROJECT_ID', 'stale-managed-project');
+    vi.stubEnv('VOID_DEPLOY_BUILD', '1');
     let probeEnvSeen: NodeJS.ProcessEnv = {};
     let buildEnvSeen: NodeJS.ProcessEnv = {};
-    try {
-      const root = d1Project(PROVISIONED_D1);
-      const { deps } = harness({
-        resolveSchemaFacts: ((_input, env) => {
-          probeEnvSeen = { ...env };
-          return okSchemaFacts();
-        }) as CloudflareDeployDeps['resolveSchemaFacts'],
-        runBuild: (env) => {
-          buildEnvSeen = { ...env };
-        },
-      });
+    const root = d1Project(PROVISIONED_D1);
+    const { deps } = harness({
+      resolveSchemaFacts: ((_input, env) => {
+        probeEnvSeen = { ...env };
+        return okSchemaFacts();
+      }) as CloudflareDeployDeps['resolveSchemaFacts'],
+      runBuild: (env) => {
+        buildEnvSeen = { ...env };
+      },
+    });
 
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
 
-      for (const env of [probeEnvSeen, buildEnvSeen]) {
-        expect(env.VOID_DEPLOY_PROJECT_ID).toBeUndefined();
-        expect(env.VOID_DEPLOY_BUILD).toBeUndefined();
-      }
-    } finally {
-      if (savedProjectId === undefined) {
-        delete process.env.VOID_DEPLOY_PROJECT_ID;
-      } else {
-        process.env.VOID_DEPLOY_PROJECT_ID = savedProjectId;
-      }
-      if (savedManagedBuild === undefined) {
-        delete process.env.VOID_DEPLOY_BUILD;
-      } else {
-        process.env.VOID_DEPLOY_BUILD = savedManagedBuild;
-      }
+    for (const env of [probeEnvSeen, buildEnvSeen]) {
+      expect(env.VOID_DEPLOY_PROJECT_ID).toBeUndefined();
+      expect(env.VOID_DEPLOY_BUILD).toBeUndefined();
     }
   });
 });
@@ -9389,56 +8442,33 @@ describe('runCloudflareDeploy — schema probe runs under the build NODE_ENV', (
 describe('runCloudflareDeploy — wrangler credentials reach only the wrangler runner', () => {
   it('the BUILD child env carries none of the wrangler auth credentials', async () => {
     let buildEnvSeen: NodeJS.ProcessEnv = {};
-    const previousDatabaseUrl = process.env.DATABASE_URL;
-    const previousVoidToken = process.env.VOID_TOKEN;
-    try {
-      await withWranglerCredentials(async () => {
-        process.env.DATABASE_URL = 'postgres://production-secret';
-        process.env.VOID_TOKEN = 'managed-platform-token';
-        const root = d1Project(PROVISIONED_D1);
-        const { deps } = harness({
-          runBuild: (env) => {
-            buildEnvSeen = { ...env };
-          },
-        });
-        await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-      });
-      for (const name of WRANGLER_AUTH_VARS) {
-        expect(buildEnvSeen[name]).toBeUndefined();
-      }
-      expect(buildEnvSeen.DATABASE_URL).toBeUndefined();
-      expect(buildEnvSeen.VOID_TOKEN).toBeUndefined();
-    } finally {
-      if (previousDatabaseUrl === undefined) {
-        delete process.env.DATABASE_URL;
-      } else {
-        process.env.DATABASE_URL = previousDatabaseUrl;
-      }
-      if (previousVoidToken === undefined) {
-        delete process.env.VOID_TOKEN;
-      } else {
-        process.env.VOID_TOKEN = previousVoidToken;
-      }
+    stubWranglerCredentials();
+    vi.stubEnv('DATABASE_URL', 'postgres://production-secret');
+    vi.stubEnv('VOID_TOKEN', 'managed-platform-token');
+    const root = d1Project(PROVISIONED_D1);
+    const { deps } = harness({
+      runBuild: (env) => {
+        buildEnvSeen = { ...env };
+      },
+    });
+    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
+    for (const name of WRANGLER_AUTH_VARS) {
+      expect(buildEnvSeen[name]).toBeUndefined();
     }
+    expect(buildEnvSeen.DATABASE_URL).toBeUndefined();
+    expect(buildEnvSeen.VOID_TOKEN).toBeUndefined();
   });
 
-  it('the wrangler runner keeps Wrangler auth but not Void readiness credentials', async () => {
-    await withWranglerCredentials(async () => {
-      // Run a deploy first so the fork's memoized provision module is loaded — the sync
-      // `deployChildEnv` reads it, exactly as `createDeployWranglerRunner` does.
-      const root = d1Project(PROVISIONED_D1);
-      const { deps } = harness();
-      await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-
-      const runnerEnv = deployChildEnv('acc123', 'https://api.cloudflare.com/client/v4');
-      for (const name of WRANGLER_AUTH_VARS) {
-        if (name === 'CF_ACCESS_TOKEN') {
-          expect(runnerEnv[name]).toBeUndefined();
-        } else {
-          expect(runnerEnv[name]).toBe(`secret-${name}`);
-        }
+  it('the wrangler runner keeps Wrangler auth but not Void readiness credentials', () => {
+    stubWranglerCredentials();
+    const runnerEnv = deployChildEnv('acc123', 'https://api.cloudflare.com/client/v4');
+    for (const name of WRANGLER_AUTH_VARS) {
+      if (name === 'CF_ACCESS_TOKEN') {
+        expect(runnerEnv[name]).toBeUndefined();
+      } else {
+        expect(runnerEnv[name]).toBe(`secret-${name}`);
       }
-    });
+    }
   });
 });
 
@@ -9678,62 +8708,41 @@ describe('env-schema probe (real subprocess)', () => {
   });
 
   it('the orchestrator scrubs CLOUDFLARE_API_TOKEN + CF Access before spawning the probe', async () => {
-    const savedToken = process.env.CLOUDFLARE_API_TOKEN;
-    const savedId = process.env.CF_ACCESS_CLIENT_ID;
-    const savedSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    process.env.CLOUDFLARE_API_TOKEN = 'super-secret-token';
-    process.env.CF_ACCESS_CLIENT_ID = 'super-secret-id';
-    process.env.CF_ACCESS_CLIENT_SECRET = 'super-secret-secret';
+    vi.stubEnv('CLOUDFLARE_API_TOKEN', 'super-secret-token');
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', 'super-secret-id');
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'super-secret-secret');
     const leakFile = join(tmpDir, 'orchestrator-leak.json');
-    try {
-      // The env.ts LEAKS the three parent creds to a file; the orchestrator spawns the REAL
-      // probe (resolveSchemaFacts undefined → default subprocess seam) under a scrubbed env.
-      const root = d1Project(PROVISIONED_D1, {
-        'package.json': JSON.stringify({ name: 'myapp', type: 'module' }),
-        'env.ts': [
-          `import { defineEnv } from ${JSON.stringify(srcEnvPublic)};`,
-          `import { string } from ${JSON.stringify(srcEnvHelpers)};`,
-          `import { writeFileSync } from 'node:fs';`,
-          `writeFileSync(${JSON.stringify(leakFile)}, JSON.stringify({`,
-          `  token: process.env.CLOUDFLARE_API_TOKEN ?? null,`,
-          `  id: process.env.CF_ACCESS_CLIENT_ID ?? null,`,
-          `  secret: process.env.CF_ACCESS_CLIENT_SECRET ?? null,`,
-          `}));`,
-          `export default defineEnv({ FOO: string() });`,
-        ].join('\n'),
-      });
-      await runCloudflareDeploy(
-        root,
-        { platform: 'cloudflare' },
-        silentCliLog,
-        harness({ resolveSchemaFacts: undefined }).deps,
-      );
-      const leaked = JSON.parse(readFileSync(leakFile, 'utf-8')) as {
-        token: string | null;
-        id: string | null;
-        secret: string | null;
-      };
-      // The child (project env.ts) ran under the scrubbed env — none of the parent's creds.
-      expect(leaked.token).toBeNull();
-      expect(leaked.id).toBeNull();
-      expect(leaked.secret).toBeNull();
-    } finally {
-      if (savedToken === undefined) {
-        delete process.env.CLOUDFLARE_API_TOKEN;
-      } else {
-        process.env.CLOUDFLARE_API_TOKEN = savedToken;
-      }
-      if (savedId === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_ID;
-      } else {
-        process.env.CF_ACCESS_CLIENT_ID = savedId;
-      }
-      if (savedSecret === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_SECRET;
-      } else {
-        process.env.CF_ACCESS_CLIENT_SECRET = savedSecret;
-      }
-    }
+    // The env.ts LEAKS the three parent creds to a file; the orchestrator spawns the REAL
+    // probe (resolveSchemaFacts undefined → default subprocess seam) under a scrubbed env.
+    const root = d1Project(PROVISIONED_D1, {
+      'package.json': JSON.stringify({ name: 'myapp', type: 'module' }),
+      'env.ts': [
+        `import { defineEnv } from ${JSON.stringify(srcEnvPublic)};`,
+        `import { string } from ${JSON.stringify(srcEnvHelpers)};`,
+        `import { writeFileSync } from 'node:fs';`,
+        `writeFileSync(${JSON.stringify(leakFile)}, JSON.stringify({`,
+        `  token: process.env.CLOUDFLARE_API_TOKEN ?? null,`,
+        `  id: process.env.CF_ACCESS_CLIENT_ID ?? null,`,
+        `  secret: process.env.CF_ACCESS_CLIENT_SECRET ?? null,`,
+        `}));`,
+        `export default defineEnv({ FOO: string() });`,
+      ].join('\n'),
+    });
+    await runCloudflareDeploy(
+      root,
+      { platform: 'cloudflare' },
+      silentCliLog,
+      harness({ resolveSchemaFacts: undefined }).deps,
+    );
+    const leaked = JSON.parse(readFileSync(leakFile, 'utf-8')) as {
+      token: string | null;
+      id: string | null;
+      secret: string | null;
+    };
+    // The child (project env.ts) ran under the scrubbed env — none of the parent's creds.
+    expect(leaked.token).toBeNull();
+    expect(leaked.id).toBeNull();
+    expect(leaked.secret).toBeNull();
   });
 
   it('a broken env.ts fails closed with a VALUES-FREE classification — no raw child output echoed', async () => {
@@ -9853,47 +8862,32 @@ describe('env-schema probe (real subprocess)', () => {
   });
 
   it('the child env carries NONE of the full wrangler-auth credential set (all aliases scrubbed)', async () => {
-    // The FULL wrangler-auth credential set + aliases set on the parent; a d1 app whose
-    // env.ts leaks them.
+    // Every Cloudflare credential is set on the parent; the app's env.ts leaks what it sees.
+    stubWranglerCredentials();
     const authVars = WRANGLER_AUTH_VARS;
-    const saved: Record<string, string | undefined> = {};
-    for (const name of authVars) {
-      saved[name] = process.env[name];
-      process.env[name] = `secret-${name}`;
-    }
     const leakFile = join(tmpDir, 'auth-scrub-leak.json');
-    try {
-      const root = d1Project(PROVISIONED_D1, {
-        'package.json': JSON.stringify({ name: 'myapp', type: 'module' }),
-        'env.ts': [
-          `import { defineEnv } from ${JSON.stringify(srcEnvPublic)};`,
-          `import { string } from ${JSON.stringify(srcEnvHelpers)};`,
-          `import { writeFileSync } from 'node:fs';`,
-          `writeFileSync(${JSON.stringify(leakFile)}, JSON.stringify({`,
-          ...authVars.map((name) => `  ${name}: process.env[${JSON.stringify(name)}] ?? null,`),
-          `}));`,
-          `export default defineEnv({ FOO: string() });`,
-        ].join('\n'),
-      });
-      await runCloudflareDeploy(
-        root,
-        { platform: 'cloudflare' },
-        silentCliLog,
-        harness({ resolveSchemaFacts: undefined }).deps,
-      );
-      const leaked = JSON.parse(readFileSync(leakFile, 'utf-8')) as Record<string, string | null>;
-      // The probe needs no credentials — the child sees none of them, canonical OR alias.
-      for (const name of authVars) {
-        expect(leaked[name]).toBeNull();
-      }
-    } finally {
-      for (const name of authVars) {
-        if (saved[name] === undefined) {
-          delete process.env[name];
-        } else {
-          process.env[name] = saved[name];
-        }
-      }
+    const root = d1Project(PROVISIONED_D1, {
+      'package.json': JSON.stringify({ name: 'myapp', type: 'module' }),
+      'env.ts': [
+        `import { defineEnv } from ${JSON.stringify(srcEnvPublic)};`,
+        `import { string } from ${JSON.stringify(srcEnvHelpers)};`,
+        `import { writeFileSync } from 'node:fs';`,
+        `writeFileSync(${JSON.stringify(leakFile)}, JSON.stringify({`,
+        ...authVars.map((name) => `  ${name}: process.env[${JSON.stringify(name)}] ?? null,`),
+        `}));`,
+        `export default defineEnv({ FOO: string() });`,
+      ].join('\n'),
+    });
+    await runCloudflareDeploy(
+      root,
+      { platform: 'cloudflare' },
+      silentCliLog,
+      harness({ resolveSchemaFacts: undefined }).deps,
+    );
+    const leaked = JSON.parse(readFileSync(leakFile, 'utf-8')) as Record<string, string | null>;
+    // The probe needs no credentials — the child sees none of them, canonical OR alias.
+    for (const name of authVars) {
+      expect(leaked[name]).toBeNull();
     }
   });
 
@@ -9921,10 +8915,6 @@ describe('env-schema probe (real subprocess)', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// wrangler framework autoconfig / OpenNext delegation disabled
-// ---------------------------------------------------------------------------
-
 // ---------------------------------------------------------------------------
 // `--skip-build` — every gate on this path reads the artifact `vite build`
 // emits, so there is nothing to validate without a build. Reject the combination
@@ -9980,13 +8970,6 @@ describe('runCloudflareDeploy — --skip-build is rejected', () => {
     expect(joined).toContain('--platform cloudflare');
     expect(joined).toMatch(/validat/i);
   });
-
-  it('leaves the build running when --skip-build is absent', async () => {
-    const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
-    const { deps, trace } = harness();
-    await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
-    expect(trace).toContain('build');
-  });
 });
 
 describe('runCloudflareDeploy — wrangler autoconfig disabled', () => {
@@ -10110,12 +9093,12 @@ describe('assertWranglerUploaderUnchanged', () => {
 });
 
 // ---------------------------------------------------------------------------
-// Mode B email (design doc 0078) — step 3b-ii. The email module itself is unit-tested in
+// Native Cloudflare email step. The email module itself is unit-tested in
 // email-cloudflare.test.ts on fakes; these tests pin the ORCHESTRATION: where the step sits,
 // what it spawns, what it writes, what it prints, and what it never leaks.
 // ---------------------------------------------------------------------------
 
-describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
+describe('runCloudflareDeploy — native Cloudflare email step', () => {
   const ZONE_ID = '5b66f5cb84fd7dcfdd0170515e622181';
   const BEARER = 'cfoa-SECRET-BEARER-TOKEN-0123456789abcdef';
   const BETA_WARNING = '▲ [WARNING] 🚧 `wrangler email x` is an open beta command.\n';
@@ -10199,12 +9182,12 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     stderr: BETA_WARNING,
   };
 
-  type Spawn = { args: Array<string>; opts: { capture: boolean; env?: Record<string, string> } };
+  type Spawn = { args: Array<string>; opts: { capture: boolean } };
 
   /**
    * A deploy runner keyed on the wrangler argv WITHOUT the `-c <cfg> --env=` context (asserted
-   * separately): the `whoami` / `auth token` / `email …` table for the first-deploy transcript
-   * of 0078, overridable per test. Unknown commands exit clean, as the base harness does.
+   * separately): the `whoami` / `auth token` / `email …` table for a first deploy,
+   * overridable per test. Unknown commands exit clean, as the base harness does.
    */
   function emailRunner(
     overrides: Record<string, DeployWranglerRunResult>,
@@ -10290,7 +9273,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     }) as typeof fetch;
   }
 
-  /** Public DNS for the transcript: Google MX on the apex, nothing on the subdomain yet. */
+  /** Public DNS for a first deploy: Google MX on the apex, nothing on the subdomain yet. */
   function emailDns(mx: Record<string, Array<string>> = {}): EmailDns {
     const noData = (): Error => Object.assign(new Error('ENODATA'), { code: 'ENODATA' });
     const records: Record<string, Array<string>> = {
@@ -10339,7 +9322,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     };
   }
 
-  /** The harness, with the email seams wired to the transcript fakes. */
+  /** The harness, with the email seams wired to these fakes. */
   function emailHarness(
     options: {
       runner?: Record<string, DeployWranglerRunResult>;
@@ -10473,7 +9456,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     expect(trace.indexOf('probe')).toBeLessThan(trace.indexOf('build'));
   });
 
-  it('borrows the bearer via `auth token --json` with WRANGLER_WRITE_LOGS=false and never leaks it', async () => {
+  it('borrows the bearer via `auth token --json` and never leaks it', async () => {
     const root = emailProject();
     const { deps, spawns, fetchCalls } = emailHarness();
     const output = captureOutput();
@@ -10486,22 +9469,17 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     expect(authSpawns.length).toBeGreaterThan(0);
     for (const spawn of authSpawns) {
       expect(spawn.args).toEqual(['auth', 'token', '--json', ...configArgs(root)]);
-      expect(spawn.opts).toEqual({ capture: true, env: { WRANGLER_WRITE_LOGS: 'false' } });
+      expect(spawn.opts).toEqual({ capture: true });
     }
     // The token reached the Authorization header — and NOTHING else.
     expect(fetchCalls.some((c) => c.auth === `Bearer ${BEARER}`)).toBe(true);
     expect(output.lines.join('\n')).not.toContain(BEARER);
     for (const spawn of spawns) {
       expect(JSON.stringify(spawn.args)).not.toContain(BEARER);
-      expect(JSON.stringify(spawn.opts.env ?? {})).not.toContain(BEARER);
     }
     expect(
       Object.values(process.env).some((v) => typeof v === 'string' && v.includes(BEARER)),
     ).toBe(false);
-    // Only `auth token` gets the log pin; no other spawn carries any extra env.
-    for (const spawn of spawns.filter((s) => s.args[0] !== 'auth')) {
-      expect(spawn.opts.env).toBeUndefined();
-    }
   });
 
   it('a failed `auth token` yields no bearer: the dashboard fallback is printed, addresses withheld, deploy continues', async () => {
@@ -10596,7 +9574,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     // No apply: no bearer writes, no `sending enable`, no config write.
     expect(fetchCalls.filter((c) => c.method !== 'GET')).toEqual([]);
     expect(spawns.some((s) => s.args[0] === 'email' && s.args[2] === 'enable')).toBe(false);
-    // Step 5 still reconciles name/account_id, so compare the email keys, not the bytes.
+    // The deploy still pins name/account_id in the config, so compare the email keys, not the bytes.
     const after = readRootConfig(root);
     expect(after.send_email).toBeUndefined();
     expect(after.addresses).toBeUndefined();
@@ -10837,7 +9815,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     expect(spawns.some((s) => s.args[0] === 'deploy')).toBe(true);
   });
 
-  it('a hand-written `addresses` array Void did not derive skips the step, array untouched (decision 13)', async () => {
+  it('a hand-written `addresses` array Void did not derive skips the step, array untouched', async () => {
     const root = emailProject({ ...PROVISIONED_D1, addresses: ['ceo@acme.com'] });
     const { deps, spawns, confirms, exitCalls } = emailHarness();
     const output = captureOutput();
@@ -10853,7 +9831,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     expect(spawns.some((s) => s.args[0] === 'deploy')).toBe(true);
   });
 
-  /** The committed Mode B config a first deploy leaves behind. */
+  /** The committed email config a first deploy leaves behind. */
   const COMMITTED_EMAIL = {
     ...PROVISIONED_D1,
     send_email: [{ name: 'SEND_EMAIL' }],
@@ -11074,13 +10052,9 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
   });
 
   /**
-   * The Workers Free account AFTER the deploy above (or `void email setup`, which exits 0
-   * there): the binding, `addresses` and the sender var are committed, routing +
-   * subaddressing are on, the rule exists, and `sending settings` still answers not-found —
-   * the same answer a Paid account that never onboarded gives. The committed binding is the
-   * memory of the refusal, so the preflight reads ready on every later deploy: no prompt in
-   * a TTY, nothing to ask in CI, `--require-email` passes, and the onboarding is never
-   * retried by the deploy — `void email setup` is where that retry is offered.
+   * A Workers Free account after the deploy above: the email config is committed and sending
+   * still answers not-found. The committed binding records the refusal, so later deploys read
+   * ready and never retry the onboarding; `void email setup` offers that retry.
    */
   const COMMITTED_ON_FREE = {
     ...readyRows,
@@ -11315,7 +10289,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     expect(printed).toContain('outbound  sendEmail() from noreply@mail.acme.com');
   });
 
-  it('a committed `addresses` array Void did not derive stays untouched when routing is off too (decision 13)', async () => {
+  it('a committed `addresses` array Void did not derive stays untouched when routing is off too', async () => {
     const root = emailProject({ ...COMMITTED_EMAIL, addresses: ['ceo@acme.com'] });
     const { deps, spawns, confirms, exitCalls } = emailHarness({ isCI: true });
     const output = captureOutput();
@@ -11353,8 +10327,8 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
   });
 
   it('an app that stopped using email warns about the setup wrangler.jsonc still carries, and deploys as-is', async () => {
-    // No `email/` directory and no `void/email` import, but the root still has what a Mode B
-    // deploy wrote: wrangler keeps routing support@ to a worker with no `email()` export.
+    // No `email/` directory and no `void/email` import, but the root still has what an earlier
+    // email deploy wrote: wrangler keeps routing support@ to a worker with no `email()` export.
     const root = d1Project(COMMITTED_EMAIL, INIT_MIGRATION);
     const { deps, spawns, exitCalls } = emailHarness({
       confirm: async () => {
@@ -11383,13 +10357,9 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
   });
 
   it('last inbound handler removed, outbound `void/email` kept: the committed entry is a decision-13 blocker, the array stays, and the trigger snapshot still carries it (the ready-path `null` write is never reached)', async () => {
-    // Deploy 1 wrote COMMITTED_EMAIL from `email/support+[ticket].ts`. The handler is gone, but
-    // `routes/index.ts` still imports `void/email`, so `needsEmail` holds and the email step runs
-    // with an EMPTY derived set. Preflight step 8 reads the committed support@ entry as one Void
-    // did not derive (it is not in the empty candidate set): ownership `foreign`, an all-scope
-    // blocker, the step skips with the array untouched. `patch.addresses = null` (the ready path)
-    // is never reached, and the version annotation replays the entry — wrangler keeps the rule
-    // routed to a worker with no `email()` export.
+    // The inbound handler that produced COMMITTED_EMAIL is gone, but `void/email` is still
+    // imported, so the email step runs with an empty derived set. The committed entry is one Void
+    // did not derive, so the step skips and leaves the array, and the annotation replays it.
     const root = makeProject({
       'package.json': JSON.stringify({ name: 'myapp' }),
       'void.json': JSON.stringify({ email: { from: 'noreply@mail.acme.com' } }),
@@ -11455,7 +10425,7 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     ]);
   });
 
-  it('an app with no email use never touches the email step (no whoami before 3e, no auth token)', async () => {
+  it('an app with no email use never touches the email step (no early whoami, no auth token)', async () => {
     const root = d1Project(PROVISIONED_D1, INIT_MIGRATION);
     const { deps, spawns, trace } = emailHarness({
       confirm: async () => {
@@ -11464,14 +10434,14 @@ describe('runCloudflareDeploy — Mode B email step (3b-ii)', () => {
     });
     await runCloudflareDeploy(root, { platform: 'cloudflare' }, silentCliLog, deps);
     expect(spawns.some((s) => s.args[0] === 'auth' || s.args[0] === 'email')).toBe(false);
-    // The ONLY whoami is 3e's, which comes after the probe.
+    // The only whoami is the deploy's own, after the env-schema probe.
     expect(trace.filter((t) => t === 'wrangler:whoami --json')).toHaveLength(1);
     expect(trace.indexOf('probe')).toBeLessThan(trace.indexOf('wrangler:whoami --json'));
   });
 });
 
 describe('runWranglerAuthToken — the session-bearer bridge, on its own', () => {
-  type AuthCall = { args: Array<string>; opts: { capture: boolean; env?: Record<string, string> } };
+  type AuthCall = { args: Array<string>; opts: { capture: boolean } };
   const bridge = (result: DeployWranglerRunResult | (() => never)) => {
     const calls: Array<AuthCall> = [];
     const run: DeployWranglerRun = operationFixture((args, opts) => {
@@ -11481,7 +10451,7 @@ describe('runWranglerAuthToken — the session-bearer bridge, on its own', () =>
     return { calls, token: runWranglerAuthToken(run, '/p/wrangler.jsonc') };
   };
 
-  it('spawns exactly `auth token --json` in the deploy config context, captured, logs off', async () => {
+  it('spawns exactly `auth token --json` in the deploy config context, captured', async () => {
     const { calls, token } = bridge({
       status: 0,
       stdout: `{\n  "type": "oauth",\n  "token": "cfoa.abc"\n}\n`,
@@ -11493,7 +10463,7 @@ describe('runWranglerAuthToken — the session-bearer bridge, on its own', () =>
     expect(calls).toEqual([
       {
         args: ['auth', 'token', '--json', '-c', '/p/wrangler.jsonc', '--env='],
-        opts: { capture: true, env: { WRANGLER_WRITE_LOGS: 'false' } },
+        opts: { capture: true },
       },
     ]);
   });
@@ -11549,7 +10519,7 @@ describe('runCloudflareDeploy — `addresses` is whole-object pinned across the
     d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: REAL_D1_ID }],
   };
 
-  it('fails closed when the build injects an `addresses` array the root never declared (used to fail open)', async () => {
+  it('fails closed when the build injects an `addresses` array the root never declared', async () => {
     // wrangler ≥ 4.113 would turn this into a routing rule sending the account's inbound mail for
     // `ceo@acme.com` to the deployed worker. No email step runs (no email use), so the pin alone
     // must catch it.
diff --git a/packages/void/test/unit/cloudflare-durable-patch.test.ts b/packages/void/test/unit/cloudflare-durable-patch.test.ts
index 5723b1fc3..5fd5b70ed 100644
--- a/packages/void/test/unit/cloudflare-durable-patch.test.ts
+++ b/packages/void/test/unit/cloudflare-durable-patch.test.ts
@@ -221,4 +221,22 @@ describe('Sandbox migration storage identity', () => {
       ),
     ).not.toThrow();
   });
+  it('rejects reuse of a legacy Sandbox namespace', () => {
+    expect(() =>
+      assertSandboxNamespaceConfig(
+        {
+          durable_objects: { bindings: [{ name: 'SANDBOX', class_name: 'Sandbox' }] },
+          containers: [
+            {
+              name: 'void-sandbox',
+              class_name: 'Sandbox',
+              image: 'docker.io/cloudflare/sandbox:0.12.10',
+            },
+          ],
+          migrations: [{ tag: 'void-sandbox-v1', new_sqlite_classes: ['Sandbox'] }],
+        },
+        sandbox,
+      ),
+    ).toThrow('new Durable Object namespace');
+  });
 });
diff --git a/packages/void/test/unit/cloudflare-isr.test.ts b/packages/void/test/unit/cloudflare-isr.test.ts
index a702c28cc..791319bf6 100644
--- a/packages/void/test/unit/cloudflare-isr.test.ts
+++ b/packages/void/test/unit/cloudflare-isr.test.ts
@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { approvedCloudflareIsrBinding, chooseCloudflareIsr } from '../../src/cli/cloudflare-isr.ts';
+import { renderVoidConfig } from '../../src/config-write.ts';
 import { readConfig } from '../../src/config.ts';
 
 const roots: Array<string> = [];
@@ -10,8 +11,8 @@ function project() {
   const root = mkdtempSync(join(tmpdir(), 'void-isr-choice-'));
   roots.push(root);
   writeFileSync(
-    join(root, 'void.json'),
-    JSON.stringify({
+    join(root, 'void.config.ts'),
+    renderVoidConfig({
       head: { title: 'Blog' },
       routing: { headers: { '/posts/*.md': ['Content-Type: text/markdown'] } },
     }),
@@ -42,13 +43,13 @@ describe('Cloudflare migration ISR choice', () => {
   });
   it('does not save a choice or prompt in CI', async () => {
     const root = project();
-    const before = readFileSync(join(root, 'void.json'), 'utf8');
+    const before = readFileSync(join(root, 'void.config.ts'), 'utf8');
     const confirm = vi.fn();
     await expect(
       chooseCloudflareIsr(root, readConfig(root), { interactive: false, confirm }),
     ).rejects.toThrow('Set routing.isr to true');
     expect(confirm).not.toHaveBeenCalled();
-    expect(readFileSync(join(root, 'void.json'), 'utf8')).toBe(before);
+    expect(readFileSync(join(root, 'void.config.ts'), 'utf8')).toBe(before);
   });
   it('authorizes only a valid configured cache and never an application KV alias', () => {
     const id = '0123456789abcdef0123456789abcdef';
diff --git a/packages/void/test/unit/cloudflare-login-output.test.ts b/packages/void/test/unit/cloudflare-login-output.test.ts
index 46f51cede..ec5f579e1 100644
--- a/packages/void/test/unit/cloudflare-login-output.test.ts
+++ b/packages/void/test/unit/cloudflare-login-output.test.ts
@@ -1,9 +1,13 @@
+import { execFile } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { stripVTControlCharacters } from 'node:util';
-import { expect, it, vi } from 'vite-plus/test';
+import { expect, it } from 'vite-plus/test';
 import {
   cloudflareDeviceCode,
   cloudflareVerificationUrl,
-  printCloudflareLoginPrompt,
 } from '../../src/cli/cloudflare-login-output.ts';
 import { encodeCloudflareOperation } from '../../src/cli/cloudflare-process.ts';
 
@@ -33,19 +37,6 @@ it('extracts only the complete verification URL supplied by cf', () => {
   expect(cloudflareVerificationUrl('and enter the code:\n  a1B2c3D4\n')).toBeNull();
 });
 
-it('prints only the short Void prompt with the actual code', () => {
-  const printed = vi.spyOn(console, 'log').mockImplementation(() => {});
-  try {
-    printCloudflareLoginPrompt('a1B2c3D4');
-    expect(printed).toHaveBeenCalledTimes(1);
-    expect(stripVTControlCharacters(printed.mock.calls[0]?.[0] ?? '')).toContain(
-      'Opening Cloudflare login in your browser. Confirm the code a1B2c3D4 in your browser. Press Ctrl+C to cancel.',
-    );
-  } finally {
-    printed.mockRestore();
-  }
-});
-
 it('hides cf login chatter and prints the code before the child exits', async () => {
   const directory = mkdtempSync(join(tmpdir(), 'void-login-output-'));
   try {
@@ -117,8 +108,3 @@ syncBuiltinESMExports();
     rmSync(directory, { recursive: true, force: true });
   }
 });
-import { execFile } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
diff --git a/packages/void/test/unit/cloudflare-login-terminal.test.ts b/packages/void/test/unit/cloudflare-login-terminal.test.ts
index ea9d7e644..edbb08bcd 100644
--- a/packages/void/test/unit/cloudflare-login-terminal.test.ts
+++ b/packages/void/test/unit/cloudflare-login-terminal.test.ts
@@ -4,12 +4,11 @@ import type { CloudflareOperation } from '@void/deploy-cloudflare';
 import { log } from '@voidzero-dev/vite-plus-prompts';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import {
-  cloudflareAuthNeedsTerminal,
   createBundledCloudflareAuthRunner,
   ensureCloudflareAuthentication,
   runCloudflareAuthCommand,
 } from '../../src/cli/cloudflare-auth.ts';
-import { createDeployWranglerRunner, loadProvisionModule } from '../../src/cli/deploy.ts';
+import { createDeployWranglerRunner } from '../../src/cli/deploy.ts';
 
 vi.mock('node:child_process', async (importOriginal) => ({
   ...(await importOriginal<typeof import('node:child_process')>()),
@@ -41,7 +40,6 @@ describe('cf browser login', () => {
       },
     ],
   ] as const)('%s shows the live login prompt', async (_, create) => {
-    await loadProvisionModule();
     vi.spyOn(log, 'info').mockImplementation(() => {});
     let reads = 0;
     vi.mocked(spawnSync).mockImplementation((_command, args, options) => {
@@ -99,7 +97,7 @@ describe('cf browser login', () => {
       false,
     );
     expect(result).toMatchObject({ status: 0, data: { removed: true } });
-    expect(vi.mocked(spawnSync).mock.calls[0]?.[2]?.stdio).toEqual(['ignore', 'pipe', 'pipe']);
+    expect(vi.mocked(spawnSync).mock.calls[0]?.[2]?.stdio).toEqual(['pipe', 'pipe', 'pipe']);
     expect(stdout).toHaveBeenCalledWith('Session removed.\n');
     expect(stderr).toHaveBeenCalledWith('Provider note.\n');
   });
@@ -133,10 +131,4 @@ describe('cf browser login', () => {
     child.emit('close', 0, null);
     await expect(result).resolves.toMatchObject({ status: null, error: 'spawn failed' });
   });
-
-  it('only streams browser login', () => {
-    expect(cloudflareAuthNeedsTerminal({ type: 'auth.login' })).toBe(true);
-    expect(cloudflareAuthNeedsTerminal({ type: 'auth.whoami' })).toBe(false);
-    expect(cloudflareAuthNeedsTerminal({ type: 'auth.token' })).toBe(false);
-  });
 });
diff --git a/packages/void/test/unit/cloudflare-operation-process.test.ts b/packages/void/test/unit/cloudflare-operation-process.test.ts
index 2f7cbe768..cc303e145 100644
--- a/packages/void/test/unit/cloudflare-operation-process.test.ts
+++ b/packages/void/test/unit/cloudflare-operation-process.test.ts
@@ -1,14 +1,15 @@
 import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { createServer, request as httpRequest } from 'node:http';
+import { createServer, request as httpRequest, type Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 import { connect } from 'node:net';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { Duplex } from 'node:stream';
 import { pathToFileURL } from 'node:url';
-import { expect, it } from 'vite-plus/test';
+import type { CloudflareOperation } from '@void/deploy-cloudflare';
+import { afterEach, expect, it } from 'vite-plus/test';
 import { isVoidSecretOnlyDraft } from '../../../deploy-cloudflare/src/secret-draft.ts';
 import { voidSecretDraftVersion } from '../../../deploy-cloudflare/test/secret-draft-fixture.ts';
 import {
@@ -23,87 +24,141 @@ const voidVersion = JSON.parse(readFileSync(new URL('../../package.json', import
 const cfVersion = JSON.parse(readFileSync(new URL(import.meta.resolve('cf/package.json')), 'utf8'))
   .version as string;
 
+const cleanups: Array<() => unknown> = [];
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0).reverse()) {
+    await cleanup();
+  }
+});
+
+function temporaryDirectory(prefix: string): string {
+  const directory = mkdtempSync(join(tmpdir(), prefix));
+  cleanups.push(() => rmSync(directory, { recursive: true, force: true }));
+  return directory;
+}
+
+/** Serve on a random local port until the test ends and return the origin. */
+async function listen(server: Server): Promise<string> {
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  cleanups.push(
+    () =>
+      new Promise<void>((resolve) => {
+        server.close(() => resolve());
+        server.closeAllConnections();
+      }),
+  );
+  return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+}
+
+// Children get only what Node needs, so host credentials cannot leak into a test.
+const systemEnv = {
+  PATH: process.env.PATH,
+  SYSTEMROOT: process.env.SYSTEMROOT,
+  WINDIR: process.env.WINDIR,
+  TMP: process.env.TMP,
+  TEMP: process.env.TEMP,
+};
+
+function tokenEnv(
+  api?: string,
+  token: 'CLOUDFLARE_API_TOKEN' | 'CF_API_TOKEN' = 'CLOUDFLARE_API_TOKEN',
+): NodeJS.ProcessEnv {
+  return {
+    ...systemEnv,
+    CI: 'true',
+    [token]: 'synthetic-token',
+    CLOUDFLARE_ACCOUNT_ID: 'test-account',
+    ...(api ? { CLOUDFLARE_API_BASE_URL: `${api}/client/v4` } : {}),
+  };
+}
+
+function unproxiedEnv(api: string): NodeJS.ProcessEnv {
+  return {
+    ...process.env,
+    CF_API_TOKEN: 'synthetic-token',
+    CLOUDFLARE_ACCOUNT_ID: 'test-account',
+    CLOUDFLARE_API_BASE_URL: `${api}/client/v4`,
+    HTTP_PROXY: '',
+    HTTPS_PROXY: '',
+    http_proxy: '',
+    https_proxy: '',
+  };
+}
+
+/** Run the operation process the CLI spawns; `preload` is imported first to stub cf. */
+function runOperation(
+  cwd: string,
+  request: CloudflareOperation | Array<string>,
+  env: NodeJS.ProcessEnv,
+  preload?: string,
+): Promise<{ status: number; stdout: string; stderr: string }> {
+  const [command, ...prefix] = resolveCloudflareOperationArgv();
+  const args = Array.isArray(request) ? request : encodeCloudflareOperation(request);
+  return new Promise((resolve) => {
+    execFile(
+      command!,
+      [...(preload ? ['--import', pathToFileURL(preload).href] : []), ...prefix, ...args],
+      { cwd, encoding: 'utf8', timeout: 20_000, env },
+      (error, stdout, stderr) =>
+        resolve({ status: error ? Number(error.code) || 1 : 0, stdout, stderr }),
+    );
+  });
+}
+
 it('requests immutable version source explicitly without loading or provisioning build output', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-secret-source-'));
+  const directory = temporaryDirectory('void-cf-secret-source-');
   const draft = voidSecretDraftVersion();
   const requests: Array<string> = [];
   const userAgents: Array<string | undefined> = [];
-  const server = createServer((request, response) => {
-    requests.push(request.url ?? '');
-    userAgents.push(request.headers['user-agent']);
-    request.resume();
-    response.writeHead(200, { 'Content-Type': 'application/json' });
-    response.end(JSON.stringify({ success: true, errors: [], messages: [], result: draft }));
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  try {
-    const configPath = join(directory, 'wrangler.json');
-    writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const captured = await new Promise<string>((resolve, reject) =>
-      execFile(
-        command!,
-        [
-          ...prefix,
-          ...encodeCloudflareOperation({
-            type: 'versions.view',
-            versionId: draft.id,
-            includeSource: true,
-            configPath,
-            workerName: 'test-worker',
-          }),
-        ],
-        {
-          cwd: directory,
-          encoding: 'utf8',
-          timeout: 20_000,
-          env: {
-            PATH: process.env.PATH,
-            SYSTEMROOT: process.env.SYSTEMROOT,
-            WINDIR: process.env.WINDIR,
-            CI: 'true',
-            CLI_VERSION: 'inherited-version void/stale',
-            CLOUDFLARE_API_TOKEN: 'synthetic-token',
-            CLOUDFLARE_ACCOUNT_ID: 'test-account',
-            CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-          },
-        },
-        (error, stdout, stderr) => (error ? reject(new Error(stderr)) : resolve(stdout)),
-      ),
-    );
-    const result = decodeCloudflareOperationResult({ status: 0, stdout: captured, stderr: '' });
-    expect(result.status).toBe(0);
-    expect(isVoidSecretOnlyDraft(result.data as Record<string, unknown>)).toBe(true);
-    expect(requests).toEqual([
-      `/client/v4/accounts/test-account/workers/workers/test-worker/versions/${draft.id}?include=modules`,
-    ]);
-    expect(captured).not.toContain('synthetic-token');
-    expect(userAgents).toEqual([`cf-cli/${cfVersion} void/${voidVersion}`]);
-  } finally {
-    await new Promise<void>((resolve) => {
-      server.close(() => resolve());
-      server.closeAllConnections();
-    });
-    rmSync(directory, { recursive: true, force: true });
-  }
+  const api = await listen(
+    createServer((request, response) => {
+      requests.push(request.url ?? '');
+      userAgents.push(request.headers['user-agent']);
+      request.resume();
+      response.writeHead(200, { 'Content-Type': 'application/json' });
+      response.end(JSON.stringify({ success: true, errors: [], messages: [], result: draft }));
+    }),
+  );
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
+  const output = await runOperation(
+    directory,
+    {
+      type: 'versions.view',
+      versionId: draft.id,
+      includeSource: true,
+      configPath,
+      workerName: 'test-worker',
+    },
+    { ...tokenEnv(api), CLI_VERSION: 'inherited-version void/stale' },
+  );
+  expect(output.status, output.stderr).toBe(0);
+  const result = decodeCloudflareOperationResult({ status: 0, stdout: output.stdout, stderr: '' });
+  expect(result.status).toBe(0);
+  expect(isVoidSecretOnlyDraft(result.data as Record<string, unknown>)).toBe(true);
+  expect(requests).toEqual([
+    `/client/v4/accounts/test-account/workers/workers/test-worker/versions/${draft.id}?include=modules`,
+  ]);
+  expect(output.stdout).not.toContain('synthetic-token');
+  expect(userAgents).toEqual([`cf-cli/${cfVersion} void/${voidVersion}`]);
 });
 
 it.each([200, 503])(
   'reports HTTP %i without loading the build toolchain when domain cleanup returns non-JSON',
   async (status) => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-cf-domain-error-'));
-    const server = createServer((request, response) => {
-      request.resume();
-      response.statusCode = status;
-      response.end('temporary upstream response');
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const configPath = join(directory, 'wrangler.json');
-      const preload = join(directory, 'reject-build-imports.mjs');
-      writeFileSync(
-        preload,
-        `import { registerHooks } from 'node:module';
+    const directory = temporaryDirectory('void-cf-domain-error-');
+    const api = await listen(
+      createServer((request, response) => {
+        request.resume();
+        response.statusCode = status;
+        response.end('temporary upstream response');
+      }),
+    );
+    const configPath = join(directory, 'wrangler.json');
+    const preload = join(directory, 'reject-build-imports.mjs');
+    writeFileSync(
+      preload,
+      `import { registerHooks } from 'node:module';
 registerHooks({
   resolve(specifier, context, nextResolve) {
     if (['vite', '@cloudflare/build-output-utils'].includes(specifier) || specifier.endsWith('/cf-build-output.ts')) {
@@ -113,52 +168,17 @@ registerHooks({
   },
 });
 `,
-      );
-      writeFileSync(
-        configPath,
-        JSON.stringify({ name: 'test-worker', account_id: 'test-account' }),
-      );
-      const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-      const output = await new Promise<{ status: number; stderr: string }>((resolve) => {
-        execFile(
-          command!,
-          [
-            '--import',
-            pathToFileURL(preload).href,
-            ...prefix,
-            ...encodeCloudflareOperation({
-              type: 'triggers.clear-domains',
-              configPath,
-              workerName: 'test-worker',
-            }),
-          ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CI: 'true',
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-            },
-          },
-          (error, _stdout, stderr) => resolve({ status: error ? 1 : 0, stderr }),
-        );
-      });
-      expect(output.status).toBe(1);
-      expect(output.stderr).toContain(`HTTP ${status}`);
-      expect(output.stderr).not.toContain('synthetic-token');
-    } finally {
-      await new Promise<void>((resolve) => {
-        server.close(() => resolve());
-        server.closeAllConnections();
-      });
-      rmSync(directory, { recursive: true, force: true });
-    }
+    );
+    writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
+    const output = await runOperation(
+      directory,
+      { type: 'triggers.clear-domains', configPath, workerName: 'test-worker' },
+      tokenEnv(api),
+      preload,
+    );
+    expect(output.status).toBe(1);
+    expect(output.stderr).toContain(`HTTP ${status}`);
+    expect(output.stderr).not.toContain('synthetic-token');
   },
   30_000,
 );
@@ -166,122 +186,87 @@ registerHooks({
 it.each(['clear-crons', 'clear-domains'])(
   'clears %s through the pinned account API',
   async (operation) => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-cf-clear-crons-'));
+    const directory = temporaryDirectory('void-cf-clear-crons-');
     let requested = false;
-    const server = createServer(async (request, response) => {
-      requested = true;
-      expect(request.method).toBe('PUT');
-      expect(request.url).toBe(
-        `/client/v4/accounts/test-account/workers/scripts/test-worker/${operation === 'clear-crons' ? 'schedules' : 'domains/records'}`,
-      );
-      expect(request.headers.authorization).toBe('Bearer synthetic-token');
-      expect(request.headers['user-agent']).toBe(`void/${voidVersion}`);
-      let body = '';
-      for await (const chunk of request) {
-        body += chunk;
-      }
-      expect(JSON.parse(body)).toEqual(
-        operation === 'clear-crons'
-          ? []
-          : {
-              override_scope: true,
-              override_existing_origin: false,
-              override_existing_dns_record: false,
-              origins: [],
-            },
-      );
-      response.setHeader('Content-Type', 'application/json');
-      response.end(JSON.stringify({ success: true, result: { schedules: [] } }));
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const configPath = join(directory, 'wrangler.json');
-      writeFileSync(
-        configPath,
-        JSON.stringify({ name: 'test-worker', account_id: 'test-account' }),
-      );
-      const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-      const output = await new Promise<{ status: number; stderr: string }>((resolve) => {
-        execFile(
-          command!,
-          [
-            ...prefix,
-            ...encodeCloudflareOperation({
-              type: `triggers.${operation}` as 'triggers.clear-crons' | 'triggers.clear-domains',
-              configPath,
-              workerName: 'test-worker',
-            }),
-          ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CI: 'true',
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-            },
-          },
-          (error, _stdout, stderr) => resolve({ status: error ? 1 : 0, stderr }),
+    const api = await listen(
+      createServer(async (request, response) => {
+        requested = true;
+        expect(request.method).toBe('PUT');
+        expect(request.url).toBe(
+          `/client/v4/accounts/test-account/workers/scripts/test-worker/${operation === 'clear-crons' ? 'schedules' : 'domains/records'}`,
         );
-      });
-      expect(output.status, output.stderr).toBe(0);
-      expect(requested).toBe(true);
-    } finally {
-      await new Promise<void>((resolve) => {
-        server.close(() => resolve());
-        server.closeAllConnections();
-      });
-      rmSync(directory, { recursive: true, force: true });
-    }
+        expect(request.headers.authorization).toBe('Bearer synthetic-token');
+        expect(request.headers['user-agent']).toBe(`void/${voidVersion}`);
+        let body = '';
+        for await (const chunk of request) {
+          body += chunk;
+        }
+        expect(JSON.parse(body)).toEqual(
+          operation === 'clear-crons'
+            ? []
+            : {
+                override_scope: true,
+                override_existing_origin: false,
+                override_existing_dns_record: false,
+                origins: [],
+              },
+        );
+        response.setHeader('Content-Type', 'application/json');
+        response.end(JSON.stringify({ success: true, result: { schedules: [] } }));
+      }),
+    );
+    const configPath = join(directory, 'wrangler.json');
+    writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
+    const output = await runOperation(
+      directory,
+      {
+        type: `triggers.${operation}` as 'triggers.clear-crons' | 'triggers.clear-domains',
+        configPath,
+        workerName: 'test-worker',
+      },
+      tokenEnv(api),
+    );
+    expect(output.status, output.stderr).toBe(0);
+    expect(requested).toBe(true);
   },
   30_000,
 );
 
 it.each([
   ['clear-crons', 'true'],
-  ['clear-domains', 'true'],
-  ['clear-crons', 'false'],
   ['clear-domains', 'false'],
 ])(
   'uses browser credentials for %s with keyring %s',
   async (operation, keyringSetting) => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-cf-clear-crons-oauth-'));
+    const directory = temporaryDirectory('void-cf-clear-crons-oauth-');
     const requests: Array<{
       method: string | undefined;
       url: string | undefined;
       authorization: string | undefined;
       body: unknown;
     }> = [];
-    const server = createServer(async (request, response) => {
-      let body = '';
-      for await (const chunk of request) {
-        body += chunk;
-      }
-      requests.push({
-        method: request.method,
-        url: request.url,
-        authorization: request.headers.authorization,
-        body: JSON.parse(body),
-      });
-      response.setHeader('Content-Type', 'application/json');
-      response.end(JSON.stringify({ success: true, result: { schedules: [] } }));
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const configPath = join(directory, 'wrangler.json');
-      const preload = join(directory, 'mock-cf.mjs');
-      writeFileSync(
-        configPath,
-        JSON.stringify({ name: 'test-worker', account_id: 'test-account' }),
-      );
-      writeFileSync(
-        preload,
-        `import child from 'node:child_process';
+    const api = await listen(
+      createServer(async (request, response) => {
+        let body = '';
+        for await (const chunk of request) {
+          body += chunk;
+        }
+        requests.push({
+          method: request.method,
+          url: request.url,
+          authorization: request.headers.authorization,
+          body: JSON.parse(body),
+        });
+        response.setHeader('Content-Type', 'application/json');
+        response.end(JSON.stringify({ success: true, result: { schedules: [] } }));
+      }),
+    );
+    const configPath = join(directory, 'wrangler.json');
+    const preload = join(directory, 'mock-cf.mjs');
+    writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
+    writeFileSync(
+      preload,
+      `import child from 'node:child_process';
 import os from 'node:os';
 import { syncBuiltinESMExports } from 'node:module';
 os.homedir = () => process.env.VOID_TEST_HOME;
@@ -302,249 +287,135 @@ child.spawnSync = (_binary, args, options) => {
 };
 syncBuiltinESMExports();
 `,
-      );
-      const entry = join(
-        import.meta.dirname,
-        '..',
-        '..',
-        'src',
-        'cli',
-        'cloudflare-operation-process.ts',
-      );
-      const output = await new Promise<{ status: number; stderr: string }>((resolve) => {
-        execFile(
-          process.execPath,
-          [
-            '--import',
-            pathToFileURL(preload).href,
-            entry,
-            ...encodeCloudflareOperation({
-              type: `triggers.${operation}` as 'triggers.clear-crons' | 'triggers.clear-domains',
-              configPath,
-              workerName: 'test-worker',
-            }),
-          ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CI: 'true',
-              CLOUDFLARE_AUTH_USE_KEYRING: keyringSetting,
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-              HOME: directory,
-              USERPROFILE: directory,
-              XDG_CONFIG_HOME: join(directory, '.config'),
-              APPDATA: join(directory, 'AppData', 'Roaming'),
-              LOCALAPPDATA: join(directory, 'AppData', 'Local'),
-              VOID_TEST_HOME: directory,
-            },
-          },
-          (error, _stdout, stderr) => resolve({ status: error ? 1 : 0, stderr }),
-        );
-      });
-      expect(output.status, output.stderr).toBe(0);
-      expect(requests).toEqual([
-        {
-          method: 'PUT',
-          url: `/client/v4/accounts/test-account/workers/scripts/test-worker/${operation === 'clear-crons' ? 'schedules' : 'domains/records'}`,
-          authorization: 'Bearer synthetic-oauth-token',
-          body:
-            operation === 'clear-crons'
-              ? []
-              : {
-                  override_scope: true,
-                  override_existing_origin: false,
-                  override_existing_dns_record: false,
-                  origins: [],
-                },
-        },
-      ]);
-    } finally {
-      await new Promise<void>((resolve) => {
-        server.close(() => resolve());
-        server.closeAllConnections();
-      });
-      rmSync(directory, { recursive: true, force: true });
-    }
+    );
+    const output = await runOperation(
+      directory,
+      {
+        type: `triggers.${operation}` as 'triggers.clear-crons' | 'triggers.clear-domains',
+        configPath,
+        workerName: 'test-worker',
+      },
+      {
+        ...systemEnv,
+        CI: 'true',
+        CLOUDFLARE_AUTH_USE_KEYRING: keyringSetting,
+        CLOUDFLARE_ACCOUNT_ID: 'test-account',
+        CLOUDFLARE_API_BASE_URL: `${api}/client/v4`,
+        HOME: directory,
+        USERPROFILE: directory,
+        XDG_CONFIG_HOME: join(directory, '.config'),
+        APPDATA: join(directory, 'AppData', 'Roaming'),
+        LOCALAPPDATA: join(directory, 'AppData', 'Local'),
+        VOID_TEST_HOME: directory,
+      },
+      preload,
+    );
+    expect(output.status, output.stderr).toBe(0);
+    expect(requests).toMatchObject([
+      {
+        method: 'PUT',
+        url: `/client/v4/accounts/test-account/workers/scripts/test-worker/${operation === 'clear-crons' ? 'schedules' : 'domains/records'}`,
+        authorization: 'Bearer synthetic-oauth-token',
+      },
+    ]);
   },
   30_000,
 );
 
 it('reports an absent cf session as authentication failure', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-no-auth-'));
-  try {
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [...prefix, ...encodeCloudflareOperation({ type: 'auth.whoami' })],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              HOME: directory,
-              USERPROFILE: directory,
-              XDG_CONFIG_HOME: directory,
-              APPDATA: directory,
-              // Test absent credentials independently of host keyring support.
-              CLOUDFLARE_AUTH_USE_KEYRING: 'false',
-              CI: 'true',
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stdout + output.stderr).toBe(1);
-    expect(JSON.parse(output.stdout).data, output.stderr).toEqual({ loggedIn: false });
-    expect(output.stderr).toContain('authentication is required');
-  } finally {
-    rmSync(directory, { recursive: true, force: true });
-  }
+  const directory = temporaryDirectory('void-cf-no-auth-');
+  const output = await runOperation(
+    directory,
+    { type: 'auth.whoami' },
+    {
+      ...systemEnv,
+      HOME: directory,
+      USERPROFILE: directory,
+      XDG_CONFIG_HOME: directory,
+      APPDATA: directory,
+      // Test absent credentials independently of host keyring support.
+      CLOUDFLARE_AUTH_USE_KEYRING: 'false',
+      CI: 'true',
+    },
+  );
+  expect(output.status, output.stdout + output.stderr).toBe(1);
+  expect(JSON.parse(output.stdout).data, output.stderr).toEqual({ loggedIn: false });
+  expect(output.stderr).toContain('authentication is required');
 }, 30_000);
 
 it('discovers KV namespaces beyond the first cf API page', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-kv-pages-'));
+  const directory = temporaryDirectory('void-cf-kv-pages-');
   const requestedPages: Array<number> = [];
   const namespaces = Array.from({ length: 100 }, (_, index) => ({
     id: (index + 1).toString(16).padStart(32, '0'),
     title: `other-${index}`,
   }));
   const target = { id: 'f'.repeat(32), title: 'existing-void-kv' };
-  const server = createServer((request, response) => {
-    const url = new URL(request.url ?? '', 'http://127.0.0.1');
-    expect(url.pathname).toBe('/client/v4/accounts/test-account/storage/kv/namespaces');
-    expect(url.searchParams.get('per_page')).toBe('100');
-    expect(url.searchParams.get('order')).toBe('id');
-    expect(url.searchParams.get('direction')).toBe('asc');
-    const page = Number(url.searchParams.get('page'));
-    requestedPages.push(page);
-    response.setHeader('Content-Type', 'application/json');
-    response.end(
-      JSON.stringify({
-        success: true,
-        errors: [],
-        messages: [],
-        result: page === 1 ? namespaces : page === 2 ? [target] : [],
-      }),
-    );
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  try {
-    const configPath = join(directory, 'wrangler.json');
-    writeFileSync(configPath, JSON.stringify({ account_id: 'test-account' }));
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [...prefix, ...encodeCloudflareOperation({ type: 'kv.namespace.list', configPath })],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CI: 'true',
-              CF_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stderr).toBe(0);
-    expect(JSON.parse(output.stdout).data).toEqual([...namespaces, target]);
-    expect(requestedPages).toEqual([1, 2]);
-  } finally {
-    await new Promise<void>((resolve) => {
-      server.close(() => resolve());
-      server.closeAllConnections();
-    });
-    rmSync(directory, { recursive: true, force: true });
-  }
+  const api = await listen(
+    createServer((request, response) => {
+      const url = new URL(request.url ?? '', 'http://127.0.0.1');
+      expect(url.pathname).toBe('/client/v4/accounts/test-account/storage/kv/namespaces');
+      expect(url.searchParams.get('per_page')).toBe('100');
+      expect(url.searchParams.get('order')).toBe('id');
+      expect(url.searchParams.get('direction')).toBe('asc');
+      const page = Number(url.searchParams.get('page'));
+      requestedPages.push(page);
+      response.setHeader('Content-Type', 'application/json');
+      response.end(
+        JSON.stringify({
+          success: true,
+          errors: [],
+          messages: [],
+          result: page === 1 ? namespaces : page === 2 ? [target] : [],
+        }),
+      );
+    }),
+  );
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(configPath, JSON.stringify({ account_id: 'test-account' }));
+  const output = await runOperation(
+    directory,
+    { type: 'kv.namespace.list', configPath },
+    tokenEnv(api, 'CF_API_TOKEN'),
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(JSON.parse(output.stdout).data).toEqual([...namespaces, target]);
+  expect(requestedPages).toEqual([1, 2]);
 }, 30_000);
 
 it('finds existing Queues beyond the first cf API page', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-queue-pages-'));
+  const directory = temporaryDirectory('void-cf-queue-pages-');
   const requestedPages: Array<number> = [];
-  const server = createServer((request, response) => {
-    const url = new URL(request.url ?? '', 'http://127.0.0.1');
-    expect(url.pathname).toBe('/client/v4/accounts/test-account/queues');
-    const page = Number(url.searchParams.get('page'));
-    requestedPages.push(page);
-    response.setHeader('Content-Type', 'application/json');
-    response.end(
-      JSON.stringify({
-        success: true,
-        result: [
-          page === 1
-            ? { queue_id: 'first-queue', queue_name: 'another-queue' }
-            : { queue_id: 'target-queue', queue_name: 'existing-void-queue' },
-        ],
-        result_info: { page, per_page: 1, total_pages: 2, total_count: 2 },
-      }),
-    );
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  try {
-    const configPath = join(directory, 'wrangler.json');
-    writeFileSync(configPath, JSON.stringify({ account_id: 'test-account' }));
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [
-            ...prefix,
-            ...encodeCloudflareOperation({
-              type: 'queues.info',
-              name: 'existing-void-queue',
-              configPath,
-            }),
+  const api = await listen(
+    createServer((request, response) => {
+      const url = new URL(request.url ?? '', 'http://127.0.0.1');
+      expect(url.pathname).toBe('/client/v4/accounts/test-account/queues');
+      const page = Number(url.searchParams.get('page'));
+      requestedPages.push(page);
+      response.setHeader('Content-Type', 'application/json');
+      response.end(
+        JSON.stringify({
+          success: true,
+          result: [
+            page === 1
+              ? { queue_id: 'first-queue', queue_name: 'another-queue' }
+              : { queue_id: 'target-queue', queue_name: 'existing-void-queue' },
           ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CI: 'true',
-              CF_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stderr).toBe(0);
-    expect(JSON.parse(output.stdout).data).toMatchObject({ name: 'existing-void-queue' });
-    expect(requestedPages).toEqual([1, 2]);
-  } finally {
-    await new Promise<void>((resolve) => {
-      server.close(() => resolve());
-      server.closeAllConnections();
-    });
-    rmSync(directory, { recursive: true, force: true });
-  }
+          result_info: { page, per_page: 1, total_pages: 2, total_count: 2 },
+        }),
+      );
+    }),
+  );
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(configPath, JSON.stringify({ account_id: 'test-account' }));
+  const output = await runOperation(
+    directory,
+    { type: 'queues.info', name: 'existing-void-queue', configPath },
+    tokenEnv(api, 'CF_API_TOKEN'),
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(JSON.parse(output.stdout).data).toMatchObject({ name: 'existing-void-queue' });
+  expect(requestedPages).toEqual([1, 2]);
 }, 30_000);
 
 it.each([
@@ -615,191 +486,125 @@ it.each([
 ])(
   'cleans up Queue consumers using verified identities: $label',
   async ({ consumers, deleted, status }) => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-cf-queue-cleanup-'));
+    const directory = temporaryDirectory('void-cf-queue-cleanup-');
     const deletes: Array<string> = [];
-    const server = createServer((request, response) => {
-      const url = new URL(request.url ?? '', 'http://127.0.0.1');
-      request.resume();
-      response.setHeader('Content-Type', 'application/json');
-      const queuePath = '/client/v4/accounts/test-account/queues';
-      if (request.method === 'GET' && url.pathname === queuePath) {
-        response.end(
-          JSON.stringify({
-            success: true,
-            result: [{ queue_id: 'queue-id', queue_name: 'existing-queue' }],
-            result_info: { page: 1, total_pages: 1 },
-          }),
-        );
-      } else if (request.method === 'GET' && url.pathname === `${queuePath}/queue-id/consumers`) {
-        response.end(JSON.stringify({ success: true, result: consumers }));
-      } else if (
-        request.method === 'DELETE' &&
-        url.pathname.startsWith(`${queuePath}/queue-id/consumers/`)
-      ) {
-        deletes.push(url.pathname.split('/').at(-1)!);
-        response.end(JSON.stringify({ success: true, result: {} }));
-      } else {
-        response.statusCode = 400;
-        response.end(
-          JSON.stringify({ success: false, errors: [{ message: 'Unexpected request' }] }),
-        );
-      }
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const configPath = join(directory, 'wrangler.json');
-      writeFileSync(
-        configPath,
-        JSON.stringify({ account_id: 'test-account', name: 'test-worker' }),
-      );
-      const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-      const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-        (resolve) => {
-          execFile(
-            command!,
-            [
-              ...prefix,
-              ...encodeCloudflareOperation({
-                type: 'queues.consumer.remove',
-                queueName: 'existing-queue',
-                workerName: 'test-worker',
-                configPath,
-              }),
-            ],
-            {
-              cwd: directory,
-              encoding: 'utf8',
-              timeout: 20_000,
-              env: {
-                PATH: process.env.PATH,
-                SYSTEMROOT: process.env.SYSTEMROOT,
-                WINDIR: process.env.WINDIR,
-                CI: 'true',
-                CF_API_TOKEN: 'synthetic-token',
-                CLOUDFLARE_ACCOUNT_ID: 'test-account',
-                CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-              },
-            },
-            (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
+    const api = await listen(
+      createServer((request, response) => {
+        const url = new URL(request.url ?? '', 'http://127.0.0.1');
+        request.resume();
+        response.setHeader('Content-Type', 'application/json');
+        const queuePath = '/client/v4/accounts/test-account/queues';
+        if (request.method === 'GET' && url.pathname === queuePath) {
+          response.end(
+            JSON.stringify({
+              success: true,
+              result: [{ queue_id: 'queue-id', queue_name: 'existing-queue' }],
+              result_info: { page: 1, total_pages: 1 },
+            }),
           );
-        },
-      );
-      expect(output.status, output.stderr).toBe(status);
-      expect(deletes).toEqual(deleted);
-      expect(output.stderr).not.toContain('synthetic-token');
-    } finally {
-      await new Promise<void>((resolve) => {
-        server.close(() => resolve());
-        server.closeAllConnections();
-      });
-      rmSync(directory, { recursive: true, force: true });
-    }
+        } else if (request.method === 'GET' && url.pathname === `${queuePath}/queue-id/consumers`) {
+          response.end(JSON.stringify({ success: true, result: consumers }));
+        } else if (
+          request.method === 'DELETE' &&
+          url.pathname.startsWith(`${queuePath}/queue-id/consumers/`)
+        ) {
+          deletes.push(url.pathname.split('/').at(-1)!);
+          response.end(JSON.stringify({ success: true, result: {} }));
+        } else {
+          response.statusCode = 400;
+          response.end(
+            JSON.stringify({ success: false, errors: [{ message: 'Unexpected request' }] }),
+          );
+        }
+      }),
+    );
+    const configPath = join(directory, 'wrangler.json');
+    writeFileSync(configPath, JSON.stringify({ account_id: 'test-account', name: 'test-worker' }));
+    const output = await runOperation(
+      directory,
+      {
+        type: 'queues.consumer.remove',
+        queueName: 'existing-queue',
+        workerName: 'test-worker',
+        configPath,
+      },
+      tokenEnv(api, 'CF_API_TOKEN'),
+    );
+    expect(output.status, output.stderr).toBe(status);
+    expect(deletes).toEqual(deleted);
+    expect(output.stderr).not.toContain('synthetic-token');
   },
   30_000,
 );
 
 it('uses pinned cf despite a project-local CLI and preserves D1 results and the CF token alias', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-d1-contract-'));
+  const directory = temporaryDirectory('void-cf-d1-contract-');
   const requests: Array<{ method: string; path: string; authorization: string | undefined }> = [];
-  const server = createServer((request, response) => {
-    requests.push({
-      method: request.method ?? '',
-      path: request.url ?? '',
-      authorization: request.headers.authorization,
-    });
-    request.resume();
-    response.setHeader('Content-Type', 'application/json');
-    response.end(
-      JSON.stringify({
-        success: true,
-        errors: [],
-        messages: [],
-        result: [{ results: [{ name: '0001_setup.sql' }], success: true, meta: {} }],
-      }),
-    );
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  try {
-    const local = join(directory, 'node_modules', 'cf');
-    mkdirSync(local, { recursive: true });
-    writeFileSync(join(directory, 'package.json'), '{}');
-    writeFileSync(
-      join(local, 'package.json'),
-      JSON.stringify({ name: 'cf', version: '0.0.0', bin: { cf: 'fake.cjs' } }),
-    );
-    writeFileSync(join(local, 'fake.cjs'), 'console.log("UNPINNED_PROJECT_CF_EXECUTED");');
-    const configPath = join(directory, 'wrangler.json');
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        account_id: 'test-account',
-        d1_databases: [{ binding: 'DB', database_id: 'test-database' }],
-      }),
-    );
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number | null; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [
-            ...prefix,
-            ...encodeCloudflareOperation({
-              type: 'd1.execute',
-              database: 'DB',
-              sql: 'SELECT name FROM d1_migrations',
-              configPath,
-            }),
-          ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              TMP: process.env.TMP,
-              TEMP: process.env.TEMP,
-              CI: 'true',
-              CF_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-            },
-          },
-          (_error, stdout, stderr) => resolve({ status: _error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stderr).toBe(0);
-    expect(JSON.parse(output.stdout).data).toEqual([
-      { results: [{ name: '0001_setup.sql' }], success: true, meta: {} },
-    ]);
-    expect(requests).toEqual([
-      {
-        method: 'POST',
-        path: '/client/v4/accounts/test-account/d1/database/test-database/query',
-        authorization: 'Bearer synthetic-token',
-      },
-    ]);
-  } finally {
-    await new Promise<void>((resolve) => {
-      server.close(() => resolve());
-      server.closeAllConnections();
-    });
-    rmSync(directory, { recursive: true, force: true });
-  }
+  const api = await listen(
+    createServer((request, response) => {
+      requests.push({
+        method: request.method ?? '',
+        path: request.url ?? '',
+        authorization: request.headers.authorization,
+      });
+      request.resume();
+      response.setHeader('Content-Type', 'application/json');
+      response.end(
+        JSON.stringify({
+          success: true,
+          errors: [],
+          messages: [],
+          result: [{ results: [{ name: '0001_setup.sql' }], success: true, meta: {} }],
+        }),
+      );
+    }),
+  );
+  const local = join(directory, 'node_modules', 'cf');
+  mkdirSync(local, { recursive: true });
+  writeFileSync(join(directory, 'package.json'), '{}');
+  writeFileSync(
+    join(local, 'package.json'),
+    JSON.stringify({ name: 'cf', version: '0.0.0', bin: { cf: 'fake.cjs' } }),
+  );
+  writeFileSync(join(local, 'fake.cjs'), 'console.log("UNPINNED_PROJECT_CF_EXECUTED");');
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      account_id: 'test-account',
+      d1_databases: [{ binding: 'DB', database_id: 'test-database' }],
+    }),
+  );
+  const output = await runOperation(
+    directory,
+    { type: 'd1.execute', database: 'DB', sql: 'SELECT name FROM d1_migrations', configPath },
+    tokenEnv(api, 'CF_API_TOKEN'),
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(JSON.parse(output.stdout).data).toEqual([
+    { results: [{ name: '0001_setup.sql' }], success: true, meta: {} },
+  ]);
+  expect(requests).toEqual([
+    {
+      method: 'POST',
+      path: '/client/v4/accounts/test-account/d1/database/test-database/query',
+      authorization: 'Bearer synthetic-token',
+    },
+  ]);
 }, 30_000);
 
 it('uses the configured HTTP proxy for cf resource requests', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-resource-proxy-'));
+  const directory = temporaryDirectory('void-cf-resource-proxy-');
   let proxied = 0;
   let queried = 0;
-  const api = createServer((request, response) => {
-    queried++;
-    expect(request.url).toBe('/client/v4/accounts/test-account/d1/database/test-database/query');
-    response.setHeader('Content-Type', 'application/json');
-    response.end(JSON.stringify({ success: true, result: [{ results: [], success: true }] }));
-  });
+  const api = await listen(
+    createServer((request, response) => {
+      queried++;
+      expect(request.url).toBe('/client/v4/accounts/test-account/d1/database/test-database/query');
+      response.setHeader('Content-Type', 'application/json');
+      response.end(JSON.stringify({ success: true, result: [{ results: [], success: true }] }));
+    }),
+  );
   const proxy = createServer((request, response) => {
     proxied++;
     const upstream = httpRequest(
@@ -825,155 +630,46 @@ it('uses the configured HTTP proxy for cf resource requests', async () => {
     });
     upstream.on('error', () => socket.destroy());
   });
-  await Promise.all([
-    new Promise<void>((resolve) => api.listen(0, '127.0.0.1', resolve)),
-    new Promise<void>((resolve) => proxy.listen(0, '127.0.0.1', resolve)),
-  ]);
-  try {
-    const configPath = join(directory, 'wrangler.json');
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        account_id: 'test-account',
-        d1_databases: [{ binding: 'DB', database_id: 'test-database' }],
-      }),
-    );
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stderr: string }>((resolve) => {
-      execFile(
-        command!,
-        [
-          ...prefix,
-          ...encodeCloudflareOperation({
-            type: 'd1.execute',
-            database: 'DB',
-            sql: 'SELECT 1',
-            configPath,
-          }),
-        ],
-        {
-          cwd: directory,
-          timeout: 20_000,
-          env: {
-            ...process.env,
-            CF_API_TOKEN: 'synthetic-token',
-            CLOUDFLARE_ACCOUNT_ID: 'test-account',
-            CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(api.address() as AddressInfo).port}/client/v4`,
-            HTTP_PROXY: `http://127.0.0.1:${(proxy.address() as AddressInfo).port}`,
-            HTTPS_PROXY: '',
-            NO_PROXY: '',
-          },
-        },
-        (error, _stdout, stderr) => resolve({ status: error ? 1 : 0, stderr }),
-      );
-    });
-    expect(output.status, output.stderr).toBe(0);
-    expect(queried).toBe(1);
-    expect(proxied).toBe(1);
-  } finally {
-    await Promise.all(
-      [api, proxy].map(
-        (server) =>
-          new Promise<void>((resolve) => {
-            server.close(() => resolve());
-            server.closeAllConnections();
-          }),
-      ),
-    );
-    rmSync(directory, { recursive: true, force: true });
-  }
+  const proxyUrl = await listen(proxy);
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      account_id: 'test-account',
+      d1_databases: [{ binding: 'DB', database_id: 'test-database' }],
+    }),
+  );
+  const output = await runOperation(
+    directory,
+    { type: 'd1.execute', database: 'DB', sql: 'SELECT 1', configPath },
+    {
+      ...process.env,
+      CF_API_TOKEN: 'synthetic-token',
+      CLOUDFLARE_ACCOUNT_ID: 'test-account',
+      CLOUDFLARE_API_BASE_URL: `${api}/client/v4`,
+      HTTP_PROXY: proxyUrl,
+      HTTPS_PROXY: '',
+      NO_PROXY: '',
+    },
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(queried).toBe(1);
+  expect(proxied).toBe(1);
 }, 30_000);
 
 it.each([401, 403, 404, 503])(
   'stops a prebuilt platform upload before cf can provision an unavailable R2 bucket (HTTP %s)',
   async (status) => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-cf-platform-r2-preflight-'));
+    const directory = temporaryDirectory('void-cf-platform-r2-preflight-');
     const requests: Array<string> = [];
-    const api = createServer((request, response) => {
-      requests.push(`${request.method} ${request.url}`);
-      response.statusCode = status;
-      response.setHeader('Content-Type', 'application/json');
-      response.end(JSON.stringify({ success: false, errors: [{ code: 10006 }] }));
-    });
-    await new Promise<void>((resolve) => api.listen(0, '127.0.0.1', resolve));
-    try {
-      const configPath = join(directory, 'wrangler.json');
-      writeFileSync(
-        join(directory, 'index.js'),
-        'export default { fetch() { return new Response("ok") } };',
-      );
-      writeFileSync(
-        configPath,
-        JSON.stringify({
-          name: 'test-worker',
-          account_id: 'test-account',
-          compatibility_date: '2026-09-29',
-          main: 'index.js',
-          no_bundle: true,
-          r2_buckets: [{ binding: 'ASSETS', bucket_name: 'missing-bucket' }],
-        }),
-      );
-      const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-      const output = await new Promise<{ status: number; stderr: string }>((resolve) => {
-        execFile(
-          command!,
-          [...prefix, ...encodeCloudflareOperation({ type: 'versions.upload', configPath })],
-          {
-            cwd: directory,
-            timeout: 20_000,
-            env: {
-              ...process.env,
-              CF_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(api.address() as AddressInfo).port}/client/v4`,
-              HTTP_PROXY: '',
-              HTTPS_PROXY: '',
-              http_proxy: '',
-              https_proxy: '',
-            },
-          },
-          (error, _stdout, stderr) => resolve({ status: error ? 1 : 0, stderr }),
-        );
-      });
-      expect(output.status).toBe(1);
-      expect(output.stderr).toContain('refusing automatic provisioning');
-      expect(output.stderr).toContain(`HTTP ${status}`);
-      expect(requests).toEqual(['GET /client/v4/accounts/test-account/r2/buckets/missing-bucket']);
-    } finally {
-      await new Promise<void>((resolve) => {
-        api.close(() => resolve());
-        api.closeAllConnections();
-      });
-      rmSync(directory, { recursive: true, force: true });
-    }
-  },
-  30_000,
-);
-
-it('allows a prebuilt platform upload when named resources already exist', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-platform-resource-preflight-'));
-  const requests: Array<string> = [];
-  const jurisdictions: Array<string | undefined> = [];
-  const api = createServer((request, response) => {
-    const path = request.url ?? '';
-    requests.push(`${request.method} ${path}`);
-    if (path.includes('/r2/buckets/')) {
-      jurisdictions.push(request.headers['cf-r2-jurisdiction'] as string | undefined);
-    }
-    response.setHeader('Content-Type', 'application/json');
-    response.end(
-      JSON.stringify({
-        success: true,
-        result:
-          path.endsWith('/queues') || path.includes('/queues?page=')
-            ? [{ queue_id: 'queue-id', queue_name: 'existing-queue' }]
-            : {},
-        ...(path.includes('/queues?page=') ? { result_info: { page: 1, total_pages: 1 } } : {}),
+    const api = await listen(
+      createServer((request, response) => {
+        requests.push(`${request.method} ${request.url}`);
+        response.statusCode = status;
+        response.setHeader('Content-Type', 'application/json');
+        response.end(JSON.stringify({ success: false, errors: [{ code: 10006 }] }));
       }),
     );
-  });
-  await new Promise<void>((resolve) => api.listen(0, '127.0.0.1', resolve));
-  try {
     const configPath = join(directory, 'wrangler.json');
     writeFileSync(
       join(directory, 'index.js'),
@@ -987,15 +683,68 @@ it('allows a prebuilt platform upload when named resources already exist', async
         compatibility_date: '2026-09-29',
         main: 'index.js',
         no_bundle: true,
-        r2_buckets: [{ binding: 'ASSETS', bucket_name: 'existing-bucket', jurisdiction: 'eu' }],
-        queues: { producers: [{ binding: 'JOBS', queue: 'existing-queue' }] },
-        dispatch_namespaces: [{ binding: 'DISPATCH', namespace: 'existing-namespace' }],
+        r2_buckets: [{ binding: 'ASSETS', bucket_name: 'missing-bucket' }],
       }),
     );
-    const preload = join(directory, 'mock-version-upload.mjs');
-    writeFileSync(
-      preload,
-      `import child from 'node:child_process';
+    const output = await runOperation(
+      directory,
+      { type: 'versions.upload', configPath },
+      unproxiedEnv(api),
+    );
+    expect(output.status).toBe(1);
+    expect(output.stderr).toContain('refusing automatic provisioning');
+    expect(output.stderr).toContain(`HTTP ${status}`);
+    expect(requests).toEqual(['GET /client/v4/accounts/test-account/r2/buckets/missing-bucket']);
+  },
+  30_000,
+);
+
+it('allows a prebuilt platform upload when named resources already exist', async () => {
+  const directory = temporaryDirectory('void-cf-platform-resource-preflight-');
+  const requests: Array<string> = [];
+  const jurisdictions: Array<string | undefined> = [];
+  const api = await listen(
+    createServer((request, response) => {
+      const path = request.url ?? '';
+      requests.push(`${request.method} ${path}`);
+      if (path.includes('/r2/buckets/')) {
+        jurisdictions.push(request.headers['cf-r2-jurisdiction'] as string | undefined);
+      }
+      response.setHeader('Content-Type', 'application/json');
+      response.end(
+        JSON.stringify({
+          success: true,
+          result:
+            path.endsWith('/queues') || path.includes('/queues?page=')
+              ? [{ queue_id: 'queue-id', queue_name: 'existing-queue' }]
+              : {},
+          ...(path.includes('/queues?page=') ? { result_info: { page: 1, total_pages: 1 } } : {}),
+        }),
+      );
+    }),
+  );
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(
+    join(directory, 'index.js'),
+    'export default { fetch() { return new Response("ok") } };',
+  );
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      name: 'test-worker',
+      account_id: 'test-account',
+      compatibility_date: '2026-09-29',
+      main: 'index.js',
+      no_bundle: true,
+      r2_buckets: [{ binding: 'ASSETS', bucket_name: 'existing-bucket', jurisdiction: 'eu' }],
+      queues: { producers: [{ binding: 'JOBS', queue: 'existing-queue' }] },
+      dispatch_namespaces: [{ binding: 'DISPATCH', namespace: 'existing-namespace' }],
+    }),
+  );
+  const preload = join(directory, 'mock-version-upload.mjs');
+  writeFileSync(
+    preload,
+    `import child from 'node:child_process';
 import { syncBuiltinESMExports } from 'node:module';
 const actualSpawnSync=child.spawnSync;
 child.spawnSync = (binary, args, options) => {
@@ -1003,53 +752,23 @@ child.spawnSync = (binary, args, options) => {
   return { status:0, stdout:JSON.stringify({id:'11111111-1111-4111-8111-111111111111'}), stderr:'' };
 };
 syncBuiltinESMExports();`,
-    );
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [
-            '--import',
-            pathToFileURL(preload).href,
-            ...prefix,
-            ...encodeCloudflareOperation({ type: 'versions.upload', configPath }),
-          ],
-          {
-            cwd: directory,
-            timeout: 20_000,
-            env: {
-              ...process.env,
-              CF_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(api.address() as AddressInfo).port}/client/v4`,
-              HTTP_PROXY: '',
-              HTTPS_PROXY: '',
-              http_proxy: '',
-              https_proxy: '',
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stderr).toBe(0);
-    expect(JSON.parse(output.stdout).data).toEqual({
-      versionId: '11111111-1111-4111-8111-111111111111',
-    });
-    expect(requests).toEqual([
-      'GET /client/v4/accounts/test-account/r2/buckets/existing-bucket',
-      'GET /client/v4/accounts/test-account/workers/dispatch/namespaces/existing-namespace',
-      'GET /client/v4/accounts/test-account/queues?page=1',
-    ]);
-    expect(jurisdictions).toEqual(['eu']);
-  } finally {
-    await new Promise<void>((resolve) => {
-      api.close(() => resolve());
-      api.closeAllConnections();
-    });
-    rmSync(directory, { recursive: true, force: true });
-  }
+  );
+  const output = await runOperation(
+    directory,
+    { type: 'versions.upload', configPath },
+    unproxiedEnv(api),
+    preload,
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(JSON.parse(output.stdout).data).toEqual({
+    versionId: '11111111-1111-4111-8111-111111111111',
+  });
+  expect(requests).toEqual([
+    'GET /client/v4/accounts/test-account/r2/buckets/existing-bucket',
+    'GET /client/v4/accounts/test-account/workers/dispatch/namespaces/existing-namespace',
+    'GET /client/v4/accounts/test-account/queues?page=1',
+  ]);
+  expect(jurisdictions).toEqual(['eu']);
 }, 30_000);
 
 it.each([
@@ -1061,7 +780,7 @@ it.each([
 ])(
   'inspects existing Worker versions with $label',
   async ({ lowercase, bypass, authenticated }) => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-cf-proxy-contract-'));
+    const directory = temporaryDirectory('void-cf-proxy-contract-');
     const versionId = '11111111-1111-4111-8111-111111111111';
     let proxied = 0;
     let inspected = 0;
@@ -1076,23 +795,25 @@ it.each([
           ),
       ),
     );
-    const api = createServer((request, response) => {
-      inspected++;
-      expect(request.headers.authorization).toBe('Bearer synthetic-token');
-      expect(request.headers['proxy-authorization']).toBeUndefined();
-      expect(request.url).toBe(
-        `/client/v4/accounts/test-account/workers/scripts/test-worker/versions/${versionId}`,
-      );
-      response.setHeader('Content-Type', 'application/json');
-      response.end(
-        JSON.stringify({
-          success: true,
-          result: {
-            resources: { bindings: [], script: { handlers: ['fetch'] }, script_runtime: {} },
-          },
-        }),
-      );
-    });
+    const api = await listen(
+      createServer((request, response) => {
+        inspected++;
+        expect(request.headers.authorization).toBe('Bearer synthetic-token');
+        expect(request.headers['proxy-authorization']).toBeUndefined();
+        expect(request.url).toBe(
+          `/client/v4/accounts/test-account/workers/scripts/test-worker/versions/${versionId}`,
+        );
+        response.setHeader('Content-Type', 'application/json');
+        response.end(
+          JSON.stringify({
+            success: true,
+            result: {
+              resources: { bindings: [], script: { handlers: ['fetch'] }, script_runtime: {} },
+            },
+          }),
+        );
+      }),
+    );
     const proxy = createServer((request, response) => {
       proxied++;
       proxyAuthorizations.push(request.headers['proxy-authorization']);
@@ -1121,89 +842,50 @@ it.each([
       });
       upstream.on('error', () => socket.destroy());
     });
-    await Promise.all([
-      new Promise<void>((resolve) => api.listen(0, '127.0.0.1', resolve)),
-      new Promise<void>((resolve) => proxy.listen(0, '127.0.0.1', resolve)),
-    ]);
-    try {
-      const proxyUrl = `http://${authenticated ? 'proxy-user:proxy-pass@' : ''}127.0.0.1:${(proxy.address() as AddressInfo).port}`;
-      const configPath = join(directory, 'wrangler.json');
-      const preload = join(directory, 'mock-cf.mjs');
-      writeFileSync(
-        configPath,
-        JSON.stringify({ name: 'test-worker', account_id: 'test-account' }),
-      );
-      writeFileSync(
-        preload,
-        `import child from 'node:child_process';
+    const proxyOrigin = await listen(proxy);
+    const proxyUrl = authenticated
+      ? proxyOrigin.replace('http://', 'http://proxy-user:proxy-pass@')
+      : proxyOrigin;
+    const configPath = join(directory, 'wrangler.json');
+    const preload = join(directory, 'mock-cf.mjs');
+    writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
+    writeFileSync(
+      preload,
+      `import child from 'node:child_process';
 import { syncBuiltinESMExports } from 'node:module';
 child.spawnSync = () => ({ status: 0, stdout: JSON.stringify({ id: '${versionId}', bindings: [] }), stderr: '' });
 syncBuiltinESMExports();
 `,
-      );
-      const entry = join(
-        import.meta.dirname,
-        '..',
-        '..',
-        'src',
-        'cli',
-        'cloudflare-operation-process.ts',
-      );
-      const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-        (resolve) => {
-          execFile(
-            process.execPath,
-            [
-              '--import',
-              pathToFileURL(preload).href,
-              entry,
-              ...encodeCloudflareOperation({ type: 'versions.view', versionId, configPath }),
-            ],
-            {
-              cwd: directory,
-              encoding: 'utf8',
-              timeout: 10_000,
-              env: {
-                ...proxyEnvironment,
-                CLOUDFLARE_ACCOUNT_ID: 'test-account',
-                CLOUDFLARE_API_TOKEN: 'synthetic-token',
-                CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(api.address() as AddressInfo).port}/client/v4`,
-                [lowercase ? 'http_proxy' : 'HTTP_PROXY']: proxyUrl,
-                [lowercase ? 'no_proxy' : 'NO_PROXY']: bypass ? '127.0.0.1' : '',
-                NODE_USE_ENV_PROXY: '',
-              },
-            },
-            (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-          );
-        },
-      );
-      expect(output.status, output.stderr).toBe(0);
-      expect(JSON.parse(output.stdout).data.resources.bindings).toEqual([]);
-      expect(proxied).toBe(bypass ? 0 : 1);
-      expect(proxyAuthorizations).toEqual(
-        bypass
-          ? []
-          : [
-              authenticated
-                ? `Basic ${Buffer.from('proxy-user:proxy-pass').toString('base64')}`
-                : undefined,
-            ],
-      );
-      expect(inspected).toBe(1);
-    } finally {
-      await Promise.all(
-        [api, proxy].map(
-          (server) =>
-            new Promise<void>((resolve) => {
-              server.close(() => resolve());
-              server.closeAllConnections();
-            }),
-        ),
-      );
-      rmSync(directory, { recursive: true, force: true });
-    }
+    );
+    const output = await runOperation(
+      directory,
+      { type: 'versions.view', versionId, configPath },
+      {
+        ...proxyEnvironment,
+        CLOUDFLARE_ACCOUNT_ID: 'test-account',
+        CLOUDFLARE_API_TOKEN: 'synthetic-token',
+        CLOUDFLARE_API_BASE_URL: `${api}/client/v4`,
+        [lowercase ? 'http_proxy' : 'HTTP_PROXY']: proxyUrl,
+        [lowercase ? 'no_proxy' : 'NO_PROXY']: bypass ? '127.0.0.1' : '',
+        NODE_USE_ENV_PROXY: '',
+      },
+      preload,
+    );
+    expect(output.status, output.stderr).toBe(0);
+    expect(JSON.parse(output.stdout).data.resources.bindings).toEqual([]);
+    expect(proxied).toBe(bypass ? 0 : 1);
+    expect(proxyAuthorizations).toEqual(
+      bypass
+        ? []
+        : [
+            authenticated
+              ? `Basic ${Buffer.from('proxy-user:proxy-pass').toString('base64')}`
+              : undefined,
+          ],
+    );
+    expect(inspected).toBe(1);
   },
-  15_000,
+  30_000,
 );
 
 it.each([
@@ -1291,13 +973,12 @@ it.each([
     ],
   },
 ])('returns structured email data for $operation', async ({ operation, commands, ...example }) => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-cf-email-json-'));
-  try {
-    const preload = join(directory, 'mock-cf.mjs');
-    const callsPath = join(directory, 'calls.json');
-    writeFileSync(
-      preload,
-      `import child from 'node:child_process';
+  const directory = temporaryDirectory('void-cf-email-json-');
+  const preload = join(directory, 'mock-cf.mjs');
+  const callsPath = join(directory, 'calls.json');
+  writeFileSync(
+    preload,
+    `import child from 'node:child_process';
 import { syncBuiltinESMExports } from 'node:module';
 import { writeFileSync } from 'node:fs';
 const commands = ${JSON.stringify(commands)};
@@ -1314,48 +995,22 @@ child.spawnSync = (_executable, args) => {
 };
 syncBuiltinESMExports();
 `,
-    );
-    const entry = join(
-      import.meta.dirname,
-      '..',
-      '..',
-      'src',
-      'cli',
-      'cloudflare-operation-process.ts',
-    );
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          process.execPath,
-          ['--import', pathToFileURL(preload).href, entry, ...encodeCloudflareOperation(operation)],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 10_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CI: 'true',
-              CLOUDFLARE_AUTH_USE_KEYRING: 'false',
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stderr).toBe(0);
-    expect(JSON.parse(output.stdout).data).toEqual(
-      'expected' in example
-        ? example.expected
-        : commands.flatMap<unknown>((command) => command.data ?? []),
-    );
-    expect(JSON.parse(readFileSync(callsPath, 'utf8'))).toEqual(
-      commands.map((command) => command.command),
-    );
-  } finally {
-    rmSync(directory, { recursive: true, force: true });
-  }
+  );
+  const output = await runOperation(
+    directory,
+    operation,
+    { ...systemEnv, CI: 'true', CLOUDFLARE_AUTH_USE_KEYRING: 'false' },
+    preload,
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(JSON.parse(output.stdout).data).toEqual(
+    'expected' in example
+      ? example.expected
+      : commands.flatMap<unknown>((command) => command.data ?? []),
+  );
+  expect(JSON.parse(readFileSync(callsPath, 'utf8'))).toEqual(
+    commands.map((command) => command.command),
+  );
 });
 
 it.each([
@@ -1371,13 +1026,12 @@ it.each([
     extra: ['--json'],
   },
 ])('rejects $label before invoking the provider', async ({ request, extra }) => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-operation-protocol-'));
+  const directory = temporaryDirectory('void-operation-protocol-');
   const capture = join(directory, 'provider-ran');
-  try {
-    const preload = join(directory, 'mock-provider.mjs');
-    writeFileSync(
-      preload,
-      `import child from 'node:child_process';
+  const preload = join(directory, 'mock-provider.mjs');
+  writeFileSync(
+    preload,
+    `import child from 'node:child_process';
 import { writeFileSync } from 'node:fs';
 import { syncBuiltinESMExports } from 'node:module';
 child.spawnSync = () => {
@@ -1385,38 +1039,15 @@ child.spawnSync = () => {
   return {status:0,stdout:'[]',stderr:''};
 };
 syncBuiltinESMExports();`,
-    );
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          ['--import', pathToFileURL(preload).href, ...prefix, request, ...extra],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 10_000,
-            env: {
-              PATH: process.env.PATH,
-              CI: 'true',
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stderr).toBe(1);
-    expect(existsSync(capture)).toBe(false);
-    expect(JSON.parse(output.stdout)).toMatchObject({
-      operationResult: 1,
-      errors: expect.any(Array),
-    });
-    expect(output.stdout + output.stderr).not.toContain('synthetic-token');
-  } finally {
-    rmSync(directory, { recursive: true, force: true });
-  }
+  );
+  const output = await runOperation(directory, [request, ...extra], tokenEnv(), preload);
+  expect(output.status, output.stderr).toBe(1);
+  expect(existsSync(capture)).toBe(false);
+  expect(JSON.parse(output.stdout)).toMatchObject({
+    operationResult: 1,
+    errors: expect.any(Array),
+  });
+  expect(output.stdout + output.stderr).not.toContain('synthetic-token');
 });
 
 it.each([
@@ -1424,12 +1055,11 @@ it.each([
   { label: 'spawn error', code: 10007, signal: null, spawnError: true },
   { label: 'missing exit status', code: 10006, signal: null, spawnError: false },
 ])('preserves an inner provider $label without authorizing resource absence', async (example) => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-operation-provider-failure-'));
-  try {
-    const preload = join(directory, 'failed-provider.mjs');
-    writeFileSync(
-      preload,
-      `import child from 'node:child_process';
+  const directory = temporaryDirectory('void-operation-provider-failure-');
+  const preload = join(directory, 'failed-provider.mjs');
+  writeFileSync(
+    preload,
+    `import child from 'node:child_process';
 import { syncBuiltinESMExports } from 'node:module';
 child.spawnSync = () => ({
   status: null,
@@ -1439,115 +1069,52 @@ child.spawnSync = () => ({
   stderr: '[${example.code}] Resource does not exist.'
 });
 syncBuiltinESMExports();`,
+  );
+  const operation =
+    example.code === 10007
+      ? { type: 'secret.list' as const, workerName: 'test-worker' }
+      : { type: 'r2.bucket.info' as const, name: 'test-bucket' };
+  const output = await runOperation(directory, operation, tokenEnv(), preload);
+  expect(output.status).toBe(1);
+  expect(output.stderr).toContain(`[code: ${example.code}]`);
+  const envelope = JSON.parse(output.stdout);
+  expect(envelope.operationResult).toBe(1);
+  expect(envelope.errorCode).toBeUndefined();
+  expect(envelope.failure).toBeUndefined();
+  expect(envelope.errors[0].code).toBeUndefined();
+  const decoded = decodeCloudflareOperationResult({ ...output, signal: null, error: null });
+  expect(decoded.status).toBe(1);
+  expect(decoded.data).toBeUndefined();
+  expect(decoded.errorCode).toBeUndefined();
+  expect(decoded.failure).toBeUndefined();
+  if (example.signal) {
+    expect(decoded.signal).toBe(example.signal);
+  } else {
+    expect(decoded.error).toContain(
+      example.spawnError
+        ? 'Synthetic provider spawn failure.'
+        : 'Cloudflare CLI did not report an exit status.',
     );
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const operation =
-      example.code === 10007
-        ? { type: 'secret.list' as const, workerName: 'test-worker' }
-        : { type: 'r2.bucket.info' as const, name: 'test-bucket' };
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [
-            '--import',
-            pathToFileURL(preload).href,
-            ...prefix,
-            ...encodeCloudflareOperation(operation),
-          ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 10_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CI: 'true',
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status).toBe(1);
-    expect(output.stderr).toContain(`[code: ${example.code}]`);
-    const envelope = JSON.parse(output.stdout);
-    expect(envelope.operationResult).toBe(1);
-    expect(envelope.errorCode).toBeUndefined();
-    expect(envelope.failure).toBeUndefined();
-    expect(envelope.errors[0].code).toBeUndefined();
-    const decoded = decodeCloudflareOperationResult({ ...output, signal: null, error: null });
-    expect(decoded.status).toBe(1);
-    expect(decoded.data).toBeUndefined();
-    expect(decoded.errorCode).toBeUndefined();
-    expect(decoded.failure).toBeUndefined();
-    if (example.signal) {
-      expect(decoded.signal).toBe(example.signal);
-    } else {
-      expect(decoded.error).toContain(
-        example.spawnError
-          ? 'Synthetic provider spawn failure.'
-          : 'Cloudflare CLI did not report an exit status.',
-      );
-    }
-    expect(output.stdout + output.stderr).not.toContain('synthetic-token');
-  } finally {
-    rmSync(directory, { recursive: true, force: true });
   }
+  expect(output.stdout + output.stderr).not.toContain('synthetic-token');
 });
 
 it('rejects a changed tail target before any provider request', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-tail-target-'));
-  try {
-    const configPath = join(directory, 'wrangler.jsonc');
-    writeFileSync(
-      configPath,
-      JSON.stringify({ name: 'changed-worker', account_id: 'test-account' }),
-    );
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [
-            ...prefix,
-            ...encodeCloudflareOperation({
-              type: 'tail',
-              workerName: 'original-worker',
-              configPath,
-            }),
-          ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: 'http://127.0.0.1:1/client/v4',
-            },
-          },
-          (error, stdout, stderr) =>
-            resolve({ status: error ? Number(error.code) || 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status).toBe(1);
-    expect(output.stderr).toContain('tail target is not pinned');
-    expect(output.stdout).toBe('');
-  } finally {
-    rmSync(directory, { recursive: true, force: true });
-  }
+  const directory = temporaryDirectory('void-tail-target-');
+  const configPath = join(directory, 'wrangler.jsonc');
+  writeFileSync(configPath, JSON.stringify({ name: 'changed-worker', account_id: 'test-account' }));
+  const output = await runOperation(
+    directory,
+    { type: 'tail', workerName: 'original-worker', configPath },
+    { ...tokenEnv('http://127.0.0.1:1'), CI: undefined },
+  );
+  expect(output.status).toBe(1);
+  expect(output.stderr).toContain('tail target is not pinned');
+  expect(output.stdout).toBe('');
 });
 
 it('renders binary and text frames from a real Node WebSocket in order and removes the captured tail', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-tail-binary-'));
+  const directory = temporaryDirectory('void-tail-binary-');
   const sockets = new Set<Duplex>();
   const requests: Array<{ method: string | undefined; url: string | undefined; body: string }> = [];
   let initialization: string | undefined;
@@ -1637,69 +1204,43 @@ it('renders binary and text frames from a real Node WebSocket in order and remov
     };
     socket.on('data', started);
   });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  try {
-    const configPath = join(directory, 'wrangler.json');
-    writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
-    const [command, ...prefix] = resolveCloudflareOperationArgv(directory);
-    const output = await new Promise<{ status: number; stdout: string; stderr: string }>(
-      (resolve) => {
-        execFile(
-          command!,
-          [
-            ...prefix,
-            ...encodeCloudflareOperation({
-              type: 'tail',
-              workerName: 'test-worker',
-              configPath,
-              search: 'marker',
-              versionId: '11111111-2222-3333-4444-555555555555',
-            }),
-          ],
-          {
-            cwd: directory,
-            encoding: 'utf8',
-            timeout: 20_000,
-            env: {
-              PATH: process.env.PATH,
-              SYSTEMROOT: process.env.SYSTEMROOT,
-              WINDIR: process.env.WINDIR,
-              CLOUDFLARE_API_TOKEN: 'synthetic-token',
-              CLOUDFLARE_ACCOUNT_ID: 'test-account',
-              CLOUDFLARE_API_BASE_URL: `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`,
-            },
-          },
-          (error, stdout, stderr) => resolve({ status: error ? 1 : 0, stdout, stderr }),
-        );
-      },
-    );
-    expect(output.status, output.stderr).toBe(0);
-    expect(initialization).toBe('{"debug":false}');
-    expect(output.stderr).not.toContain('malformed tail');
-    expect(output.stdout).toContain('POST https://isolated.invalid/runtime - ok');
-    expect(output.stdout).toContain('  (log) binary marker');
-    expect(output.stdout).not.toContain('\x1b]');
-    expect(output.stdout).not.toContain('\x07');
-    expect(output.stdout).toContain('  (error) error marker');
-    expect(output.stdout).toContain('Queue owned-queue - ok');
-    expect(output.stdout.indexOf('binary marker')).toBeLessThan(
-      output.stdout.indexOf('text marker'),
-    );
-    expect(requests).toHaveLength(2);
-    expect(JSON.parse(requests[0]!.body)).toEqual({
-      filters: [{ query: 'marker' }, { scriptVersion: '11111111-2222-3333-4444-555555555555' }],
-    });
-    expect(requests[1]).toEqual({
-      method: 'DELETE',
-      url: '/client/v4/accounts/test-account/workers/scripts/test-worker/tails/owned-tail',
-      body: '',
-    });
-  } finally {
+  const api = await listen(server);
+  // Upgraded sockets keep the server open until they are destroyed.
+  cleanups.push(() => {
     for (const socket of sockets) {
       socket.destroy();
     }
-    server.closeAllConnections();
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-    rmSync(directory, { recursive: true, force: true });
-  }
+  });
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
+  const output = await runOperation(
+    directory,
+    {
+      type: 'tail',
+      workerName: 'test-worker',
+      configPath,
+      search: 'marker',
+      versionId: '11111111-2222-3333-4444-555555555555',
+    },
+    { ...tokenEnv(api), CI: undefined },
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(initialization).toBe('{"debug":false}');
+  expect(output.stderr).not.toContain('malformed tail');
+  expect(output.stdout).toContain('POST https://isolated.invalid/runtime - ok');
+  expect(output.stdout).toContain('  (log) binary marker');
+  expect(output.stdout).not.toContain('\x1b]');
+  expect(output.stdout).not.toContain('\x07');
+  expect(output.stdout).toContain('  (error) error marker');
+  expect(output.stdout).toContain('Queue owned-queue - ok');
+  expect(output.stdout.indexOf('binary marker')).toBeLessThan(output.stdout.indexOf('text marker'));
+  expect(requests).toHaveLength(2);
+  expect(JSON.parse(requests[0]!.body)).toEqual({
+    filters: [{ query: 'marker' }, { scriptVersion: '11111111-2222-3333-4444-555555555555' }],
+  });
+  expect(requests[1]).toEqual({
+    method: 'DELETE',
+    url: '/client/v4/accounts/test-account/workers/scripts/test-worker/tails/owned-tail',
+    body: '',
+  });
 }, 30_000);
diff --git a/packages/void/test/unit/cloudflare-operations.test.ts b/packages/void/test/unit/cloudflare-operations.test.ts
index 367210317..60a637263 100644
--- a/packages/void/test/unit/cloudflare-operations.test.ts
+++ b/packages/void/test/unit/cloudflare-operations.test.ts
@@ -714,24 +714,6 @@ describe('Cloudflare custom domains', () => {
     expect(readFileSync(join(root, 'wrangler.jsonc'), 'utf-8')).toBe(before);
   });
 
-  it('removes the final domain through the authenticated API', async () => {
-    const root = project(
-      '{"name":"my-worker","account_id":"account-1","routes":[{"pattern":"app.example.com","custom_domain":true}]}',
-    );
-    const runner = vi.fn<CloudflareOperationRunner>();
-    const publishEmpty = vi.fn(async () => undefined);
-
-    await expect(
-      changeCloudflareDomain(root, 'app.example.com', 'delete', runner, publishEmpty),
-    ).resolves.toMatchObject({ modified: true, domains: [] });
-
-    expect(publishEmpty).toHaveBeenCalledWith(
-      expect.objectContaining({ accountId: 'account-1', workerName: 'my-worker' }),
-    );
-    expect(runner).not.toHaveBeenCalled();
-    expect(readWranglerCustomDomains(root).domains).toEqual([]);
-  });
-
   it('publishes an empty final domain set to the pinned Cloudflare API', async () => {
     const root = project(
       '{"name":"my-worker","account_id":"account-1","routes":[{"pattern":"app.example.com","custom_domain":true}]}',
@@ -741,7 +723,11 @@ describe('Cloudflare custom domains', () => {
     const runner = vi
       .fn<CloudflareOperationRunner>()
       .mockResolvedValue({ status: 0, stdout: '', stderr: '' });
-    await changeCloudflareDomain(root, 'app.example.com', 'delete', runner);
+    await expect(
+      changeCloudflareDomain(root, 'app.example.com', 'delete', runner),
+    ).resolves.toMatchObject({ modified: true, domains: [] });
+    expect(readWranglerCustomDomains(root).domains).toEqual([]);
+    expect(runner).toHaveBeenCalledTimes(1);
     expect(runner).toHaveBeenCalledWith(
       {
         type: 'triggers.clear-domains',
diff --git a/packages/void/test/unit/cloudflare-process.test.ts b/packages/void/test/unit/cloudflare-process.test.ts
index 4f5242686..b85b32c8e 100644
--- a/packages/void/test/unit/cloudflare-process.test.ts
+++ b/packages/void/test/unit/cloudflare-process.test.ts
@@ -1,8 +1,5 @@
 import { describe, expect, it } from 'vite-plus/test';
-import {
-  decodeCloudflareOperationResult,
-  encodeCloudflareOperation,
-} from '../../src/cli/cloudflare-process.ts';
+import { decodeCloudflareOperationResult } from '../../src/cli/cloudflare-process.ts';
 
 const processResult = (envelope: unknown) => ({
   status: 0,
@@ -11,18 +8,6 @@ const processResult = (envelope: unknown) => ({
 });
 
 describe('typed Cloudflare process protocol', () => {
-  it('encodes one typed request with literal public targets', () => {
-    const operation = {
-      type: 'd1.create' as const,
-      name: 'name $(touch injected); with spaces',
-      binding: 'DB',
-      configPath: '/app with spaces/config.jsonc',
-    };
-    const args = encodeCloudflareOperation(operation);
-    expect(args).toHaveLength(1);
-    expect(JSON.parse(args[0])).toEqual(operation);
-  });
-
   it('keeps structured data separate from human output', () => {
     expect(
       decodeCloudflareOperationResult(
diff --git a/packages/void/test/unit/cloudflare-readiness.test.ts b/packages/void/test/unit/cloudflare-readiness.test.ts
index 794c1a6e7..484932ebd 100644
--- a/packages/void/test/unit/cloudflare-readiness.test.ts
+++ b/packages/void/test/unit/cloudflare-readiness.test.ts
@@ -1,15 +1,27 @@
-import { mkdtempSync, readFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { describe, expect, it } from 'vite-plus/test';
+import { afterEach, describe, expect, it } from 'vite-plus/test';
 import {
   rememberCloudflareWorkersDevSubdomain,
   resolveCloudflareWorkersDevSubdomain,
 } from '../../src/cli/cloudflare-readiness.ts';
 
+const roots: Array<string> = [];
+function tempRoot(): string {
+  const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
+  roots.push(root);
+  return root;
+}
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 describe('Cloudflare readiness state', () => {
   it('prefers and normalizes the environment override', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
+    const root = tempRoot();
     expect(
       resolveCloudflareWorkersDevSubdomain(root, 'account-a', {
         CLOUDFLARE_WORKERS_SUBDOMAIN: 'Developer-Platform-Experience.workers.dev',
@@ -17,17 +29,8 @@ describe('Cloudflare readiness state', () => {
     ).toBe('developer-platform-experience');
   });
 
-  it('accepts the FedRAMP workers.dev subdomain form', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
-    expect(
-      resolveCloudflareWorkersDevSubdomain(root, 'account-a', {
-        CLOUDFLARE_WORKERS_SUBDOMAIN: 'my-team.fed.workers.dev',
-      }),
-    ).toBe('my-team.fed');
-  });
-
   it('rejects an invalid environment override', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
+    const root = tempRoot();
     expect(() =>
       resolveCloudflareWorkersDevSubdomain(root, 'account-a', {
         CLOUDFLARE_WORKERS_SUBDOMAIN: 'https://example.com/path',
@@ -36,7 +39,7 @@ describe('Cloudflare readiness state', () => {
   });
 
   it('treats an unset GitHub Actions variable as absent', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
+    const root = tempRoot();
     expect(
       resolveCloudflareWorkersDevSubdomain(root, 'account-a', {
         CLOUDFLARE_WORKERS_SUBDOMAIN: '',
@@ -45,7 +48,7 @@ describe('Cloudflare readiness state', () => {
   });
 
   it('caches a Wrangler-reported subdomain and preserves unrelated state', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
+    const root = tempRoot();
     expect(
       rememberCloudflareWorkersDevSubdomain(
         root,
@@ -63,7 +66,7 @@ describe('Cloudflare readiness state', () => {
   });
 
   it('keeps cached subdomains isolated when a project switches accounts', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
+    const root = tempRoot();
     rememberCloudflareWorkersDevSubdomain(root, 'account-a', 'https://app.first-team.workers.dev');
     rememberCloudflareWorkersDevSubdomain(root, 'account-b', 'https://app.second-team.workers.dev');
 
@@ -72,7 +75,7 @@ describe('Cloudflare readiness state', () => {
   });
 
   it('ignores URLs outside workers.dev', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-readiness-'));
+    const root = tempRoot();
     expect(rememberCloudflareWorkersDevSubdomain(root, 'account-a', 'https://example.com')).toBe(
       false,
     );
diff --git a/packages/void/test/unit/compile-auth.test.ts b/packages/void/test/unit/compile-auth.test.ts
index 6511610bf..ac4b76364 100644
--- a/packages/void/test/unit/compile-auth.test.ts
+++ b/packages/void/test/unit/compile-auth.test.ts
@@ -143,15 +143,11 @@ describe('compileRouteTable auth integration', () => {
       auth: sqliteAuth,
       migrationHandlerPath: '/resolved/migration-handler.mjs',
       migrations: [{ name: '001_init.sql', sql: 'select 1;' }],
-      migrationDialect: 'sqlite',
     });
 
     expect(code).toContain('runVoidAuthMigrations');
     expect(code).toContain(
-      'runVoidAuthMigrations(new Request(c.req.url), __voidGetMigrationEnv(), __voidAuthOptions, __voidAuthMigrationSchema)',
-    );
-    expect(code).toContain(
-      'runVoidAuthMigrations(new Request(request.url), __voidGetMigrationEnv(), __voidAuthOptions, __voidAuthMigrationSchema)',
+      'runVoidAuthMigrations(__voidGetMigrationEnv(), __voidAuthOptions, __voidAuthMigrationSchema)',
     );
     expect(code).toContain('export async function __voidHandleInternalRoute(request)');
     expect(code).toContain('if (request.method === "POST" && url.pathname === "/__void/migrate")');
@@ -165,7 +161,6 @@ describe('compileRouteTable auth integration', () => {
       bindingNames: { d1: 'myapp_db' },
       migrationHandlerPath: '/resolved/migration-handler.mjs',
       migrations: [{ name: '001_init.sql', sql: 'select 1;' }],
-      migrationDialect: 'sqlite',
     });
 
     expect(code).toContain('env["myapp_db"]');
@@ -173,7 +168,7 @@ describe('compileRouteTable auth integration', () => {
     expect(code).toContain('return { ...env, DB: env["myapp_db"] };');
     expect(code).toContain('__createMigrationHandler(\n    __voidGetMigrationEnv(),');
     expect(code).toContain(
-      'runVoidAuthMigrations(new Request(c.req.url), __voidGetMigrationEnv(), __voidAuthOptions, __voidAuthMigrationSchema)',
+      'runVoidAuthMigrations(__voidGetMigrationEnv(), __voidAuthOptions, __voidAuthMigrationSchema)',
     );
   });
 });
diff --git a/packages/void/test/unit/compile.test.ts b/packages/void/test/unit/compile.test.ts
index b9fc077c7..6f175ebb9 100644
--- a/packages/void/test/unit/compile.test.ts
+++ b/packages/void/test/unit/compile.test.ts
@@ -1,8 +1,4 @@
-import {
-  compilePattern as sharedCompilePattern,
-  mergeQueryIntoLocation as sharedMergeQueryIntoLocation,
-  substituteParams as sharedSubstituteParams,
-} from '@void/edge';
+import { compilePattern as sharedCompilePattern, matchPatternCaptures } from '@void/edge';
 /* oxlint-disable typescript-eslint/no-explicit-any -- these tests wire the void context augmentations by hand (`c.rewrite`, `c.originalUrl`, `c.isRewritten`) to exercise generated code paths directly; `as any` is the least noisy way to assign/read those members without re-declaring the full Hono context shape per test. */
 import { Hono } from 'hono';
 import { describe, expect, it } from 'vite-plus/test';
@@ -11,6 +7,7 @@ import {
   compileWorkerEntry,
   compileNodeApp,
   compileNodeServer,
+  type CompileOptions,
 } from '../../src/router/compile.ts';
 import type { ScanResult } from '../../src/router/scan.ts';
 import { VoidAssetRewriteError } from '../../src/runtime/handler.ts';
@@ -27,7 +24,6 @@ import {
   createManifestLoader,
   createSsrFallback,
   createAssetNotFound,
-  createWorkerFetch,
   type RoutingRuntime,
 } from '../../src/runtime/routing.ts';
 
@@ -42,24 +38,29 @@ const testOptions = {
   auth: null,
 };
 
+const emptyScan: ScanResult = {
+  routes: [],
+  middleware: [],
+  jobs: [],
+  queues: [],
+  pages: { pages: [], layouts: [], namedLayouts: [] },
+};
+
+function compile(options: Partial<CompileOptions> = {}, scan: ScanResult = emptyScan): string {
+  return compileRouteTable(scan, '/routes', '/middleware', '/crons', '/queues', null, {
+    ...testOptions,
+    ...options,
+  });
+}
+
 describe('compileRouteTable', () => {
   it('matches every expression of a multi-cron job', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [{ filePath: 'multi.ts', name: 'multi', crons: ['0 * * * *', '30 * * * *'] }],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
+    const code = compile(
+      {},
+      {
+        ...emptyScan,
+        jobs: [{ filePath: 'multi.ts', name: 'multi', crons: ['0 * * * *', '30 * * * *'] }],
+      },
     );
 
     expect(code).toContain('const job0Crons = ["0 * * * *","30 * * * *"]');
@@ -68,74 +69,24 @@ describe('compileRouteTable', () => {
   });
 
   it('handles empty scan result', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
+    const code = compile();
 
     expect(code).toContain('const app = new Hono()');
     expect(code).toContain('export async function scheduled() {}');
     expect(code).toContain('export default app');
   });
 
-  it('does not import getRuntimeEnv for node targets', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(scan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      nodeTarget: true,
-    });
-
-    // Node targets must not import getRuntimeEnv — generated code uses __getRawEnv() instead
-    expect(code).not.toContain('getRuntimeEnv');
-  });
-
   it('does not import runtime env helpers for node targets', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(scan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      nodeTarget: true,
-    });
+    const code = compile({ nodeTarget: true });
 
+    expect(code).not.toContain('getRuntimeEnv');
     expect(code).not.toContain(`import { withRuntimeEnv }`);
     expect(code).toContain('const withRuntimeEnv = (_env, fn) => fn();');
   });
 
   it('adds SSR fallback handler when ssr entry is provided', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
     const code = compileRouteTable(
-      scan,
+      emptyScan,
       '/routes',
       '/middleware',
       '/crons',
@@ -153,192 +104,20 @@ describe('compileRouteTable', () => {
     expect(code).toContain('"reactRefresh":true');
   });
 
-  it('generates /__void/queue route for queue consumers', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [
-        {
-          filePath: 'emails.ts',
-          name: 'emails',
-          bindingName: 'QUEUE_EMAILS',
-        },
-      ],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-
-    expect(code).toContain('app.post("/__void/queue"');
-    expect(code).toContain('const __queueNames = ["emails"]');
-    expect(code).toContain('import("/queues/emails.ts")');
-    expect(code).toContain('mod.default(batch, env)');
-    expect(code).toContain('export async function __processQueue');
-  });
-
-  it('resolves exact queue names before the longest prefixed-name suffix', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [
-        {
-          filePath: 'emails.ts',
-          name: 'emails',
-          bindingName: 'QUEUE_EMAILS',
-        },
-      ],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-
-    expect(code).toContain('if (exact !== -1) return exact');
-    expect(code).toContain('if (!queueName.endsWith("-" + name)) continue');
-    expect(code).toContain('if (name.length > matchLength)');
-    expect(code).toContain('else if (name.length === matchLength)');
-    expect(code).toContain('match = -1');
-    expect(code).toContain('if (__queueIndex === -1)');
-    expect(code).toContain('return { ok: false, error:');
-  });
-
   it('omits /__void/queue route when no queues defined', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-
-    expect(code).not.toContain('/__void/queue');
-  });
-
-  it('generates /__void/scheduled auth guard with getRuntimeEnv and x-void-internal check', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [{ filePath: 'sync.ts', name: 'sync', crons: ['0 * * * *'] }],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-
-    // The /__void/scheduled handler: dev compiles accept only the dev trigger
-    // token; builds use the proxy token when set, otherwise the build key.
-    expect(code).toContain('app.post("/__void/scheduled"');
-    expect(code).toContain('c.req.header("x-void-internal")');
-    expect(code).toContain('c.req.header("x-void-dev-trigger")');
-    expect(code).toContain('__getRawEnv()?.__VOID_PROXY_TOKEN');
-    expect(code).toContain('__VOID_DEV_TRIGGER_TOKEN');
-    expect(code).toContain('__VOID_BUILD_KEY');
-    expect(code).not.toContain('import.meta.env.DEV');
-    expect(code).toContain('const __VOID_SERVE = false;');
-  });
-
-  it('generates /__void/queue auth guard with __getRawEnv() and x-void-internal check', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [
-        {
-          filePath: 'emails.ts',
-          name: 'emails',
-          bindingName: 'QUEUE_EMAILS',
-        },
-      ],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-
-    // The /__void/queue HTTP route: same rule as /__void/scheduled.
-    expect(code).toContain('app.post("/__void/queue"');
-    expect(code).toContain('c.req.header("x-void-internal")');
-    expect(code).toContain('c.req.header("x-void-dev-trigger")');
-    expect(code).toContain('__VOID_DEV_TRIGGER_TOKEN');
-    expect(code).toContain('__VOID_BUILD_KEY');
-    expect(code).not.toContain('import.meta.env.DEV');
-    expect(code).toContain('const __VOID_SERVE = false;');
-    // Queue dispatch logic must be exported as __processQueue for direct native handler use
-    expect(code).toContain('export async function __processQueue');
+    expect(compile()).not.toContain('/__void/queue');
   });
 
   it('exports __VOID_BUILD_KEY as a unique UUID for build-time auth', () => {
     const scan: ScanResult = {
-      routes: [],
-      middleware: [],
+      ...emptyScan,
       jobs: [{ filePath: 'sync.ts', name: 'sync', crons: ['0 * * * *'] }],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
     };
 
-    const code1 = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-    const code2 = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
+    const code1 = compile({}, scan);
+    const code2 = compile({}, scan);
 
-    // Must export a build key
     expect(code1).toContain('export const __VOID_BUILD_KEY =');
-    // Each compilation generates a different key
     const match1 = code1.match(/__VOID_BUILD_KEY = "([^"]+)"/);
     const match2 = code2.match(/__VOID_BUILD_KEY = "([^"]+)"/);
     expect(match1).toBeTruthy();
@@ -346,26 +125,6 @@ describe('compileRouteTable', () => {
     expect(match1![1]).not.toBe(match2![1]);
   });
 
-  it('uses configured dev trigger token for local manual trigger auth', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [{ filePath: 'sync.ts', name: 'sync', crons: ['0 * * * *'] }],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(scan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      devTriggerToken: 'dev-trigger-test-token',
-      dev: true,
-    });
-
-    expect(code).toContain('export const __VOID_DEV_TRIGGER_TOKEN = "dev-trigger-test-token"');
-    expect(code).toContain('const __VOID_SERVE = true;');
-    expect(code).toContain('__devToken !== __VOID_DEV_TRIGGER_TOKEN');
-  });
-
   it('generates websocket durable object exports and proxy routes', () => {
     const scan: ScanResult = {
       routes: [
@@ -398,15 +157,7 @@ describe('compileRouteTable', () => {
       pages: { pages: [], layouts: [], namedLayouts: [] },
     };
 
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
+    const code = compile({}, scan);
 
     expect(code).toContain('import websocket0 from "/routes/chat/[room].ws.ts"');
     expect(code).toContain('createWebSocketDurableObject');
@@ -460,18 +211,7 @@ describe('compileRouteTable', () => {
   });
 
   it('exports tombstones for removed websocket Durable Object classes', () => {
-    const scan: ScanResult = {
-      routes: [],
-      websockets: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-    const code = compileRouteTable(scan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      webSocketTombstones: ['RemovedChatWs'],
-    });
+    const code = compile({ webSocketTombstones: ['RemovedChatWs'] });
 
     expect(code).toContain('createWebSocketTombstoneDurableObject');
     expect(code).toContain(
@@ -483,16 +223,7 @@ describe('compileRouteTable', () => {
   });
 
   it('generates the shared live durable object export when live is enabled', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const code = compileRouteTable(scan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
+    const code = compile({
       hasLive: true,
       liveRuntimePath: '/resolved/void/runtime/live-server.mjs',
     });
@@ -504,53 +235,20 @@ describe('compileRouteTable', () => {
   });
 });
 
-/**
- * Runtime behaviour tests for the c.redirect / c.rewrite wrappers. The
- * compile.ts tests above assert the emitted source string; these drive the
- * equivalent wrappers through a real Hono app so the actual behaviour
- * (query merge, re-dispatch, helper plumbing) is covered end-to-end.
- *
- * The wrapper logic is replicated here verbatim from compile.ts to keep the
- * test independent of the eval-and-import dance a real integration test
- * would require. If compile.ts drifts, the text-level tests above will
- * fail first and point at this file.
- */
-/**
- * Compile-time output of `compileRouteTable` is an ESM module. To exercise it
- * end-to-end without a real bundler, strip the static `import` statements and
- * `export` keywords, then evaluate via `new Function` with the imported names
- * supplied as parameters. Returns the Hono `app` instance the module would
- * export as default.
- *
- * Used by the X-Void-Original-URL gate test below: the substring assertion it
- * replaces was fragile against both refactor-driven false negatives and
- * refactor-driven false positives. Driving the real artifact through `fetch`
- * checks the security boundary at runtime instead.
- */
+/** Evaluate a compiled route table with its imports supplied and return its Hono app. */
 function evalCompiledApp(code: string): Hono {
-  // Strip the well-known import block and the node-target inline
-  // `const withRuntimeEnv = ...;` declaration; both forms get replaced with
-  // the same noop binding injected at the top of the eval'd body. Hono and
-  // VoidAssetRewriteError are passed in via `new Function` parameters so the
-  // bindings the compiled output references resolve cleanly.
+  // Drop imports, the node-target `withRuntimeEnv` const and `export` keywords so
+  // the module body runs inside `new Function`; a noop `withRuntimeEnv` replaces both forms.
   const stripped = code
     .replace(/^import\s+\{[^}]*\}\s+from\s+["'][^"']+["'];?\s*$/gm, '')
     .replace(/^const\s+withRuntimeEnv\s+=.*$/gm, '')
-    // Remove `export` keyword from `export const`, `export async function`,
-    // `export function`, `export default app;` so the module body is plain
-    // statements eval-safe inside a Function body.
     .replace(/^export\s+default\s+app;?\s*$/gm, '')
     .replace(/^export\s+(const|async\s+function|function)\s+/gm, '$1 ')
     .replace(/^export\s+\{[^}]*\};?\s*$/gm, '');
 
   const factory = new Function(
     'Hono',
-    'convertReturnValue',
-    '__VoidAssetRewriteError',
     'AsyncLocalStorage',
-    '__compilePattern',
-    '__substituteParams',
-    '__mergeQueryIntoLocation',
     '__createRoutingRuntime',
     '__createHttpRouteHandler',
     '__createModuleLoader',
@@ -562,26 +260,13 @@ function evalCompiledApp(code: string): Hono {
     '__createManifestLoader',
     '__createSsrFallback',
     '__createAssetNotFound',
-    [
-      // Inject the noop binding for both nodeTarget (was a `const` we stripped)
-      // and the cf branch (was an import we stripped). Anything beyond the
-      // gate-relevant header migration — route invocation, prerender, scheduled
-      // — is exercised by the test route the caller installs after eval.
-      'const withRuntimeEnv = (_e, fn) => fn();',
-      stripped,
-      'return app;',
-    ].join('\n'),
+    ['const withRuntimeEnv = (_e, fn) => fn();', stripped, 'return app;'].join('\n'),
   );
   // eslint-disable-next-line @typescript-eslint/no-require-imports -- vitest runs in node; node:async_hooks is built-in.
   const { AsyncLocalStorage } = require('node:async_hooks');
   return factory(
     Hono,
-    (v: unknown) => (v instanceof Response ? v : new Response(String(v ?? ''))),
-    class VoidAssetRewriteErrorStub extends Error {},
     AsyncLocalStorage,
-    sharedCompilePattern,
-    sharedSubstituteParams,
-    sharedMergeQueryIntoLocation,
     createRoutingRuntime,
     createHttpRouteHandler,
     createModuleLoader,
@@ -597,118 +282,61 @@ function evalCompiledApp(code: string): Hono {
 }
 
 const runtimeByApp = new WeakMap<Hono, RoutingRuntime>();
-function installVoidWrappers(app: Hono, originalUrls: WeakMap<Request, URL>): void {
-  const runtime = createRoutingRuntime(app, {
-    nodeTarget: true,
-    managedDispatch: true,
-    originalUrls,
-  });
+function installVoidWrappers(app: Hono): void {
+  const runtime = createRoutingRuntime(app, { nodeTarget: true, managedDispatch: true });
   runtimeByApp.set(app, runtime);
   app.use(runtime.contextMiddleware);
 }
 
 describe('c.redirect runtime wrapper', () => {
-  it('preserves the original request query on internal redirects', async () => {
+  it.each([
+    ['/new', '/new?x=1&y=2'],
+    // A protocol-relative location is cross-origin, so the request query must not leak to it.
+    ['//partner.example.com/landing', '//partner.example.com/landing'],
+  ])('redirects to %s with Location %s', async (destination, location) => {
     const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/old', (c) => c.redirect('/new', 302));
+    installVoidWrappers(app);
+    app.get('/old', (c) => c.redirect(destination, 302));
 
     const res = await app.fetch(new Request('http://localhost/old?x=1&y=2'));
 
     expect(res.status).toBe(302);
-    expect(res.headers.get('Location')).toBe('/new?x=1&y=2');
-  });
-
-  it("destination's explicit query wins over the incoming request query", async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/old', (c) => c.redirect('/new?foo=1', 302));
-
-    const res = await app.fetch(new Request('http://localhost/old?foo=override&bar=2'));
-
-    expect(res.status).toBe(302);
-    // `foo=1` from destination must NOT be replaced by `foo=override`;
-    // `bar=2` from the request is merged since destination doesn't carry it.
-    expect(res.headers.get('Location')).toBe('/new?foo=1&bar=2');
-  });
-
-  it('drops the incoming query when destination has an explicit empty query', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/old', (c) => c.redirect('/new?', 302));
-
-    const res = await app.fetch(new Request('http://localhost/old?token=secret&bar=2'));
-
-    expect(res.status).toBe(302);
-    expect(res.headers.get('Location')).toBe('/new');
-  });
-
-  it('preserves fragments when an explicit empty query drops incoming params', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/old', (c) => c.redirect('/new?#faq', 302));
-
-    const res = await app.fetch(new Request('http://localhost/old?token=secret&bar=2'));
-
-    expect(res.status).toBe(302);
-    expect(res.headers.get('Location')).toBe('/new#faq');
-  });
-
-  it('keeps destination fragments after the merged query string', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/old', (c) => c.redirect('/new#faq', 302));
-
-    const res = await app.fetch(new Request('http://localhost/old?utm=x'));
-
-    expect(res.status).toBe(302);
-    expect(res.headers.get('Location')).toBe('/new?utm=x#faq');
-  });
-
-  it('keeps destination fragments after merged destination and request queries', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/old', (c) => c.redirect('/new?a=1#faq', 302));
-
-    const res = await app.fetch(new Request('http://localhost/old?a=override&b=2'));
-
-    expect(res.status).toBe(302);
-    expect(res.headers.get('Location')).toBe('/new?a=1&b=2#faq');
-  });
-
-  it('does not merge incoming query into protocol-relative ("//host/x") locations', async () => {
-    // `"//partner.example.com/landing".startsWith("/")` is true — a naive
-    // path-absolute check would merge the request query into the Location
-    // header, leaking attacker-controlled params (or victim session tokens)
-    // to a cross-origin host. Protocol-relative URLs must pass through
-    // untouched, just like absolute URLs.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/old', (c) => c.redirect('//partner.example.com/landing', 302));
-
-    const res = await app.fetch(
-      new Request('http://localhost/old?session=ATTACKER_TOKEN&email=victim@example.com'),
-    );
-
-    expect(res.status).toBe(302);
-    expect(res.headers.get('Location')).toBe('//partner.example.com/landing');
+    expect(res.headers.get('Location')).toBe(location);
   });
 });
 
 function installRoutingRulesMiddleware(
   app: Hono,
-  originalUrls: WeakMap<Request, URL>,
   rules: Array<{ source: string; destination: string; status: number; force?: boolean }>,
 ): void {
-  const runtime =
-    runtimeByApp.get(app) ?? createRoutingRuntime(app, { nodeTarget: true, originalUrls });
+  const runtime = runtimeByApp.get(app) ?? createRoutingRuntime(app, { nodeTarget: true });
   app.use('*', runtime.routingMiddleware(rules));
 }
 
+/** Calls `c.rewrite(destination)` from a handler and returns what it threw. */
+async function rewriteError(destination: string): Promise<unknown> {
+  const app = new Hono();
+  installVoidWrappers(app);
+
+  let caught: unknown;
+  app.get('/from', (c) => {
+    try {
+      (c as any).rewrite(destination);
+    } catch (err) {
+      caught = err;
+    }
+    return c.text('handled', 200);
+  });
+
+  const res = await app.fetch(new Request('http://localhost/from'));
+  expect(res.status).toBe(200);
+  return caught;
+}
+
 describe('c.rewrite runtime wrapper', () => {
   it('re-dispatches to the rewritten path and exposes c.originalUrl / c.isRewritten', async () => {
     const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
+    installVoidWrappers(app);
 
     app.get('/external', (c) => (c as any).rewrite('/internal'));
     app.get('/internal', (c) => {
@@ -725,24 +353,14 @@ describe('c.rewrite runtime wrapper', () => {
 
     expect(res.status).toBe(200);
     expect(await res.text()).toBe('internal-body');
-    // Response came from the /internal handler, proving re-dispatch happened.
     expect(res.headers.get('X-Handler')).toBe('internal');
-    // `c.originalUrl()` on the re-dispatched context returns the pre-rewrite URL.
     expect(res.headers.get('X-Original-Url')).toBe('http://localhost/external?keep=1');
-    // `c.isRewritten()` is true on the replayed hop.
     expect(res.headers.get('X-Is-Rewritten')).toBe('1');
   });
 
   it('c.isRewritten() is true when dispatch sets X-Void-Original-URL (platform edge rewrite)', async () => {
-    // Regression anchor: in production on the default target, Void's dispatch
-    // worker applies static routing.rewrites / fallbacks by mutating the
-    // pathname and setting `X-Void-Original-URL` on the forwarded request.
-    // The worker's entry middleware migrates that header into the
-    // `__voidOriginalUrls` WeakMap once per request, so both `c.originalUrl()`
-    // and `c.isRewritten()` report the pre-rewrite URL without reading the
-    // header every call.
     const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
+    installVoidWrappers(app);
 
     app.get('/en/docs', (c) => {
       return new Response('docs-body', {
@@ -765,23 +383,17 @@ describe('c.rewrite runtime wrapper', () => {
   });
 
   it('single-hop loop guard: re-dispatched request skips the static rule table', async () => {
-    // Regression anchor for the `__voidOriginalUrls` WeakMap guard in
-    // compile.ts. A middleware calls `c.rewrite('/a')`, and `/a` itself is
-    // also a rewrite source that (without the guard) would re-fire endlessly.
-    // Counter tracks how many times the routing rule table *matches* a request
-    // so the test fails loudly if the guard regresses.
     const app = new Hono();
-    const voidOriginalUrls = new WeakMap<Request, URL>();
     let ruleMatches = 0;
 
-    installVoidWrappers(app, voidOriginalUrls);
+    installVoidWrappers(app);
     app.use('*', async (c, next) => {
-      if (!voidOriginalUrls.has(c.req.raw)) {
+      if (!(c as any).isRewritten()) {
         ruleMatches++;
       }
       await next();
     });
-    installRoutingRulesMiddleware(app, voidOriginalUrls, [
+    installRoutingRulesMiddleware(app, [
       { source: '/a', destination: '/a', status: 200, force: true },
     ]);
 
@@ -794,19 +406,11 @@ describe('c.rewrite runtime wrapper', () => {
     const res = await app.fetch(new Request('http://localhost/a'));
     expect(res.status).toBe(200);
     expect(await res.text()).toBe('handler-a');
-    // Exactly one match: the original request. The re-dispatched request
-    // carries the internal flag and is skipped by the rule table.
     expect(ruleMatches).toBe(1);
-    // The handler ran under the re-dispatched context, so `c.isRewritten()` is true.
     expect(res.headers.get('X-Is-Rewritten')).toBe('1');
   });
 
   it('rewrite vs fallback interaction: force-rewrite (always) wins over fallback (post-asset)', async () => {
-    // When the same source matches both a rewrite (force=true, pre-asset) and
-    // a fallback (force=false, post-asset), the rewrite bucket fires first and
-    // the fallback never reaches the request. This is enforced by splitting
-    // rules into separate buckets via `splitRedirectRulesByForce` — the
-    // pre-asset bucket resolves the request before the post-asset one runs.
     const { splitRedirectRulesByForce } = await import('../../src/cli/headers.ts');
     const allRules = [
       {
@@ -826,20 +430,9 @@ describe('c.rewrite runtime wrapper', () => {
     ];
     const { always: preAsset, fallbacks: postAsset } = splitRedirectRulesByForce(allRules);
 
-    // Buckets are disjoint — the rewrite lands in pre-asset, the fallback in post-asset.
-    expect(preAsset).toHaveLength(1);
-    expect(preAsset[0].destination).toBe('/rewrite-target');
-    expect(postAsset).toHaveLength(1);
-    expect(postAsset[0].destination).toBe('/fallback.html');
-
-    // Drive the pre-asset bucket through the routing-rules middleware: the
-    // rewrite fires and the request resolves to /rewrite-target. The fallback
-    // bucket is never consulted because the request was resolved before the
-    // asset-miss phase would run.
     const app = new Hono();
-    const voidOriginalUrls = new WeakMap<Request, URL>();
-    installVoidWrappers(app, voidOriginalUrls);
-    installRoutingRulesMiddleware(app, voidOriginalUrls, preAsset);
+    installVoidWrappers(app);
+    installRoutingRulesMiddleware(app, preAsset);
 
     let fallbackFired = false;
     app.notFound(async (c) => {
@@ -858,12 +451,8 @@ describe('c.rewrite runtime wrapper', () => {
   });
 
   it('middleware runs twice on c.rewrite, with c.isRewritten() flipping false → true', async () => {
-    // Every rewrite hop replays the full middleware stack. A counter-style
-    // middleware therefore fires twice (once for the original request, once
-    // for the re-dispatched one), and `c.isRewritten()` lets users skip
-    // side-effectful work on the replay.
     const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
+    installVoidWrappers(app);
 
     let invocations = 0;
     const observed: Array<boolean> = [];
@@ -879,23 +468,13 @@ describe('c.rewrite runtime wrapper', () => {
     const res = await app.fetch(new Request('http://localhost/from'));
     expect(res.status).toBe(200);
     expect(await res.text()).toBe('to-handler');
-
-    // Counter middleware fired once per dispatch — twice total.
     expect(invocations).toBe(2);
-    // First invocation is the original request (not rewritten), second is the replay.
     expect(observed).toEqual([false, true]);
   });
 
   it('middleware runs twice when a post-asset fallback rewrite re-dispatches', async () => {
-    // Same replay semantics as a force-phase rewrite, but driven by a
-    // fallback-phase rule (status=200, force=false) that fires from
-    // `app.notFound` — mirroring how compile.ts wires `fallbackRules` into
-    // the notFound hook after the asset lookup misses. The middleware must
-    // still run twice (once per dispatch) and both URLs — the original and
-    // the rewritten — must be observable from the appropriate context APIs.
     const app = new Hono();
-    const voidOriginalUrls = new WeakMap<Request, URL>();
-    installVoidWrappers(app, voidOriginalUrls);
+    installVoidWrappers(app);
 
     let invocations = 0;
     const observedReqUrls: Array<string> = [];
@@ -907,7 +486,6 @@ describe('c.rewrite runtime wrapper', () => {
       await next();
     });
 
-    // Fallback rule: /missing/* rewrites to /spa-shell on asset-miss.
     const fallbackRules = [{ source: '/missing/*', destination: '/spa-shell', status: 200 }];
     app.notFound(
       async (c) =>
@@ -920,32 +498,16 @@ describe('c.rewrite runtime wrapper', () => {
     expect(res.status).toBe(200);
     expect(await res.text()).toBe('shell-body');
 
-    // Middleware fired once per dispatch — twice total.
     expect(invocations).toBe(2);
-    // First hop: original request URL, no X-Void-Original-URL yet.
     expect(observedReqUrls[0]).toBe('http://localhost/missing/deep');
     expect(observedOriginalUrls[0]).toBeNull();
-    // Second hop: rewritten URL on c.req.url, and c.originalUrl() surfaces
-    // the pre-rewrite URL — both observable from the replayed context.
     expect(observedReqUrls[1]).toBe('http://localhost/spa-shell');
     expect(observedOriginalUrls[1]?.href).toBe('http://localhost/missing/deep');
   });
 
   it('c.rewrite() target reaches fallbackRules when no route matches', async () => {
-    // Regression anchor for F4: a user-initiated `c.rewrite("/missing")` whose
-    // target has no route should still get a chance at `routing.fallbacks` —
-    // the fallback rule was authored as the last-resort handler for `/missing`
-    // regardless of how the request arrived. The original framework bug
-    // conflated three populators of `__voidOriginalUrls` (dispatch handoff,
-    // static-rewrite middleware, user `c.rewrite`) under one fallback guard,
-    // so user rewrites silently bypassed fallbacks. The fix splits the guard
-    // onto a separate `__voidFallbackHandled` WeakSet that is populated only
-    // by fallback re-dispatches (preserving single-hop semantics + parity
-    // with dispatch's pipeline) — user rewrites and static rewrites flow
-    // through to fallbacks normally.
     const app = new Hono();
-    const voidOriginalUrls = new WeakMap<Request, URL>();
-    installVoidWrappers(app, voidOriginalUrls);
+    installVoidWrappers(app);
 
     app.use('*', async (c, next) => {
       if (new URL(c.req.url).pathname === '/trigger') {
@@ -967,450 +529,85 @@ describe('c.rewrite runtime wrapper', () => {
     expect(await res.text()).toBe('index-body');
   });
 
-  it('fallback re-dispatch does not cycle if its destination is also a fallback source', async () => {
-    // Regression anchor for the `__voidFallbackHandled` cycle guard: a
-    // fallback rewrite whose destination matches another fallback source
-    // should fire exactly once — the re-dispatch is marked so the inner
-    // notFound skips fallbacks. Mirrors dispatch's single-pass semantics.
-    const app = new Hono();
-    const voidOriginalUrls = new WeakMap<Request, URL>();
-    installVoidWrappers(app, voidOriginalUrls);
-
-    let fallbackInvocations = 0;
-    const fallbackRules = [
-      { source: '/a', destination: '/b', status: 200 },
-      { source: '/b', destination: '/c', status: 200 },
-    ];
-    app.notFound(
-      async (c) =>
-        (await runtimeByApp.get(app)!.applyFallback(c, fallbackRules)) ??
-        c.text('terminal-404', 404),
-    );
-    app.get('/c', (c) => {
-      fallbackInvocations++;
-      return c.text('incorrect second fallback');
-    });
-
-    const res = await app.fetch(new Request('http://localhost/a'));
-    // First fallback fires (/a → /b), second hop is marked, /b's notFound
-    // skips fallbacks → terminal 404.
-    expect(res.status).toBe(404);
-    expect(await res.text()).toBe('terminal-404');
-    expect(fallbackInvocations).toBe(0);
-  });
-
-  it('c.rewrite preserves a "?query" in the destination path (does not URL-encode "?")', async () => {
-    // Regression anchor: setting `URL.pathname = "/page?x=1"` percent-encodes
-    // the `?` into `%3F`, so the re-dispatched request lands at `/page%3Fx=1`
-    // and the query is lost. The wrapper must split on the first `?` and set
-    // `pathname` + `search` separately.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    app.get('/from', (c) => (c as any).rewrite('/page?x=1'));
-    app.get('/page', (c) => {
-      return new Response('ok', {
-        headers: {
-          'X-Req-Path': new URL(c.req.url).pathname,
-          'X-Req-Search': new URL(c.req.url).search,
-        },
-      });
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(res.headers.get('X-Req-Path')).toBe('/page');
-    expect(res.headers.get('X-Req-Search')).toBe('?x=1');
-  });
-
-  it('c.rewrite preserves the incoming query when the destination has none', async () => {
-    // `c.rewrite('/en/page')` on a request to `/page?x=1` must forward `?x=1`
-    // to the rewritten handler — matches static _redirects 200 rewrites (which
-    // forbid `?` in destinations and always preserve the incoming query) and
-    // avoids dropping caller-provided state like pagination or OAuth params.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    app.get('/from', (c) => (c as any).rewrite('/page'));
-    app.get('/page', (c) => {
-      return new Response('ok', {
-        headers: { 'X-Req-Search': new URL(c.req.url).search },
-      });
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from?x=1&y=2'));
-    expect(res.status).toBe(200);
-    expect(res.headers.get('X-Req-Search')).toBe('?x=1&y=2');
-  });
-
-  it('c.rewrite destination query wins over the incoming query', async () => {
-    // When the destination has its own `?`, it replaces the incoming query
-    // wholesale (it does not merge) — documents the precedence rule.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    app.get('/from', (c) => (c as any).rewrite('/page?b=2'));
-    app.get('/page', (c) => {
-      return new Response('ok', {
-        headers: { 'X-Req-Search': new URL(c.req.url).search },
-      });
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from?a=1'));
-    expect(res.headers.get('X-Req-Search')).toBe('?b=2');
-  });
-
-  it('c.rewrite strips a "#fragment" from the destination path (does not URL-encode "#")', async () => {
-    // Regression anchor: setting `URL.pathname = "/foo#frag"` percent-encodes
-    // `#` into `%23`, so the re-dispatched request lands at `/foo%23frag` and
-    // matches no route. Fragments don't reach servers anyway, so the wrapper
-    // must split on the first `#` and drop it (matches the asset-guard split).
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    app.get('/from', (c) => (c as any).rewrite('/foo#frag'));
-    app.get('/foo', (c) => {
-      const u = new URL(c.req.url);
-      return new Response('ok', {
-        headers: {
-          'X-Req-Path': u.pathname,
-          'X-Req-Search': u.search,
-          'X-Req-Hash': u.hash,
-        },
-      });
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(res.headers.get('X-Req-Path')).toBe('/foo');
-    expect(res.headers.get('X-Req-Search')).toBe('');
-    expect(res.headers.get('X-Req-Hash')).toBe('');
-  });
-
-  it('c.rewrite preserves a "?query" but strips a trailing "#fragment"', async () => {
-    // `/foo?x=1#frag` → pathname `/foo`, search `?x=1`, hash dropped. The
-    // search slice must stop at `#` so the fragment isn't smuggled into the
-    // query string.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    app.get('/from', (c) => (c as any).rewrite('/foo?x=1#frag'));
-    app.get('/foo', (c) => {
-      const u = new URL(c.req.url);
-      return new Response('ok', {
-        headers: {
-          'X-Req-Path': u.pathname,
-          'X-Req-Search': u.search,
-          'X-Req-Hash': u.hash,
-        },
-      });
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(res.headers.get('X-Req-Path')).toBe('/foo');
-    expect(res.headers.get('X-Req-Search')).toBe('?x=1');
-    expect(res.headers.get('X-Req-Hash')).toBe('');
-  });
-
-  it('c.rewrite treats "?" after "#" as part of the (dropped) fragment', async () => {
-    // Unusual but legal-looking: `/foo#frag?x=1`. The fragment starts at the
-    // first `#`, so everything after — including the `?x=1` — is the fragment
-    // and is dropped. Path is `/foo`, search is empty.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    app.get('/from', (c) => (c as any).rewrite('/foo#frag?x=1'));
-    app.get('/foo', (c) => {
-      const u = new URL(c.req.url);
-      return new Response('ok', {
-        headers: {
-          'X-Req-Path': u.pathname,
-          'X-Req-Search': u.search,
-          'X-Req-Hash': u.hash,
-        },
-      });
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(res.headers.get('X-Req-Path')).toBe('/foo');
-    expect(res.headers.get('X-Req-Search')).toBe('');
-    expect(res.headers.get('X-Req-Hash')).toBe('');
-  });
-
-  it('c.rewrite rejects absolute-URL destinations with an internal-only error', async () => {
-    // `c.rewrite` is strictly in-worker re-dispatch. An absolute URL would
-    // silently turn into a proxy — fail at the call site so users reach for
-    // `fetch()` instead.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    let caught: unknown;
-    app.get('/from', (c) => {
-      try {
-        (c as any).rewrite('https://upstream.example/path');
-      } catch (err) {
-        caught = err;
-      }
-      return c.text('handled', 200);
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(caught).toBeInstanceOf(Error);
-    expect(String(caught)).toContain('only accepts internal, path-absolute destinations');
-  });
-
-  it('c.rewrite rejects protocol-relative ("//host/x") destinations', async () => {
-    // `"//evil.com/x".startsWith("/")` is true — a naive path-absolute check
-    // lets it through, and `new URL("//evil.com/x", base)` then resolves to
-    // `https://evil.com/x`, silently proxying the request off-origin. Must
-    // fail distinct from the generic path-absolute error so users get a
-    // targeted message pointing at the `//` mistake.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    let caught: unknown;
-    app.get('/from', (c) => {
-      try {
-        (c as any).rewrite('//evil.com/x');
-      } catch (err) {
-        caught = err;
-      }
-      return c.text('handled', 200);
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(caught).toBeInstanceOf(Error);
-    expect(String(caught)).toContain('protocol-relative');
-    expect(String(caught)).toContain('//');
-  });
-
-  it('c.rewrite still accepts ordinary path-absolute destinations', async () => {
-    // Regression companion to the `//` rejection — the guard is a prefix
-    // check, so a `/internal` path must keep dispatching through the router.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    app.get('/from', (c) => (c as any).rewrite('/internal'));
-    app.get('/internal', (c) => c.text('internal-handler', 200));
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(await res.text()).toBe('internal-handler');
-  });
-
-  it('c.rewrite works on a node-target context without c.executionCtx', async () => {
-    // Hono's `c.executionCtx` getter throws on Node/Bun/Deno. The codegen
-    // must swallow the throw so `c.rewrite` still re-dispatches correctly.
-    // The test wrapper replays the same try/catch; this test drives the path
-    // end-to-end by making `executionCtx` throw on access.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
+  // Setting `URL.pathname` to a value with `?` or `#` would percent-encode it,
+  // so the destination is split: the query is kept and the fragment dropped.
+  it.each([
+    ['/page?x=1', '', '/page', '?x=1'],
+    ['/page', '?x=1&y=2', '/page', '?x=1&y=2'],
+    ['/page?b=2', '?a=1', '/page', '?b=2'],
+    ['/foo#frag', '', '/foo', ''],
+    ['/foo?x=1#frag', '', '/foo', '?x=1'],
+    ['/foo#frag?x=1', '', '/foo', ''],
+  ])(
+    'c.rewrite(%j) from a request with query %j lands on %s with search %j',
+    async (destination, incomingQuery, pathname, search) => {
+      const app = new Hono();
+      installVoidWrappers(app);
 
-    app.use('*', async (c, next) => {
-      Object.defineProperty(c, 'executionCtx', {
-        get() {
-          throw new Error('ExecutionContext not available on node targets');
-        },
-        configurable: true,
+      app.get('/from', (c) => (c as any).rewrite(destination));
+      app.get(pathname, (c) => {
+        const u = new URL(c.req.url);
+        return new Response('ok', {
+          headers: {
+            'X-Req-Path': u.pathname,
+            'X-Req-Search': u.search,
+            'X-Req-Hash': u.hash,
+          },
+        });
       });
-      await next();
-    });
-
-    app.get('/from', (c) => (c as any).rewrite('/to'));
-    app.get('/to', (c) => c.text('to-handler', 200));
 
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(await res.text()).toBe('to-handler');
-  });
+      const res = await app.fetch(new Request(`http://localhost/from${incomingQuery}`));
+      expect(res.status).toBe(200);
+      expect(res.headers.get('X-Req-Path')).toBe(pathname);
+      expect(res.headers.get('X-Req-Search')).toBe(search);
+      expect(res.headers.get('X-Req-Hash')).toBe('');
+    },
+  );
 
   it.each([
     ['external URL', 'http://evil.com'],
     ['protocol-relative', '//evil.com/path'],
   ])('c.rewrite rejects %s destinations with a clear error', async (_label, destination) => {
-    // Both external (`http://…`) and protocol-relative (`//host/x`) are caught
-    // by the single combined guard in compile.ts. Assert the key phrase rather
-    // than the verbatim sentence so small copy tweaks don't break the test.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    let caught: unknown;
-    app.get('/from', (c) => {
-      try {
-        (c as any).rewrite(destination);
-      } catch (err) {
-        caught = err;
-      }
-      return c.text('handled', 200);
-    });
+    const caught = await rewriteError(destination);
 
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
     expect(caught).toBeInstanceOf(Error);
     expect((caught as Error).message).toContain('path-absolute');
+    expect((caught as Error).message).toContain('protocol-relative');
     expect((caught as Error).message).toContain('use fetch()');
   });
 
-  it('c.rewrite to a static asset path throws VoidAssetRewriteError', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    let caught: unknown;
-    app.get('/from', (c) => {
-      try {
-        (c as any).rewrite('/hero.png');
-      } catch (err) {
-        caught = err;
-      }
-      return c.text('handled', 200);
-    });
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(caught).toBeInstanceOf(VoidAssetRewriteError);
-    expect((caught as Error).name).toBe('VoidAssetRewriteError');
-    expect((caught as Error).message).toContain('/hero.png');
-    expect((caught as Error).message).toContain('routing.rewrites');
-    expect((caught as Error).message).toContain(
-      'https://void.dev/guide/edge/rewrites#runtime-rewrites-cannot-reach-static-assets',
-    );
-  });
-
-  it('c.rewrite to an API .json path throws (routes should be returned, not literal .json)', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    let caught: unknown;
-    app.get('/from', (c) => {
-      try {
-        (c as any).rewrite('/api/users.json');
-      } catch (err) {
-        caught = err;
-      }
-      return c.text('handled', 200);
-    });
-
-    await app.fetch(new Request('http://localhost/from'));
-    expect(caught).toBeInstanceOf(VoidAssetRewriteError);
-    expect((caught as Error).message).toContain('/api/users.json');
-  });
-
-  it('c.rewrite asset check is case-insensitive', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    let caught: unknown;
-    app.get('/from', (c) => {
-      try {
-        (c as any).rewrite('/hero.PNG');
-      } catch (err) {
-        caught = err;
-      }
-      return c.text('handled', 200);
-    });
-
-    await app.fetch(new Request('http://localhost/from'));
-    expect(caught).toBeInstanceOf(VoidAssetRewriteError);
-  });
-
-  it('c.rewrite to a .html path does NOT throw (ambiguous — may be a real route)', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/from', (c) => (c as any).rewrite('/about.html'));
-    app.get('/about.html', (c) => c.text('about-html', 200));
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(await res.text()).toBe('about-html');
-  });
-
-  it('c.rewrite to a path without an extension does NOT throw', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-    app.get('/from', (c) => (c as any).rewrite('/users/123'));
-    app.get('/users/:id', (c) => c.text(`user ${c.req.param('id')}`, 200));
-
-    const res = await app.fetch(new Request('http://localhost/from'));
-    expect(res.status).toBe(200);
-    expect(await res.text()).toBe('user 123');
-  });
-
-  it('c.rewrite to an asset path with a query string still throws', async () => {
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    let caught: unknown;
-    app.get('/from', (c) => {
-      try {
-        (c as any).rewrite('/hero.png?v=2');
-      } catch (err) {
-        caught = err;
-      }
-      return c.text('handled', 200);
-    });
-
-    await app.fetch(new Request('http://localhost/from'));
-    expect(caught).toBeInstanceOf(VoidAssetRewriteError);
-    expect((caught as Error).message).toContain('/hero.png?v=2');
-  });
-
-  it('multi-middleware rewrite cycles are NOT caught by the single-hop guard (documented gap)', async () => {
-    // Documents the caveat in docs/guide/edge/rewrites.md:146 — the WeakSet
-    // loop guard is identity-keyed on the `Request` object, so each hop that
-    // constructs a fresh Request (every c.rewrite(), and every replay through
-    // a sibling middleware) creates a new identity. A cycle of /a → /b → /c
-    // → /a therefore has no runtime guard: each hop re-runs all middleware,
-    // forming infinite recursion bounded only by the host runtime's stack.
-    //
-    // We bound the test by bailing after a fixed hop count so CI doesn't
-    // hang. The assertion captures the observed behaviour (hop counter
-    // blows past any reasonable depth), pinning the gap. If a max-depth
-    // guard is ever added upstream, this test is the signal to revisit it.
-    const app = new Hono();
-    installVoidWrappers(app, new WeakMap<Request, URL>());
-
-    const MAX_HOPS = 50;
-    let hops = 0;
+  it.each(['/hero.png', '/hero.PNG', '/api/users.json', '/hero.png?v=2'])(
+    'c.rewrite to static asset path %s throws VoidAssetRewriteError',
+    async (destination) => {
+      const caught = await rewriteError(destination);
 
-    const nextPath: Record<string, string> = { '/a': '/b', '/b': '/c', '/c': '/a' };
+      expect(caught).toBeInstanceOf(VoidAssetRewriteError);
+      expect((caught as Error).name).toBe('VoidAssetRewriteError');
+      expect((caught as Error).message).toContain(destination);
+      expect((caught as Error).message).toContain('routing.rewrites');
+      expect((caught as Error).message).toContain(
+        'https://void.dev/guide/edge/rewrites#runtime-rewrites-cannot-reach-static-assets',
+      );
+    },
+  );
 
-    app.use('*', async (c, next) => {
-      const pathname = new URL(c.req.url).pathname;
-      const target = nextPath[pathname];
-      if (target) {
-        hops++;
-        if (hops > MAX_HOPS) {
-          // Bail rather than recurse: this is the documented infinite loop.
-          return c.text('bailed', 508);
-        }
-        return (c as any).rewrite(target);
-      }
-      return next();
-    });
+  // `.html` may be a real route, so it is not treated as a static asset.
+  it.each(['/about.html', '/users/123'])(
+    'c.rewrite to %s re-dispatches without throwing',
+    async (destination) => {
+      const app = new Hono();
+      installVoidWrappers(app);
+      app.get('/from', (c) => (c as any).rewrite(destination));
+      app.get(destination, (c) => c.text('target', 200));
 
-    // No handler ever resolves — the cycle consumes every hop. The test
-    // relies on our explicit bail at MAX_HOPS.
-    const res = await app.fetch(new Request('http://localhost/a'));
-    expect(res.status).toBe(508);
-    expect(await res.text()).toBe('bailed');
-    // Exceeded MAX_HOPS, confirming no built-in guard intervened.
-    expect(hops).toBeGreaterThan(MAX_HOPS);
-  });
+      const res = await app.fetch(new Request('http://localhost/from'));
+      expect(res.status).toBe(200);
+      expect(await res.text()).toBe('target');
+    },
+  );
 });
 
 describe('default-target dev parity', () => {
-  const emptyScan: ScanResult = {
-    routes: [],
-    middleware: [],
-    jobs: [],
-    queues: [],
-    pages: { pages: [], layouts: [], namedLayouts: [] },
-  };
-
   const redirectRules = [
     {
       source: '/old',
@@ -1437,24 +634,11 @@ describe('default-target dev parity', () => {
     },
   ];
 
-  function compile(
-    opts: Partial<typeof testOptions> & {
-      dev?: boolean;
-      nodeTarget?: boolean;
-      managedDispatch?: boolean;
-    },
-  ) {
-    return compileRouteTable(emptyScan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      redirectRules,
-      headerRules,
-      fallbackRules,
-      ...opts,
-    });
-  }
+  const compileWithRules = (options: Partial<CompileOptions>) =>
+    compile({ redirectRules, headerRules, fallbackRules, ...options });
 
   it('applies header rules to immutable responses in local dev', async () => {
-    const code = compile({ nodeTarget: false, dev: true });
+    const code = compileWithRules({ nodeTarget: false, dev: true });
     const app = evalCompiledApp(code);
 
     app.get('/redirect', () => Response.redirect('https://example.com/next', 302));
@@ -1476,7 +660,7 @@ describe('default-target dev parity', () => {
   });
 
   it('runs native Cloudflare prod rewrites, headers, and post-asset fallbacks', async () => {
-    const code = compile({ nodeTarget: false, dev: false, managedDispatch: false });
+    const code = compileWithRules({ nodeTarget: false, dev: false, managedDispatch: false });
     const app = evalCompiledApp(code);
     app.get('/new', (c: any) =>
       c.text(c.originalUrl()?.pathname === '/rewrite' ? 'rewritten' : 'new'),
@@ -1502,13 +686,7 @@ describe('default-target dev parity', () => {
   });
 
   it('applies native Cloudflare prod headers to assets without fallback rules', async () => {
-    const code = compileRouteTable(emptyScan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      nodeTarget: false,
-      dev: false,
-      managedDispatch: false,
-      headerRules,
-    });
+    const code = compile({ nodeTarget: false, dev: false, managedDispatch: false, headerRules });
     const app = evalCompiledApp(code);
     const ctx = {
       waitUntil: () => undefined,
@@ -1527,33 +705,14 @@ describe('default-target dev parity', () => {
   });
 
   it('omits redirect + header + fallback middleware from managed bundles', () => {
-    const code = compile({ nodeTarget: false, dev: false, managedDispatch: true });
+    const code = compileWithRules({ nodeTarget: false, dev: false, managedDispatch: true });
     expect(code).not.toContain('const __routingRules =');
     expect(code).not.toContain('const __headerRules =');
     expect(code).not.toContain('const __fallbackRules =');
   });
 
-  // Regression: prior to feat/rewrites the void.json validator warned that
-  // `routing.fallbacks` was default-target-only and the codegen skipped the
-  // notFound fallback hook on non-default targets. Fallbacks now apply on
-  // every target — this test locks in that contract so reintroducing a
-  // `nodeTarget` → "strip fallbackRules" branch fails loudly in both dev and
-  // prod builds.
-
-  // Only a managed build trusts an inbound `X-Void-Original-URL` header:
-  // dispatch strips client-supplied values on ingress. Native CF, CF dev,
-  // and node/bun/deno targets have no trusted dispatch in front, so clients
-  // must not be able to spoof rewrite metadata.
-  //
-  // This is a behavioral test that evaluates the actual compiled artifact
-  // (with the production `installVoidWrappers` runtime) and drives a real Request through
-  // it with `X-Void-Original-URL: /spoof` set. Asserting on the runtime
-  // outputs of `c.originalUrl()` and `c.isRewritten()` catches both:
-  // - false negatives a string check would flag (e.g. destructuring the
-  //   header getter into a local — keeps the gate but breaks `code.includes`).
-  // - false positives a string check would silently miss (e.g. emitting the
-  //   header read in BOTH dev and prod but only honoring it in prod — the
-  //   substring is present in cfDev's output but the runtime ignores it).
+  // Only managed dispatch strips client-supplied X-Void-Original-URL on ingress;
+  // every other target must not let clients spoof rewrite metadata.
   it('reads inbound X-Void-Original-URL only behind managed dispatch', async () => {
     type Permutation = {
       readonly label: string;
@@ -1581,12 +740,10 @@ describe('default-target dev parity', () => {
     ];
 
     for (const { label, opts, trustsHeader } of permutations) {
-      const code = compile(opts);
+      const code = compileWithRules(opts);
       const app = evalCompiledApp(code);
 
-      // The compiled middleware only attaches `c.originalUrl` / `c.isRewritten`
-      // — they're not bound to the route handler scope until the wrapper
-      // middleware runs, so define the route AFTER eval so it sees the wrappers.
+      // Registered after eval so the compiled context middleware runs first.
       app.get('/probe', (c: any) => {
         const orig = c.originalUrl();
         return new Response('probe', {
@@ -1597,9 +754,7 @@ describe('default-target dev parity', () => {
         });
       });
 
-      // Pass a stub `executionCtx` as the third arg — the second middleware
-      // emitted by the compiler reads `c.executionCtx` inside
-      // `requestContext.run`, which throws in a bare Hono env without it.
+      // Non-node targets read c.executionCtx, which Hono throws on without a ctx.
       const stubCtx = {
         waitUntil: () => undefined,
         passThroughOnException: () => undefined,
@@ -1676,43 +831,10 @@ describe('default-target dev parity', () => {
 });
 
 describe('compileWorkerEntry', () => {
-  it('serves the actual metadata version without echoing the requested version override', async () => {
-    const code = compileWorkerEntry({ versionMetadataBinding: 'AUTHORED_VERSION' });
-    const source = code.match(
-      /const __voidFetch = (__createWorkerFetch\([\s\S]*?\n {2}\}\));/,
-    )?.[1];
-    expect(source).toBeDefined();
-    const handler = new Function(
-      '__createWorkerFetch',
-      'app',
-      'serveWithAssets',
-      '__withRawEnv',
-      'withRuntimeEnv',
-      '__filterInternalBindings',
-      '__voidHandleInternalRoute',
-      '__voidCollectPrerenderPaths',
-      `return (${source});`,
-    )(
-      createWorkerFetch,
-      { fetch: () => new Response('application') },
-      (_request: Request, _env: object, response: Response) => response,
-      (_env: object, callback: () => Promise<Response>) => callback(),
-      (_env: object, callback: () => Promise<Response>) => callback(),
-      (env: object) => env,
-      async () => null,
-      async () => [],
-    ) as (request: Request, env: Record<string, unknown>, ctx: object) => Promise<Response>;
-    const response = await handler(
-      new Request('https://app.example/__void/ready', {
-        headers: { 'Cloudflare-Workers-Version-Overrides': 'app="new-version"' },
-      }),
-      { AUTHORED_VERSION: { id: 'old-version', tag: 'private-tag', timestamp: 'private-time' } },
-      {},
+  it('passes the version metadata binding name to the worker fetch', () => {
+    expect(compileWorkerEntry({ versionMetadataBinding: 'AUTHORED_VERSION' })).toContain(
+      'versionMetadataBinding: "AUTHORED_VERSION"',
     );
-    expect(await response.json()).toEqual({ ready: true, versionId: 'old-version' });
-    expect(response.headers.get('cache-control')).toBe('no-store');
-    const missing = await handler(new Request('https://app.example/__void/ready'), {}, {});
-    expect(await missing.json()).toEqual({ ready: true });
   });
 
   it('re-exports typed Durable Object modules as worker classes', () => {
@@ -1800,9 +922,7 @@ describe('compileWorkerEntry', () => {
       sandbox: true,
     });
 
-    // Platform sandbox wraps Cloudflare's Sandbox with metering/gate hooks.
-    // Importing it (instead of the bare Sandbox class) lets user subclasses
-    // inherit those overrides without opting in.
+    // VoidPlatformSandbox carries the metering/gate hooks, so user subclasses inherit them.
     expect(code).toContain(
       'import { VoidPlatformSandbox as __VoidSandbox, __setSandboxBindingName } from "void/sandbox"',
     );
@@ -1867,7 +987,6 @@ describe('compileWorkerEntry', () => {
     expect(code).toContain('__processQueue');
     expect(code).toContain('batch.queue');
     expect(code).toContain('m.timestamp.toISOString()');
-    // Native queue handler calls __processQueue directly (no HTTP round-trip)
     expect(code).toContain('withRuntimeEnv(env, () => __processQueue(payload, userEnv))');
   });
 
@@ -1918,12 +1037,6 @@ describe('compileWorkerEntry', () => {
     expect(code).not.toContain('accept.includes("text/html")');
   });
 
-  // `routing.notFound: '404-page'` sets `assetConfig.not_found_handling`, so
-  // CF's asset binding answers an unmatched path with the NEAREST `404.html` —
-  // at a 404 status, which the `asset.status !== 404` guard above discards. The
-  // resolved handling has to reach the generated helper or the override is
-  // inert on every worker-first app.
-
   it('serveWithAssets keeps the worker response for not_found_handling: none', () => {
     const code = compileWorkerEntry({
       hasQueues: false,
@@ -1935,40 +1048,18 @@ describe('compileWorkerEntry', () => {
       notFound: 'none',
     });
 
-    // Byte-identical to the pre-existing default — `none` is what every
-    // worker-first app infers, so this is the no-regression guard.
     expect(code).toBe(compileWorkerEntry());
   });
 
-  it('native queue handler calls __processQueue directly without HTTP', () => {
-    const code = compileWorkerEntry({ hasQueues: true });
-
-    // Native queue handler must call __processQueue directly (no /__void/queue HTTP round-trip)
-    // This avoids the global-flag race condition with concurrent fetch events
-    expect(code).toContain('__processQueue(payload, userEnv)');
-    expect(code).not.toContain('__voidInternalCall');
-    expect(code).not.toContain('__setVoidInternalCall');
-  });
-
   it('passes filtered env (userEnv) not raw env to scheduled handler', () => {
     const code = compileWorkerEntry();
 
-    // handleScheduled must filter internal bindings before passing to user code
     expect(code).toContain('async function handleScheduled(controller, env, ctx)');
     expect(code).toContain('const userEnv = __filterInternalBindings(env)');
     expect(code).toContain('scheduled(controller, userEnv, ctx)');
-    // Must NOT pass raw env to scheduled()
     expect(code).not.toMatch(/scheduled\(controller,\s*env,\s*ctx\)/);
   });
 
-  it('filters internal bindings in native queue handler', () => {
-    const code = compileWorkerEntry({ hasQueues: true });
-
-    // Queue handler must filter env before passing to __processQueue
-    expect(code).toContain('const userEnv = __filterInternalBindings(env)');
-    expect(code).toContain('__processQueue(payload, userEnv)');
-  });
-
   it('omits boot-time env validation when no envSchemaModule is provided', () => {
     const code = compileWorkerEntry();
     expect(code).not.toContain('_validateEnvOnce');
@@ -1980,7 +1071,6 @@ describe('compileWorkerEntry', () => {
       remote: {
         bindingNames: { d1: 'myapp_db', kv: 'myapp_kv', r2: 'myapp_storage' },
         remotePath: '/resolved/remote.mjs',
-        envPath: '/resolved/env-legacy.mjs',
       },
       assetsDir: 'assets',
       webSocketClasses: [],
@@ -2033,9 +1123,7 @@ describe('compileNodeApp', () => {
       importPath: '/abs/path/to/env.ts',
       helperPath: '/resolved/env-public.mjs',
     });
-    // Side-effect import of user env.ts so the schema is registered
     expect(code).toContain('import "/abs/path/to/env.ts"');
-    // Helper import
     expect(code).toContain('import { _validateEnvOnce } from "/resolved/env-public.mjs"');
     // Only path discovery can run without remote production secrets.
     // Node/Bun read the application request environment from process.env.
@@ -2089,77 +1177,47 @@ describe('compileNodeServer', () => {
 });
 
 describe('shared pattern compiler in generated routes', () => {
-  // Build a minimal route table with a header rule so the generated module
-  // imports the cached compiler and emits its warning wrapper.
-  const emptyScan: ScanResult = {
-    routes: [],
-    middleware: [],
-    jobs: [],
-    queues: [],
-    pages: { pages: [], layouts: [], namedLayouts: [] },
-  };
   const compilePattern = (source: string) => {
-    const { regex, paramNames } = sharedCompilePattern(source);
-    return { regex, names: [...paramNames] };
+    const { paramNames } = sharedCompilePattern(source);
+    return { names: [...paramNames] };
   };
 
   it(':name and bare "*" do not clash even when both appear', () => {
-    // `:id*` produces `(?<id>...)`; the bare `*` produces `(?<splat>...)` —
-    // distinct group names, so no collision.
-    const { regex, names } = compilePattern('/u/:id*/files/*');
+    const { names } = compilePattern('/u/:id*/files/*');
     expect(names).toEqual(['id', 'splat']);
-    const m = regex.exec('/u/42/extra/files/a/b');
-    expect(m?.groups?.id).toBe('42/extra');
-    expect(m?.groups?.splat).toBe('a/b');
+    expect(matchPatternCaptures('/u/:id*/files/*', '/u/42/extra/files/a/b')).toEqual({
+      id: '42/extra',
+      splat: 'a/b',
+    });
   });
 
   it('__compilePattern itself still throws on duplicate capture group names', () => {
-    // The legacySplatCaptured flag prevents two bare `*`s clashing on the
-    // implicit `splat` name, but it does NOT cover duplicate `:name` tokens
-    // or a `:splat` colliding with a bare `*`. These cases still throw at
-    // construction. They're caught by:
-    //   1. Build-time validation (`assertUniqueCaptureNames` in config.ts)
-    //   2. Runtime per-rule try/catch in `runtime/routing.ts` (so one
-    //      malformed rule cannot 500 unrelated traffic if validation is bypassed)
+    // Config validation rejects these; the runtime skips such rules per request.
     expect(() => compilePattern('/:id/:id')).toThrow(/duplicate capture group name/i);
     expect(() => compilePattern('/:splat/*')).toThrow(/duplicate capture group name/i);
     expect(() => compilePattern('/:rest*/:rest*')).toThrow(/duplicate capture group name/i);
   });
 
   it('production routing middleware skips invalid rules and still applies valid ones', async () => {
-    // Behavioral verification of the runtime guard: a single rule with a bad
-    // source must not 500 the request — it should be skipped (with a warn-once)
-    // and other rules in the table should still match.
-    const codeWithRules = compileRouteTable(
-      emptyScan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      {
-        ...testOptions,
-        dev: true,
-        // First rule is malformed (duplicate `:id`); second rule is valid.
-        // The middleware must skip the bad one, log warn once, and apply the good one.
-        redirectRules: [
-          {
-            source: '/:id/:id',
-            destination: '/x',
-            status: 200,
-            force: true,
-            origin: 'test',
-          },
-          {
-            source: '/old',
-            destination: '/new',
-            status: 200,
-            force: true,
-            origin: 'test',
-          },
-        ],
-      },
-    );
+    const codeWithRules = compile({
+      dev: true,
+      redirectRules: [
+        {
+          source: '/:id/:id',
+          destination: '/x',
+          status: 200,
+          force: true,
+          origin: 'test',
+        },
+        {
+          source: '/old',
+          destination: '/new',
+          status: 200,
+          force: true,
+          origin: 'test',
+        },
+      ],
+    });
     const app = evalCompiledApp(codeWithRules);
     app.get('/new', (c) => c.text('new route'));
     const response = await app.fetch(
@@ -2194,9 +1252,7 @@ describe('shared pattern compiler in generated routes', () => {
 });
 
 describe('compileWorkerEntry — ISR wiring', () => {
-  // FIX 1: cron/queue handlers must stamp the deployment id (only — no host,
-  // there is no request) so a self-host `revalidate()` from a scheduled or queue
-  // handler can find it and purge KV instead of no-oping.
+  // revalidate() in cron and queue handlers needs the deployment id; they have no request host.
   it('stamps the deployment id at the top of the scheduled + queue handlers when isr is set', () => {
     const code = compileWorkerEntry({
       hasQueues: true,
@@ -2207,25 +1263,21 @@ describe('compileWorkerEntry — ISR wiring', () => {
       isr: { runtimePath: 'void/isr' },
     });
 
-    // Scheduled handler stamps the id (deployment id only — no __VOID_ISR_HOST).
     expect(code).toContain(
       'async function handleScheduled(controller, env, ctx) {\n' +
         '  env.__VOID_ISR_DEPLOYMENT_ID ??= __VOID_ISR_DEPLOYMENT_ID;\n' +
         '  const userEnv = __filterInternalBindings(env);',
     );
-    // Queue handler stamps the id (deployment id only — no __VOID_ISR_HOST).
     expect(code).toContain(
       'async function __voidQueue(batch, env, ctx) {\n' +
         '  env.__VOID_ISR_DEPLOYMENT_ID ??= __VOID_ISR_DEPLOYMENT_ID;\n' +
         '  const userEnv = __filterInternalBindings(env);',
     );
-    // No host stamp in cron/queue (there is no request).
     expect(code).not.toContain('env.__VOID_ISR_HOST ??= new URL(controller');
   });
 
   it('does NOT stamp the deployment id in scheduled/queue handlers when isr is absent', () => {
-    const code = compileWorkerEntry({ hasQueues: true }); // hasQueues, no isr
-    // Byte-identical to today: no deployment-id stamp anywhere.
+    const code = compileWorkerEntry({ hasQueues: true });
     expect(code).not.toContain('__VOID_ISR_DEPLOYMENT_ID ??=');
     expect(code).toContain(
       'async function handleScheduled(controller, env, ctx) {\n' +
@@ -2238,67 +1290,26 @@ describe('compileWorkerEntry — ISR wiring', () => {
 });
 
 describe('compileRouteTable — baked ISR consts', () => {
-  const scan: ScanResult = {
-    routes: [],
-    middleware: [],
-    jobs: [],
-    queues: [],
-    pages: { pages: [], layouts: [], namedLayouts: [] },
-  };
-
   it('emits __VOID_ISR_DEPLOYMENT_ID as a compile-time string literal (never crypto.randomUUID())', () => {
-    const code = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-    // A quoted UUID literal — baked at build time, not a runtime call.
+    const code = compile();
     expect(code).toMatch(/export const __VOID_ISR_DEPLOYMENT_ID = "[0-9a-f-]{36}";/);
     expect(code).not.toContain('__VOID_ISR_DEPLOYMENT_ID = crypto.randomUUID()');
   });
 
   it('bakes a fresh deployment id per compilation (one shared id per deploy)', () => {
-    const a = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
-    const b = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
+    const a = compile();
+    const b = compile();
     const idA = a.match(/__VOID_ISR_DEPLOYMENT_ID = "([^"]+)"/)![1];
     const idB = b.match(/__VOID_ISR_DEPLOYMENT_ID = "([^"]+)"/)![1];
     expect(idA).not.toBe(idB);
   });
 
   it('emits the merged revalidate config verbatim (undefined | number | path map)', () => {
-    const none = compileRouteTable(
-      scan,
-      '/routes',
-      '/middleware',
-      '/crons',
-      '/queues',
-      null,
-      testOptions,
-    );
+    const none = compile();
     expect(none).toContain('export const __VOID_ISR_REVALIDATE = undefined;');
 
     const num = compileRouteTable(
-      scan,
+      emptyScan,
       '/routes',
       '/middleware',
       '/crons',
@@ -2311,7 +1322,7 @@ describe('compileRouteTable — baked ISR consts', () => {
     expect(num).toContain('export const __VOID_ISR_REVALIDATE = 60;');
 
     const map = compileRouteTable(
-      scan,
+      emptyScan,
       '/routes',
       '/middleware',
       '/crons',
@@ -2326,7 +1337,7 @@ describe('compileRouteTable — baked ISR consts', () => {
 
   it('bakes the ordered page policy and raw path config for native ISR', () => {
     const code = compileRouteTable(
-      scan,
+      emptyScan,
       '/routes',
       '/middleware',
       '/crons',
@@ -2347,21 +1358,9 @@ describe('compileRouteTable — baked ISR consts', () => {
 });
 
 describe('typed runtime metadata wiring', () => {
-  const empty: ScanResult = {
-    routes: [],
-    middleware: [],
-    jobs: [],
-    queues: [],
-    pages: { pages: [], layouts: [], namedLayouts: [] },
-  };
-  const compile = (options: Partial<Parameters<typeof compileRouteTable>[6]> = {}) =>
-    compileRouteTable(empty, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      ...options,
-    });
   it('imports Worker-safe execution and emits route export selection and cache policy', () => {
     const scan: ScanResult = {
-      ...empty,
+      ...emptyScan,
       routes: [
         {
           pattern: '/hello',
@@ -2373,10 +1372,7 @@ describe('typed runtime metadata wiring', () => {
         },
       ],
     };
-    const dev = compileRouteTable(scan, '/routes', '/middleware', '/crons', '/queues', null, {
-      ...testOptions,
-      dev: true,
-    });
+    const dev = compile({ dev: true }, scan);
     expect(dev).toContain('createRoutingRuntime as __createRoutingRuntime');
     expect(dev).toContain(
       'const _load_hello_ts = __createModuleLoader(() => import("/routes/hello.ts"), false)',
diff --git a/packages/void/test/unit/config.test.ts b/packages/void/test/unit/config.test.ts
index 4bc73fd89..b7c1f318c 100644
--- a/packages/void/test/unit/config.test.ts
+++ b/packages/void/test/unit/config.test.ts
@@ -207,14 +207,6 @@ describe('readConfig', () => {
     cleanup();
   });
 
-  it('rejects inference.auth regardless of type', () => {
-    setup(JSON.stringify({ inference: { auth: 'github' } }));
-    expect(() => readConfig(tmpDir)).toThrow(
-      '"inference.auth" in void.json is no longer supported',
-    );
-    cleanup();
-  });
-
   it('rejects unknown top-level auth providers', () => {
     setup(JSON.stringify({ auth: { providers: ['email', 'patreon'] } }));
     expect(() => readConfig(tmpDir)).toThrow('"auth.providers" value \'patreon\'');
@@ -263,12 +255,6 @@ describe('readConfig', () => {
     cleanup();
   });
 
-  it('throws on invalid binding value type', () => {
-    setup(JSON.stringify({ inference: { bindings: { db: 42 } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must be a boolean or a string');
-    cleanup();
-  });
-
   it('accepts sandbox boolean and object config', () => {
     setup(JSON.stringify({ sandbox: true }));
     expect(readConfig(tmpDir).sandbox).toBe(true);
@@ -389,19 +375,6 @@ describe('readConfig', () => {
     cleanup();
   });
 
-  it('throws on partial compatibility_date format', () => {
-    setup(JSON.stringify({ worker: { compatibility_date: '2026-02' } }));
-    expect(() => readConfig(tmpDir)).toThrow('YYYY-MM-DD format');
-    cleanup();
-  });
-
-  it('accepts valid compatibility_date format', () => {
-    setup(JSON.stringify({ worker: { compatibility_date: '2026-02-24' } }));
-    const config = readConfig(tmpDir);
-    expect(config.worker?.compatibility_date).toBe('2026-02-24');
-    cleanup();
-  });
-
   it('accepts valid worker.limits.cpu_ms', () => {
     setup(JSON.stringify({ worker: { limits: { cpu_ms: 50 } } }));
     const config = readConfig(tmpDir);
@@ -429,26 +402,8 @@ describe('readConfig', () => {
     cleanup();
   });
 
-  it('throws on worker.limits.cpu_ms of 0', () => {
-    setup(JSON.stringify({ worker: { limits: { cpu_ms: 0 } } }));
-    expect(() => readConfig(tmpDir)).toThrow('"worker.limits.cpu_ms"');
-    cleanup();
-  });
-
-  it('throws on negative worker.limits.cpu_ms', () => {
-    setup(JSON.stringify({ worker: { limits: { cpu_ms: -5 } } }));
-    expect(() => readConfig(tmpDir)).toThrow('"worker.limits.cpu_ms"');
-    cleanup();
-  });
-
-  it('throws on non-integer worker.limits.cpu_ms', () => {
-    setup(JSON.stringify({ worker: { limits: { cpu_ms: 50.5 } } }));
-    expect(() => readConfig(tmpDir)).toThrow('"worker.limits.cpu_ms"');
-    cleanup();
-  });
-
-  it('throws on worker.limits.cpu_ms above 300000', () => {
-    setup(JSON.stringify({ worker: { limits: { cpu_ms: 300001 } } }));
+  it.each([0, -5, 50.5, 300001])('throws on invalid worker.limits.cpu_ms: %s', (cpuMs) => {
+    setup(JSON.stringify({ worker: { limits: { cpu_ms: cpuMs } } }));
     expect(() => readConfig(tmpDir)).toThrow('"worker.limits.cpu_ms"');
     cleanup();
   });
@@ -508,27 +463,16 @@ describe('readConfig', () => {
     cleanup();
   });
 
-  // `routing.notFound` overrides the INFERRED asset `not_found_handling`.
-  // Typos must fail at config-read time: an unvalidated string would be written
-  // straight into `assets.not_found_handling`, and the failure would only show
-  // up as Cloudflare rejecting the deployed worker config.
-  it('accepts routing.notFound: "404-page"', () => {
-    setup(JSON.stringify({ routing: { notFound: '404-page' } }));
-    expect(readConfig(tmpDir).routing?.notFound).toBe('404-page');
-    cleanup();
-  });
-
-  it('accepts routing.notFound: "single-page-application"', () => {
-    setup(JSON.stringify({ routing: { notFound: 'single-page-application' } }));
-    expect(readConfig(tmpDir).routing?.notFound).toBe('single-page-application');
-    cleanup();
-  });
-
-  it('accepts routing.notFound: "none"', () => {
-    setup(JSON.stringify({ routing: { notFound: 'none' } }));
-    expect(readConfig(tmpDir).routing?.notFound).toBe('none');
-    cleanup();
-  });
+  // `routing.notFound` is written straight into `assets.not_found_handling`, so a typo
+  // must fail here instead of when Cloudflare rejects the deployed config.
+  it.each(['404-page', 'single-page-application', 'none'])(
+    'accepts routing.notFound: %j',
+    (notFound) => {
+      setup(JSON.stringify({ routing: { notFound } }));
+      expect(readConfig(tmpDir).routing?.notFound).toBe(notFound);
+      cleanup();
+    },
+  );
 
   it('leaves routing.notFound undefined when omitted', () => {
     setup(JSON.stringify({ routing: { revalidate: 60 } }));
@@ -689,69 +633,21 @@ describe('readConfig migration errors', () => {
     cleanup();
   });
 
-  it('throws migration error when old flat bindings key is used', () => {
-    setup(JSON.stringify({ bindings: { db: true } }));
-    expect(() => readConfig(tmpDir)).toThrow('"bindings" has moved to "inference.bindings"');
-    cleanup();
-  });
-
-  it('throws migration error when old flat headers key is used', () => {
-    setup(JSON.stringify({ headers: { '/*': ['X-Frame-Options: DENY'] } }));
-    expect(() => readConfig(tmpDir)).toThrow('"headers" has moved to "routing.headers"');
-    cleanup();
-  });
-
-  it('throws migration error when old flat redirects key is used', () => {
-    setup(JSON.stringify({ redirects: { '/old': '/new' } }));
-    expect(() => readConfig(tmpDir)).toThrow('"redirects" has moved to "routing.redirects"');
-    cleanup();
-  });
-
-  it('throws migration error when old cache key is used', () => {
-    setup(JSON.stringify({ cache: { revalidate: 60 } }));
-    expect(() => readConfig(tmpDir)).toThrow('"cache" has been replaced by "routing"');
-    cleanup();
-  });
-
-  it('throws migration error when old wrangler key is used', () => {
-    setup(JSON.stringify({ wrangler: { compatibility_date: '2025-12-01' } }));
-    expect(() => readConfig(tmpDir)).toThrow('"wrangler" has been renamed to "worker"');
-    cleanup();
-  });
-
-  it('throws migration error when old mode key is used', () => {
-    setup(JSON.stringify({ mode: 'spa' }));
-    expect(() => readConfig(tmpDir)).toThrow('"mode" has been renamed to "inference.appType"');
-    cleanup();
-  });
-
-  it('throws migration error when old flat build key is used', () => {
-    setup(JSON.stringify({ build: 'nuxt build' }));
-    expect(() => readConfig(tmpDir)).toThrow('"build" has moved to "inference.build"');
-    cleanup();
-  });
-
-  it('throws migration error when old flat scanDirs key is used', () => {
-    setup(JSON.stringify({ scanDirs: ['src'] }));
-    expect(() => readConfig(tmpDir)).toThrow('"scanDirs" has moved to "inference.scanDirs"');
-    cleanup();
-  });
-
-  it('throws migration error when old flat appType key is used', () => {
-    setup(JSON.stringify({ appType: 'spa' }));
-    expect(() => readConfig(tmpDir)).toThrow('"appType" has moved to "inference.appType"');
-    cleanup();
-  });
-
-  it('throws migration error when old flat outputDir key is used', () => {
-    setup(JSON.stringify({ outputDir: 'dist' }));
-    expect(() => readConfig(tmpDir)).toThrow('"outputDir" has moved to "inference.outputDir"');
-    cleanup();
-  });
-
-  it('throws migration error when old top-level revalidate is used', () => {
-    setup(JSON.stringify({ revalidate: 60 }));
-    expect(() => readConfig(tmpDir)).toThrow('"revalidate" has moved to "routing.revalidate"');
+  it.each([
+    ['bindings', { db: true }, '"bindings" has moved to "inference.bindings"'],
+    ['headers', { '/*': ['X-Frame-Options: DENY'] }, '"headers" has moved to "routing.headers"'],
+    ['redirects', { '/old': '/new' }, '"redirects" has moved to "routing.redirects"'],
+    ['cache', { revalidate: 60 }, '"cache" has been replaced by "routing"'],
+    ['wrangler', { compatibility_date: '2025-12-01' }, '"wrangler" has been renamed to "worker"'],
+    ['mode', 'spa', '"mode" has been renamed to "inference.appType"'],
+    ['build', 'nuxt build', '"build" has moved to "inference.build"'],
+    ['scanDirs', ['src'], '"scanDirs" has moved to "inference.scanDirs"'],
+    ['appType', 'spa', '"appType" has moved to "inference.appType"'],
+    ['outputDir', 'dist', '"outputDir" has moved to "inference.outputDir"'],
+    ['revalidate', 60, '"revalidate" has moved to "routing.revalidate"'],
+  ])('throws a migration error for the old %s key', (key, value, message) => {
+    setup(JSON.stringify({ [key]: value }));
+    expect(() => readConfig(tmpDir)).toThrow(message);
     cleanup();
   });
 });
@@ -766,20 +662,13 @@ describe('readConfig target', () => {
     }
   });
 
-  it('defaults target to undefined (cloudflare is implicit default)', () => {
-    setup(JSON.stringify({}));
-    const config = readConfig(tmpDir);
-    expect(config.target).toBeUndefined();
-    cleanup();
-  });
-
   it('rejects invalid target value', () => {
     setup(JSON.stringify({ target: 'lambda' }));
     expect(() => readConfig(tmpDir)).toThrow('"target" in void.json must be one of');
     cleanup();
   });
 
-  it('warns on CF-only fields with non-CF target via isNodeTarget', () => {
+  it('isNodeTarget recognizes node, bun and deno', () => {
     expect(isNodeTarget('node')).toBe(true);
     expect(isNodeTarget('bun')).toBe(true);
     expect(isNodeTarget('deno')).toBe(true);
@@ -874,7 +763,6 @@ describe('readConfig redirects', () => {
     );
     const keyPattern = new RegExp(Object.keys(objectForm.patternProperties)[0]);
 
-    // Runtime (config.ts) accepts a key that is exactly "*" or starts with "/".
     for (const key of ['*', '/x', '/docs/*']) {
       expect(keyPattern.test(key)).toBe(true);
     }
@@ -913,7 +801,6 @@ describe('readConfig redirects', () => {
       const destPattern = new RegExp(
         schema.properties.routing.properties[field].patternProperties['^(/|https://)'].pattern,
       );
-      // Runtime accepts internal paths and rejects protocol-relative dests + query strings.
       for (const dest of ['/en/docs', '/', '/index.html']) {
         expect(destPattern.test(dest)).toBe(true);
       }
@@ -927,10 +814,8 @@ describe('readConfig redirects', () => {
     const schema = JSON.parse(readFileSync(join(import.meta.dirname, '../../schema.json'), 'utf8'));
     const limits = schema.properties.worker.properties.limits;
     expect(limits.type).toBe('object');
-    // Runtime (config.ts) rejects unknown keys inside limits.
     expect(limits.additionalProperties).toBe(false);
     expect(Object.keys(limits.properties)).toEqual(['cpu_ms']);
-    // Runtime accepts an integer between 1 and 300000 (Cloudflare's hard max).
     expect(limits.properties.cpu_ms.type).toBe('integer');
     expect(limits.properties.cpu_ms.minimum).toBe(1);
     expect(limits.properties.cpu_ms.maximum).toBe(300000);
@@ -946,7 +831,7 @@ describe('readConfig redirects', () => {
   });
 });
 
-describe('routing.rewrites validation', () => {
+describe('routing.rewrites and routing.fallbacks validation', () => {
   it('accepts static rewrites without wildcards', () => {
     setup(JSON.stringify({ routing: { rewrites: { '/docs': '/en/docs' } } }));
     const config = readConfig(tmpDir);
@@ -954,49 +839,6 @@ describe('routing.rewrites validation', () => {
     cleanup();
   });
 
-  it('throws when rewrites is not an object', () => {
-    setup(JSON.stringify({ routing: { rewrites: ['/old', '/new'] } }));
-    expect(() => readConfig(tmpDir)).toThrow('"routing.rewrites" in void.json must be an object');
-    cleanup();
-  });
-
-  it('throws when source does not start with /', () => {
-    setup(JSON.stringify({ routing: { rewrites: { docs: '/en/docs' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must start with "/"');
-    cleanup();
-  });
-
-  it('throws when destination is not a string', () => {
-    setup(JSON.stringify({ routing: { rewrites: { '/docs': 42 } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must be a string');
-    cleanup();
-  });
-
-  it('throws when destination does not start with /', () => {
-    setup(JSON.stringify({ routing: { rewrites: { '/docs': 'en/docs' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must start with "/"');
-    cleanup();
-  });
-
-  it('throws when destination contains a query string', () => {
-    setup(JSON.stringify({ routing: { rewrites: { '/docs': '/en/docs?lang=en' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must not contain "?"');
-    cleanup();
-  });
-
-  it('throws when destination is protocol-relative ("//host/x")', () => {
-    // Mirrors the `c.rewrite()` codegen guard in router/compile.ts (commit
-    // 3c60d38). `"//evil.com/x".startsWith("/")` is true, so a naive
-    // single-slash check lets the value through — but when the manifest is
-    // applied at dispatch, `new URL("//evil.com/x", base)` resolves to
-    // `https://evil.com/x` and turns the rewrite into a cross-origin proxy.
-    setup(JSON.stringify({ routing: { rewrites: { '/docs': '//evil.com/x' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must not start with "//"');
-    cleanup();
-  });
-});
-
-describe('routing.fallbacks validation', () => {
   it('accepts valid fallbacks', () => {
     setup(JSON.stringify({ routing: { fallbacks: { '/*': '/index.html' } } }));
     const config = readConfig(tmpDir);
@@ -1004,42 +846,19 @@ describe('routing.fallbacks validation', () => {
     cleanup();
   });
 
-  it('throws when fallbacks is not an object', () => {
-    setup(JSON.stringify({ routing: { fallbacks: ['/*', '/index.html'] } }));
-    expect(() => readConfig(tmpDir)).toThrow('"routing.fallbacks" in void.json must be an object');
-    cleanup();
-  });
-
-  it('throws when source does not start with /', () => {
-    setup(JSON.stringify({ routing: { fallbacks: { '*': '/index.html' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must start with "/"');
-    cleanup();
-  });
-
-  it('throws when destination is not a string', () => {
-    setup(JSON.stringify({ routing: { fallbacks: { '/*': 42 } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must be a string');
-    cleanup();
-  });
-
-  it('throws when destination does not start with /', () => {
-    setup(JSON.stringify({ routing: { fallbacks: { '/*': 'index.html' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must start with "/"');
-    cleanup();
-  });
-
-  it('throws when destination contains a query string', () => {
-    setup(JSON.stringify({ routing: { fallbacks: { '/*': '/index.html?foo=1' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must not contain "?"');
-    cleanup();
-  });
-
-  it('throws when destination is protocol-relative ("//host/x")', () => {
-    // Symmetric with the rewrites guard — fallbacks reach the platform via
-    // the same manifest path, so the same cross-origin hazard applies.
-    setup(JSON.stringify({ routing: { fallbacks: { '/*': '//evil.com/index.html' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must not start with "//"');
-    cleanup();
+  describe.each(['rewrites', 'fallbacks'])('routing.%s', (field) => {
+    it.each<[unknown, string]>([
+      [['/old', '/new'], `"routing.${field}" in void.json must be an object`],
+      [{ docs: '/en/docs' }, 'must start with "/"'],
+      [{ '/docs': 42 }, 'must be a string'],
+      [{ '/docs': 'en/docs' }, 'must start with "/"'],
+      [{ '/docs': '/en/docs?lang=en' }, 'must not contain "?"'],
+      [{ '/docs': '//evil.com/x' }, 'must not start with "//"'],
+    ])('rejects %j', (rules, message) => {
+      setup(JSON.stringify({ routing: { [field]: rules } }));
+      expect(() => readConfig(tmpDir)).toThrow(message);
+      cleanup();
+    });
   });
 });
 
@@ -1075,16 +894,7 @@ describe('routing.redirects protocol-relative guard', () => {
 });
 
 describe('routing rules: host-prefixed sources', () => {
-  // `https://host/path` keys on `routing.{redirects,rewrites,fallbacks}`
-  // scope a rule to a specific Host header. The validator splits the URL
-  // and validates the path portion as it would for path-only sources;
-  // `convertRedirectsConfig` etc emit the rule with `host` populated and
-  // `source` set to the path. Validation is symmetric across redirects,
-  // rewrites, and fallbacks — and rejects http://, //host, and non-literal
-  // hosts.
-
-  it('accepts a redirect with https:// prefixed source and emits host on rule', async () => {
-    const { convertRedirectsConfig } = await import('../../src/config.ts');
+  it('accepts a redirect with https:// prefixed source and emits host on rule', () => {
     setup(
       JSON.stringify({
         routing: { redirects: { 'https://www.foo.com/*': 'https://foo.com/:splat' } },
@@ -1104,8 +914,7 @@ describe('routing rules: host-prefixed sources', () => {
     cleanup();
   });
 
-  it('lowercases mixed-case host on redirect source', async () => {
-    const { convertRedirectsConfig } = await import('../../src/config.ts');
+  it('lowercases mixed-case host on redirect source', () => {
     setup(JSON.stringify({ routing: { redirects: { 'https://WWW.FOO.COM/about': '/new' } } }));
     const config = readConfig(tmpDir);
     const rules = convertRedirectsConfig(config.routing?.redirects);
@@ -1114,8 +923,7 @@ describe('routing rules: host-prefixed sources', () => {
     cleanup();
   });
 
-  it('accepts a rewrite with https:// prefixed source', async () => {
-    const { convertRewritesConfig } = await import('../../src/config.ts');
+  it('accepts a rewrite with https:// prefixed source', () => {
     setup(
       JSON.stringify({ routing: { rewrites: { 'https://app.foo.com/api/*': '/api/:splat' } } }),
     );
@@ -1131,8 +939,7 @@ describe('routing rules: host-prefixed sources', () => {
     cleanup();
   });
 
-  it('accepts a fallback with https:// prefixed source', async () => {
-    const { convertFallbacksConfig } = await import('../../src/config.ts');
+  it('accepts a fallback with https:// prefixed source', () => {
     setup(JSON.stringify({ routing: { fallbacks: { 'https://app.foo.com/*': '/index.html' } } }));
     const config = readConfig(tmpDir);
     const rules = convertFallbacksConfig(config.routing?.fallbacks);
@@ -1146,8 +953,7 @@ describe('routing rules: host-prefixed sources', () => {
     cleanup();
   });
 
-  it('omits host when source is path-only', async () => {
-    const { convertRedirectsConfig } = await import('../../src/config.ts');
+  it('omits host when source is path-only', () => {
     setup(JSON.stringify({ routing: { redirects: { '/old': '/new' } } }));
     const config = readConfig(tmpDir);
     const rules = convertRedirectsConfig(config.routing?.redirects);
@@ -1185,8 +991,7 @@ describe('routing rules: host-prefixed sources', () => {
     cleanup();
   });
 
-  it('treats https://host (no path) as https://host/', async () => {
-    const { convertRedirectsConfig } = await import('../../src/config.ts');
+  it('treats https://host (no path) as https://host/', () => {
     setup(JSON.stringify({ routing: { redirects: { 'https://www.foo.com': '/x' } } }));
     const config = readConfig(tmpDir);
     const rules = convertRedirectsConfig(config.routing?.redirects);
@@ -1199,42 +1004,14 @@ describe('duplicate "*" wildcards in rule sources', () => {
   // Dispatch compiles each `*` into a `(?<splat>...)` capture group, so two
   // in one source makes `new RegExp()` throw on duplicate group name at
   // startup. Catch these at config-read time with a clear message.
-  it('rejects a redirect source with two "*"', () => {
-    setup(JSON.stringify({ routing: { redirects: { '/a/*/b/*': '/dest' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must contain at most one "*" wildcard');
-    cleanup();
-  });
-
-  it('rejects a rewrite source with two "*"', () => {
-    setup(JSON.stringify({ routing: { rewrites: { '/*/docs/*': '/dest' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must contain at most one "*" wildcard');
-    cleanup();
-  });
-
-  it('rejects a fallback source with two "*"', () => {
-    setup(JSON.stringify({ routing: { fallbacks: { '/*/*': '/index.html' } } }));
-    expect(() => readConfig(tmpDir)).toThrow('must contain at most one "*" wildcard');
-    cleanup();
-  });
-
-  it('rejects a header pattern with two "*"', () => {
-    // Multi-`*` header rules used to crash `vite dev` on the first request:
-    // the framework's emitted `__compilePattern` produced two `(?<splat>...)`
-    // capture groups, so `new RegExp()` threw "Duplicate capture group name"
-    // and every request 500'd. Validation now catches this at config-read time.
-    setup(
-      JSON.stringify({ routing: { headers: { '/assets/*/img/*': ['Cache-Control: no-cache'] } } }),
-    );
-    expect(() => readConfig(tmpDir)).toThrow('must contain at most one "*" wildcard');
-    cleanup();
-  });
-
-  it('rejects a revalidateQueryAllowlist pattern with two "*"', () => {
-    setup(
-      JSON.stringify({
-        routing: { revalidateQueryAllowlist: { '/a/*/b/*': ['q'] } },
-      }),
-    );
+  it.each<[string, Record<string, unknown>]>([
+    ['redirect source', { redirects: { '/a/*/b/*': '/dest' } }],
+    ['rewrite source', { rewrites: { '/*/docs/*': '/dest' } }],
+    ['fallback source', { fallbacks: { '/*/*': '/index.html' } }],
+    ['header pattern', { headers: { '/assets/*/img/*': ['Cache-Control: no-cache'] } }],
+    ['revalidateQueryAllowlist pattern', { revalidateQueryAllowlist: { '/a/*/b/*': ['q'] } }],
+  ])('rejects a %s with two "*"', (_kind, routing) => {
+    setup(JSON.stringify({ routing }));
     expect(() => readConfig(tmpDir)).toThrow('must contain at most one "*" wildcard');
     cleanup();
   });
@@ -1639,11 +1416,6 @@ describe('database config', () => {
     cleanup();
   });
 
-  it('defaults to sqlite for empty config', () => {
-    setup();
-    expect(getDatabaseDialect({})).toBe('sqlite');
-  });
-
   it('accepts pg', () => {
     setup(JSON.stringify({ database: 'pg' }));
     const config = readConfig(tmpDir);
diff --git a/packages/void/test/unit/db-args.test.ts b/packages/void/test/unit/db-args.test.ts
index 4c8d56a6e..8df712327 100644
--- a/packages/void/test/unit/db-args.test.ts
+++ b/packages/void/test/unit/db-args.test.ts
@@ -21,13 +21,6 @@ describe('parseDbArgs', () => {
     });
   });
 
-  it('parses seed with a TypeScript file', () => {
-    expect(parseDbArgs(['seed', '--file', 'db/seed.ts'])).toEqual({
-      action: 'seed',
-      file: 'db/seed.ts',
-    });
-  });
-
   it('parses execute with inline SQL', () => {
     expect(parseDbArgs(['execute', 'SELECT * FROM users'])).toEqual({
       action: 'execute',
@@ -101,26 +94,6 @@ describe('parseDbArgs', () => {
     });
   });
 
-  it('parses export with --output', () => {
-    expect(parseDbArgs(['export', '--output', 'backup.sql'])).toEqual({
-      action: 'export',
-      output: 'backup.sql',
-      noData: undefined,
-      noSchema: undefined,
-      table: undefined,
-    });
-  });
-
-  it('parses export with --no-data', () => {
-    expect(parseDbArgs(['export', '--no-data'])).toEqual({
-      action: 'export',
-      output: undefined,
-      noData: true,
-      noSchema: undefined,
-      table: undefined,
-    });
-  });
-
   it('parses export with --no-schema', () => {
     expect(parseDbArgs(['export', '--no-schema'])).toEqual({
       action: 'export',
@@ -131,16 +104,6 @@ describe('parseDbArgs', () => {
     });
   });
 
-  it('parses export with --table', () => {
-    expect(parseDbArgs(['export', '--table', 'users'])).toEqual({
-      action: 'export',
-      output: undefined,
-      noData: undefined,
-      noSchema: undefined,
-      table: 'users',
-    });
-  });
-
   it('parses export with all flags', () => {
     expect(
       parseDbArgs(['export', '--output', 'dump.sql', '--no-data', '--table', 'users']),
@@ -163,12 +126,6 @@ describe('parseDbArgs', () => {
     );
   });
 
-  it('errors on export with --remote combined with other flags', () => {
-    expect(() => parseDbArgs(['export', '--remote', '--output', 'dump.sql'])).toThrow(
-      '`void db export --remote` is not yet supported. Local export only for now.',
-    );
-  });
-
   it('parses studio', () => {
     expect(parseDbArgs(['studio'])).toEqual({ action: 'studio', remote: undefined });
   });
@@ -225,12 +182,6 @@ describe('parseDbArgs', () => {
     );
   });
 
-  it('errors on no subcommand', () => {
-    expect(() => parseDbArgs([])).toThrow(
-      'db: Usage: void db <push|generate|status|reset|seed|execute|migrate|studio|export|connect|set-url|rename-migrations>.',
-    );
-  });
-
   it('errors on extra positional', () => {
     expect(() => parseDbArgs(['status', 'extra'])).toThrow("db: Unexpected argument 'extra'.");
   });
diff --git a/packages/void/test/unit/db-commands.test.ts b/packages/void/test/unit/db-commands.test.ts
index 56d3ef63b..1ed02a7ee 100644
--- a/packages/void/test/unit/db-commands.test.ts
+++ b/packages/void/test/unit/db-commands.test.ts
@@ -110,84 +110,6 @@ vi.mock('@voidzero-dev/vite-plus-prompts', () => ({
   },
 }));
 
-const TMP_DIR = join(import.meta.dirname, '.tmp-db-commands-test');
-
-afterEach(() => {
-  rmSync(TMP_DIR, { recursive: true, force: true });
-});
-
-describe('getAppliedMigrations', () => {
-  it('returns [] when DB file does not exist', async () => {
-    const { getAppliedMigrations } = await import('../../src/migrations/runner.ts');
-    const result = await getAppliedMigrations(join(TMP_DIR, 'nonexistent.sqlite'));
-    expect(result).toEqual([]);
-  });
-
-  it('returns [] when _void_migrations table does not exist', async () => {
-    mkdirSync(TMP_DIR, { recursive: true });
-    const dbPath = join(TMP_DIR, 'empty.sqlite');
-
-    const Database = (await import('better-sqlite3')).default;
-    const db = new Database(dbPath);
-    db.exec('CREATE TABLE other (id INTEGER)');
-    db.close();
-
-    const { getAppliedMigrations } = await import('../../src/migrations/runner.ts');
-    const result = await getAppliedMigrations(dbPath);
-    expect(result).toEqual([]);
-  });
-
-  it('returns applied migrations sorted by name', async () => {
-    mkdirSync(TMP_DIR, { recursive: true });
-    const dbPath = join(TMP_DIR, 'migrations.sqlite');
-
-    const Database = (await import('better-sqlite3')).default;
-    const db = new Database(dbPath);
-    db.exec(`
-      CREATE TABLE _void_migrations (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);
-      INSERT INTO _void_migrations (name, applied_at) VALUES ('002_second.sql', '2025-01-02T00:00:00Z');
-      INSERT INTO _void_migrations (name, applied_at) VALUES ('001_first.sql', '2025-01-01T00:00:00Z');
-    `);
-    db.close();
-
-    const { getAppliedMigrations } = await import('../../src/migrations/runner.ts');
-    const result = await getAppliedMigrations(dbPath);
-    expect(result).toEqual([
-      { name: '001_first.sql', applied_at: '2025-01-01T00:00:00Z' },
-      { name: '002_second.sql', applied_at: '2025-01-02T00:00:00Z' },
-    ]);
-  });
-});
-
-describe('getLocalD1Target', () => {
-  it('uses .void for Void apps', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-db-persist-'));
-    try {
-      writeFileSync(join(root, 'package.json'), JSON.stringify({ dependencies: { void: '*' } }));
-
-      const { getLocalD1Target } = await import('../../src/cli/db.ts');
-      expect(getLocalD1Target(root).persistRoot).toBe(toSlash(join(root, '.void')));
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  it('uses Wrangler state for framework apps that own the Cloudflare emulator', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-db-persist-'));
-    try {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify({ dependencies: { '@sveltejs/kit': '*' } }),
-      );
-
-      const { getLocalD1Target } = await import('../../src/cli/db.ts');
-      expect(getLocalD1Target(root).persistRoot).toBe(toSlash(join(root, '.wrangler', 'state')));
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-});
-
 const rootsToClean: Array<string> = [];
 
 function createRenameProjectRoot(options: {
@@ -399,15 +321,12 @@ describe('void db reset', () => {
   });
 
   it('SQLite: catches genuine drift before rmSync (dbPath file survives)', async () => {
-    // Create a project with a journal entry that has NO matching .sql file
-    // on disk. Bootstrap cannot heal this — a journal already exists — so
-    // assertJournalCoherence must throw and nothing destructive can happen.
     const root = mkdtempSync(join(tmpdir(), 'void-reset-sqlite-'));
     rootsToClean.push(root);
 
     const migrationsDir = join(root, 'db', 'migrations');
     mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    // Journal references a file that doesn't exist on disk — genuine drift.
+    // The journal names a .sql file that is not on disk.
     writeFileSync(
       join(migrationsDir, 'meta', '_journal.json'),
       JSON.stringify({
@@ -427,26 +346,17 @@ describe('void db reset', () => {
 
     writeFileSync(join(root, 'void.json'), JSON.stringify({}));
 
-    // Set up a fake DB file that must NOT be deleted.
     const fakeDbPath = join(root, '.void', 'fake.sqlite');
     mkdirSync(join(root, '.void'), { recursive: true });
     writeFileSync(fakeDbPath, 'sentinel');
     mockGetMiniflareDatabasePath.mockReturnValue(fakeDbPath);
-
-    // If runMigrations is called, the test should fail — drift was not caught first.
     mockRunMigrations.mockRejectedValue(new Error('runMigrations should not be called'));
 
     await expect(runDbCommand(root, { action: 'reset' })).rejects.toThrow();
 
-    // The db file must still exist — nothing destructive happened.
     expect(existsSync(fakeDbPath)).toBe(true);
     expect(mockRunMigrations).not.toHaveBeenCalled();
   });
-
-  // Note: The symmetric PG path follows the same pattern — assertJournalCoherence
-  // is called before withPgClient, so the PG client is never contacted on drift.
-  // Testing it here would require a live PG connection; the SQLite test is sufficient
-  // to validate the "coherence before destructive work" invariant.
 });
 
 describe('void db status', () => {
@@ -474,17 +384,12 @@ describe('void db status', () => {
   });
 
   it('SQLite: corrupted _journal.json exits cleanly via log.error (not uncaught throw)', async () => {
-    // Regression: `readJournal` (called inside assertJournalCoherence) throws
-    // on malformed JSON. That call must live inside the try/catch so the
-    // failure routes through log.error + process.exit(1) rather than bubbling
-    // as an uncaught stack trace.
     const root = mkdtempSync(join(tmpdir(), 'void-status-corrupt-journal-'));
     rootsToClean.push(root);
 
     const migrationsDir = join(root, 'db', 'migrations');
     mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
     writeFileSync(join(migrationsDir, '0001_a.sql'), '-- a\n');
-    // Corrupted journal — invalid JSON, e.g. from a bad merge.
     writeFileSync(join(migrationsDir, 'meta', '_journal.json'), '{invalid');
     writeFileSync(join(root, 'void.json'), JSON.stringify({}));
 
@@ -503,8 +408,7 @@ describe('void db rename-migrations', () => {
     vi.clearAllMocks();
     // Return a path that does NOT exist so the SQLite tracking branch no-ops.
     mockGetMiniflareDatabasePath.mockReturnValue(join(tmpdir(), 'nonexistent-void-rename.sqlite'));
-    // Reinstall default implementations — `mockReset` in `afterEach`
-    // clears them between tests.
+    // afterEach resets these mocks, so reinstall the defaults.
     mockGetToken.mockImplementation(() => null);
     mockReadProjectConfig.mockImplementation(() => null);
     mockRenameMigrations.mockReset();
@@ -529,28 +433,22 @@ describe('void db rename-migrations', () => {
     }
   });
 
-  it('rewrites journal tags to match renamed files (sqlite)', async () => {
+  it('renames .sql files, journal tags and snapshots together (sqlite)', async () => {
     const root = createRenameProjectRoot({
       files: {
         '0001_a.sql': '-- a\n',
         '0002_b.sql': '-- b\n',
       },
     });
-    // Journal-backed projects must have matching snapshots on
-    // disk. Seed them so the pre-rename gate passes.
-    const migrationsDirForSnapshots = join(root, 'db', 'migrations');
-    writeFileSync(
-      join(migrationsDirForSnapshots, 'meta', '0001_snapshot.json'),
-      '{"id":"snap-a","prevId":null}',
-    );
-    writeFileSync(
-      join(migrationsDirForSnapshots, 'meta', '0002_snapshot.json'),
-      '{"id":"snap-b","prevId":"snap-a"}',
-    );
+    const migrationsDir = join(root, 'db', 'migrations');
+    const metaDir = join(migrationsDir, 'meta');
+    const snapshotContentsA = '{"id":"snap-a","prevId":null}';
+    const snapshotContentsB = '{"id":"snap-b","prevId":"snap-a"}';
+    writeFileSync(join(metaDir, '0001_snapshot.json'), snapshotContentsA);
+    writeFileSync(join(metaDir, '0002_snapshot.json'), snapshotContentsB);
 
     await runDbCommand(root, { action: 'rename-migrations' });
 
-    const migrationsDir = join(root, 'db', 'migrations');
     const files = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
@@ -558,19 +456,28 @@ describe('void db rename-migrations', () => {
     expect(files[0]).toMatch(/^\d{14}_a\.sql$/);
     expect(files[1]).toMatch(/^\d{14}_b\.sql$/);
 
-    const journal = JSON.parse(readFileSync(join(migrationsDir, 'meta', '_journal.json'), 'utf-8'));
+    const journal = JSON.parse(readFileSync(join(metaDir, '_journal.json'), 'utf-8'));
     expect(journal.version).toBe('7');
     expect(journal.dialect).toBe('sqlite');
     expect(journal.entries).toHaveLength(2);
     const tagsOnDisk = files.map((f) => f.replace(/\.sql$/, ''));
     expect(journal.entries.map((e: { tag: string }) => e.tag).sort()).toEqual(tagsOnDisk.sort());
-    // idx preserved
     expect(journal.entries[0].idx).toBe(0);
     expect(journal.entries[1].idx).toBe(1);
-    // when preserved (original fixture values)
     expect(journal.entries[0].when).toBe(1_700_000_000_000);
     expect(journal.entries[1].when).toBe(1_700_000_000_001);
 
+    // Drizzle-kit names a snapshot after the tag's part before the first underscore.
+    const [prefixA, prefixB] = tagsOnDisk.map((tag) => tag.split('_')[0]);
+    const snapshots = readdirSync(metaDir).filter((f) => f.endsWith('_snapshot.json'));
+    expect(snapshots.sort()).toEqual([`${prefixA}_snapshot.json`, `${prefixB}_snapshot.json`]);
+    expect(readFileSync(join(metaDir, `${prefixA}_snapshot.json`), 'utf-8')).toBe(
+      snapshotContentsA,
+    );
+    expect(readFileSync(join(metaDir, `${prefixB}_snapshot.json`), 'utf-8')).toBe(
+      snapshotContentsB,
+    );
+
     const { collectMigrations } = await import('../../src/migrations/collect.ts');
     const { assertJournalCoherence } = await import('../../src/migrations/validate.ts');
     expect(() =>
@@ -579,11 +486,6 @@ describe('void db rename-migrations', () => {
   });
 
   it('renames legacy bare projects without a journal (no _journal.json, no snapshots)', async () => {
-    // Legacy projects carry hand-written `.sql` files plus a tracking row
-    // in `_void_migrations`, but no `meta/_journal.json` and no snapshots.
-    // `rename-migrations` must still be usable on those projects — it
-    // renames the files, updates the tracking rows, and skips the journal/
-    // snapshot rewrite steps cleanly (no journal is created).
     const root = createRenameProjectRoot({
       files: {
         '0001_a.sql': '-- a\n',
@@ -596,8 +498,6 @@ describe('void db rename-migrations', () => {
     const journalPathOnDisk = join(migrationsDir, 'meta', '_journal.json');
     expect(existsSync(journalPathOnDisk)).toBe(false);
 
-    // Seed a real SQLite file with a `_void_migrations` tracking table so we
-    // can assert the tracking rows get rewritten even without a journal.
     const Database = (await import('better-sqlite3')).default;
     const dbPath = join(root, '.void', 'legacy.sqlite');
     mkdirSync(join(root, '.void'), { recursive: true });
@@ -612,7 +512,6 @@ describe('void db rename-migrations', () => {
 
     await runDbCommand(root, { action: 'rename-migrations' });
 
-    // Files got renamed to timestamp-prefixed tags.
     const files = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
@@ -620,15 +519,12 @@ describe('void db rename-migrations', () => {
     expect(files[0]).toMatch(/^\d{14}_a\.sql$/);
     expect(files[1]).toMatch(/^\d{14}_b\.sql$/);
 
-    // No journal file was synthesized — legacy projects stay legacy.
     expect(existsSync(journalPathOnDisk)).toBe(false);
-    // Nothing landed in meta/ either.
     const metaDir = join(migrationsDir, 'meta');
     if (existsSync(metaDir)) {
       expect(readdirSync(metaDir)).toEqual([]);
     }
 
-    // Tracking rows were updated to match the new filenames.
     const verify = new Database(dbPath);
     const names = verify.prepare('SELECT name FROM _void_migrations ORDER BY name').all() as Array<{
       name: string;
@@ -639,44 +535,6 @@ describe('void db rename-migrations', () => {
     expect(names[1].name).toMatch(/^\d{14}_b\.sql$/);
   }, 15_000);
 
-  it('restores original journal bytes when writeJournal itself fails', async () => {
-    const root = createRenameProjectRoot({
-      files: {
-        '0001_a.sql': '-- a\n',
-        '0002_b.sql': '-- b\n',
-      },
-    });
-
-    const migrationsDir = join(root, 'db', 'migrations');
-    // Seed snapshots so the pre-rename gate passes and we
-    // actually exercise the `writeJournal` failure path below.
-    writeFileSync(join(migrationsDir, 'meta', '0001_snapshot.json'), '{"id":"snap-a"}');
-    writeFileSync(join(migrationsDir, 'meta', '0002_snapshot.json'), '{"id":"snap-b"}');
-    const journalPathOnDisk = join(migrationsDir, 'meta', '_journal.json');
-    const originalJournalBytes = readFileSync(journalPathOnDisk);
-
-    // Force `writeJournal` to throw during the rename flow. With the
-    // current rollback semantics, the snapshot must still be restored
-    // byte-for-byte even though the mutation never completed.
-    mockWriteJournal.mockImplementation(() => {
-      throw new Error('simulated writeJournal failure');
-    });
-
-    await expect(runDbCommand(root, { action: 'rename-migrations' })).rejects.toThrow(
-      'process.exit:1',
-    );
-
-    // Files reverted to original names.
-    const files = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(files).toEqual(['0001_a.sql', '0002_b.sql']);
-
-    // Journal restored byte-for-byte.
-    const afterBytes = readFileSync(journalPathOnDisk);
-    expect(afterBytes.equals(originalJournalBytes)).toBe(true);
-  });
-
   it('restores journal on rollback when sqlite tracking update fails', async () => {
     const root = createRenameProjectRoot({
       files: {
@@ -686,20 +544,17 @@ describe('void db rename-migrations', () => {
     });
 
     const migrationsDir = join(root, 'db', 'migrations');
-    // Seed snapshots so the pre-rename gate passes and we
-    // actually reach the sqlite tracking-table branch below.
     writeFileSync(join(migrationsDir, 'meta', '0001_snapshot.json'), '{"id":"snap-a"}');
     writeFileSync(join(migrationsDir, 'meta', '0002_snapshot.json'), '{"id":"snap-b"}');
     const journalPathOnDisk = join(migrationsDir, 'meta', '_journal.json');
     const originalJournalBytes = readFileSync(journalPathOnDisk);
 
-    // Create a fake sqlite DB file so the SQLite branch runs.
+    // The SQLite tracking branch runs only when the database file exists.
     const fakeDbPath = join(root, '.void', 'fake.sqlite');
     mkdirSync(join(root, '.void'), { recursive: true });
     writeFileSync(fakeDbPath, '');
     mockGetMiniflareDatabasePath.mockReturnValue(fakeDbPath);
 
-    // Force the tracking-table update to blow up.
     mockOpenSqliteDatabase.mockImplementation(() => {
       throw new Error('boom');
     });
@@ -708,99 +563,16 @@ describe('void db rename-migrations', () => {
       'process.exit:1',
     );
 
-    // Files reverted to original names.
     const files = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
     expect(files).toEqual(['0001_a.sql', '0002_b.sql']);
 
-    // Journal restored byte-for-byte.
     const afterBytes = readFileSync(journalPathOnDisk);
     expect(afterBytes.equals(originalJournalBytes)).toBe(true);
   });
 
-  it('renames meta/*_snapshot.json alongside .sql files', async () => {
-    // Drizzle-kit stores snapshots at `meta/<tag-prefix>_snapshot.json`
-    // where the prefix is everything before the first underscore in the
-    // journal entry's tag. Renaming the .sql file without renaming the
-    // snapshot leaves drop/rollback tooling looking for the wrong path, so
-    // `rename-migrations` must rename both in lockstep.
-    const root = createRenameProjectRoot({
-      files: {
-        '0001_a.sql': '-- a\n',
-        '0002_b.sql': '-- b\n',
-      },
-    });
-
-    const migrationsDir = join(root, 'db', 'migrations');
-    const snapshotContentsA = '{"id":"snap-a","prevId":null}';
-    const snapshotContentsB = '{"id":"snap-b","prevId":"snap-a"}';
-    writeFileSync(join(migrationsDir, 'meta', '0001_snapshot.json'), snapshotContentsA);
-    writeFileSync(join(migrationsDir, 'meta', '0002_snapshot.json'), snapshotContentsB);
-
-    await runDbCommand(root, { action: 'rename-migrations' });
-
-    // SQL files got timestamp prefixes.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toHaveLength(2);
-    const tagA = sqlFiles[0].replace(/\.sql$/, '');
-    const tagB = sqlFiles[1].replace(/\.sql$/, '');
-    const prefixA = tagA.split('_')[0];
-    const prefixB = tagB.split('_')[0];
-    expect(prefixA).toMatch(/^\d{14}$/);
-    expect(prefixB).toMatch(/^\d{14}$/);
-
-    // The old snapshot paths no longer exist.
-    const metaDir = join(migrationsDir, 'meta');
-    expect(existsSync(join(metaDir, '0001_snapshot.json'))).toBe(false);
-    expect(existsSync(join(metaDir, '0002_snapshot.json'))).toBe(false);
-
-    // The new snapshot paths exist and carry the original bytes.
-    const newSnapshotA = join(metaDir, `${prefixA}_snapshot.json`);
-    const newSnapshotB = join(metaDir, `${prefixB}_snapshot.json`);
-    expect(existsSync(newSnapshotA)).toBe(true);
-    expect(existsSync(newSnapshotB)).toBe(true);
-    expect(readFileSync(newSnapshotA, 'utf-8')).toBe(snapshotContentsA);
-    expect(readFileSync(newSnapshotB, 'utf-8')).toBe(snapshotContentsB);
-  });
-
-  it('renames journal-backed projects when matching snapshots are present', async () => {
-    // Positive coverage for the round-29 gate: a journal-backed project
-    // with all snapshots present on disk renames cleanly and does not
-    // invent spurious snapshot files along the way.
-    const root = createRenameProjectRoot({
-      files: {
-        '0001_a.sql': '-- a\n',
-      },
-    });
-    const migrationsDir = join(root, 'db', 'migrations');
-    writeFileSync(
-      join(migrationsDir, 'meta', '0001_snapshot.json'),
-      '{"id":"snap-a","prevId":null}',
-    );
-
-    await runDbCommand(root, { action: 'rename-migrations' });
-
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toHaveLength(1);
-    expect(sqlFiles[0]).toMatch(/^\d{14}_a\.sql$/);
-
-    // Exactly one snapshot file exists, under the new timestamp prefix.
-    const metaFiles = readdirSync(join(migrationsDir, 'meta'));
-    const snapshots = metaFiles.filter((f) => f.endsWith('_snapshot.json')).sort();
-    expect(snapshots).toHaveLength(1);
-    expect(snapshots[0]).toMatch(/^\d{14}_snapshot\.json$/);
-  });
-
   it('renames bare-legacy placeholder journal projects (empty entries, no snapshots)', async () => {
-    // The kitchen-sink playground ships a placeholder journal of the
-    // form `{"version":"7","dialect":"sqlite","entries":[]}` with no
-    // `meta/*_snapshot.json` files. `assertJournalCoherence` treats that
-    // shape as bare-legacy, so the pre-rename snapshot gate must not run.
     const root = mkdtempSync(join(tmpdir(), 'void-rename-placeholder-'));
     rootsToClean.push(root);
 
@@ -808,20 +580,18 @@ describe('void db rename-migrations', () => {
     mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
     writeFileSync(join(migrationsDir, '0000_foo.sql'), '-- foo\n');
     writeFileSync(join(migrationsDir, '0001_bar.sql'), '-- bar\n');
-    // Placeholder journal: parseable, well-formed, empty entries.
+    // An empty placeholder journal counts as bare legacy, so the snapshot check is skipped.
     writeFileSync(
       join(migrationsDir, 'meta', '_journal.json'),
       JSON.stringify({ version: '7', dialect: 'sqlite', entries: [] }, null, 2) + '\n',
     );
     writeFileSync(join(root, 'void.json'), JSON.stringify({}));
 
-    // Sanity: no snapshot files seeded, no migrations.js.
     expect(readdirSync(join(migrationsDir, 'meta'))).toEqual(['_journal.json']);
     expect(existsSync(join(migrationsDir, 'migrations.js'))).toBe(false);
 
     await runDbCommand(root, { action: 'rename-migrations' });
 
-    // Files were renamed to timestamp-prefixed tags.
     const sqlFiles = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
@@ -829,90 +599,13 @@ describe('void db rename-migrations', () => {
     expect(sqlFiles[0]).toMatch(/^\d{14}_foo\.sql$/);
     expect(sqlFiles[1]).toMatch(/^\d{14}_bar\.sql$/);
 
-    // No "missing snapshot" error was logged — the gate was skipped.
     const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
     expect(errorMessages).not.toContain('snapshot files are missing');
     expect(errorMessages).not.toContain('drizzle-managed project');
   });
 
-  it('refuses to rename when _journal.json is missing but meta/*_snapshot.json is present', async () => {
-    // Regression: `rename-migrations` used to key its legacy bypass solely
-    // on the absence of `_journal.json`. If a user lost the journal in a
-    // merge but the drizzle snapshots stayed behind, the command ran to
-    // completion, renamed the files, and reported success — after which
-    // every subsequent `void db status`/`migrate`/`deploy` failed because
-    // `assertJournalCoherence` treats that exact shape as partial drizzle
-    // state. Refuse up front with the same phrasing, before any file
-    // mutation or remote call.
-    const root = createRenameProjectRoot({
-      files: {
-        '0001_old.sql': '-- old\n',
-      },
-      withJournal: false,
-    });
-    const migrationsDir = join(root, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const snapshotPath = join(migrationsDir, 'meta', '0000_silent_the_anarchist_snapshot.json');
-    writeFileSync(snapshotPath, JSON.stringify({ id: 'snap-0000', prevId: null }));
-
-    await expect(runDbCommand(root, { action: 'rename-migrations' })).rejects.toThrow(
-      'process.exit:1',
-    );
-
-    // No files were renamed — the lone .sql is still on disk under its
-    // original numeric prefix.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toEqual(['0001_old.sql']);
-    // The snapshot is still there too.
-    expect(existsSync(snapshotPath)).toBe(true);
-
-    // The error message calls out the partial state AND the snapshot path.
-    const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('partial drizzle-kit state');
-    expect(errorMessages).toContain('db/migrations/meta/0000_silent_the_anarchist_snapshot.json');
-  });
-
-  it('refuses to rename when _journal.json is missing but migrations.js is present', async () => {
-    // Symmetric to the snapshot case above, but for drizzle-kit's bundled
-    // mode. A `migrations.js` on disk without a journal is still a
-    // partial drizzle-kit state — refuse consistently.
-    const root = createRenameProjectRoot({
-      files: {
-        '0001_old.sql': '-- old\n',
-      },
-      withJournal: false,
-    });
-    const migrationsDir = join(root, 'db', 'migrations');
-    const bundledPath = join(migrationsDir, 'migrations.js');
-    writeFileSync(bundledPath, 'export default {};\n');
-
-    await expect(runDbCommand(root, { action: 'rename-migrations' })).rejects.toThrow(
-      'process.exit:1',
-    );
-
-    // Nothing got renamed.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toEqual(['0001_old.sql']);
-    expect(existsSync(bundledPath)).toBe(true);
-
-    const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('partial drizzle-kit state');
-    expect(errorMessages).toContain('db/migrations/migrations.js');
-  });
-
   it('refuses to rename when db/migrations has journal/file drift (missing .sql)', async () => {
-    // Seed a journal with two entries but only one matching `.sql` file on
-    // disk. `assertJournalCoherence` rejects that shape across the rest of
-    // the CLI; `rename-migrations` must refuse with the same drift error
-    // BEFORE any file rename, journal rewrite, or remote call. Previously
-    // the command checked only the partial-state shape (missing journal +
-    // leftover artifacts) and happily renamed the one matching file,
-    // leaving the user with new timestamped filenames that were harder to
-    // reconcile against the stale journal entry.
+    // The journal lists 0002_second, which is not on disk.
     const root = createRenameProjectRoot({
       files: {
         '0001_first.sql': '-- first\n',
@@ -937,93 +630,24 @@ describe('void db rename-migrations', () => {
     const migrationsDir = join(root, 'db', 'migrations');
     const journalPathOnDisk = join(migrationsDir, 'meta', '_journal.json');
     const originalJournalBytes = readFileSync(journalPathOnDisk);
-    const filesBefore = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
 
     await expect(runDbCommand(root, { action: 'rename-migrations' })).rejects.toThrow(
       'process.exit:1',
     );
 
-    // File list is byte-identical to what we seeded.
     const filesAfter = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
-    expect(filesAfter).toEqual(filesBefore);
     expect(filesAfter).toEqual(['0001_first.sql']);
-
-    // Journal bytes are untouched — no partial rewrite.
     expect(readFileSync(journalPathOnDisk).equals(originalJournalBytes)).toBe(true);
 
-    // No tracking-table update, no remote call, no journal write was attempted.
-    expect(mockOpenSqliteDatabase).not.toHaveBeenCalled();
-    expect(mockWriteJournal).not.toHaveBeenCalled();
-
-    // Error message calls out drift AND names the missing file.
     const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
     expect(errorMessages).toContain('Migration drift detected');
     expect(errorMessages).toContain('db/migrations/0002_second.sql');
   });
 
-  it('refuses to rename when disk has an orphan .sql file not in journal', async () => {
-    // Symmetric to the missing-file drift case: seed one journal entry but
-    // two `.sql` files on disk. The extra file is an orphan drizzle-kit
-    // never saw; renaming it would dress it up with a timestamp prefix and
-    // leave the orphan state intact. Refuse up front via
-    // `assertJournalCoherence`, same as the rest of the CLI.
-    const root = createRenameProjectRoot({
-      files: {
-        '0001_first.sql': '-- first\n',
-        '0002_orphan.sql': '-- orphan\n',
-      },
-      journalEntries: [
-        {
-          idx: 0,
-          version: '7',
-          when: 1_700_000_000_000,
-          tag: '0001_first',
-          breakpoints: true,
-        },
-      ],
-    });
-    const migrationsDir = join(root, 'db', 'migrations');
-    const journalPathOnDisk = join(migrationsDir, 'meta', '_journal.json');
-    const originalJournalBytes = readFileSync(journalPathOnDisk);
-    const filesBefore = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-
-    await expect(runDbCommand(root, { action: 'rename-migrations' })).rejects.toThrow(
-      'process.exit:1',
-    );
-
-    // Both files remain on disk under their original numeric prefixes.
-    const filesAfter = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(filesAfter).toEqual(filesBefore);
-    expect(filesAfter).toEqual(['0001_first.sql', '0002_orphan.sql']);
-
-    // Journal bytes untouched.
-    expect(readFileSync(journalPathOnDisk).equals(originalJournalBytes)).toBe(true);
-
-    // No tracking-table update, no remote call, no journal write.
-    expect(mockOpenSqliteDatabase).not.toHaveBeenCalled();
-    expect(mockWriteJournal).not.toHaveBeenCalled();
-
-    // Error message calls out drift AND names the orphan file.
-    const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('Migration drift detected');
-    expect(errorMessages).toContain('db/migrations/0002_orphan.sql');
-  });
-
   it('refuses to rename when db/migrations/migrations.js is present (bundled mode)', async () => {
-    // A drizzle-kit bundled project has BOTH `_journal.json` AND
-    // `db/migrations/migrations.js`. The journal is valid, so the
-    // partial-state guard above does NOT fire — only the bundled-mode
-    // guard does. Renaming the .sql files in bundled mode would break the
-    // static imports inside `migrations.js` at runtime, so refuse up
-    // front with an actionable recovery path before touching anything.
+    // The journal is coherent, so only the bundled-mode guard can stop this rename.
     const root = createRenameProjectRoot({
       files: {
         '0001_a.sql': '-- a\n',
@@ -1046,32 +670,24 @@ describe('void db rename-migrations', () => {
       'process.exit:1',
     );
 
-    // Files are untouched — nothing was renamed.
     const sqlFiles = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
     expect(sqlFiles).toEqual(['0001_a.sql', '0002_b.sql']);
 
-    // Journal bytes unchanged.
     expect(readFileSync(journalPathOnDisk).equals(originalJournalBytes)).toBe(true);
-    // Bundle file is still there, unchanged.
     expect(existsSync(bundledPath)).toBe(true);
     expect(readFileSync(bundledPath).equals(originalBundleBytes)).toBe(true);
 
-    // No remote calls / tracking-table updates were attempted.
     expect(mockOpenSqliteDatabase).not.toHaveBeenCalled();
     expect(mockWriteJournal).not.toHaveBeenCalled();
 
-    // Error message calls out the bundled format and the recovery path.
     const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
     expect(errorMessages).toMatch(/bundled migration format/);
     expect(errorMessages).toContain('db/migrations/migrations.js');
   });
 
-  it('rollback restores snapshot filenames when journal rewrite fails', async () => {
-    // Seed snapshots alongside the .sql files, then force `writeJournal` to
-    // throw. Rollback must reverse both the .sql renames AND the snapshot
-    // renames, leaving the filesystem exactly as it was before.
+  it('rollback restores .sql names, snapshots and journal bytes when the journal rewrite fails', async () => {
     const root = createRenameProjectRoot({
       files: {
         '0001_a.sql': '-- a\n',
@@ -1088,8 +704,6 @@ describe('void db rename-migrations', () => {
     const journalPathOnDisk = join(migrationsDir, 'meta', '_journal.json');
     const originalJournalBytes = readFileSync(journalPathOnDisk);
 
-    // Force the journal rewrite to fail after the file (and snapshot)
-    // renames have happened, so we exercise the full rollback path.
     mockWriteJournal.mockImplementation(() => {
       throw new Error('simulated writeJournal failure');
     });
@@ -1098,92 +712,21 @@ describe('void db rename-migrations', () => {
       'process.exit:1',
     );
 
-    // SQL files reverted to original names.
     const sqlFiles = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
     expect(sqlFiles).toEqual(['0001_a.sql', '0002_b.sql']);
 
-    // Snapshot files restored to original paths with original contents.
     const metaDir = join(migrationsDir, 'meta');
-    expect(existsSync(join(metaDir, '0001_snapshot.json'))).toBe(true);
-    expect(existsSync(join(metaDir, '0002_snapshot.json'))).toBe(true);
     expect(readFileSync(join(metaDir, '0001_snapshot.json'), 'utf-8')).toBe(snapshotContentsA);
     expect(readFileSync(join(metaDir, '0002_snapshot.json'), 'utf-8')).toBe(snapshotContentsB);
-
-    // No stray timestamp-prefixed snapshot paths linger.
     const allSnapshots = readdirSync(metaDir).filter((f) => f.endsWith('_snapshot.json'));
     expect(allSnapshots.sort()).toEqual(['0001_snapshot.json', '0002_snapshot.json']);
 
-    // Journal restored byte-for-byte.
-    expect(readFileSync(journalPathOnDisk).equals(originalJournalBytes)).toBe(true);
-  });
-
-  it('refuses to rename when a journal-backed snapshot is missing', async () => {
-    // Journal-backed project where the snapshot for one of the tags has
-    // disappeared (bad merge, hand cleanup). Renaming would leave the
-    // snapshot chain broken for the next `void gen migration` or
-    // `void db generate`, so the command refuses BEFORE any rename happens.
-    const root = createRenameProjectRoot({
-      files: {
-        '0000_foo.sql': '-- foo\n',
-        '0001_bar.sql': '-- bar\n',
-      },
-    });
-
-    const migrationsDir = join(root, 'db', 'migrations');
-    const metaDir = join(migrationsDir, 'meta');
-    // 0000_snapshot.json present, 0001_snapshot.json deliberately missing.
-    writeFileSync(join(metaDir, '0000_snapshot.json'), '{"id":"snap-0000","prevId":null}');
-
-    const journalPathOnDisk = join(metaDir, '_journal.json');
-    const originalJournalBytes = readFileSync(journalPathOnDisk);
-    const filesBefore = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-
-    await expect(runDbCommand(root, { action: 'rename-migrations' })).rejects.toThrow(
-      'process.exit:1',
-    );
-
-    // Neither .sql file was renamed — both are still on disk under
-    // their original numeric prefixes.
-    const filesAfter = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(filesAfter).toEqual(filesBefore);
-    expect(filesAfter).toEqual(['0000_foo.sql', '0001_bar.sql']);
-
-    // The journal file is byte-unchanged from the original.
     expect(readFileSync(journalPathOnDisk).equals(originalJournalBytes)).toBe(true);
-
-    // No tracking-table update, no journal rewrite was attempted.
-    expect(mockOpenSqliteDatabase).not.toHaveBeenCalled();
-    expect(mockWriteJournal).not.toHaveBeenCalled();
-
-    // The error message calls out the missing snapshot path.
-    const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('snapshot files are missing');
-    expect(errorMessages).toContain('db/migrations/meta/0001_snapshot.json');
   });
 
-  it('runs the snapshot preflight BEFORE mutating the remote (linked project)', async () => {
-    // Regression: `runRenameMigrations` used to call
-    // `client.renameMigrations` FIRST and then run the snapshot preflight
-    // gate, meaning a missing snapshot left the remote mutated while
-    // nothing locally changed. The best-effort `reverseRemote()` rollback
-    // could then fail transiently and leave the project in a divergent
-    // state. The fix hoists the preflight above the remote call so the
-    // remote is mutated only after the local state is verified safe.
-    //
-    // This test simulates a linked project (`getToken` + `readProjectConfig`
-    // both return values) with a journal-backed layout where one snapshot
-    // is missing. `client.renameMigrations` is wired to throw if it ever
-    // runs. We assert:
-    //   1. `process.exit(1)` fires with the missing-snapshot error.
-    //   2. `client.renameMigrations` was NEVER called.
-    //   3. The on-disk state is byte-identical to the seed (no local
-    //      mutation either — the preflight runs before file renames too).
+  it('refuses a missing snapshot before renaming remote records (linked project)', async () => {
     mockGetToken.mockReturnValue('test-token');
     mockReadProjectConfig.mockReturnValue({ projectId: 'proj-under-test', slug: 'under-test' });
     mockRenameMigrations.mockImplementation(() => {
@@ -1199,36 +742,25 @@ describe('void db rename-migrations', () => {
 
     const migrationsDir = join(root, 'db', 'migrations');
     const metaDir = join(migrationsDir, 'meta');
-    // Seed only one of the two required snapshots — 0001 is deliberately
-    // absent so the preflight bails.
+    // 0001_snapshot.json is missing.
     writeFileSync(join(metaDir, '0000_snapshot.json'), '{"id":"snap-0000","prevId":null}');
 
     const journalPathOnDisk = join(metaDir, '_journal.json');
     const originalJournalBytes = readFileSync(journalPathOnDisk);
-    const filesBefore = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
 
     await expect(runDbCommand(root, { action: 'rename-migrations' })).rejects.toThrow(
       'process.exit:1',
     );
 
-    // `client.renameMigrations` was never invoked — the preflight ran
-    // first and refused to proceed.
     expect(mockRenameMigrations).not.toHaveBeenCalled();
 
-    // Local filesystem is byte-identical to the seed: no .sql renames,
-    // no journal rewrite, no snapshot renames.
     const filesAfter = readdirSync(migrationsDir)
       .filter((f) => f.endsWith('.sql'))
       .sort();
-    expect(filesAfter).toEqual(filesBefore);
     expect(filesAfter).toEqual(['0000_foo.sql', '0001_bar.sql']);
     expect(readFileSync(journalPathOnDisk).equals(originalJournalBytes)).toBe(true);
-    // The one snapshot we did seed is still there under its original name.
     expect(existsSync(join(metaDir, '0000_snapshot.json'))).toBe(true);
 
-    // Error message names the missing snapshot file.
     const errorMessages = mockLog.error.mock.calls.map((call) => String(call[0])).join('\n');
     expect(errorMessages).toContain('snapshot files are missing');
     expect(errorMessages).toContain('db/migrations/meta/0001_snapshot.json');
diff --git a/packages/void/test/unit/db-execute-remote.test.ts b/packages/void/test/unit/db-execute-remote.test.ts
index 0361f32ca..86dd640f0 100644
--- a/packages/void/test/unit/db-execute-remote.test.ts
+++ b/packages/void/test/unit/db-execute-remote.test.ts
@@ -1,13 +1,10 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 
-// ---- hoisted mocks ---------------------------------------------------------
-
 const mockGetToken = vi.fn<() => string | null>(() => null);
 const mockReadProjectConfig = vi.fn<() => { projectId: string; slug: string } | null>(() => null);
-const mockIsStagingMode = vi.fn<() => boolean>(() => false);
 const mockGetProxyUrl = vi.fn<() => string>(() => 'https://proxy.void.cloud');
 
 const mockGetResources = vi.fn<() => Promise<Array<{ type: string; binding_name: string }>>>(() =>
@@ -19,13 +16,11 @@ const mockEnsurePlatformAccessToken = vi.fn();
 vi.mock('../../src/cli/auth', () => ({
   getProxyUrl: () => mockGetProxyUrl(),
   getToken: () => mockGetToken(),
-  isStagingMode: () => mockIsStagingMode(),
 }));
 
 vi.mock('../../src/cli/project', () => ({
   readProjectConfig: () => mockReadProjectConfig(),
   readDeploymentPlatform: () => 'void',
-  isVoidInternalStaging: () => false,
 }));
 
 vi.mock('../../src/cli/client', () => ({
@@ -89,33 +84,18 @@ vi.mock('@voidzero-dev/vite-plus-prompts', () => ({
   },
 }));
 
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
 const roots: Array<string> = [];
 
 function createProjectRoot(options: { database?: 'pg'; d1Binding?: string } = {}): string {
   const root = mkdtempSync(join(tmpdir(), 'void-db-execute-remote-'));
   roots.push(root);
 
-  const migrationsDir = join(root, 'db', 'migrations');
-  mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-
   const voidConfig: Record<string, unknown> = options.database === 'pg' ? { database: 'pg' } : {};
   if (options.d1Binding) {
     voidConfig.inference = { bindings: { db: options.d1Binding } };
   }
   writeFileSync(join(root, 'void.json'), JSON.stringify(voidConfig));
 
-  // .void/project.json to satisfy readProjectConfig (the REAL one is mocked,
-  // so this is just to ensure the root is a plausible project dir)
-  mkdirSync(join(root, '.void'), { recursive: true });
-  writeFileSync(
-    join(root, '.void', 'project.json'),
-    JSON.stringify({ projectId: 'proj-abc', slug: 'test-proj' }),
-  );
-
   return root;
 }
 
@@ -126,10 +106,6 @@ function jsonResponse(body: unknown, status = 200): Response {
   });
 }
 
-// ---------------------------------------------------------------------------
-// Suite
-// ---------------------------------------------------------------------------
-
 describe('void db execute --remote (D1)', () => {
   let runDbCommand: typeof import('../../src/cli/db.ts').runDbCommand;
 
@@ -140,13 +116,9 @@ describe('void db execute --remote (D1)', () => {
 
     mockGetToken.mockReturnValue('test-token');
     mockReadProjectConfig.mockReturnValue({ projectId: 'proj-abc', slug: 'test-proj' });
-    mockIsStagingMode.mockReturnValue(false);
-    mockGetProxyUrl.mockImplementation(() =>
-      mockIsStagingMode() ? 'https://proxy.staging.void.cloud' : 'https://proxy.void.cloud',
-    );
+    mockGetProxyUrl.mockReturnValue('https://proxy.void.cloud');
     mockGetResources.mockResolvedValue([]);
     mockEnsurePlatformAccessToken.mockReset();
-    // By default, confirm returns true (proceed)
     mockConfirm.mockResolvedValue(true);
     mockIsCancel.mockImplementation((v) => typeof v === 'symbol');
 
@@ -193,43 +165,26 @@ describe('void db execute --remote (D1)', () => {
     });
   });
 
-  it('uses the staging proxy URL when in staging mode', async () => {
-    const root = createProjectRoot();
-    mockIsStagingMode.mockReturnValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true });
-
-    const [url] = fetchMock.mock.calls[0] as [string, RequestInit];
-    expect(url).toBe('https://proxy.staging.void.cloud/d1/query');
-  });
-
   it('sends custom platform credentials only to its pinned proxy', async () => {
     const root = createProjectRoot();
     const proxyOrigin = 'https://void-company-proxy.example.workers.dev';
     mockGetProxyUrl.mockReturnValue(proxyOrigin);
-    const saved = process.env.VOID_ACCESS_CREDENTIALS;
-    process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-      'https://api.void.cloud': {
-        CF_ACCESS_CLIENT_ID: 'api-id',
-        CF_ACCESS_CLIENT_SECRET: 'api-secret',
-      },
-      [proxyOrigin]: {
-        CF_ACCESS_CLIENT_ID: 'proxy-id',
-        CF_ACCESS_CLIENT_SECRET: 'proxy-secret',
-      },
-    });
+    vi.stubEnv(
+      'VOID_ACCESS_CREDENTIALS',
+      JSON.stringify({
+        'https://api.void.cloud': {
+          CF_ACCESS_CLIENT_ID: 'api-id',
+          CF_ACCESS_CLIENT_SECRET: 'api-secret',
+        },
+        [proxyOrigin]: {
+          CF_ACCESS_CLIENT_ID: 'proxy-id',
+          CF_ACCESS_CLIENT_SECRET: 'proxy-secret',
+        },
+      }),
+    );
     fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
 
-    try {
-      await runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true });
-    } finally {
-      if (saved === undefined) {
-        delete process.env.VOID_ACCESS_CREDENTIALS;
-      } else {
-        process.env.VOID_ACCESS_CREDENTIALS = saved;
-      }
-    }
+    await runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true });
 
     expect(fetchMock.mock.calls[0]?.[0]).toBe(
       'https://void-company-proxy.example.workers.dev/d1/query',
@@ -244,14 +199,15 @@ describe('void db execute --remote (D1)', () => {
     const root = createProjectRoot();
     const proxyOrigin = 'https://proxy.example.com';
     mockGetProxyUrl.mockReturnValue(proxyOrigin);
-    const saved = process.env.VOID_ACCESS_CREDENTIALS;
-    process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-      [proxyOrigin]: { CF_ACCESS_TOKEN: 'stale-user-token' },
-    });
+    vi.stubEnv(
+      'VOID_ACCESS_CREDENTIALS',
+      JSON.stringify({ [proxyOrigin]: { CF_ACCESS_TOKEN: 'stale-user-token' } }),
+    );
     mockEnsurePlatformAccessToken.mockImplementation(() => {
-      process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-        [proxyOrigin]: { CF_ACCESS_TOKEN: 'fresh-user-token' },
-      });
+      vi.stubEnv(
+        'VOID_ACCESS_CREDENTIALS',
+        JSON.stringify({ [proxyOrigin]: { CF_ACCESS_TOKEN: 'fresh-user-token' } }),
+      );
     });
     const challengeLocation =
       'https://team.cloudflareaccess.com/cdn-cgi/access/login/proxy.example.com';
@@ -261,15 +217,7 @@ describe('void db execute --remote (D1)', () => {
       )
       .mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
 
-    try {
-      await runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true });
-    } finally {
-      if (saved === undefined) {
-        delete process.env.VOID_ACCESS_CREDENTIALS;
-      } else {
-        process.env.VOID_ACCESS_CREDENTIALS = saved;
-      }
-    }
+    await runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true });
 
     expect(fetchMock).toHaveBeenCalledTimes(2);
     expect(fetchMock.mock.calls.map(([url]) => url)).toEqual([
@@ -303,13 +251,15 @@ describe('void db execute --remote (D1)', () => {
     const root = createProjectRoot();
     const proxyOrigin = 'https://proxy.example.com';
     mockGetProxyUrl.mockReturnValue(proxyOrigin);
-    const saved = process.env.VOID_ACCESS_CREDENTIALS;
-    process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-      [proxyOrigin]: {
-        CF_ACCESS_CLIENT_ID: 'ci-id',
-        CF_ACCESS_CLIENT_SECRET: 'ci-secret',
-      },
-    });
+    vi.stubEnv(
+      'VOID_ACCESS_CREDENTIALS',
+      JSON.stringify({
+        [proxyOrigin]: {
+          CF_ACCESS_CLIENT_ID: 'ci-id',
+          CF_ACCESS_CLIENT_SECRET: 'ci-secret',
+        },
+      }),
+    );
     fetchMock.mockResolvedValueOnce(
       new Response(null, {
         status: 302,
@@ -319,17 +269,9 @@ describe('void db execute --remote (D1)', () => {
       }),
     );
 
-    try {
-      await expect(
-        runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true }),
-      ).rejects.toThrow('process.exit:1');
-    } finally {
-      if (saved === undefined) {
-        delete process.env.VOID_ACCESS_CREDENTIALS;
-      } else {
-        process.env.VOID_ACCESS_CREDENTIALS = saved;
-      }
-    }
+    await expect(
+      runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true }),
+    ).rejects.toThrow('process.exit:1');
 
     expect(fetchMock).toHaveBeenCalledTimes(1);
     expect(mockEnsurePlatformAccessToken).not.toHaveBeenCalled();
@@ -402,23 +344,15 @@ describe('void db execute --remote (D1)', () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  it('errors when --file is passed with --remote D1', async () => {
-    const root = createProjectRoot();
-    // The rejection fires before the file is read, so the file does not need to exist.
-    await expect(
-      runDbCommand(root, { action: 'execute', file: 'query.sql', remote: true }),
-    ).rejects.toThrow('process.exit:1');
-  });
-
-  it('rejects --file before prompting for destructive confirmation (ordering regression guard)', async () => {
+  it('rejects --file with --remote D1 before prompting for confirmation', async () => {
     const root = createProjectRoot();
     Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
 
+    // The file does not exist: the rejection comes before it is read.
     await expect(
       runDbCommand(root, { action: 'execute', file: 'delete.sql', remote: true }),
     ).rejects.toThrow('process.exit:1');
 
-    // The confirmation prompt must NOT have fired — the error comes first.
     expect(mockConfirm).not.toHaveBeenCalled();
   });
 
@@ -433,7 +367,6 @@ describe('void db execute --remote (D1)', () => {
 
   it('prompts for confirmation on destructive statement in TTY', async () => {
     const root = createProjectRoot();
-    // Simulate a TTY
     Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
     mockConfirm.mockResolvedValue(true);
     fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
@@ -457,223 +390,30 @@ describe('void db execute --remote (D1)', () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  it('skips confirmation for SELECT statements even in TTY', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, { action: 'execute', command: 'SELECT * FROM users', remote: true });
-
-    expect(mockConfirm).not.toHaveBeenCalled();
-  });
-
-  it('skips confirmation for EXPLAIN statements', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN SELECT * FROM users',
-      remote: true,
-    });
-
-    expect(mockConfirm).not.toHaveBeenCalled();
-  });
-
-  it('prompts for confirmation for EXPLAIN ANALYZE (executes DML in PostgreSQL)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN ANALYZE DELETE FROM users',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('prompts for confirmation for EXPLAIN (ANALYZE) DELETE (parenthesized option form)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN (ANALYZE) DELETE FROM users',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('prompts for confirmation for EXPLAIN (ANALYZE TRUE) UPDATE (option with boolean argument)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN (ANALYZE TRUE) UPDATE users SET name = $1',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('prompts for confirmation for EXPLAIN (ANALYZE FALSE) (fail-closed: rejects even when ANALYZE is disabled)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN (ANALYZE FALSE) SELECT 1',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('skips confirmation for EXPLAIN (VERBOSE) SELECT (option list without ANALYZE is safe)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN (VERBOSE) SELECT 1',
-      remote: true,
-    });
-
-    expect(mockConfirm).not.toHaveBeenCalled();
-  });
-
-  it('prompts for confirmation for EXPLAIN /*x*/ ANALYZE (block comment between keywords, PostgreSQL treats it as whitespace)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN /*x*/ ANALYZE DELETE FROM users',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('prompts for confirmation for EXPLAIN -- comment\\n ANALYZE (line comment between keywords)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN -- comment\n ANALYZE DELETE FROM users',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('prompts for confirmation for EXPLAIN /*opts*/ (ANALYZE) DELETE (block comment before parenthesized option list)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'EXPLAIN /*opts*/ (ANALYZE) DELETE FROM users',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('prompts for confirmation for /* leading */ EXPLAIN ANALYZE (leading block comment before EXPLAIN)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: '/* leading */ EXPLAIN ANALYZE DELETE FROM users',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('skips confirmation for -- header\\nSELECT 1 (leading line comment is stripped, previously a UX nuisance)', async () => {
+  // Comments are stripped before the check. EXPLAIN ANALYZE in any form and WITH
+  // (a CTE can write) always prompt.
+  it.each<[string, boolean]>([
+    ['SELECT * FROM users', false],
+    ['EXPLAIN SELECT * FROM users', false],
+    ['EXPLAIN (VERBOSE) SELECT 1', false],
+    ['-- header\nSELECT 1', false],
+    ['EXPLAIN ANALYZE DELETE FROM users', true],
+    ['EXPLAIN (ANALYZE) DELETE FROM users', true],
+    ['EXPLAIN (ANALYZE TRUE) UPDATE users SET name = $1', true],
+    ['EXPLAIN (ANALYZE FALSE) SELECT 1', true],
+    ['EXPLAIN /*x*/ ANALYZE DELETE FROM users', true],
+    ['EXPLAIN -- comment\n ANALYZE DELETE FROM users', true],
+    ['EXPLAIN /*opts*/ (ANALYZE) DELETE FROM users', true],
+    ['/* leading */ EXPLAIN ANALYZE DELETE FROM users', true],
+    ['WITH cte AS (SELECT 1) SELECT * FROM cte', true],
+  ])('confirmation prompt for %j in TTY: %s', async (command, prompts) => {
     const root = createProjectRoot();
     Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
     fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
 
-    await runDbCommand(root, {
-      action: 'execute',
-      command: '-- header\nSELECT 1',
-      remote: true,
-    });
+    await runDbCommand(root, { action: 'execute', command, remote: true });
 
-    expect(mockConfirm).not.toHaveBeenCalled();
-  });
-
-  it('prompts for confirmation for WITH (CTE) statements (fail-closed: writable CTEs are indistinguishable without a parser)', async () => {
-    const root = createProjectRoot();
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(true);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'WITH cte AS (SELECT 1) SELECT * FROM cte',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it('includes explicitly scoped CF Access service-token headers for the selected proxy', async () => {
-    vi.stubEnv('VOID_ACCESS_ORIGIN', 'https://proxy.staging.void.cloud');
-    const root = createProjectRoot();
-    mockIsStagingMode.mockReturnValue(true);
-    const originalId = process.env.CF_ACCESS_CLIENT_ID;
-    const originalSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    process.env.CF_ACCESS_CLIENT_ID = 'test-client-id.access';
-    process.env.CF_ACCESS_CLIENT_SECRET = 'test-client-secret';
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: [], success: true }));
-
-    try {
-      await runDbCommand(root, { action: 'execute', command: 'SELECT 1', remote: true });
-    } finally {
-      if (originalId === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_ID;
-      } else {
-        process.env.CF_ACCESS_CLIENT_ID = originalId;
-      }
-      if (originalSecret === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_SECRET;
-      } else {
-        process.env.CF_ACCESS_CLIENT_SECRET = originalSecret;
-      }
-    }
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    const headers = init.headers as Record<string, string>;
-    expect(headers['CF-Access-Client-Id']).toBe('test-client-id.access');
-    expect(headers['CF-Access-Client-Secret']).toBe('test-client-secret');
+    expect(mockConfirm).toHaveBeenCalledTimes(prompts ? 1 : 0);
   });
 
   it('skips confirmation for UPDATE when not in TTY (non-interactive)', async () => {
@@ -686,11 +426,9 @@ describe('void db execute --remote (D1)', () => {
     expect(mockConfirm).not.toHaveBeenCalled();
   });
 
-  it('non-remote path is unaffected (regression: local SQLite still works)', async () => {
-    // The non-remote path should not call fetch at all
+  it('runs execute without --remote against the local database, not the proxy', async () => {
     const root = createProjectRoot();
-    // The SQLite path will fail because there's no local DB, but it should
-    // try to open the local DB, not call fetch
+    // No local database exists, so the local path exits.
     await expect(runDbCommand(root, { action: 'execute', command: 'SELECT 1' })).rejects.toThrow(
       'process.exit:1',
     );
@@ -708,7 +446,6 @@ describe('void db execute --remote (PostgreSQL)', () => {
 
     mockGetToken.mockReturnValue('test-token');
     mockReadProjectConfig.mockReturnValue({ projectId: 'proj-abc', slug: 'test-proj' });
-    mockIsStagingMode.mockReturnValue(false);
     mockPgConnect.mockResolvedValue(undefined);
     mockPgEnd.mockResolvedValue(undefined);
     mockPgQuery.mockResolvedValue({ rows: [] });
@@ -806,38 +543,4 @@ describe('void db execute --remote (PostgreSQL)', () => {
       }),
     ).rejects.toThrow(PlatformApiError);
   });
-
-  it('prompts for confirmation on destructive statement (TTY)', async () => {
-    const root = createProjectRoot({ database: 'pg' });
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockGetDatabaseUrl.mockResolvedValue({ url: 'postgres://host/db' });
-    mockPgQuery.mockResolvedValue({ rows: [] });
-    mockConfirm.mockResolvedValue(true);
-
-    await runDbCommand(root, {
-      action: 'execute',
-      command: 'UPDATE users SET name = $1',
-      remote: true,
-    });
-
-    expect(mockConfirm).toHaveBeenCalledTimes(1);
-    expect(mockPgQuery).toHaveBeenCalledTimes(1);
-  });
-
-  it('aborts destructive statement when user declines', async () => {
-    const root = createProjectRoot({ database: 'pg' });
-    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
-    mockConfirm.mockResolvedValue(false);
-
-    await expect(
-      runDbCommand(root, {
-        action: 'execute',
-        command: 'DROP TABLE users',
-        remote: true,
-      }),
-    ).rejects.toThrow('process.exit:0');
-
-    expect(mockGetDatabaseUrl).not.toHaveBeenCalled();
-    expect(mockPgQuery).not.toHaveBeenCalled();
-  });
 });
diff --git a/packages/void/test/unit/db-export-stdout.test.ts b/packages/void/test/unit/db-export-stdout.test.ts
index b6ef98a79..c3319f146 100644
--- a/packages/void/test/unit/db-export-stdout.test.ts
+++ b/packages/void/test/unit/db-export-stdout.test.ts
@@ -3,7 +3,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 
-const shared = vi.hoisted(() => ({ dbPath: '', includeExtras: false }));
+const shared = vi.hoisted(() => ({ dbPath: '' }));
 
 // Mock the SQLite layer directly (no `importActual`) so the test never loads
 // better-sqlite3's native binding — it feeds the export path a canned schema.
@@ -22,30 +22,6 @@ vi.mock('../../src/migrations/runner', () => {
               { name: 'title', hidden: 0 },
             ];
           }
-          if (sql.includes("type IN ('index','trigger','view')")) {
-            return shared.includeExtras
-              ? [
-                  {
-                    type: 'index',
-                    name: 'notes_title',
-                    tbl_name: 'notes',
-                    sql: 'CREATE INDEX notes_title ON notes (title)',
-                  },
-                  {
-                    type: 'trigger',
-                    name: 'notes_audit',
-                    tbl_name: 'notes',
-                    sql: 'CREATE TRIGGER notes_audit AFTER INSERT ON notes BEGIN SELECT 1; END',
-                  },
-                  {
-                    type: 'view',
-                    name: 'note_titles',
-                    tbl_name: 'note_titles',
-                    sql: 'CREATE VIEW note_titles AS SELECT title FROM notes',
-                  },
-                ]
-              : [];
-          }
           if (sql.includes('NOT LIKE')) {
             return [{ name: 'notes' }];
           }
@@ -73,7 +49,6 @@ describe('void db export → stdout', () => {
 
   afterEach(() => {
     vi.restoreAllMocks();
-    shared.includeExtras = false;
     for (const root of roots.splice(0, roots.length)) {
       rmSync(root, { recursive: true, force: true });
     }
@@ -107,34 +82,7 @@ describe('void db export → stdout', () => {
     await runDbCommand(root, { action: 'export' });
 
     expect(stdout).toBe(EXPECTED_SQL);
-    expect(stdout.startsWith('CREATE TABLE')).toBe(true);
     expect(stdout).not.toContain('void db');
     expect(stderr).toBe('');
   });
-
-  it('includes indexes, triggers, and views after table data', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-db-export-'));
-    roots.push(root);
-    writeFileSync(join(root, 'package.json'), JSON.stringify({ dependencies: { void: '*' } }));
-    writeFileSync(join(root, 'void.json'), JSON.stringify({}));
-    const dbFile = join(root, 'local.sqlite');
-    writeFileSync(dbFile, '');
-    shared.dbPath = dbFile;
-    shared.includeExtras = true;
-
-    const { runDbCommand } = await import('../../src/cli/db.ts');
-    let stdout = '';
-    vi.spyOn(process.stdout, 'write').mockImplementation((chunk: string | Uint8Array) => {
-      stdout += chunk.toString();
-      return true;
-    });
-    await runDbCommand(root, { action: 'export' });
-
-    expect(stdout).toContain('CREATE INDEX notes_title ON notes (title);');
-    expect(stdout).toContain(
-      'CREATE TRIGGER notes_audit AFTER INSERT ON notes BEGIN SELECT 1; END;',
-    );
-    expect(stdout).toContain('CREATE VIEW note_titles AS SELECT title FROM notes;');
-    expect(stdout.indexOf('INSERT INTO "notes"')).toBeLessThan(stdout.indexOf('CREATE TRIGGER'));
-  });
 });
diff --git a/packages/void/test/unit/db-studio-remote.test.ts b/packages/void/test/unit/db-studio-remote.test.ts
index 35659b0e4..c380e0ff6 100644
--- a/packages/void/test/unit/db-studio-remote.test.ts
+++ b/packages/void/test/unit/db-studio-remote.test.ts
@@ -1,10 +1,8 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join, relative } from 'node:path';
+import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 
-// ---- hoisted mocks ---------------------------------------------------------
-
 const mockGetToken = vi.fn<() => string | null>(() => null);
 const mockReadProjectConfig = vi.fn<() => { projectId: string; slug: string } | null>(() => null);
 
@@ -12,13 +10,11 @@ const mockGetDatabaseUrl = vi.fn<() => Promise<{ url: string }>>();
 
 vi.mock('../../src/cli/auth', () => ({
   getToken: () => mockGetToken(),
-  isStagingMode: () => false,
 }));
 
 vi.mock('../../src/cli/project', () => ({
   readProjectConfig: () => mockReadProjectConfig(),
   readDeploymentPlatform: () => 'void',
-  isVoidInternalStaging: () => false,
 }));
 
 vi.mock('../../src/cli/client', () => ({
@@ -41,13 +37,15 @@ vi.mock('../../src/cli/client', () => ({
   },
 }));
 
+const PRIVATE_CONFIG_PATH = join(tmpdir(), 'void-drizzle-test', 'drizzle.config.json');
+
 // Mock the drizzle config writers to avoid needing a real schema on disk.
 const mockWriteDrizzleConfig = vi.fn<(root: string, dbPath: string, dialect?: string) => string>(
   (root, _dbPath, _dialect) => join(root, '.void', 'drizzle.config.json'),
 );
 const mockWithPrivateDrizzleConfig = vi.fn(
   (_root: string, _dbUrl: string, _dialect: string, run: (configPath: string) => unknown) =>
-    run(join(tmpdir(), 'void-drizzle-test', 'drizzle.config.json')),
+    run(PRIVATE_CONFIG_PATH),
 );
 
 vi.mock('../../src/drizzle/config.ts', () => ({
@@ -79,45 +77,24 @@ vi.mock('@voidzero-dev/vite-plus-prompts', () => ({
   },
 }));
 
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
 const roots: Array<string> = [];
 
-function expectConfigOutsideRoot(root: string): void {
+function expectDrizzleKitRunWithPrivateConfig(command: 'push' | 'studio'): void {
   expect(mockExecFileSync).toHaveBeenCalledTimes(1);
   const cliArgs = (mockExecFileSync.mock.calls[0] as unknown as [string, Array<string>])[1];
-  const configPath = cliArgs[cliArgs.indexOf('--config') + 1];
-  expect(configPath).toBeDefined();
-  expect(relative(root, configPath!).startsWith('..')).toBe(true);
+  expect(cliArgs.slice(1)).toEqual([command, '--config', PRIVATE_CONFIG_PATH]);
 }
 
 function createProjectRoot(options: { database?: 'pg' } = {}): string {
   const root = mkdtempSync(join(tmpdir(), 'void-db-studio-remote-'));
   roots.push(root);
 
-  // db/migrations + schema (schema is needed only in the non-mocked local path)
-  const migrationsDir = join(root, 'db', 'migrations');
-  mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-
   const voidConfig = options.database === 'pg' ? { database: 'pg' } : {};
   writeFileSync(join(root, 'void.json'), JSON.stringify(voidConfig));
 
-  // .void dir
-  mkdirSync(join(root, '.void'), { recursive: true });
-  writeFileSync(
-    join(root, '.void', 'project.json'),
-    JSON.stringify({ projectId: 'proj-abc', slug: 'test-proj' }),
-  );
-
   return root;
 }
 
-// ---------------------------------------------------------------------------
-// Suite — PG remote
-// ---------------------------------------------------------------------------
-
 describe('void db studio --remote (PostgreSQL)', () => {
   let runDbCommand: typeof import('../../src/cli/db.ts').runDbCommand;
 
@@ -141,7 +118,7 @@ describe('void db studio --remote (PostgreSQL)', () => {
     }
   });
 
-  it('fetches the database URL via getDatabaseUrl and keeps it out of the project directory', async () => {
+  it('runs drizzle-kit studio with a private config holding the fetched database URL', async () => {
     const root = createProjectRoot({ database: 'pg' });
     const dbUrl = 'postgres://user:pass@host:5432/mydb';
     mockGetDatabaseUrl.mockResolvedValue({ url: dbUrl });
@@ -156,7 +133,7 @@ describe('void db studio --remote (PostgreSQL)', () => {
       expect.any(Function),
     );
     expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
-    expectConfigOutsideRoot(root);
+    expectDrizzleKitRunWithPrivateConfig('studio');
   });
 
   it('exits with code 1 when drizzle-kit studio fails', async () => {
@@ -172,58 +149,6 @@ describe('void db studio --remote (PostgreSQL)', () => {
     expect(mockWithPrivateDrizzleConfig).toHaveBeenCalledTimes(1);
   });
 
-  it('spawns drizzle-kit studio --config <configPath>', async () => {
-    const root = createProjectRoot({ database: 'pg' });
-    const dbUrl = 'postgres://user:pass@host:5432/mydb';
-    mockGetDatabaseUrl.mockResolvedValue({ url: dbUrl });
-
-    await runDbCommand(root, { action: 'studio', remote: true });
-
-    // execFileSync is called with (node, [drizzleKitBin, 'studio', '--config', configPath], opts)
-    expect(mockExecFileSync).toHaveBeenCalledTimes(1);
-    const execCallArgs = mockExecFileSync.mock.calls[0] as unknown as [
-      string,
-      Array<string>,
-      unknown,
-    ];
-    const cliArgs = execCallArgs[1];
-    expect(cliArgs).toContain('studio');
-    expect(cliArgs).toContain('--config');
-  });
-
-  it('surfaces the friendly 404 message when the URL is not stored', async () => {
-    const root = createProjectRoot({ database: 'pg' });
-
-    const { PlatformApiError } = await import('../../src/cli/client.ts');
-    mockGetDatabaseUrl.mockRejectedValue(new PlatformApiError('test', 404, '{}'));
-
-    const { log: clackLog } = await import('@voidzero-dev/vite-plus-prompts');
-
-    await expect(runDbCommand(root, { action: 'studio', remote: true })).rejects.toThrow(
-      'process.exit:1',
-    );
-
-    const errorCalls = (clackLog.error as ReturnType<typeof vi.fn>).mock.calls
-      .map((c: Array<unknown>) => String(c[0]))
-      .join('\n');
-    expect(errorCalls).toContain('void db set-url');
-    // No config may be written and drizzle-kit must NOT have been spawned
-    expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
-    expect(mockWithPrivateDrizzleConfig).not.toHaveBeenCalled();
-    expect(mockExecFileSync).not.toHaveBeenCalled();
-  });
-
-  it('re-throws non-404 errors from getDatabaseUrl', async () => {
-    const root = createProjectRoot({ database: 'pg' });
-
-    const { PlatformApiError } = await import('../../src/cli/client.ts');
-    mockGetDatabaseUrl.mockRejectedValue(new PlatformApiError('test', 403, '{}'));
-
-    await expect(runDbCommand(root, { action: 'studio', remote: true })).rejects.toThrow(
-      PlatformApiError,
-    );
-  });
-
   it('errors when not logged in', async () => {
     const root = createProjectRoot({ database: 'pg' });
     mockGetToken.mockReturnValue(null);
@@ -247,10 +172,6 @@ describe('void db studio --remote (PostgreSQL)', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Suite — D1 remote (not yet supported)
-// ---------------------------------------------------------------------------
-
 describe('void db studio --remote (D1)', () => {
   let runDbCommand: typeof import('../../src/cli/db.ts').runDbCommand;
 
@@ -275,7 +196,7 @@ describe('void db studio --remote (D1)', () => {
   });
 
   it('errors with "not yet supported" message and does not call writeDrizzleConfig or execFileSync', async () => {
-    const root = createProjectRoot(); // D1 project (no database: 'pg')
+    const root = createProjectRoot();
 
     const { log: clackLog } = await import('@voidzero-dev/vite-plus-prompts');
 
@@ -296,11 +217,7 @@ describe('void db studio --remote (D1)', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Suite — local (regression: --remote unset)
-// ---------------------------------------------------------------------------
-
-describe('void db studio (local, regression)', () => {
+describe('void db studio and push (local)', () => {
   let runDbCommand: typeof import('../../src/cli/db.ts').runDbCommand;
 
   beforeEach(async () => {
@@ -320,17 +237,30 @@ describe('void db studio (local, regression)', () => {
     }
   });
 
-  it('local D1 studio fails (no local DB) without calling getDatabaseUrl', async () => {
-    const root = createProjectRoot(); // D1, no local DB file
+  it('local D1 studio exits when no local database exists', async () => {
+    const root = createProjectRoot();
+
+    const { log: clackLog } = await import('@voidzero-dev/vite-plus-prompts');
 
-    // The local D1 path checks for the DB file and exits. Confirm that:
-    // - getDatabaseUrl is NOT called (it's remote-only)
     await expect(runDbCommand(root, { action: 'studio' })).rejects.toThrow('process.exit:1');
 
+    expect(clackLog.error).toHaveBeenCalledWith('No local database found. Run `void dev` first.');
+    expect(mockGetDatabaseUrl).not.toHaveBeenCalled();
+    expect(mockExecFileSync).not.toHaveBeenCalled();
+  });
+
+  it('local PG studio errors when .env has no DATABASE_URL', async () => {
+    const root = createProjectRoot({ database: 'pg' });
+
+    await expect(runDbCommand(root, { action: 'studio' })).rejects.toThrow(
+      'DATABASE_URL not found in .env',
+    );
+
     expect(mockGetDatabaseUrl).not.toHaveBeenCalled();
+    expect(mockExecFileSync).not.toHaveBeenCalled();
   });
 
-  it('local PG studio keeps the .env database URL out of the project directory', async () => {
+  it('local PG studio passes the .env database URL through a private config', async () => {
     const root = createProjectRoot({ database: 'pg' });
     const dbUrl = 'postgres://local:pass@localhost:5432/dev';
     writeFileSync(join(root, '.env'), `DATABASE_URL=${dbUrl}\n`);
@@ -345,10 +275,10 @@ describe('void db studio (local, regression)', () => {
       expect.any(Function),
     );
     expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
-    expectConfigOutsideRoot(root);
+    expectDrizzleKitRunWithPrivateConfig('studio');
   });
 
-  it('PG push keeps the .env database URL out of the project directory', async () => {
+  it('PG push passes the .env database URL through a private config', async () => {
     const root = createProjectRoot({ database: 'pg' });
     const dbUrl = 'postgres://local:pass@localhost:5432/dev';
     writeFileSync(join(root, '.env'), `DATABASE_URL=${dbUrl}\n`);
@@ -362,18 +292,6 @@ describe('void db studio (local, regression)', () => {
       expect.any(Function),
     );
     expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
-    const cliArgs = (mockExecFileSync.mock.calls[0] as unknown as [string, Array<string>])[1];
-    expect(cliArgs).toContain('push');
-    expectConfigOutsideRoot(root);
-  });
-
-  it('local PG studio does not call getDatabaseUrl (uses local URL path)', async () => {
-    const root = createProjectRoot({ database: 'pg' });
-
-    // The local PG path calls getPgUrl (reads .env). No DATABASE_URL set, so it throws.
-    // Regardless, getDatabaseUrl must NOT be called — it's only used for --remote.
-    await expect(runDbCommand(root, { action: 'studio' })).rejects.toThrow();
-
-    expect(mockGetDatabaseUrl).not.toHaveBeenCalled();
+    expectDrizzleKitRunWithPrivateConfig('push');
   });
 });
diff --git a/packages/void/test/unit/deferred-xss.test.ts b/packages/void/test/unit/deferred-xss.test.ts
index 29bbd0a04..a2131c204 100644
--- a/packages/void/test/unit/deferred-xss.test.ts
+++ b/packages/void/test/unit/deferred-xss.test.ts
@@ -1,44 +1,42 @@
 import { describe, it, expect } from 'vite-plus/test';
 import { safeJsonStringify } from '../../src/pages/protocol.ts';
+import { serializePageData } from '../../src/pages/serialize.ts';
 
-describe('deferred data XSS prevention (real implementation)', () => {
-  it('escapes </script> in string values', () => {
-    const malicious = { name: '</script><script>alert(1)</script>' };
-    const result = safeJsonStringify(malicious);
-    expect(result).not.toContain('</script>');
-    expect(result).toContain('\\u003c/script\\u003e');
+describe.each([
+  ['serializePageData', serializePageData],
+  ['safeJsonStringify', safeJsonStringify],
+])('%s inline-script escaping', (_name, serialize) => {
+  it('escapes </script> so the inline script tag cannot be closed early', () => {
+    const payload = { html: '</script><script>alert(1)</script>' };
+    const out = serialize(payload);
+    expect(out).not.toMatch(/<\/script/i);
+    expect(out).toContain('\\u003c/script\\u003e');
+    expect(JSON.parse(out)).toEqual(payload);
   });
 
-  it('escapes < and > characters', () => {
-    const result = safeJsonStringify('<img onerror=alert(1)>');
-    expect(result).not.toContain('<');
-    expect(result).not.toContain('>');
-  });
-
-  it('escapes & character', () => {
-    const result = safeJsonStringify('a&b');
-    expect(result).toContain('\\u0026');
-  });
-
-  it('preserves normal data', () => {
-    const data = { name: 'hello world', count: 42, nested: { ok: true } };
-    const result = safeJsonStringify(data);
-    expect(JSON.parse(result)).toEqual(data);
-  });
-
-  it('escapes unicode line/paragraph separators', () => {
-    const result = safeJsonStringify('line\u2028para\u2029');
-    expect(result).not.toContain('\u2028');
-    expect(result).not.toContain('\u2029');
-  });
-
-  it('handles undefined without throwing', () => {
-    const result = safeJsonStringify(undefined);
-    expect(result).toBe('null');
+  it('escapes <, >, &, U+2028 and U+2029 and still round-trips', () => {
+    const payload = {
+      html: '<img onerror=alert(1)>',
+      amp: 'a & b',
+      ls: 'a\u2028b',
+      ps: 'a\u2029b',
+      count: 42,
+      nested: { ok: true },
+    };
+    const out = serialize(payload);
+    for (const char of ['<', '>', '&', '\u2028', '\u2029']) {
+      expect(out).not.toContain(char);
+    }
+    expect(out).toContain('\\u0026');
+    expect(JSON.parse(out)).toEqual(payload);
   });
+});
 
-  it('handles function values without throwing', () => {
-    const result = safeJsonStringify(() => {});
-    expect(result).toBe('null');
+describe('safeJsonStringify', () => {
+  it.each([
+    ['undefined', undefined],
+    ['a function', () => {}],
+  ])('returns null for %s', (_label, value) => {
+    expect(safeJsonStringify(value)).toBe('null');
   });
 });
diff --git a/packages/void/test/unit/define-handler.test.ts b/packages/void/test/unit/define-handler.test.ts
index 8ea3eb8b3..fc6f63e5e 100644
--- a/packages/void/test/unit/define-handler.test.ts
+++ b/packages/void/test/unit/define-handler.test.ts
@@ -18,10 +18,7 @@ type ValidationIssueBody = {
   }>;
 };
 
-/**
- * Helper that mimics the generated code pattern in compile.ts:
- *   return convertReturnValue(await mod.default(c))
- */
+/** Wraps the handler the way createHttpRouteHandler in runtime/routing.ts does. */
 function createApp(handler: (c: CloudContext) => unknown) {
   const app = new Hono();
   app.get('/test', async (c) => {
@@ -130,27 +127,6 @@ describe('defineHandler', () => {
     expect(await res.json()).toEqual({ data: 'hello' });
   });
 
-  it('handler returning Response passes through', async () => {
-    const handler = defineHandler(() => {
-      return new Response('raw', { status: 201 });
-    });
-
-    const app = createApp(handler);
-    const res = await app.request(req());
-    expect(res.status).toBe(201);
-    expect(await res.text()).toBe('raw');
-  });
-
-  it('handler returning null → 204', async () => {
-    const handler = defineHandler(() => {
-      return null;
-    });
-
-    const app = createApp(handler);
-    const res = await app.request(req());
-    expect(res.status).toBe(204);
-  });
-
   it('raw Hono middleware (not wrapped with defineMiddleware)', async () => {
     const order: Array<string> = [];
 
@@ -174,46 +150,6 @@ describe('defineHandler', () => {
     expect(order).toEqual(['raw-before', 'handler', 'raw-after']);
   });
 
-  it('mixed raw Hono middleware and defineMiddleware', async () => {
-    const order: Array<string> = [];
-
-    const rawMiddleware: MiddlewareHandler = async (_c, next) => {
-      order.push('raw');
-      await next();
-    };
-
-    const wrapped = defineMiddleware(async (_c, next) => {
-      order.push('wrapped');
-      await next();
-    });
-
-    const handler = defineHandler(rawMiddleware, wrapped, (_c) => {
-      order.push('handler');
-      return { done: true };
-    });
-
-    const app = createApp(handler);
-    const res = await app.request(req());
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ done: true });
-    expect(order).toEqual(['raw', 'wrapped', 'handler']);
-  });
-
-  it('raw Hono middleware short-circuits', async () => {
-    const guard: MiddlewareHandler = async (c, _next) => {
-      return c.text('forbidden', 403);
-    };
-
-    const handler = defineHandler(guard, () => {
-      throw new Error('should not be called');
-    });
-
-    const app = createApp(handler);
-    const res = await app.request(req());
-    expect(res.status).toBe(403);
-    expect(await res.text()).toBe('forbidden');
-  });
-
   it('middleware error propagates', async () => {
     const failing = defineMiddleware(async () => {
       throw new Error('middleware boom');
@@ -360,45 +296,4 @@ describe('defineHandler.withValidator', () => {
       body: { name: 'Bob' },
     });
   });
-
-  it('handler can return a raw Response', async () => {
-    const handler = defineHandler.withValidator({
-      body: passSchema(),
-    })((_c) => {
-      return new Response('created', { status: 201 });
-    });
-
-    const app = createValidatedApp('post', '/test', handler);
-
-    const res = await app.request(
-      new Request('http://localhost/test', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ ok: true }),
-      }),
-    );
-
-    expect(res.status).toBe(201);
-    expect(await res.text()).toBe('created');
-  });
-
-  it('handler can return null for 204', async () => {
-    const handler = defineHandler.withValidator({
-      body: passSchema(),
-    })(() => {
-      return null;
-    });
-
-    const app = createValidatedApp('post', '/test', handler);
-
-    const res = await app.request(
-      new Request('http://localhost/test', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({}),
-      }),
-    );
-
-    expect(res.status).toBe(204);
-  });
 });
diff --git a/packages/void/test/unit/deploy-args.test.ts b/packages/void/test/unit/deploy-args.test.ts
index 3a22cbb78..4d8a5dc63 100644
--- a/packages/void/test/unit/deploy-args.test.ts
+++ b/packages/void/test/unit/deploy-args.test.ts
@@ -40,23 +40,11 @@ describe('parseDeployArgs', () => {
     expect(result.spa).toBe(true);
   });
 
-  it('parses --dir and --spa together', () => {
-    const result = parseDeployArgs(['--dir', 'dist', '--spa']);
-    expect(result.dir).toBe('dist');
-    expect(result.spa).toBe(true);
-  });
-
   it('parses --skip-build flag', () => {
     const result = parseDeployArgs(['--skip-build']);
     expect(result.skipBuild).toBe(true);
   });
 
-  it('parses --skip-build with --project', () => {
-    const result = parseDeployArgs(['--project', 'my-app', '--skip-build']);
-    expect(result.projectSlug).toBe('my-app');
-    expect(result.skipBuild).toBe(true);
-  });
-
   it('parses all flags together', () => {
     const result = parseDeployArgs([
       '--project',
@@ -152,34 +140,20 @@ describe('parseDeployArgs', () => {
     );
   });
 
-  it('passes --skip-build through for target-specific validation', () => {
-    expect(parseDeployArgs(['--platform', 'cloudflare', '--skip-build'])).toMatchObject({
-      platform: 'cloudflare',
-      skipBuild: true,
-    });
-  });
-
   it('explains that Cloudflare resolves no Void project', () => {
     expect(() => parseDeployArgs(['--platform', 'cloudflare', '--project', 'foo'])).toThrow(
       /--project is not supported with --platform cloudflare.*no Void project is involved/,
     );
   });
 
-  it('parses static-directory and SPA flags on Cloudflare', () => {
-    expect(parseDeployArgs(['--platform', 'cloudflare', '--dir', 'dist', '--spa'])).toMatchObject({
+  it('parses static-directory, SPA and skip-build flags on Cloudflare', () => {
+    expect(
+      parseDeployArgs(['--platform', 'cloudflare', '--dir', 'dist', '--spa', '--skip-build']),
+    ).toMatchObject({
       platform: 'cloudflare',
       dir: 'dist',
       spa: true,
+      skipBuild: true,
     });
   });
-
-  it('keeps the managed static-directory path available', () => {
-    expect(parseDeployArgs(['--project', 'foo', '--dir', 'dist', '--spa'])).toMatchObject({
-      projectSlug: 'foo',
-      dir: 'dist',
-      spa: true,
-    });
-    expect(parseDeployArgs([]).platform).toBeUndefined();
-    expect(parseDeployArgs([]).provision).toBeUndefined();
-  });
 });
diff --git a/packages/void/test/unit/deploy-asset-config.test.ts b/packages/void/test/unit/deploy-asset-config.test.ts
index 3146b35bb..8e6c08183 100644
--- a/packages/void/test/unit/deploy-asset-config.test.ts
+++ b/packages/void/test/unit/deploy-asset-config.test.ts
@@ -59,56 +59,6 @@ describe('resolveAssetConfig', () => {
     ).toEqual(SPA_API);
   });
 
-  it('routes the /__void internal namespace to the worker for SPA + API apps', () => {
-    // Regression: a SPA app with API routes + D1 migrations lands in the
-    // apiWorkerFirst branch. Without /__void in run_worker_first, CF Static
-    // Assets serves index.html for GET /__void/migrate/capabilities before the
-    // worker runs, so the migration handler is never reached and the deploy
-    // fails with "migration protocol v2 capability negotiation failed".
-    const config = resolveAssetConfig({
-      isSsr: false,
-      hasPages: false,
-      hasApiRoutes: true,
-      hasDocumentRoutes: false,
-      hasMiddleware: false,
-    });
-    expect(config.not_found_handling).toBe('single-page-application');
-    expect(config.run_worker_first).toContain('/__void');
-    expect(config.run_worker_first).toContain('/__void/*');
-  });
-
-  it('routes the /__void internal namespace worker-first for auth-enabled SPA apps', () => {
-    // authEnabled also triggers the apiWorkerFirst branch (auth apps have
-    // migrations for the auth tables), so /__void must reach the worker too.
-    const config = resolveAssetConfig({
-      isSsr: false,
-      hasPages: false,
-      hasApiRoutes: false,
-      hasDocumentRoutes: false,
-      hasMiddleware: false,
-      authEnabled: true,
-    });
-    expect(config.run_worker_first).toContain('/__void/*');
-  });
-
-  it('routes the /__void internal namespace worker-first for a migration-only SPA (cron/queue app, no API/auth/pages)', () => {
-    // A SPA whose only server code is a cron/queue handler still advertises
-    // manifest.migrations (validatedMigrations is passed to buildVoidManifest
-    // independently of routes), but has none of the asset-routing flags, so it
-    // falls to the pure-SPA branch. Without /__void there, CF serves index.html
-    // for GET /__void/migrate/capabilities and negotiation fails.
-    const config = resolveAssetConfig({
-      isSsr: false,
-      hasPages: false,
-      hasApiRoutes: false,
-      hasDocumentRoutes: false,
-      hasMiddleware: false,
-    });
-    expect(config.not_found_handling).toBe('single-page-application');
-    expect(config.run_worker_first).toContain('/__void');
-    expect(config.run_worker_first).toContain('/__void/*');
-  });
-
   it('uses none when the project has document routes', () => {
     expect(
       resolveAssetConfig({
@@ -159,10 +109,6 @@ describe('resolveAssetConfig', () => {
   });
 
   it('uses none for the common SPA + auth-middleware shape', () => {
-    // Regression: this is the case the SPA-fallback shortcut silently
-    // breaks. Browser navigation to /api/auth/callback/google would arrive
-    // with Sec-Fetch-Mode: navigate, get the SPA shell, and never reach
-    // Better Auth — leaving the user "signed in" without a session cookie.
     expect(
       resolveAssetConfig({
         isSsr: false,
@@ -210,7 +156,7 @@ describe('resolveAssetConfig', () => {
     expect(hasApiRoutes([{ pattern: '/hello' }, { pattern: '/apiish' }])).toBe(false);
   });
 
-  it('uses the same worker-owned HTML decision as the asset config', () => {
+  it('reports worker-owned HTML routing for document routes', () => {
     const inputs = {
       isSsr: false,
       hasPages: false,
@@ -218,7 +164,6 @@ describe('resolveAssetConfig', () => {
       hasMiddleware: false,
     };
     expect(workerOwnsHtmlRouting(inputs)).toBe(true);
-    expect(resolveAssetConfig(inputs)).toEqual(NONE);
   });
 
   it('resolves the complete request trigger policy', () => {
@@ -281,19 +226,7 @@ describe('resolveAssetConfig', () => {
   });
 });
 
-// `routing.notFound` (void.json) is an explicit escape hatch, not a new default.
-//
-// Without it, an app whose assets came from a static site generator and whose
-// only backend is an API route takes the `apiWorkerFirst` branch, so unknown
-// URLs are answered with `index.html` and HTTP **200**. The generator's real
-// `404.html` is never served and crawlers see 200 for every URL. The default
-// cannot change — a genuine SPA needs that fallback for deep links, and a built
-// asset tree carries nothing that distinguishes the two — so the user says so.
-//
-// `run_worker_first`, `workerFirst` and `apiWorkerFirst` stay as inferred, so
-// which layer sees a request first is unaffected. `workerSpaFallback` is the one
-// derived flag that MUST follow the override — see the worker-first describe
-// below for why.
+// `routing.notFound` overrides only `not_found_handling`; worker-first routing stays inferred.
 describe('resolveAssetRoutingPolicy — routing.notFound override', () => {
   const SPA_API_WORKER_FIRST = ['/api', '/api/*', '/__void', '/__void/*'];
 
@@ -325,8 +258,7 @@ describe('resolveAssetRoutingPolicy — routing.notFound override', () => {
     expect(overridden.assetConfig.run_worker_first).toEqual(inferred.assetConfig.run_worker_first);
     expect(overridden.apiWorkerFirst).toBe(inferred.apiWorkerFirst);
     expect(overridden.workerFirst).toBe(inferred.workerFirst);
-    // This shape is asset-first, so there is no worker-side shell fallback to
-    // begin with. The worker-first shape is a different story — below.
+    // Asset-first shape: no worker-side shell fallback either way.
     expect(inferred.workerSpaFallback).toBe(false);
     expect(overridden.workerSpaFallback).toBe(false);
   });
@@ -359,29 +291,9 @@ describe('resolveAssetRoutingPolicy — routing.notFound override', () => {
       },
     );
   });
-
-  it('is reachable through resolveAssetConfig (the deploy entry point)', () => {
-    expect(resolveAssetConfig({ ...ssgWithApi, notFound: '404-page' }).not_found_handling).toBe(
-      '404-page',
-    );
-  });
 });
 
-// The shape the `routing.notFound` override was silently inert on.
-//
-// `workerSpaFallback` is true for `workerFirst && !isSsr && !hasPages` — any
-// non-SSR app with no `pages/` that still owns HTML routing: a `middleware/`
-// file, a route outside `/api`, a document websocket, or Live. That flag makes
-// the generated `serveWithAssets` answer every unmatched HTML navigation with
-// `/index.html` at status **200**, before `not_found_handling` is ever
-// consulted. So setting `routing.notFound: '404-page'` changed the wrangler
-// asset config and changed nothing a user could observe.
-//
-// This is exactly the app the docs walk people into: `docs/guide/app-types.md`
-// recommends `routing.notFound` for `appType: "void"` + `vitepress build &&
-// vite build`, and `docs/guide/edge/static-assets.md` names it as the override
-// for "Worker owns HTML (Pages, SSR, middleware…)". Add one `middleware/` file
-// to that VitePress app and the documented escape hatch stopped working.
+// Worker-first without SSR or pages/: the worker itself serves the SPA shell for unmatched pages.
 describe('resolveAssetRoutingPolicy — notFound on the worker-first SPA-fallback shape', () => {
   // middleware/ → workerOwnsHtmlRouting, no pages/, no SSR.
   const ssgWithMiddleware = {
@@ -438,12 +350,7 @@ describe('resolveAssetRoutingPolicy — notFound on the worker-first SPA-fallbac
   });
 });
 
-// End-to-end over the REAL generated helper: policy in, executed worker code
-// out. A unit assertion on `workerSpaFallback` alone would not have caught the
-// second half of the bug — with the flag cleared the app returns a real 404,
-// but with the WORKER's generic body, while the docs promise the generator's
-// own `404.html`. `compileAssetFallbackHelper` has to pass the asset binding's
-// 404 through, and only executing it proves that.
+// Runs createAssetFallback with the resolved policy against a fake asset binding.
 describe('generated serveWithAssets — routing.notFound end to end', () => {
   /** Stand-in for CF's asset binding, implementing `not_found_handling`. */
   function makeAssets(handling: string | undefined, opts?: { has404Page?: boolean }) {
@@ -462,8 +369,6 @@ describe('generated serveWithAssets — routing.notFound end to end', () => {
             headers: { 'content-type': 'text/html' },
           });
         }
-        // CF serves the NEAREST 404.html, with a real 404 status — which is
-        // precisely why the helper's `asset.status !== 404` guard dropped it.
         if (handling === '404-page' && opts?.has404Page !== false) {
           return new Response('<html>GENERATED 404</html>', {
             status: 404,
@@ -476,7 +381,7 @@ describe('generated serveWithAssets — routing.notFound end to end', () => {
   }
 
   /**
-   * Runs the generated helper and hands back the raw `Response`, so a caller can
+   * Runs the asset fallback and hands back the raw `Response`, so a caller can
    * assert on headers and not just status/body. `path`, `accept` and the worker
    * response default to a browser navigation to an unmatched document path.
    */
@@ -569,12 +474,6 @@ describe('generated serveWithAssets — routing.notFound end to end', () => {
     ).toEqual({ status: 404, body: '<html>GENERATED 404</html>' });
   });
 
-  // Guard against a recurring misreading of `workerSpaFallback: false` on the
-  // SSR/Pages shapes as "the explicit override cannot work there". It already
-  // works: `serveWithAssets` returns the asset response as soon as it is not a
-  // 404, so SPA mode hands back the shell at 200 BEFORE `fallthroughCode` — the
-  // only place `workerSpaFallback` matters — is ever reached. Enabling the flag
-  // for `isSsr` / `hasPages` would be strictly dead code, so it must stay off.
   for (const shape of [
     { label: 'SSR', isSsr: true, hasPages: false },
     { label: 'Pages', isSsr: false, hasPages: true },
@@ -595,16 +494,7 @@ describe('generated serveWithAssets — routing.notFound end to end', () => {
     });
   }
 
-  // The axis the cases above miss: they all send `accept: text/html` to a
-  // document path with a generic worker 404, so nothing here distinguished
-  // "browser asked for a page" from "an API client asked for data".
-  //
-  // `serveWithAssets` wraps EVERY app response with no path filtering and
-  // engages on any 404, so a GET/HEAD API handler that deliberately answers 404
-  // has to survive it intact. On the asset-first shape — this feature's own
-  // documented recipe — `404-page` means the asset layer answers document misses
-  // itself, so the worker only ever reaches this branch on `run_worker_first`
-  // paths (`/api/*`, `/__void/*`), where an HTML 404 page is never the answer.
+  // serveWithAssets sees every worker 404, so a deliberate API 404 must pass through intact.
   describe('an API 404 is not replaced by the HTML 404 page', () => {
     /** A handler deliberately answering 404 with JSON, plus a CORS header. */
     const apiJson404 = () =>
diff --git a/packages/void/test/unit/deploy-auth.test.ts b/packages/void/test/unit/deploy-auth.test.ts
index 1de6aa1ed..cfa04c388 100644
--- a/packages/void/test/unit/deploy-auth.test.ts
+++ b/packages/void/test/unit/deploy-auth.test.ts
@@ -4,7 +4,8 @@ import { join } from 'node:path';
 import { intro } from '@voidzero-dev/vite-plus-prompts';
 import { toSlash } from 'pathslash';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { buildEnv, runDeploy } from '../../src/cli/deploy.ts';
+import { runDeploy } from '../../src/cli/deploy.ts';
+import { buildEnv } from '../../src/shared/untrusted-env.ts';
 
 const mockError = vi.fn();
 const mockInfo = vi.fn();
@@ -154,6 +155,8 @@ describe('runDeploy auth failures', () => {
 
     expect(intro).not.toHaveBeenCalled();
     expect(mockInfo).not.toHaveBeenCalledWith('Deployment target: Cloudflare');
+    expect(mockProjectLookup).not.toHaveBeenCalled();
+    expect(mockClientCtor).not.toHaveBeenCalled();
   });
 
   it('reauthenticates and retries once for expired local auth tokens in interactive mode', async () => {
@@ -276,61 +279,26 @@ describe('runDeploy project access', () => {
 
     expect(mockProjectLookup).toHaveBeenCalledOnce();
   });
-
-  it('does not fetch Void project roles for a direct Cloudflare deployment', async () => {
-    linkProject();
-
-    await expect(
-      runDeploy(root, { platform: 'cloudflare', projectSlug: 'my-app' }),
-    ).rejects.toThrow('--project is not supported with platform cloudflare');
-
-    expect(mockProjectLookup).not.toHaveBeenCalled();
-    expect(mockClientCtor).not.toHaveBeenCalled();
-  });
 });
 
 describe('runDeploy GitHub Actions OIDC exchange', () => {
-  it('exchanges an OIDC token for a deploy token when no VOID_TOKEN and in Actions', async () => {
-    mockGetToken.mockReturnValue(null);
-    mockIsOidcAvailable.mockReturnValue(true);
-    mockExchangeOidc.mockResolvedValue('minted-token');
-
-    // The deploy still fails later (project lookup is mocked to reject), but the
-    // OIDC exchange must run first and mint the token the client is built with.
-    await expect(runDeploy(process.cwd(), { projectSlug: 'my-app' })).rejects.toThrow();
-
-    expect(mockExchangeOidc).toHaveBeenCalledTimes(1);
-    expect(mockExchangeOidc).toHaveBeenCalledWith('https://api.test', 'my-app');
-    expect(mockMaskSecret).toHaveBeenCalledWith('minted-token');
-  });
-
   it('prefers OIDC over an AMBIENT saved keychain/file token in Actions (no VOID_TOKEN env)', async () => {
-    // Regression guard: on a self-hosted / reused runner a leftover
-    // `void account login` credential lives in the keychain/config file, so
-    // getToken() returns it — but there is NO explicit VOID_TOKEN env. The
-    // deploy MUST still mint a fresh project-scoped OIDC deploy token and use
-    // THAT, not the broad long-lived saved token. (Before the fix, getToken was
-    // consulted first and the ambient token preempted OIDC entirely.)
     mockGetToken.mockReturnValue('ambient-saved-token');
     mockIsOidcAvailable.mockReturnValue(true);
     mockExchangeOidc.mockResolvedValue('minted-token');
 
     await expect(runDeploy(process.cwd(), { projectSlug: 'my-app' })).rejects.toThrow();
 
-    // The OIDC exchange ran...
     expect(mockExchangeOidc).toHaveBeenCalledTimes(1);
     expect(mockExchangeOidc).toHaveBeenCalledWith('https://api.test', 'my-app');
     expect(mockMaskSecret).toHaveBeenCalledWith('minted-token');
-    // ...the minted token was exported for the build/prerender...
     expect(process.env.VOID_TOKEN).toBe('minted-token');
-    // ...and the PlatformClient was built with the MINTED token, NOT the saved one.
+    expect(process.env.VOID_API_URL).toBe('https://api.test');
     expect(mockClientCtor).toHaveBeenCalledTimes(1);
     expect(mockClientCtor.mock.calls[0][0]).toBe('minted-token');
   });
 
   it('uses the saved keychain/file token when NOT in Actions (local dev, no exchange)', async () => {
-    // Local dev: not in GitHub Actions, no VOID_TOKEN env, but a saved token is
-    // present. It must be used directly with no OIDC exchange.
     mockGetToken.mockReturnValue('ambient-saved-token');
     mockIsOidcAvailable.mockReturnValue(false);
 
@@ -344,24 +312,7 @@ describe('runDeploy GitHub Actions OIDC exchange', () => {
     expect(process.env.VOID_TOKEN).toBeUndefined();
   });
 
-  it('binds the minted token to its issuing platform for later credential reads', async () => {
-    mockGetToken.mockReturnValue(null);
-    mockIsOidcAvailable.mockReturnValue(true);
-    mockExchangeOidc.mockResolvedValue('minted-token');
-
-    // The deploy throws later, but any in-process credential read must retain
-    // the issuing origin; a saved project must not redirect the minted token.
-    await expect(runDeploy(process.cwd(), { projectSlug: 'my-app' })).rejects.toThrow();
-
-    expect(process.env.VOID_TOKEN).toBe('minted-token');
-    expect(process.env.VOID_API_URL).toBe('https://api.test');
-    expect(mockExchangeOidc).toHaveBeenCalledWith('https://api.test', 'my-app');
-  });
-
   it('does NOT overwrite an explicit VOID_TOKEN in process.env (no mint)', async () => {
-    // getToken returns a token (explicit VOID_TOKEN / keychain / file), so the
-    // OIDC branch is skipped and the existing process.env.VOID_TOKEN is left
-    // untouched — no re-mint, no clobber.
     mockGetToken.mockReturnValue('explicit-token');
     mockIsOidcAvailable.mockReturnValue(true);
     process.env.VOID_TOKEN = 'explicit-env-token';
@@ -438,60 +389,23 @@ describe('runDeploy GitHub Actions OIDC exchange', () => {
   });
 });
 
-// The deploy flow spawns untrusted `vite build` (and other build children) with
-// the spawn env. A shared CF Access service token (used only by the CLI's own API
-// client, which captures the headers at construction) must NOT survive into those
-// children. runDeploy keeps the pair OUT of the child env via `buildEnv()` while
-// LEAVING process.env untouched — mutating process.env would break interactive
-// expired-token re-auth, which reads the pair after the build step.
 describe('runDeploy keeps the CF Access service token in process.env', () => {
-  it('does NOT delete CF_ACCESS_CLIENT_ID/SECRET from process.env (re-auth needs them)', async () => {
-    const savedId = process.env.CF_ACCESS_CLIENT_ID;
-    const savedSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    const savedToken = process.env.CF_ACCESS_TOKEN;
-    try {
-      process.env.CF_ACCESS_CLIENT_ID = 'svc-id.access';
-      process.env.CF_ACCESS_CLIENT_SECRET = 'svc-secret';
-      process.env.CF_ACCESS_TOKEN = 'jwt-keep-me';
-
-      // Default mocks make project lookup reject with an expired token in non-TTY
-      // mode, so runDeploy throws after constructing the client.
-      await expect(runDeploy(process.cwd(), { projectSlug: 'my-app' })).rejects.toThrow();
-
-      // The pair is preserved so a later re-auth can still read it.
-      expect(process.env.CF_ACCESS_CLIENT_ID).toBe('svc-id.access');
-      expect(process.env.CF_ACCESS_CLIENT_SECRET).toBe('svc-secret');
-      expect(process.env.CF_ACCESS_TOKEN).toBe('jwt-keep-me');
-    } finally {
-      const restore = (key: string, value: string | undefined): void => {
-        if (value === undefined) {
-          delete process.env[key];
-        } else {
-          process.env[key] = value;
-        }
-      };
-      restore('CF_ACCESS_CLIENT_ID', savedId);
-      restore('CF_ACCESS_CLIENT_SECRET', savedSecret);
-      restore('CF_ACCESS_TOKEN', savedToken);
-    }
-  });
-
   it('exposes the interactive re-auth path to the still-present Access pair', async () => {
     Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
     const savedId = process.env.CF_ACCESS_CLIENT_ID;
     const savedSecret = process.env.CF_ACCESS_CLIENT_SECRET;
+    const savedToken = process.env.CF_ACCESS_TOKEN;
     try {
       process.env.CF_ACCESS_CLIENT_ID = 'svc-id.access';
       process.env.CF_ACCESS_CLIENT_SECRET = 'svc-secret';
+      process.env.CF_ACCESS_TOKEN = 'jwt-keep-me';
 
-      // Capture the env the re-auth path sees when it runs (after the client was
-      // already constructed). cf-access.ts / auth.ts read process.env here, so the
-      // pair must still be present.
-      let pairAtReauth: { id?: string; secret?: string } | undefined;
+      let pairAtReauth: { id?: string; secret?: string; token?: string } | undefined;
       mockPromptForLoginToken.mockImplementationOnce(() => {
         pairAtReauth = {
           id: process.env.CF_ACCESS_CLIENT_ID,
           secret: process.env.CF_ACCESS_CLIENT_SECRET,
+          token: process.env.CF_ACCESS_TOKEN,
         };
         return Promise.resolve('fresh-token');
       });
@@ -505,7 +419,11 @@ describe('runDeploy keeps the CF Access service token in process.env', () => {
       );
 
       expect(mockPromptForLoginToken).toHaveBeenCalledTimes(1);
-      expect(pairAtReauth).toEqual({ id: 'svc-id.access', secret: 'svc-secret' });
+      expect(pairAtReauth).toEqual({
+        id: 'svc-id.access',
+        secret: 'svc-secret',
+        token: 'jwt-keep-me',
+      });
     } finally {
       const restore = (key: string, value: string | undefined): void => {
         if (value === undefined) {
@@ -516,12 +434,11 @@ describe('runDeploy keeps the CF Access service token in process.env', () => {
       };
       restore('CF_ACCESS_CLIENT_ID', savedId);
       restore('CF_ACCESS_CLIENT_SECRET', savedSecret);
+      restore('CF_ACCESS_TOKEN', savedToken);
     }
   });
 });
 
-// The build child env must omit every deploy credential even though process.env
-// keeps them. Managed prerender obtains a separate proxy-only token afterward.
 describe('buildEnv', () => {
   it('omits Cloudflare and Access credentials while process.env keeps them', () => {
     const savedId = process.env.CF_ACCESS_CLIENT_ID;
@@ -544,7 +461,6 @@ describe('buildEnv', () => {
 
       const childEnv = buildEnv({ VOID_DEPLOY_PROJECT_ID: 'proj_1' });
 
-      // Pair scrubbed from the CHILD env...
       expect(childEnv.CF_ACCESS_CLIENT_ID).toBeUndefined();
       expect(childEnv.CF_ACCESS_CLIENT_SECRET).toBeUndefined();
       expect(childEnv.CF_ACCESS_TOKEN).toBeUndefined();
@@ -554,7 +470,6 @@ describe('buildEnv', () => {
       expect(childEnv.ACTIONS_ID_TOKEN_REQUEST_URL).toBeUndefined();
       expect(childEnv.ACTIONS_ID_TOKEN_REQUEST_TOKEN).toBeUndefined();
       expect(childEnv.VOID_DEPLOY_PROJECT_ID).toBe('proj_1');
-      // ...and process.env is untouched.
       expect(process.env.CF_ACCESS_CLIENT_ID).toBe('svc-id.access');
       expect(process.env.CF_ACCESS_CLIENT_SECRET).toBe('svc-secret');
       expect(process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN).toBe('actions-oidc-bearer');
@@ -583,20 +498,8 @@ describe('buildEnv', () => {
   });
 });
 
-// Build commands are handed to a SHELL (`execSync`), and a user-configured
-// `inference.build` names bare binaries (`vitepress build && vite build`) that
-// only exist under the project's own node_modules/.bin. Under the build
-// container's `npx --yes void deploy` this happens to work — npx prepends every
-// ancestor `.bin` itself — so the gap is invisible there and only bites a
-// directly invoked `node_modules/.bin/void deploy` or a globally installed
-// `void`, where nothing puts the project's bin dir on PATH.
-//
-// It is an explicit OPT-IN (`{ localBinRoot }`), never the default: prepending
-// the project's bin dir makes a dependency-shipped `node_modules/.bin/<name>`
-// shadow the system binary of that name for the child. That is exactly what a
-// build command wants, and exactly what `getGitCommit`'s `git` children — which
-// run BEFORE any build, with `VOID_TOKEN` in env, even in the no-build deploy
-// modes (`--dir`, static/spa presets with no build command) — must not get.
+// localBinRoot is opt-in: git and drizzle-kit children must keep the system PATH,
+// so a dependency's node_modules/.bin cannot shadow them.
 describe('buildEnv — local node_modules/.bin on PATH', () => {
   const DELIMITER = process.platform === 'win32' ? ';' : ':';
 
@@ -629,18 +532,6 @@ describe('buildEnv — local node_modules/.bin on PATH', () => {
     }
   }
 
-  it('prepends <root>/node_modules/.bin', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-build-env-'));
-    try {
-      const childPath = readPath(buildEnv(undefined, { localBinRoot: root }));
-      expect(childPath?.startsWith(toSlash(join(root, 'node_modules', '.bin')) + DELIMITER)).toBe(
-        true,
-      );
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
   it('preserves the inherited PATH after the prepended entry', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-build-env-'));
     try {
@@ -655,22 +546,6 @@ describe('buildEnv — local node_modules/.bin on PATH', () => {
     }
   });
 
-  it('uses the platform PATH delimiter', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-build-env-'));
-    try {
-      withInheritedPath('/usr/bin', () => {
-        const childPath = readPath(buildEnv(undefined, { localBinRoot: root }));
-        const binDir = toSlash(join(root, 'node_modules', '.bin'));
-        expect(childPath).toBe(`${binDir}${DELIMITER}/usr/bin`);
-        // Guard against the classic `:`-everywhere bug: on Windows a `:` would
-        // make the whole variable one unusable entry (`C:\...` already has a `:`).
-        expect(DELIMITER).toBe(process.platform === 'win32' ? ';' : ':');
-      });
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
   it('sets PATH to just the bin dir when nothing was inherited', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-build-env-'));
     try {
@@ -705,11 +580,6 @@ describe('buildEnv — local node_modules/.bin on PATH', () => {
     }
   });
 
-  // The privileged case must be opt-in. `getGitCommit` and the drizzle-kit
-  // spawn call `buildEnv()` with no options, and a dependency that ships
-  // `node_modules/.bin/git` must not be able to hijack them — `getGitCommit`
-  // runs before the build and, on `void deploy --dir dist` or a static/spa
-  // preset with no build command, is the ONLY child the deploy spawns.
   it('leaves PATH untouched when no localBinRoot is given', () => {
     withInheritedPath(`/usr/bin${DELIMITER}/bin`, () => {
       expect(readPath(buildEnv())).toBe(`/usr/bin${DELIMITER}/bin`);
@@ -718,13 +588,6 @@ describe('buildEnv — local node_modules/.bin on PATH', () => {
       );
     });
   });
-
-  it('hands the child the parent PATH byte-for-byte when no localBinRoot is given', () => {
-    // Deliberately NOT asserting on `process.cwd()/node_modules/.bin`: the test
-    // runner itself puts that on PATH, so an absence check there would be
-    // vacuous. Identity with the parent is the property that matters.
-    expect(readPath(buildEnv())).toBe(readPath(process.env));
-  });
 });
 
 afterEach(() => {
diff --git a/packages/void/test/unit/deploy-drift.test.ts b/packages/void/test/unit/deploy-drift.test.ts
index 153e31e12..379e54418 100644
--- a/packages/void/test/unit/deploy-drift.test.ts
+++ b/packages/void/test/unit/deploy-drift.test.ts
@@ -12,33 +12,16 @@ import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
 import { generateVoidAuthDrizzleSchema } from '../../src/auth/drizzle.ts';
-import { getDeploySchemaDriftMessage } from '../../src/cli/deploy-drift.ts';
-import { hasDeploySchemaDrift, validateAuthMigrationSchema } from '../../src/cli/deploy.ts';
+import { getDeploySchemaDriftMessage, hasDeploySchemaDrift } from '../../src/cli/deploy-drift.ts';
+import { validateAuthMigrationSchema } from '../../src/cli/deploy-migrations.ts';
 import { writeDrizzleConfig } from '../../src/drizzle/config.ts';
 import { collectMigrations } from '../../src/migrations/collect.ts';
+import { WRANGLER_AUTH_CREDENTIAL_ENV_VARS } from '../../src/shared/untrusted-env.ts';
 
 const packageRoot = fileURLToPath(new URL('../..', import.meta.url));
 const drizzleKitBin = join(fileURLToPath(import.meta.resolve('drizzle-kit')), '..', 'bin.cjs');
 const tempDirs: Array<string> = [];
 
-/**
- * Wrangler's FULL credential env-var set (canonical names + deprecated `CF_*` aliases),
- * mirroring `WRANGLER_AUTH_CREDENTIAL_ENV_VARS` in deploy.ts.
- */
-const WRANGLER_AUTH_VARS = [
-  'CLOUDFLARE_API_TOKEN',
-  'CF_API_TOKEN',
-  'CLOUDFLARE_API_KEY',
-  'CF_API_KEY',
-  'CLOUDFLARE_EMAIL',
-  'CF_EMAIL',
-  'CLOUDFLARE_API_USER_SERVICE_KEY',
-  'WRANGLER_CF_AUTHORIZATION_TOKEN',
-  'WRANGLER_R2_SQL_AUTH_TOKEN',
-  'CLOUDFLARE_ACCESS_CLIENT_ID',
-  'CLOUDFLARE_ACCESS_CLIENT_SECRET',
-];
-
 // These cases run real Drizzle processes (up to three per test). Windows CI can take
 // over five seconds even when every operation succeeds; keep that budget local to this suite.
 const driftTestTimeout = process.platform === 'win32' ? 30_000 : 10_000;
@@ -74,6 +57,9 @@ describe('hasDeploySchemaDrift', { timeout: driftTestTimeout }, () => {
     expect(hasDeploySchemaDrift(root, 'sqlite')).toBe(true);
     expect(snapshotDir(migrationsDir)).toEqual(before);
     expect(existsSync(join(root, '.void', 'deploy-drift-check'))).toBe(false);
+    expect(getDeploySchemaDriftMessage(root)).toContain(
+      'Run `void db generate`, review the generated migration',
+    );
   });
 
   it('keeps generated Better Auth tables in the deploy drift check', () => {
@@ -130,7 +116,7 @@ describe('hasDeploySchemaDrift', { timeout: driftTestTimeout }, () => {
         'import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";',
         '',
         `writeFileSync(${JSON.stringify(leakFile)}, JSON.stringify({`,
-        ...WRANGLER_AUTH_VARS.map(
+        ...WRANGLER_AUTH_CREDENTIAL_ENV_VARS.map(
           (name) => `  ${name}: process.env[${JSON.stringify(name)}] ?? null,`,
         ),
         '}));',
@@ -144,20 +130,18 @@ describe('hasDeploySchemaDrift', { timeout: driftTestTimeout }, () => {
     );
 
     const saved: Record<string, string | undefined> = {};
-    for (const name of WRANGLER_AUTH_VARS) {
+    for (const name of WRANGLER_AUTH_CREDENTIAL_ENV_VARS) {
       saved[name] = process.env[name];
       process.env[name] = `secret-${name}`;
     }
     try {
-      // The managed path reaches this helper too, and never loads the provision module —
-      // so this also proves the scrub does not depend on that module being present.
       hasDeploySchemaDrift(root, 'sqlite');
       const leaked = JSON.parse(readFileSync(leakFile, 'utf-8')) as Record<string, string | null>;
-      for (const name of WRANGLER_AUTH_VARS) {
+      for (const name of WRANGLER_AUTH_CREDENTIAL_ENV_VARS) {
         expect(leaked[name]).toBeNull();
       }
     } finally {
-      for (const name of WRANGLER_AUTH_VARS) {
+      for (const name of WRANGLER_AUTH_CREDENTIAL_ENV_VARS) {
         if (saved[name] === undefined) {
           delete process.env[name];
         } else {
@@ -184,18 +168,6 @@ describe('hasDeploySchemaDrift', { timeout: driftTestTimeout }, () => {
     );
   });
 
-  it('keeps the generate advice when Drizzle metadata exists', () => {
-    const root = createTempApp();
-    writeSqliteSchema(root);
-    generateMigrations(root);
-    writeSqliteSchema(root, { includeEmail: true });
-
-    expect(hasDeploySchemaDrift(root, 'sqlite')).toBe(true);
-    expect(getDeploySchemaDriftMessage(root)).toContain(
-      'Run `void db generate`, review the generated migration',
-    );
-  });
-
   it('throws when drizzle-kit cannot evaluate the schema', () => {
     const root = createTempApp();
     writeFileSync(
diff --git a/packages/void/test/unit/deploy-email-platform-path.test.ts b/packages/void/test/unit/deploy-email-platform-path.test.ts
index a59444352..28de7b935 100644
--- a/packages/void/test/unit/deploy-email-platform-path.test.ts
+++ b/packages/void/test/unit/deploy-email-platform-path.test.ts
@@ -3,7 +3,7 @@ import { dirname, join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 import { runDeploy } from '../../src/cli/deploy.ts';
 
-// The Mode B email step (design doc 0078) belongs to `void deploy --platform cloudflare` ONLY.
+// The native Cloudflare email step belongs to `void deploy --platform cloudflare` ONLY.
 // This drives the MANAGED path on a project that uses email in every way the step detects
 // (an `email/` handler AND `void.json` `email.from`) far enough to reach the full-deploy branch,
 // and proves the email module was never invoked — no preflight, no apply, no bearer, no prompt.
@@ -114,7 +114,7 @@ afterEach(() => {
   rmSync(tmpDir, { recursive: true, force: true });
 });
 
-describe('managed `void deploy` never runs the Mode B email step', () => {
+describe('managed `void deploy` never runs the native Cloudflare email step', () => {
   it('reaches the full-deploy branch on an email-using project without touching the email module', async () => {
     // `dist/ssr` stands in for a built worker so `skipBuild` gets past the output check without
     // running Vite; the path then runs config, inference (which sees the `void/email` import),
diff --git a/packages/void/test/unit/deploy-events.test.ts b/packages/void/test/unit/deploy-events.test.ts
index 20f3c3f61..d81ab2b10 100644
--- a/packages/void/test/unit/deploy-events.test.ts
+++ b/packages/void/test/unit/deploy-events.test.ts
@@ -17,7 +17,7 @@ import {
   streamDeployEvents,
   warnIgnoredNotFoundForFramework,
   warnUnpublishedRouting,
-} from '../../src/cli/deploy.ts';
+} from '../../src/cli/deploy-managed-events.ts';
 import type { CliLogger } from '../../src/cli/log-file.ts';
 import type { DeployEvent } from '../../src/cli/types.ts';
 
@@ -179,23 +179,6 @@ describe('applyDeployEvent', () => {
     expect(calls.stop).toHaveLength(0);
   });
 
-  it('clears the spinner without a duplicate success message when published is true', () => {
-    const { spinner, calls } = createMockSpinner();
-    const done: DoneEvent = {
-      event: 'done',
-      deployment: 'dpl_1',
-      url: 'https://app.void.app',
-      urls: ['https://app.void.app'],
-      assets: 0,
-      workers: 1,
-      published: true,
-    };
-    const result = applyDeployEvent(done, spinner);
-    expect(result).toEqual({ kind: 'done', event: done });
-    expect(calls.clear).toHaveLength(1);
-    expect(calls.stop).toHaveLength(0);
-  });
-
   it('degrades the done message when published is false but still resolves as a committed done', () => {
     const { spinner, calls } = createMockSpinner();
     const done: DoneEvent = {
diff --git a/packages/void/test/unit/deploy-platform.test.ts b/packages/void/test/unit/deploy-platform.test.ts
index 481d35a07..b8b08dd49 100644
--- a/packages/void/test/unit/deploy-platform.test.ts
+++ b/packages/void/test/unit/deploy-platform.test.ts
@@ -2,11 +2,8 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
-import {
-  assertManagedDurableStateSupported,
-  resolveDeploymentPlatform,
-  runDeploy,
-} from '../../src/cli/deploy.ts';
+import { assertManagedDurableStateSupported } from '../../src/cli/deploy-managed-framework.ts';
+import { resolveDeploymentPlatform, runDeploy } from '../../src/cli/deploy.ts';
 
 const roots: Array<string> = [];
 
@@ -27,21 +24,11 @@ describe('resolveDeploymentPlatform', () => {
     }
   });
 
-  it('uses the saved platform', () => {
-    expect(resolveDeploymentPlatform(makeRoot({ platform: 'cloudflare' }))).toBe('cloudflare');
-    expect(resolveDeploymentPlatform(makeRoot({ platform: 'none' }))).toBe('none');
-  });
-
   it('lets an explicit platform override the saved preference', () => {
     const root = makeRoot({ platform: 'cloudflare' });
     expect(resolveDeploymentPlatform(root, { platform: 'void' })).toBe('void');
   });
 
-  it('infers Void for legacy linked projects', () => {
-    const root = makeRoot({ projectId: 'proj_123', slug: 'demo' });
-    expect(resolveDeploymentPlatform(root)).toBe('void');
-  });
-
   it('retains Void as the fallback for projects initialized by older SDKs', () => {
     expect(resolveDeploymentPlatform(makeRoot())).toBe('void');
   });
diff --git a/packages/void/test/unit/deploy-prerender-skip.test.ts b/packages/void/test/unit/deploy-prerender-skip.test.ts
index 91288b5da..baeee8ad7 100644
--- a/packages/void/test/unit/deploy-prerender-skip.test.ts
+++ b/packages/void/test/unit/deploy-prerender-skip.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vite-plus/test';
-import { hasPrerenderSources } from '../../src/cli/deploy.ts';
+import { hasPrerenderSources } from '../../src/cli/deploy-helpers.ts';
 import { compileRouteTable } from '../../src/router/compile.ts';
 import type { ScanResult } from '../../src/router/scan.ts';
 
diff --git a/packages/void/test/unit/deploy-project-setup.test.ts b/packages/void/test/unit/deploy-project-setup.test.ts
index f29d0c98d..5e6ee3fec 100644
--- a/packages/void/test/unit/deploy-project-setup.test.ts
+++ b/packages/void/test/unit/deploy-project-setup.test.ts
@@ -76,7 +76,7 @@ describe('promptDeployProjectConfig', () => {
   it.each(['create', 'link'])(
     'keeps the saved destination when choosing to %s a temporary deployment project',
     async (action) => {
-      const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
+      const { promptDeployProjectConfig } = await import('../../src/cli/deploy-helpers.ts');
       const client = createClient();
       vi.stubEnv('VOID_API_URL', client.apiUrl);
       const projectFile = join(root, '.void/project.json');
@@ -115,7 +115,7 @@ describe('promptDeployProjectConfig', () => {
   );
 
   it('does not show link option when there are no existing projects', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
+    const { promptDeployProjectConfig } = await import('../../src/cli/deploy-helpers.ts');
     const client = createClient();
     client.listProjectChoices.mockResolvedValueOnce([]);
     client.createProject.mockResolvedValueOnce({ id: 'proj_new', slug: 'new-app' });
@@ -125,6 +125,7 @@ describe('promptDeployProjectConfig', () => {
     const config = await promptDeployProjectConfig(root, client);
 
     expect(client.listProjectChoices).toHaveBeenCalledOnce();
+    expect(mockSelect).toHaveBeenCalledTimes(1);
     expect(mockSelect).toHaveBeenCalledWith({
       message: 'Set up a Void project for deploy:',
       options: [{ value: 'create', label: 'Create a new project' }],
@@ -161,59 +162,8 @@ describe('promptDeployProjectConfig', () => {
     expect(promptConfig.validate(' ')).toBe('Project slug is required.');
   });
 
-  it('re-prompts when the server rejects a short slug for a free-plan user', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
-    const { PlatformApiError } = await import('../../src/cli/client.ts');
-    const client = createClient();
-    client.listProjectChoices.mockResolvedValueOnce([]);
-    client.createProject
-      .mockRejectedValueOnce(
-        new PlatformApiError(
-          'createProject',
-          403,
-          JSON.stringify({ error: 'short slugs (5 characters or fewer) require a paid plan' }),
-        ),
-      )
-      .mockResolvedValueOnce({ id: 'proj_new', slug: 'longer-app' });
-    mockSelect.mockResolvedValueOnce('create');
-    mockText.mockResolvedValueOnce('oxc').mockResolvedValueOnce('longer-app');
-
-    const config = await promptDeployProjectConfig(root, client);
-
-    expect(client.createProject).toHaveBeenNthCalledWith(1, 'oxc');
-    expect(client.createProject).toHaveBeenNthCalledWith(2, 'longer-app');
-    expect(mockText).toHaveBeenCalledTimes(2);
-    expect(config).toEqual({ projectId: 'proj_new', slug: 'longer-app' });
-  });
-
-  it('retries when 403 body mentions slug but code is generic', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
-    const { PlatformApiError } = await import('../../src/cli/client.ts');
-    const client = createClient();
-    client.listProjectChoices.mockResolvedValueOnce([]);
-    // Generic top-level error code with the slug detail only in `message` —
-    // the retry check must inspect both fields, not short-circuit on `code`.
-    client.createProject
-      .mockRejectedValueOnce(
-        new PlatformApiError(
-          'createProject',
-          403,
-          JSON.stringify({ error: 'forbidden', message: 'slug too short for plan' }),
-        ),
-      )
-      .mockResolvedValueOnce({ id: 'proj_new', slug: 'longer-app' });
-    mockSelect.mockResolvedValueOnce('create');
-    mockText.mockResolvedValueOnce('oxc').mockResolvedValueOnce('longer-app');
-
-    const config = await promptDeployProjectConfig(root, client);
-
-    expect(client.createProject).toHaveBeenNthCalledWith(1, 'oxc');
-    expect(client.createProject).toHaveBeenNthCalledWith(2, 'longer-app');
-    expect(config).toEqual({ projectId: 'proj_new', slug: 'longer-app' });
-  });
-
   it('does not retry on non-slug 403 errors (e.g. account suspended)', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
+    const { promptDeployProjectConfig } = await import('../../src/cli/deploy-helpers.ts');
     const { PlatformApiError } = await import('../../src/cli/client.ts');
     const client = createClient();
     client.listProjectChoices.mockResolvedValueOnce([]);
@@ -229,40 +179,8 @@ describe('promptDeployProjectConfig', () => {
     expect(mockText).toHaveBeenCalledTimes(1);
   });
 
-  it('does not show project names when creating with existing projects available', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
-    const client = createClient();
-    client.listProjectChoices.mockResolvedValueOnce([
-      {
-        id: 'proj_1',
-        user_id: 'user_1',
-        slug: 'existing-app',
-        type: 'worker',
-        created_at: '2026-04-24T00:00:00.000Z',
-        custom_domain: null,
-      },
-    ]);
-    client.createProject.mockResolvedValueOnce({ id: 'proj_new', slug: 'new-app' });
-    mockSelect.mockResolvedValueOnce('create');
-    mockText.mockResolvedValueOnce('new-app');
-
-    const config = await promptDeployProjectConfig(root, client);
-
-    expect(client.listProjectChoices).toHaveBeenCalledOnce();
-    expect(mockSelect).toHaveBeenCalledTimes(1);
-    expect(mockSelect.mock.calls[0]?.[0]).toMatchObject({
-      message: 'Set up a Void project for deploy:',
-      options: [
-        { value: 'create', label: 'Create a new project' },
-        { value: 'link', label: 'Link an existing project' },
-      ],
-    });
-    expect(JSON.stringify(mockSelect.mock.calls[0]?.[0])).not.toContain('existing-app');
-    expect(config).toEqual({ projectId: 'proj_new', slug: 'new-app' });
-  });
-
   it('only shows project names after the user chooses to link', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
+    const { promptDeployProjectConfig } = await import('../../src/cli/deploy-helpers.ts');
     const client = createClient();
     client.listProjectChoices.mockResolvedValueOnce([
       {
@@ -306,7 +224,7 @@ describe('promptDeployProjectConfig', () => {
   });
 
   it('hides reader projects and identifies roles when selecting a deployment destination', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
+    const { promptDeployProjectConfig } = await import('../../src/cli/deploy-helpers.ts');
     const client = createClient();
     client.listProjectChoices.mockResolvedValueOnce([
       { id: 'proj_reader', slug: 'read-only-app', role: 'reader' },
@@ -340,7 +258,7 @@ describe('promptDeployProjectConfig', () => {
   });
 
   it('offers project creation without an empty link picker when every project is read-only', async () => {
-    const { promptDeployProjectConfig } = await import('../../src/cli/deploy.ts');
+    const { promptDeployProjectConfig } = await import('../../src/cli/deploy-helpers.ts');
     const client = createClient();
     client.listProjectChoices.mockResolvedValueOnce([
       { id: 'proj_reader', slug: 'read-only-app', role: 'reader' },
diff --git a/packages/void/test/unit/deploy-project.test.ts b/packages/void/test/unit/deploy-project.test.ts
index 0d0de7857..836696af6 100644
--- a/packages/void/test/unit/deploy-project.test.ts
+++ b/packages/void/test/unit/deploy-project.test.ts
@@ -3,19 +3,18 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { toSlash } from 'pathslash';
 import { afterEach, describe, expect, it } from 'vite-plus/test';
+import { resolveDistDir, resolveWorkerDirName } from '../../src/cli/build-output-dir.ts';
 import type { PlatformClient, ProjectResponse } from '../../src/cli/client.ts';
 import {
   ensurePreviouslyDeployedLiveBindingConfig,
   generateDeployWrapperIfNeeded,
   resolveDeployLiveBindingConfig,
   resolveDeployWorkerMain,
-  resolveDistDir,
   resolveDeployWranglerCompat,
   resolveFullDeployBuildCommand,
   resolveStaticDeployPreset,
   resolveStaticBuildCommand,
-  resolveWorkerDirName,
-} from '../../src/cli/deploy.ts';
+} from '../../src/cli/deploy-helpers.ts';
 import {
   formatProjectCommand,
   resolveProjectCommand,
@@ -29,6 +28,13 @@ import {
 
 const tempDirs: Array<string> = [];
 
+afterEach(() => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop()!;
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 describe('getRequestedProjectSlug', () => {
   afterEach(() => {
     delete process.env.VOID_PROJECT;
@@ -72,10 +78,6 @@ describe('resolveProjectBySlug', () => {
     });
   });
 
-  it('returns null when slug is not found', () => {
-    expect(resolveProjectBySlug([], 'missing')).toBeNull();
-  });
-
   it('returns null when slug does not match any project', () => {
     const projects = [
       { id: 'proj_1', slug: 'app-one' },
@@ -86,13 +88,6 @@ describe('resolveProjectBySlug', () => {
 });
 
 describe('inferDefaultSlug', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('derives slug from a scoped package name', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -111,13 +106,6 @@ describe('inferDefaultSlug', () => {
 });
 
 describe('resolveDistDir', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('returns dist/ for non-framework deploys', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -166,13 +154,6 @@ describe('resolveDistDir', () => {
 });
 
 describe('resolveDeployWranglerCompat', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('does not pin compatibility_date for non-Cloudflare targets', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -215,13 +196,6 @@ describe('resolveDeployWranglerCompat', () => {
 });
 
 describe('resolveDeployWorkerMain', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('uses the build output wrangler main for non-framework Void deploys', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -254,13 +228,6 @@ describe('resolveDeployWorkerMain', () => {
 });
 
 describe('ensurePreviouslyDeployedLiveBindingConfig', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('restores the active deployment live binding into wrangler config', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -312,13 +279,6 @@ describe('ensurePreviouslyDeployedLiveBindingConfig', () => {
 });
 
 describe('resolveDeployLiveBindingConfig', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('does not restore or activate live bindings when current source no longer needs live', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -427,12 +387,6 @@ describe('resolveStaticBuildCommand', () => {
   });
 });
 
-// The FULL (Class A / Void app) deploy used to hardcode `vite build`, ignoring
-// `inference.build`. That made "two builds, one command" impossible: an SSG that
-// emits the site first and then lets Void's own build package it (via
-// `publicDir`) alongside the worker had no way to say so, and a repo with no
-// root `index.html` died on `[UNRESOLVED_ENTRY] Cannot resolve entry module
-// index.html`. The static and framework paths already honored the override.
 describe('resolveFullDeployBuildCommand', () => {
   const root = '/tmp/void-full-deploy-build-cmd';
 
@@ -443,46 +397,18 @@ describe('resolveFullDeployBuildCommand', () => {
     });
   });
 
-  it('prints exactly what it runs for a configured command', () => {
-    // No `formatProjectCommand`/`resolveProjectCommand` rewriting on the
-    // override path — the user's text is both shown and executed, so a shell
-    // chain like `a && b` cannot be mangled into an unrunnable single command.
-    const { label, command } = resolveFullDeployBuildCommand(root, 'pnpm run build:site');
-    expect(label).toBe(command);
-  });
-
-  it('falls back to the built-in vite build when inference.build is unset', () => {
-    expect(resolveFullDeployBuildCommand(root)).toEqual({
-      label: formatProjectCommand(root, 'vite build'),
-      command: resolveProjectCommand(root, 'vite build'),
-    });
-  });
-
-  it('keeps the fallback label/command distinction (display vs. local bin)', () => {
-    // `formatProjectCommand` is the user-facing form (`vite` → `vp`, no absolute
-    // path); `resolveProjectCommand` expands to node_modules/.bin. Collapsing
-    // them would either print an absolute path or execute an unresolvable bin.
-    const { label, command } = resolveFullDeployBuildCommand(root);
-    expect(label).toBe(formatProjectCommand(root, 'vite build'));
-    expect(command).toBe(resolveProjectCommand(root, 'vite build'));
-  });
-
-  it('treats an empty inference.build as unset', () => {
-    expect(resolveFullDeployBuildCommand(root, '')).toEqual({
-      label: formatProjectCommand(root, 'vite build'),
-      command: resolveProjectCommand(root, 'vite build'),
-    });
-  });
+  it.each([undefined, ''])(
+    'falls back to the built-in vite build for inference.build %j',
+    (build) => {
+      expect(resolveFullDeployBuildCommand(root, build)).toEqual({
+        label: formatProjectCommand(root, 'vite build'),
+        command: resolveProjectCommand(root, 'vite build'),
+      });
+    },
+  );
 });
 
 describe('resolveStaticDeployPreset', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('treats --dir as a static deploy override even in framework-shaped projects', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -526,13 +452,6 @@ describe('resolveStaticDeployPreset', () => {
 });
 
 describe('resolveWorkerDirName', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('returns preset worker subdir for react-router', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -593,13 +512,6 @@ describe('resolveWorkerDirName', () => {
 });
 
 describe('generateDeployWrapperIfNeeded', () => {
-  afterEach(() => {
-    while (tempDirs.length > 0) {
-      const dir = tempDirs.pop()!;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   it('wraps class-a framework worker output when migrations are present', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-test-'));
     tempDirs.push(root);
@@ -626,6 +538,7 @@ describe('generateDeployWrapperIfNeeded', () => {
     expect(wrapper).toContain('import original from "./__original.js"');
     expect(wrapper).toContain('createMigrationHandler');
     expect(wrapper).toContain('/__void/migrate');
-    expect(wrapper).toContain('"postgresql"');
+    const handler = readFileSync(join(workerDir, '__void_migration_handler.mjs'), 'utf-8');
+    expect(handler).toContain('VALUES ($1, $2)');
   });
 });
diff --git a/packages/void/test/unit/deploy-static-only.test.ts b/packages/void/test/unit/deploy-static-only.test.ts
index b5050bb80..c3b891219 100644
--- a/packages/void/test/unit/deploy-static-only.test.ts
+++ b/packages/void/test/unit/deploy-static-only.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vite-plus/test';
-import { hasNonPageBackend } from '../../src/cli/deploy.ts';
+import { hasNonPageBackend } from '../../src/cli/deploy-helpers.ts';
 
 const NONE = {
   hasRoutes: false,
@@ -25,11 +25,4 @@ describe('hasNonPageBackend', () => {
   ] as const)('is true when %s is the only surface', (key) => {
     expect(hasNonPageBackend({ ...NONE, [key]: true })).toBe(true);
   });
-
-  // An `email/` handler compiles to the worker's `email()` export. The
-  // static-site path uploads no worker at all, so taking it would drop every
-  // inbound handler and bounce the mail with no error at deploy time.
-  it('keeps an email-only project on the worker path', () => {
-    expect(hasNonPageBackend({ ...NONE, hasEmail: true })).toBe(true);
-  });
 });
diff --git a/packages/void/test/unit/detect-exports.test.ts b/packages/void/test/unit/detect-exports.test.ts
index 4c3fdf25a..6d8396e2c 100644
--- a/packages/void/test/unit/detect-exports.test.ts
+++ b/packages/void/test/unit/detect-exports.test.ts
@@ -21,26 +21,11 @@ describe('detectHttpExports', () => {
     rmSync(TMP, { recursive: true, force: true });
   });
 
-  it('detects export const GET', () => {
-    const path = writeRoute('hello.ts', 'export const GET = () => "ok";');
-    expect(detectHttpExports(path)).toEqual(['GET']);
-  });
-
   it('detects export function POST', () => {
     const path = writeRoute('hello.ts', 'export function POST() { return "ok"; }');
     expect(detectHttpExports(path)).toEqual(['POST']);
   });
 
-  it('detects multiple methods', () => {
-    const path = writeRoute(
-      'users.ts',
-      `export const GET = () => [];
-export const POST = () => ({ created: true });
-export const DELETE = () => ({ deleted: true });`,
-    );
-    expect(detectHttpExports(path)).toEqual(['GET', 'POST', 'DELETE']);
-  });
-
   it('detects re-exported methods', () => {
     const path = writeRoute(
       'hello.ts',
diff --git a/packages/void/test/unit/direct-r2-client.test.ts b/packages/void/test/unit/direct-r2-client.test.ts
index 404499c4f..affaa299d 100644
--- a/packages/void/test/unit/direct-r2-client.test.ts
+++ b/packages/void/test/unit/direct-r2-client.test.ts
@@ -118,19 +118,6 @@ describe('PlatformClient.requestUploadUrls', () => {
       aabbccdd: { url: 'https://r2/.../1', headers: { 'Content-Md5': 'abc==' } },
     });
   });
-
-  it('throws PlatformApiError on non-2xx', async () => {
-    fetchMock.mockResolvedValueOnce(new Response('forbidden', { status: 403 }));
-    const client = makeClient();
-    await expect(
-      client.requestUploadUrls(projectId, [
-        { blake3: 'a'.repeat(32), md5: 'b'.repeat(32), size: 1, contentType: 'text/plain' },
-      ]),
-    ).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 403,
-    });
-  });
 });
 
 describe('PlatformClient.getMigrationStatus', () => {
@@ -268,16 +255,6 @@ describe('PlatformClient.finalizeDeploy', () => {
     ]);
   });
 
-  it('throws PlatformApiError on non-2xx', async () => {
-    fetchMock.mockResolvedValueOnce(new Response('busted', { status: 500 }));
-    const client = makeClient();
-    const gen = client.finalizeDeploy(projectId, makePayload());
-    await expect(gen.next()).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 500,
-    });
-  });
-
   function makeCliLog() {
     return {
       info: vi.fn(),
@@ -341,40 +318,6 @@ describe('PlatformClient.finalizeDeploy', () => {
     }
   });
 
-  it('throws the original error after exhausting transport retries', async () => {
-    vi.useFakeTimers();
-    fetchMock.mockImplementation(() => Promise.reject(new TypeError('fetch failed')));
-
-    const cliLog = makeCliLog();
-    const client = new PlatformClient(token, { apiUrl, cliLog });
-    try {
-      const consume = (async () => {
-        for await (const _event of client.finalizeDeploy(projectId, makePayload())) {
-          // unreachable — every attempt rejects
-        }
-      })();
-      const assertion = expect(consume).rejects.toBeInstanceOf(TypeError);
-      await vi.runAllTimersAsync();
-      await assertion;
-
-      // 1 initial attempt + 3 retries — no dedupe GETs.
-      expect(deployPostCalls()).toHaveLength(4);
-      expect(deploymentListCalls()).toHaveLength(0);
-      const retries = cliLog.warn.mock.calls.filter(([msg]) => msg === 'deploy_fetch_retry');
-      expect(retries.map(([, fields]) => fields?.delayMs)).toEqual([1000, 5000, 10000]);
-      expect(cliLog.error).toHaveBeenCalledWith(
-        'deploy_fetch_rejected',
-        expect.any(TypeError),
-        expect.objectContaining({
-          url: `${apiUrl}/projects/${projectId}/deploy`,
-          attempts: 4,
-        }),
-      );
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
   it('surfaces the server 409 as an error event when a deploy is already in progress', async () => {
     vi.useFakeTimers();
     // The replay hits the authoritative concurrency guard — possibly the
@@ -491,7 +434,7 @@ describe('PlatformClient.finalizeDeploy', () => {
       expect(cliLog.error).toHaveBeenCalledWith(
         'deploy_fetch_rejected',
         expect.any(TypeError),
-        expect.objectContaining({ attempts: 4 }),
+        expect.objectContaining({ url: `${apiUrl}/projects/${projectId}/deploy`, attempts: 4 }),
       );
     } finally {
       vi.useRealTimers();
@@ -1028,130 +971,71 @@ describe('PlatformClient.finalizeDeploy', () => {
   });
 });
 
-// The deploy command keeps the CF Access service-token PAIR out of the untrusted
-// build children (via `buildEnv()` on the spawn env) so they can't read the
-// shared staging credential. That is only safe because the client captures the
-// Access headers AT CONSTRUCTION and reuses them — proven here: delete the env
-// vars after construction, then verify a later API call STILL sends
-// CF-Access-Client-Id / CF-Access-Client-Secret. (deploy.ts no longer mutates
-// process.env; this test deletes them itself to assert the capture invariant.)
+// The deploy command keeps the CF Access service-token pair out of untrusted
+// build children (via `buildEnv()` on the spawn env). That is only safe because
+// the client captures the Access headers at construction and reuses them.
 describe('PlatformClient CF Access header capture (survives a later env scrub)', () => {
   it('keeps sending CF-Access headers after CF_ACCESS_* are deleted from process.env', async () => {
     vi.stubEnv('VOID_ACCESS_ORIGIN', 'https://api.staging.void.cloud');
-    const savedId = process.env.CF_ACCESS_CLIENT_ID;
-    const savedSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    try {
-      process.env.CF_ACCESS_CLIENT_ID = 'svc-id.access';
-      process.env.CF_ACCESS_CLIENT_SECRET = 'svc-secret';
-
-      // Construct a known Access-gated staging client, which captures the
-      // credentials before the untrusted build environment is scrubbed.
-      const client = new PlatformClient(token, { apiUrl: 'https://api.staging.void.cloud' });
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', 'svc-id.access');
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'svc-secret');
+    const client = new PlatformClient(token, { apiUrl: 'https://api.staging.void.cloud' });
 
-      // Simulate deploy.ts's scrub (before any user build spawns).
-      delete process.env.CF_ACCESS_CLIENT_ID;
-      delete process.env.CF_ACCESS_CLIENT_SECRET;
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', undefined);
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', undefined);
 
-      fetchMock.mockResolvedValueOnce(jsonResponse({ urls: {} }));
-      await client.requestUploadUrls(projectId, [
-        { blake3: 'a'.repeat(32), md5: 'b'.repeat(32), size: 1, contentType: 'text/plain' },
-      ]);
+    fetchMock.mockResolvedValueOnce(jsonResponse({ urls: {} }));
+    await client.requestUploadUrls(projectId, [
+      { blake3: 'a'.repeat(32), md5: 'b'.repeat(32), size: 1, contentType: 'text/plain' },
+    ]);
 
-      const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-      const headers = init.headers as Record<string, string>;
-      expect(headers['CF-Access-Client-Id']).toBe('svc-id.access');
-      expect(headers['CF-Access-Client-Secret']).toBe('svc-secret');
-    } finally {
-      if (savedId === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_ID;
-      } else {
-        process.env.CF_ACCESS_CLIENT_ID = savedId;
-      }
-      if (savedSecret === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_SECRET;
-      } else {
-        process.env.CF_ACCESS_CLIENT_SECRET = savedSecret;
-      }
-    }
+    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    const headers = init.headers as Record<string, string>;
+    expect(headers['CF-Access-Client-Id']).toBe('svc-id.access');
+    expect(headers['CF-Access-Client-Secret']).toBe('svc-secret');
   });
 
   it('does not send staging Access credentials to a self-hosted platform', async () => {
-    const savedId = process.env.CF_ACCESS_CLIENT_ID;
-    const savedSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    try {
-      process.env.CF_ACCESS_CLIENT_ID = 'svc-id.access';
-      process.env.CF_ACCESS_CLIENT_SECRET = 'svc-secret';
-      const client = makeClient();
-      fetchMock.mockResolvedValueOnce(jsonResponse({ urls: {} }));
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', 'svc-id.access');
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'svc-secret');
+    const client = makeClient();
+    fetchMock.mockResolvedValueOnce(jsonResponse({ urls: {} }));
 
-      await client.requestUploadUrls(projectId, [
-        { blake3: 'a'.repeat(32), md5: 'b'.repeat(32), size: 1, contentType: 'text/plain' },
-      ]);
+    await client.requestUploadUrls(projectId, [
+      { blake3: 'a'.repeat(32), md5: 'b'.repeat(32), size: 1, contentType: 'text/plain' },
+    ]);
 
-      const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-      const headers = init.headers as Record<string, string>;
-      expect(headers['CF-Access-Client-Id']).toBeUndefined();
-      expect(headers['CF-Access-Client-Secret']).toBeUndefined();
-    } finally {
-      if (savedId === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_ID;
-      } else {
-        process.env.CF_ACCESS_CLIENT_ID = savedId;
-      }
-      if (savedSecret === undefined) {
-        delete process.env.CF_ACCESS_CLIENT_SECRET;
-      } else {
-        process.env.CF_ACCESS_CLIENT_SECRET = savedSecret;
-      }
-    }
+    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    const headers = init.headers as Record<string, string>;
+    expect(headers['CF-Access-Client-Id']).toBeUndefined();
+    expect(headers['CF-Access-Client-Secret']).toBeUndefined();
   });
 
   it('uses a browser-renewed Access token acquired after construction', async () => {
-    const savedToken = process.env.CF_ACCESS_TOKEN;
-    const savedId = process.env.CF_ACCESS_CLIENT_ID;
-    const savedSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    const savedCredentials = process.env.VOID_ACCESS_CREDENTIALS;
-    const savedOrigin = process.env.VOID_ACCESS_ORIGIN;
-    try {
-      delete process.env.CF_ACCESS_CLIENT_ID;
-      delete process.env.CF_ACCESS_CLIENT_SECRET;
-      delete process.env.VOID_ACCESS_CREDENTIALS;
-      process.env.VOID_ACCESS_ORIGIN = 'https://api.staging.void.cloud';
-      const tokenFor = (label: string) =>
-        'header.' +
-        Buffer.from(JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 3600, label })).toString(
-          'base64url',
-        ) +
-        '.signature';
-      process.env.CF_ACCESS_TOKEN = tokenFor('initial');
-      const client = new PlatformClient(token, { apiUrl: 'https://api.staging.void.cloud' });
-
-      const renewedToken = tokenFor('renewed');
-      process.env.CF_ACCESS_TOKEN = renewedToken;
-      fetchMock.mockResolvedValueOnce(jsonResponse({ urls: {} }));
-      await client.requestUploadUrls(projectId, [
-        { blake3: 'a'.repeat(32), md5: 'b'.repeat(32), size: 1, contentType: 'text/plain' },
-      ]);
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', undefined);
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', undefined);
+    vi.stubEnv('VOID_ACCESS_CREDENTIALS', undefined);
+    vi.stubEnv('VOID_ACCESS_ORIGIN', 'https://api.staging.void.cloud');
+    const tokenFor = (label: string) =>
+      'header.' +
+      Buffer.from(JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 3600, label })).toString(
+        'base64url',
+      ) +
+      '.signature';
+    vi.stubEnv('CF_ACCESS_TOKEN', tokenFor('initial'));
+    const client = new PlatformClient(token, { apiUrl: 'https://api.staging.void.cloud' });
+
+    const renewedToken = tokenFor('renewed');
+    vi.stubEnv('CF_ACCESS_TOKEN', renewedToken);
+    fetchMock.mockResolvedValueOnce(jsonResponse({ urls: {} }));
+    await client.requestUploadUrls(projectId, [
+      { blake3: 'a'.repeat(32), md5: 'b'.repeat(32), size: 1, contentType: 'text/plain' },
+    ]);
 
-      const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-      const headers = init.headers as Record<string, string>;
-      expect(headers['cf-access-token']).toBe(renewedToken);
-      expect(headers['CF-Access-Client-Id']).toBeUndefined();
-    } finally {
-      for (const [name, value] of [
-        ['CF_ACCESS_TOKEN', savedToken],
-        ['CF_ACCESS_CLIENT_ID', savedId],
-        ['CF_ACCESS_CLIENT_SECRET', savedSecret],
-        ['VOID_ACCESS_CREDENTIALS', savedCredentials],
-        ['VOID_ACCESS_ORIGIN', savedOrigin],
-      ] as const) {
-        if (value === undefined) {
-          delete process.env[name];
-        } else {
-          process.env[name] = value;
-        }
-      }
-    }
+    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    const headers = init.headers as Record<string, string>;
+    expect(headers['cf-access-token']).toBe(renewedToken);
+    expect(headers['CF-Access-Client-Id']).toBeUndefined();
   });
 });
 
@@ -1159,8 +1043,6 @@ describe('PlatformClient Cloudflare Access challenge renewal', () => {
   const origin = 'https://api.example.com';
   const accessJwt = (seconds: number) =>
     `e30.${Buffer.from(JSON.stringify({ exp: Math.floor(Date.now() / 1000) + seconds })).toString('base64url')}.signature`;
-  let savedCredentials: string | undefined;
-  let savedOrigin: string | undefined;
   let stdinTty: boolean | undefined;
   let stdoutTty: boolean | undefined;
 
@@ -1168,24 +1050,12 @@ describe('PlatformClient Cloudflare Access challenge renewal', () => {
     spawnSyncMock.mockReset();
     accessKeyring.read.mockReset().mockReturnValue(null);
     accessKeyring.write.mockReset().mockReturnValue(true);
-    savedCredentials = process.env.VOID_ACCESS_CREDENTIALS;
-    savedOrigin = process.env.VOID_ACCESS_ORIGIN;
     stdinTty = process.stdin.isTTY;
     stdoutTty = process.stdout.isTTY;
-    delete process.env.VOID_ACCESS_ORIGIN;
+    vi.stubEnv('VOID_ACCESS_ORIGIN', undefined);
   });
 
   afterEach(() => {
-    if (savedCredentials === undefined) {
-      delete process.env.VOID_ACCESS_CREDENTIALS;
-    } else {
-      process.env.VOID_ACCESS_CREDENTIALS = savedCredentials;
-    }
-    if (savedOrigin === undefined) {
-      delete process.env.VOID_ACCESS_ORIGIN;
-    } else {
-      process.env.VOID_ACCESS_ORIGIN = savedOrigin;
-    }
     Object.defineProperty(process.stdin, 'isTTY', { configurable: true, value: stdinTty });
     Object.defineProperty(process.stdout, 'isTTY', { configurable: true, value: stdoutTty });
   });
@@ -1193,9 +1063,7 @@ describe('PlatformClient Cloudflare Access challenge renewal', () => {
   it('renews a rejected human token and retries once at the original API endpoint', async () => {
     const stale = accessJwt(600);
     const fresh = accessJwt(900);
-    process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-      [origin]: { CF_ACCESS_TOKEN: stale },
-    });
+    vi.stubEnv('VOID_ACCESS_CREDENTIALS', JSON.stringify({ [origin]: { CF_ACCESS_TOKEN: stale } }));
     Object.defineProperty(process.stdin, 'isTTY', { configurable: true, value: true });
     Object.defineProperty(process.stdout, 'isTTY', { configurable: true, value: true });
     spawnSyncMock.mockImplementation((_command, args: Array<string>) =>
@@ -1229,9 +1097,10 @@ describe('PlatformClient Cloudflare Access challenge renewal', () => {
   });
 
   it('does not retry ambiguous API errors', async () => {
-    process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-      [origin]: { CF_ACCESS_TOKEN: accessJwt(600) },
-    });
+    vi.stubEnv(
+      'VOID_ACCESS_CREDENTIALS',
+      JSON.stringify({ [origin]: { CF_ACCESS_TOKEN: accessJwt(600) } }),
+    );
     fetchMock.mockResolvedValueOnce(new Response('application failure', { status: 500 }));
 
     await expect(
@@ -1242,16 +1111,16 @@ describe('PlatformClient Cloudflare Access challenge renewal', () => {
   });
 
   it('does not replace a rejected scoped service credential with a human login', async () => {
-    process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-      [origin]: {
-        CF_ACCESS_CLIENT_ID: 'ci-client',
-        CF_ACCESS_CLIENT_SECRET: 'ci-secret',
-      },
-    });
+    vi.stubEnv(
+      'VOID_ACCESS_CREDENTIALS',
+      JSON.stringify({
+        [origin]: { CF_ACCESS_CLIENT_ID: 'ci-client', CF_ACCESS_CLIENT_SECRET: 'ci-secret' },
+      }),
+    );
     Object.defineProperty(process.stdin, 'isTTY', { configurable: true, value: false });
     Object.defineProperty(process.stdout, 'isTTY', { configurable: true, value: false });
     const client = new PlatformClient(token, { apiUrl: origin });
-    delete process.env.VOID_ACCESS_CREDENTIALS;
+    vi.stubEnv('VOID_ACCESS_CREDENTIALS', undefined);
     fetchMock.mockResolvedValueOnce(
       new Response(null, {
         status: 302,
diff --git a/packages/void/test/unit/direct-r2-deploy.test.ts b/packages/void/test/unit/direct-r2-deploy.test.ts
index 2a343fe64..42bf8321f 100644
--- a/packages/void/test/unit/direct-r2-deploy.test.ts
+++ b/packages/void/test/unit/direct-r2-deploy.test.ts
@@ -4,11 +4,8 @@ import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 import { withPlatformDiscovery } from '../helpers/platform-discovery.ts';
 
-// Capture how many times each asset path is read via `readFileSync`. Mocked
-// before any importer of `node:fs` so the spy is in place when `package.ts`
-// resolves its `import { readFileSync } from 'node:fs'` binding. Only assets
-// inside the test fixture directory are counted; other reads (e.g.
-// .assetsignore lookup misses) pass through to the real fs.
+// Spy on `readFileSync` to count asset reads. Mocked before any importer of
+// `node:fs` so `package.ts` binds to the spy.
 vi.mock('node:fs', async () => {
   const actual = await vi.importActual<typeof import('node:fs')>('node:fs');
   return {
@@ -60,7 +57,7 @@ vi.mock('../../src/cli/output.ts', async () => {
 const fsModule = await import('node:fs');
 const readFileSyncMock = fsModule.readFileSync as unknown as ReturnType<typeof vi.fn>;
 
-const { runStaticDeploy } = await import('../../src/cli/deploy.ts');
+const { runStaticDeploy } = await import('../../src/cli/deploy-managed-static.ts');
 const { openDeployLog } = await import('../../src/cli/log-file.ts');
 const { PlatformClient } = await import('../../src/cli/client.ts');
 
@@ -222,6 +219,32 @@ function openTestLog(): ReturnType<typeof openDeployLog> {
   return log;
 }
 
+function deploy(
+  options: {
+    client?: InstanceType<typeof PlatformClient>;
+    appType?: 'spa' | 'static';
+    routing?: Parameters<typeof runStaticDeploy>[10];
+    cliLog?: Parameters<typeof runStaticDeploy>[11];
+    notFound?: Parameters<typeof runStaticDeploy>[12];
+  } = {},
+): Promise<void> {
+  return runStaticDeploy(
+    workdir,
+    { projectId: 'proj_t', slug: 'test' },
+    options.client ?? makeClient(),
+    { buildCommand: null, outputDir: assetsDir, appType: options.appType ?? 'spa' },
+    true,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    options.routing,
+    options.cliLog,
+    options.notFound,
+  );
+}
+
 describe('direct-to-R2 deploy flow', () => {
   it.each([true, undefined, false])(
     'prints a single success after the box only when routing is published (%s)',
@@ -233,13 +256,7 @@ describe('direct-to-R2 deploy flow', () => {
       events.at(-1)!.published = published;
       installPlatformMocks({ finalizeEvents: events });
 
-      await runStaticDeploy(
-        workdir,
-        { projectId: 'proj_t', slug: 'test' },
-        makeClient(),
-        { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-        true,
-      );
+      await deploy();
 
       expect(summary).toHaveBeenCalledOnce();
       if (published === false) {
@@ -256,30 +273,14 @@ describe('direct-to-R2 deploy flow', () => {
 
   it('uploads assets directly to R2 then calls finalize JSON endpoint', async () => {
     const state = installPlatformMocks();
-    const client = makeClient();
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true, // skipBuild
-      undefined, // gitMetadata
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined, // cliLog (tested separately)
-    );
+    await deploy();
 
-    // Preflight + upload-urls + R2 PUTs + finalize were called once each.
     expect(state.preflightCalls).toHaveLength(1);
     expect(state.uploadUrlsCalls).toHaveLength(1);
     expect(state.r2PutCalls).toHaveLength(4);
     expect(state.finalizeCalls).toHaveLength(1);
 
-    // Each R2 PUT carries Content-Md5 and the asset bytes.
     for (const { init } of state.r2PutCalls) {
       const headers = init.headers as Record<string, string>;
       expect(headers['Content-Md5']).toBeDefined();
@@ -288,7 +289,6 @@ describe('direct-to-R2 deploy flow', () => {
       expect(init.body).toBeInstanceOf(Uint8Array);
     }
 
-    // Body payload of finalize is JSON, not multipart.
     const finalize = state.finalizeCalls[0];
     expect((finalize.init.headers as Record<string, string>)['Content-Type']).toBe(
       'application/json',
@@ -300,36 +300,16 @@ describe('direct-to-R2 deploy flow', () => {
       md5: expect.any(String),
       size: fixtureFiles['/index.html'].length,
     });
-    expect(finalizeBody.preflight).toBe(null); // skipped=0 means no preflight reuse
-    expect(finalizeBody.workerFiles).toBeUndefined(); // static → no worker bytes
+    expect(finalizeBody.preflight).toBe(null);
+    expect(finalizeBody.workerFiles).toBeUndefined();
   });
 
   it('reads each asset file from disk EXACTLY ONCE end-to-end', async () => {
     installPlatformMocks();
-    const client = makeClient();
 
-    // Reset the mock so we count ONLY reads from this run.
-    readFileSyncMock.mockClear();
+    await deploy();
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-    );
-
-    // Filter to just the fixture files — `.assetsignore` lookup may fire
-    // an additional read against a file that doesn't exist (caught and
-    // swallowed by package.ts via existsSync), but that's not an asset
-    // re-read so we filter it out.
+    // Other files, such as config, are read through the same mock.
     const reads = readFileSyncMock.mock.calls.filter(([p]: Array<unknown>) => {
       const path = String(p);
       return (
@@ -340,20 +320,12 @@ describe('direct-to-R2 deploy flow', () => {
       );
     });
 
-    // 4 fixture assets × 1 read each = 4 reads total. The new direct-to-R2
-    // flow uses the in-memory `assetFiles` cache from collectAndHashAssets
-    // for the upload phase — no second pass over the disk.
     expect(reads).toHaveLength(4);
     const uniquePaths = new Set(reads.map(([p]: Array<unknown>) => String(p)));
     expect(uniquePaths.size).toBe(4);
   });
 
   it('prunes the in-memory assetFiles cache to needed-only after preflight', async () => {
-    // 4 fixture assets, only 1 needed: pruning should drop 3 buffers
-    // immediately after preflight, and the per-PUT cleanup should drop
-    // the last one once R2 acks the upload. We assert via the JSONL log,
-    // which captures both the pre/post-prune sizes (`asset_cache_pruned`)
-    // and the upload events (`r2_put_end`).
     installPlatformMocks({
       preflightNeeded: ['/index.html'],
       preflightSkipped: 3,
@@ -363,20 +335,7 @@ describe('direct-to-R2 deploy flow', () => {
     expect(logPath).toBeTruthy();
     const client = new PlatformClient('test-token', { apiUrl: 'https://api.test', cliLog });
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      cliLog,
-    );
+    await deploy({ client, cliLog });
 
     await cliLog.close();
     const lines = readFileSync(logPath as string, 'utf-8')
@@ -385,35 +344,18 @@ describe('direct-to-R2 deploy flow', () => {
       .map((l) => JSON.parse(l) as { msg: string; before?: number; after?: number });
     const prune = lines.find((l) => l.msg === 'asset_cache_pruned');
     expect(prune).toBeDefined();
-    // Before prune: 4 fixture buffers in the cache. After: 1 (the only
-    // needed asset). Per-PUT cleanup runs after this event so the log
-    // value here is the post-prune-but-pre-PUT size.
     expect(prune?.before).toBe(4);
     expect(prune?.after).toBe(1);
   });
 
   it('does not log asset_cache_pruned when nothing was skipped', async () => {
-    // All 4 needed → prune is a no-op and we suppress the noisy log.
     installPlatformMocks();
     const cliLog = openDeployLog();
     const logPath = cliLog.path;
     expect(logPath).toBeTruthy();
     const client = new PlatformClient('test-token', { apiUrl: 'https://api.test', cliLog });
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      cliLog,
-    );
+    await deploy({ client, cliLog });
 
     await cliLog.close();
     const lines = readFileSync(logPath as string, 'utf-8')
@@ -425,22 +367,8 @@ describe('direct-to-R2 deploy flow', () => {
 
   it('skips upload-urls + R2 PUT phase when no assets are needed', async () => {
     const state = installPlatformMocks({ preflightNeeded: [], preflightSkipped: 4 });
-    const client = makeClient();
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-    );
+    await deploy();
 
     expect(state.uploadUrlsCalls).toHaveLength(0);
     expect(state.r2PutCalls).toHaveLength(0);
@@ -456,13 +384,7 @@ describe('direct-to-R2 deploy flow', () => {
       writeFileSync(join(assetsDir, '_redirects'), '/old /about 302\n/rewrite /about 200\n');
       const state = installPlatformMocks();
 
-      await runStaticDeploy(
-        workdir,
-        { projectId: 'proj_t', slug: 'test' },
-        makeClient(),
-        { buildCommand: null, outputDir: assetsDir, appType },
-        true,
-      );
+      await deploy({ appType });
 
       const body = JSON.parse(state.finalizeCalls[0].init.body as string);
       expect(body.manifest.headerRules).toEqual([
@@ -501,29 +423,11 @@ describe('direct-to-R2 deploy flow', () => {
     expect(body.manifest.headerRules).toEqual(headerRules);
   });
 
-  // `routing.notFound` must reach the STATIC manifest, not only the
-  // worker-with-assets path. `detectPreset` classifies any Vite project with
-  // no backend files as `spa`, so a plain Vite MPA lands here and would
-  // otherwise ship `not_found_handling: 'single-page-application'` — every
-  // unknown URL answered with index.html and HTTP 200.
+  // A plain Vite MPA is detected as `spa`, so its notFound must reach the static manifest.
   it('threads routing.notFound into the finalize manifest (static path)', async () => {
     const state = installPlatformMocks();
-    const client = makeClient();
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      { notFound: '404-page' },
-      undefined,
-    );
+    await deploy({ routing: { notFound: '404-page' } });
 
     const body = JSON.parse(state.finalizeCalls[0].init.body as string);
     expect(body.manifest.type).toBe('spa');
@@ -539,23 +443,8 @@ describe('direct-to-R2 deploy flow', () => {
   // dedicated trailing param or it is silently dropped there too.
   it('honors an explicit notFound when routing is undefined (full->static redirect shape)', async () => {
     const state = installPlatformMocks();
-    const client = makeClient();
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'static' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      'single-page-application',
-    );
+    await deploy({ appType: 'static', notFound: 'single-page-application' });
 
     const body = JSON.parse(state.finalizeCalls[0].init.body as string);
     expect(body.manifest.assetConfig).toEqual({
@@ -563,67 +452,14 @@ describe('direct-to-R2 deploy flow', () => {
     });
   });
 
-  it('retries 5xx R2 PUT failures up to 3 times', async () => {
-    let attemptsForFirstAsset = 0;
-    const state = installPlatformMocks({
-      r2PutBehavior(url) {
-        // Pick a deterministic asset and fail it 2 times.
-        if (url.includes('/') && attemptsForFirstAsset < 2) {
-          // Match only the very first PUT URL (preserve mock state)
-          attemptsForFirstAsset++;
-          if (attemptsForFirstAsset <= 2) {
-            return new Response('temporary', { status: 503 });
-          }
-        }
-        return new Response(null, { status: 200 });
-      },
-    });
-    const client = makeClient();
-
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-    );
-
-    // 4 assets but the first one was retried 2 times, so total PUTs = 4 + 2 = 6.
-    expect(state.r2PutCalls.length).toBeGreaterThanOrEqual(5);
-    expect(state.finalizeCalls).toHaveLength(1);
-  });
-
   it('surfaces 4xx R2 PUT errors with asset path and hash', async () => {
     installPlatformMocks({
       r2PutBehavior() {
         return new Response('SignatureMismatch', { status: 403 });
       },
     });
-    const client = makeClient();
-
-    await expect(
-      runStaticDeploy(
-        workdir,
-        { projectId: 'proj_t', slug: 'test' },
-        client,
-        { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-        true,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-      ),
-    ).rejects.toThrow(/R2 PUT failed.+SignatureMismatch/);
+
+    await expect(deploy()).rejects.toThrow(/R2 PUT failed.+SignatureMismatch/);
   });
 
   it('writes presign + r2_put + finalize events to the JSONL log', async () => {
@@ -634,20 +470,7 @@ describe('direct-to-R2 deploy flow', () => {
 
     const client = new PlatformClient('test-token', { apiUrl: 'https://api.test', cliLog });
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      cliLog,
-    );
+    await deploy({ client, cliLog });
 
     await cliLog.close();
     const lines = readFileSync(capturedLogPath as string, 'utf-8')
@@ -664,14 +487,6 @@ describe('direct-to-R2 deploy flow', () => {
   });
 
   it('dedupes presign + R2 PUT by content hash when paths share blake3', async () => {
-    // Two files with identical content → identical blake3. The upload
-    // phase must collapse to ONE presign + ONE PUT, but the final
-    // assetManifest must still list BOTH paths (the platform builds the
-    // per-path serving manifest from it).
-    //
-    // We build a fresh fixture: keep `index.html` and `style.css` from
-    // the default set, plus two extra files with the same identical
-    // content so the duplicates are an explicit pair.
     const sharedHtml = '<!doctype html><html><body>shared</body></html>\n';
     const dupeRel = '/about.html';
     const dupeRel2 = '/contact.html';
@@ -680,26 +495,9 @@ describe('direct-to-R2 deploy flow', () => {
 
     const allPaths = [...Object.keys(fixtureFiles), dupeRel, dupeRel2];
     const state = installPlatformMocks({ preflightNeeded: allPaths });
-    const client = makeClient();
 
-    await runStaticDeploy(
-      workdir,
-      { projectId: 'proj_t', slug: 'test' },
-      client,
-      { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-      true,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-    );
+    await deploy();
 
-    // 6 paths total but only 5 unique blake3 values (about.html ==
-    // contact.html). Presign request body MUST contain 5 entries,
-    // R2 PUTs MUST be 5, NOT 6.
     expect(state.uploadUrlsCalls).toHaveLength(1);
     const presign = state.uploadUrlsCalls[0] as {
       assets: Array<{ blake3: string }>;
@@ -712,8 +510,6 @@ describe('direct-to-R2 deploy flow', () => {
     const r2Hashes = new Set(state.r2PutCalls.map(({ url }) => url.split('/').pop()));
     expect(r2Hashes.size).toBe(5);
 
-    // The finalize payload's assetManifest still includes BOTH duplicate
-    // paths so the platform-side per-path serving manifest is complete.
     expect(state.finalizeCalls).toHaveLength(1);
     const finalizeBody = JSON.parse(state.finalizeCalls[0].init.body as string);
     expect(finalizeBody.assetManifest[dupeRel]).toBeDefined();
@@ -733,22 +529,9 @@ describe('direct-to-R2 deploy flow', () => {
 
     const client = new PlatformClient('test-token', { apiUrl: 'https://api.test', cliLog });
 
-    await expect(
-      runStaticDeploy(
-        workdir,
-        { projectId: 'proj_t', slug: 'test' },
-        client,
-        { buildCommand: null, outputDir: assetsDir, appType: 'spa' },
-        true,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        cliLog,
-      ),
-    ).rejects.toThrow(new RegExp(escapeRegex(logPath as string)));
+    await expect(deploy({ client, cliLog })).rejects.toThrow(
+      new RegExp(escapeRegex(logPath as string)),
+    );
 
     await cliLog.close();
   });
diff --git a/packages/void/test/unit/domain-command.test.ts b/packages/void/test/unit/domain-command.test.ts
index a4e150dfb..e10e2f774 100644
--- a/packages/void/test/unit/domain-command.test.ts
+++ b/packages/void/test/unit/domain-command.test.ts
@@ -70,10 +70,6 @@ vi.mock('../../src/cli/client', () => ({
 
 const root = '/project';
 
-function args(overrides: Partial<DomainArgs> & Pick<DomainArgs, 'subcommand'>): DomainArgs {
-  return { ...overrides };
-}
-
 beforeEach(() => {
   mockLogError.mockReset();
   mockLogSuccess.mockReset();
@@ -102,7 +98,7 @@ describe('runDomainCommand top-level guards', () => {
   it('fails when no token is found', async () => {
     mockGetToken.mockReturnValue(null);
 
-    await runExpectingExit(root, args({ subcommand: 'list' }));
+    await runExpectingExit(root, { subcommand: 'list' });
 
     expect(mockLogError).toHaveBeenCalledWith('Not logged in. Run `void account login` first.');
     expect(mockExit).toHaveBeenCalledWith(1);
@@ -112,7 +108,7 @@ describe('runDomainCommand top-level guards', () => {
     mockListProjects.mockResolvedValue([{ slug: 'foo', id: 'proj_foo' }]);
     mockListDomains.mockResolvedValue([]);
 
-    await runDomainCommand(root, args({ subcommand: 'list', projectSlug: 'foo' }));
+    await runDomainCommand(root, { subcommand: 'list', projectSlug: 'foo' });
 
     expect(mockListDomains).toHaveBeenCalledWith('proj_foo');
   });
@@ -121,7 +117,7 @@ describe('runDomainCommand top-level guards', () => {
     mockReadProjectConfig.mockReturnValue({ projectId: 'proj_linked', slug: 'linked' });
     mockListDomains.mockResolvedValue([]);
 
-    await runDomainCommand(root, args({ subcommand: 'list' }));
+    await runDomainCommand(root, { subcommand: 'list' });
 
     expect(mockListDomains).toHaveBeenCalledWith('proj_linked');
   });
@@ -129,7 +125,7 @@ describe('runDomainCommand top-level guards', () => {
   it('errors when no project resolvable', async () => {
     mockReadProjectConfig.mockReturnValue(null);
 
-    await runExpectingExit(root, args({ subcommand: 'list' }));
+    await runExpectingExit(root, { subcommand: 'list' });
 
     expect(mockLogError).toHaveBeenCalledWith(
       'No linked project. Run `void project link` or pass --project <name>.',
@@ -151,7 +147,7 @@ describe('domainAdd', () => {
       ownership_verification: { type: 'txt', name: '_cf-custom-hostname.foo', value: 'own-token' },
     });
 
-    await runDomainCommand(root, args({ subcommand: 'add', hostname: 'foo.example.com' }));
+    await runDomainCommand(root, { subcommand: 'add', hostname: 'foo.example.com' });
 
     expect(mockNote).toHaveBeenCalledTimes(1);
     const content = mockNote.mock.calls[0][0] as string;
@@ -161,6 +157,12 @@ describe('domainAdd', () => {
     expect(content).toContain('_cf-custom-hostname.foo → own-token');
     // HTTP-DCV: no user-facing SSL-validation records.
     expect(content).not.toContain('TXT (SSL validation)');
+    expect(content.indexOf('CNAME (traffic)')).toBeLessThan(
+      content.indexOf('TXT (ownership verification)'),
+    );
+    expect(content).toContain(
+      'Add the records above to your DNS, then run `void domain status foo.example.com` to check progress.',
+    );
   });
 
   it('skips ownership section when ownership_verification is missing', async () => {
@@ -174,7 +176,7 @@ describe('domainAdd', () => {
       cname_target: 'cname.example',
     });
 
-    await runDomainCommand(root, args({ subcommand: 'add', hostname: 'foo.example.com' }));
+    await runDomainCommand(root, { subcommand: 'add', hostname: 'foo.example.com' });
 
     const content = mockNote.mock.calls[0][0] as string;
     expect(content).toContain('CNAME (traffic)');
@@ -186,47 +188,6 @@ describe('domainAdd', () => {
     );
     expect(content).not.toContain('both');
   });
-
-  it('appends the summary line to the DNS Setup block', async () => {
-    mockAddDomain.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      cname_target: 'cname.example',
-      ownership_verification: { type: 'txt', name: 'own-name', value: 'own-value' },
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'add', hostname: 'foo.example.com' }));
-
-    const content = mockNote.mock.calls[0][0] as string;
-    expect(content).toContain(
-      'Add the records above to your DNS, then run `void domain status foo.example.com` to check progress.',
-    );
-  });
-
-  it('orders sections CNAME -> ownership', async () => {
-    mockAddDomain.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      cname_target: 'cname.example',
-      ownership_verification: { type: 'txt', name: 'own-name', value: 'own-value' },
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'add', hostname: 'foo.example.com' }));
-
-    const content = mockNote.mock.calls[0][0] as string;
-    const cnameIdx = content.indexOf('CNAME (traffic)');
-    const ownershipIdx = content.indexOf('TXT (ownership verification)');
-    expect(cnameIdx).toBeGreaterThanOrEqual(0);
-    expect(ownershipIdx).toBeGreaterThan(cnameIdx);
-  });
 });
 
 describe('domainStatus rollup', () => {
@@ -239,7 +200,7 @@ describe('domainStatus rollup', () => {
   it('errors when hostname not found on project', async () => {
     mockListDomains.mockResolvedValue([]);
 
-    await runExpectingExit(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
+    await runExpectingExit(root, { subcommand: 'status', hostname: 'foo.example.com' });
 
     expect(mockLogError).toHaveBeenCalledWith(
       "domain: Domain 'foo.example.com' not found on this project.",
@@ -261,256 +222,16 @@ describe('domainStatus rollup', () => {
       verification_errors: ['DNS validation timed out', 'second error'],
     });
 
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
+    await runDomainCommand(root, { subcommand: 'status', hostname: 'foo.example.com' });
 
     const statusNote = mockNote.mock.calls[0][0] as string;
     expect(statusNote).toContain('Status:   error — Verification failed: DNS validation timed out');
     // Only the first error surfaces in the rollup line.
     expect(statusNote).not.toContain('second error');
   });
-
-  it('renders awaiting_deployment state when bit is true', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'active',
-      cf_status: 'active',
-      awaiting_deployment: true,
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   awaiting_deployment —');
-    expect(statusNote).toContain(
-      'Your project has no live deployment yet. Run `void deploy` to bring the domain online.',
-    );
-  });
-
-  it('renders awaiting_dns state when cf_status=pending and ownership_verification present', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'pending_validation',
-      cf_status: 'pending',
-      ownership_verification: { type: 'txt', name: '_cf-custom-hostname.foo', value: 'own-token' },
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   awaiting_dns —');
-    expect(statusNote).toContain(
-      'Cloudflare has not yet observed your _cf-custom-hostname TXT record.',
-    );
-  });
-
-  it('renders verifying_dns state when cf_status=pending_validation', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'pending_validation',
-      cf_status: 'pending_validation',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   verifying_dns —');
-    expect(statusNote).toContain('DNS records found, Cloudflare is validating ownership.');
-  });
-
-  it('renders issuing_cert state when cf_status=pending_issuance', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'pending_validation',
-      cf_status: 'pending_issuance',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   issuing_cert —');
-    expect(statusNote).toContain('Cloudflare is issuing the SSL certificate');
-  });
-
-  it("computes 'issuing_cert' for the cert-renewal window (CF active + SSL not active)", async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      cf_status: 'active',
-      ssl_status: 'pending_validation',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   issuing_cert —');
-    expect(statusNote).toContain('Cloudflare is issuing the SSL certificate');
-  });
-
-  it("computes 'issuing_cert' over 'active' when DB is active but SSL is re-validating", async () => {
-    mockListDomains.mockResolvedValue([
-      { id: 'dom_1', hostname: 'foo.example.com', status: 'active' },
-    ]);
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'active',
-      created_at: 'now',
-      cf_status: 'active',
-      ssl_status: 'pending_validation',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   issuing_cert —');
-  });
-
-  it('issuing_cert cites the traffic CNAME and renders it when cname_target is set', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      cf_status: 'pending_issuance',
-      ssl_status: 'pending_validation',
-      cname_target: 'cname.void.app',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   issuing_cert —');
-    expect(statusNote).toContain('confirm the traffic CNAME below is published');
-    // The CNAME block it cites is actually rendered.
-    const allNotes = mockNote.mock.calls.map((c) => c[0] as string).join('\n');
-    expect(allNotes).toContain('CNAME (traffic)');
-    expect(allNotes).toContain('foo.example.com → cname.void.app');
-  });
-
-  it('renders deploying_cert state when cf_status=pending_deployment', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'pending_validation',
-      cf_status: 'pending_deployment',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   deploying_cert —');
-    expect(statusNote).toContain(
-      'SSL certificate issued; Cloudflare is propagating it to its edge.',
-    );
-  });
-
-  it('renders active state when DB status is active', async () => {
-    mockListDomains.mockResolvedValue([
-      { id: 'dom_1', hostname: 'foo.example.com', status: 'active' },
-    ]);
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'active',
-      created_at: 'now',
-      ssl_status: 'active',
-      cf_status: 'active',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   active — Live.');
-  });
-
-  it('falls back to pending when cf_status and awaiting_deployment are absent (old API)', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'pending_validation',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain(
-      'Status:   pending — Verification pending. Cloudflare is processing.',
-    );
-  });
-
-  it('error state takes priority over awaiting_deployment and cf_status states', async () => {
-    setupDomain();
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'pending_validation',
-      cf_status: 'pending_validation',
-      awaiting_deployment: true,
-      verification_errors: ['some failure'],
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    const statusNote = mockNote.mock.calls[0][0] as string;
-    expect(statusNote).toContain('Status:   error —');
-  });
 });
 
 describe('computeRollup', () => {
-  // Direct table-driven test for the rollup state machine, exercising
-  // `computeRollup` without going through `runDomainCommand`. The
-  // `domainStatus rollup` block above covers the rendering side
-  // (rollup -> note() lines).
   const baseStatus: DomainStatusResponse = {
     id: 'dom_1',
     project_id: 'p',
@@ -522,56 +243,77 @@ describe('computeRollup', () => {
     cname_target: 'cname.void.app',
   };
 
-  const cases: Array<[name: string, input: Partial<DomainStatusResponse>, expectedState: string]> =
+  const issuing =
+    'Cloudflare is issuing the SSL certificate automatically (typically <5 minutes). If this persists, confirm the traffic CNAME below is published.';
+  const verifying = 'DNS records found, Cloudflare is validating ownership.';
+  const pending = 'Verification pending. Cloudflare is processing.';
+  const cases: Array<
+    [name: string, input: Partial<DomainStatusResponse>, state: string, diagnostic: string]
+  > = [
+    [
+      'error wins over everything',
+      { verification_errors: ['boom'], cf_status: 'active', awaiting_deployment: true },
+      'error',
+      'Verification failed: boom',
+    ],
+    [
+      'awaiting_deployment beats CF states',
+      { awaiting_deployment: true, cf_status: 'pending' },
+      'awaiting_deployment',
+      'Your project has no live deployment yet. Run `void deploy` to bring the domain online.',
+    ],
+    [
+      'awaiting_dns on pending + ownership',
+      {
+        cf_status: 'pending',
+        ownership_verification: { type: 'txt', name: 'n', value: 'v' },
+      },
+      'awaiting_dns',
+      'Cloudflare has not yet observed your _cf-custom-hostname TXT record. Confirm it is published at the host shown below.',
+    ],
+    ['verifying_dns', { cf_status: 'pending_validation' }, 'verifying_dns', verifying],
+    [
+      'issuing_cert on pending_issuance',
+      { cf_status: 'pending_issuance' },
+      'issuing_cert',
+      issuing,
+    ],
+    [
+      'issuing_cert on cert-renewal (cf active + ssl pending), even when DB is active',
+      { status: 'active', cf_status: 'active', ssl_status: 'pending_validation' },
+      'issuing_cert',
+      issuing,
+    ],
+    [
+      'deploying_cert',
+      { cf_status: 'pending_deployment' },
+      'deploying_cert',
+      'SSL certificate issued; Cloudflare is propagating it to its edge.',
+    ],
     [
-      [
-        'error wins over everything',
-        { verification_errors: ['boom'], cf_status: 'active', awaiting_deployment: true },
-        'error',
-      ],
-      [
-        'awaiting_deployment beats CF states',
-        { awaiting_deployment: true, cf_status: 'pending' },
-        'awaiting_deployment',
-      ],
-      [
-        'awaiting_dns on pending + ownership',
-        {
-          cf_status: 'pending',
-          ownership_verification: { type: 'txt', name: 'n', value: 'v' },
-        },
-        'awaiting_dns',
-      ],
-      ['verifying_dns', { cf_status: 'pending_validation' }, 'verifying_dns'],
-      ['issuing_cert on pending_issuance', { cf_status: 'pending_issuance' }, 'issuing_cert'],
-      [
-        'issuing_cert on cert-renewal (cf active + ssl pending)',
-        { cf_status: 'active', ssl_status: 'pending_validation' },
-        'issuing_cert',
-      ],
-      ['deploying_cert', { cf_status: 'pending_deployment' }, 'deploying_cert'],
-      [
-        'active when DB active and CF/ssl both active',
-        { status: 'active', cf_status: 'active', ssl_status: 'active' },
-        'active',
-      ],
-      ['pending fallback when no signals', {}, 'pending'],
-      [
-        'active gated on ssl_status — pre-rollout platform during cert renewal',
-        { status: 'active', ssl_status: 'pending_validation' },
-        'pending',
-      ],
-      [
-        'empty verification_errors does NOT trigger error',
-        { verification_errors: [], cf_status: 'pending_validation' },
-        'verifying_dns',
-      ],
-    ];
-
-  for (const [name, input, expectedState] of cases) {
+      'active when DB active and CF/ssl both active',
+      { status: 'active', cf_status: 'active', ssl_status: 'active' },
+      'active',
+      'Live.',
+    ],
+    ['pending fallback when no signals', {}, 'pending', pending],
+    [
+      'active gated on ssl_status — pre-rollout platform during cert renewal',
+      { status: 'active', ssl_status: 'pending_validation' },
+      'pending',
+      pending,
+    ],
+    [
+      'empty verification_errors does NOT trigger error',
+      { verification_errors: [], cf_status: 'pending_validation' },
+      'verifying_dns',
+      verifying,
+    ],
+  ];
+
+  for (const [name, input, state, diagnostic] of cases) {
     it(name, () => {
-      const rollup = computeRollup({ ...baseStatus, ...input });
-      expect(rollup.state).toBe(expectedState);
+      expect(computeRollup({ ...baseStatus, ...input })).toEqual({ state, diagnostic });
     });
   }
 });
@@ -594,10 +336,11 @@ describe('domainStatus --verbose', () => {
       verification_errors: ['boom'],
     });
 
-    await runDomainCommand(
-      root,
-      args({ subcommand: 'status', hostname: 'foo.example.com', verbose: true }),
-    );
+    await runDomainCommand(root, {
+      subcommand: 'status',
+      hostname: 'foo.example.com',
+      verbose: true,
+    });
 
     const statusNote = mockNote.mock.calls[0][0] as string;
     expect(statusNote).toContain('Status:   error —');
@@ -623,7 +366,7 @@ describe('domainStatus --verbose', () => {
       cf_status: 'pending_validation',
     });
 
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
+    await runDomainCommand(root, { subcommand: 'status', hostname: 'foo.example.com' });
 
     const statusNote = mockNote.mock.calls[0][0] as string;
     expect(statusNote).not.toContain('SSL Status:');
@@ -649,7 +392,7 @@ describe('domainStatus pending records block', () => {
       cname_target: 'cname.void.app',
     });
 
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
+    await runDomainCommand(root, { subcommand: 'status', hostname: 'foo.example.com' });
 
     expect(mockNote).toHaveBeenCalledTimes(2);
     const pendingNote = mockNote.mock.calls[1][0] as string;
@@ -677,7 +420,7 @@ describe('domainStatus pending records block', () => {
       cname_target: 'cname.void.app',
     });
 
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
+    await runDomainCommand(root, { subcommand: 'status', hostname: 'foo.example.com' });
 
     // Only the Domain Status note — the CNAME is correct by definition when live.
     expect(mockNote).toHaveBeenCalledTimes(1);
@@ -702,7 +445,7 @@ describe('domainStatus pending records block', () => {
       ownership_verification: { type: 'txt', name: 'own-name', value: 'own-value' },
     });
 
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
+    await runDomainCommand(root, { subcommand: 'status', hostname: 'foo.example.com' });
 
     expect(mockNote).toHaveBeenCalledTimes(2);
     const pendingNote = mockNote.mock.calls[1][0] as string;
@@ -719,56 +462,13 @@ describe('domainStatus pending records block', () => {
     // Two records: plural title.
     expect(mockNote.mock.calls[1][1]).toBe('Add these DNS records to your provider');
   });
-
-  it('skips the pending block when status is fully verified', async () => {
-    mockListDomains.mockResolvedValue([
-      { id: 'dom_1', hostname: 'foo.example.com', status: 'active' },
-    ]);
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'active',
-      created_at: 'now',
-      ssl_status: 'active',
-      cf_status: 'active',
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    expect(mockNote).toHaveBeenCalledTimes(1);
-    // The single note call is the Domain Status block; no pending block follows.
-    expect(mockNote.mock.calls[0][1]).toBe('Domain Status');
-  });
-
-  it('exit code stays 0 even when pending', async () => {
-    mockListDomains.mockResolvedValue([
-      { id: 'dom_1', hostname: 'foo.example.com', status: 'pending' },
-    ]);
-    mockGetDomainStatus.mockResolvedValue({
-      id: 'dom_1',
-      project_id: 'proj_default',
-      hostname: 'foo.example.com',
-      cf_hostname_id: 'cf_1',
-      status: 'pending',
-      created_at: 'now',
-      ssl_status: 'pending_validation',
-      cf_status: 'pending',
-      ownership_verification: { type: 'txt', name: 'own-name', value: 'own-value' },
-    });
-
-    await runDomainCommand(root, args({ subcommand: 'status', hostname: 'foo.example.com' }));
-
-    expect(mockExit).not.toHaveBeenCalled();
-  });
 });
 
 describe('domainList', () => {
   it("prints 'No custom domains configured.' info line for empty list", async () => {
     mockListDomains.mockResolvedValue([]);
 
-    await runDomainCommand(root, args({ subcommand: 'list' }));
+    await runDomainCommand(root, { subcommand: 'list' });
 
     expect(mockLogInfo).toHaveBeenCalledWith('No custom domains configured.');
   });
@@ -778,7 +478,7 @@ describe('domainRemove', () => {
   it('errors with not-found message when hostname not in list', async () => {
     mockListDomains.mockResolvedValue([]);
 
-    await runExpectingExit(root, args({ subcommand: 'delete', hostname: 'foo.example.com' }));
+    await runExpectingExit(root, { subcommand: 'delete', hostname: 'foo.example.com' });
 
     expect(mockLogError).toHaveBeenCalledWith(
       "domain: Domain 'foo.example.com' not found on this project.",
diff --git a/packages/void/test/unit/dotenv.test.ts b/packages/void/test/unit/dotenv.test.ts
index 9c70a147b..71ff81eb8 100644
--- a/packages/void/test/unit/dotenv.test.ts
+++ b/packages/void/test/unit/dotenv.test.ts
@@ -38,26 +38,15 @@ describe('parseDotenv', () => {
     expect(out).toEqual({ A: '1', B: '2', C: '3' });
   });
 
-  it('skips invalid keys by default', () => {
+  it('skips invalid keys', () => {
     const out = parseDotenv('GOOD=1\n1BAD=2\nALSO-BAD=3\n');
     expect(out).toEqual({ GOOD: '1' });
   });
 
-  it('throws on invalid keys when skipInvalidKeys=false', () => {
-    expect(() => parseDotenv('1BAD=2\n', { skipInvalidKeys: false })).toThrow(
-      /dotenv: Invalid key/,
-    );
-  });
-
-  it('expands by default', () => {
+  it('expands references to earlier keys', () => {
     const out = parseDotenv('BASE=https://example.com\nAPI=${BASE}/v1\n');
     expect(out).toEqual({ BASE: 'https://example.com', API: 'https://example.com/v1' });
   });
-
-  it('skips expansion when expand=false', () => {
-    const out = parseDotenv('BASE=https://example.com\nAPI=${BASE}/v1\n', { expand: false });
-    expect(out.API).toBe('${BASE}/v1');
-  });
 });
 
 describe('parseDotenv — lines Vite and Wrangler both read', () => {
@@ -74,7 +63,7 @@ describe('parseDotenv — lines Vite and Wrangler both read', () => {
     ['exportE=7', { exportE: '7' }],
     ['export F', {}],
   ])('%j', (line, expected) => {
-    expect(parseDotenv(line, { expand: false })).toEqual(expected);
+    expect(parseDotenv(line)).toEqual(expected);
   });
 
   it('lets a later export line win over an earlier plain line', () => {
@@ -118,7 +107,7 @@ describe('parseDotenv — values read as Vite reads them', () => {
       { DATABASE_URL: 'postgres://db/app' },
     ],
   ])('%s', (_name, content, expected) => {
-    expect(parseDotenv(content, { expand: false })).toEqual(expected);
+    expect(parseDotenv(content)).toEqual(expected);
   });
 });
 
@@ -136,13 +125,6 @@ describe('parseDotenvFile', () => {
       URL: 'https://api.example.com',
     });
   });
-
-  it('reads an export line with an inline comment', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-dotenv-'));
-    const file = join(root, '.env');
-    writeFileSync(file, 'export DATABASE_URL="postgres://db/app" # local\n');
-    expect(parseDotenvFile(file)).toEqual({ DATABASE_URL: 'postgres://db/app' });
-  });
 });
 
 describe('expandDotenv — ${VAR} form', () => {
diff --git a/packages/void/test/unit/drizzle-adapters.test.ts b/packages/void/test/unit/drizzle-adapters.test.ts
deleted file mode 100644
index 6d37fb576..000000000
--- a/packages/void/test/unit/drizzle-adapters.test.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import { describe, expect, it, vi } from 'vite-plus/test';
-
-const { drizzleArktypeMock, drizzleValibotMock, drizzleZodMock } = vi.hoisted(() => ({
-  drizzleArktypeMock: {
-    createInsertSchema: vi.fn(),
-    createSelectSchema: vi.fn(),
-    createUpdateSchema: vi.fn(),
-  },
-  drizzleValibotMock: {
-    createInsertSchema: vi.fn(),
-    createSelectSchema: vi.fn(),
-    createUpdateSchema: vi.fn(),
-  },
-  drizzleZodMock: {
-    createInsertSchema: vi.fn(),
-    createSelectSchema: vi.fn(),
-    createUpdateSchema: vi.fn(),
-  },
-}));
-
-vi.mock('drizzle-zod', () => drizzleZodMock);
-vi.mock('drizzle-valibot', () => drizzleValibotMock);
-vi.mock('drizzle-arktype', () => drizzleArktypeMock);
-
-import * as drizzleArktype from '../../src/runtime/drizzle-arktype.ts';
-import * as drizzleValibot from '../../src/runtime/drizzle-valibot.ts';
-import * as drizzleZod from '../../src/runtime/drizzle-zod.ts';
-
-describe('drizzle validator runtimes', () => {
-  it('re-exports drizzle-zod', () => {
-    expect(drizzleZod.createInsertSchema).toBe(drizzleZodMock.createInsertSchema);
-    expect(drizzleZod.createSelectSchema).toBe(drizzleZodMock.createSelectSchema);
-    expect(drizzleZod.createUpdateSchema).toBe(drizzleZodMock.createUpdateSchema);
-  });
-
-  it('re-exports drizzle-valibot', () => {
-    expect(drizzleValibot.createInsertSchema).toBe(drizzleValibotMock.createInsertSchema);
-    expect(drizzleValibot.createSelectSchema).toBe(drizzleValibotMock.createSelectSchema);
-    expect(drizzleValibot.createUpdateSchema).toBe(drizzleValibotMock.createUpdateSchema);
-  });
-
-  it('re-exports drizzle-arktype', () => {
-    expect(drizzleArktype.createInsertSchema).toBe(drizzleArktypeMock.createInsertSchema);
-    expect(drizzleArktype.createSelectSchema).toBe(drizzleArktypeMock.createSelectSchema);
-    expect(drizzleArktype.createUpdateSchema).toBe(drizzleArktypeMock.createUpdateSchema);
-  });
-});
diff --git a/packages/void/test/unit/drizzle-config.test.ts b/packages/void/test/unit/drizzle-config.test.ts
index 8d41a29b1..601fa0e14 100644
--- a/packages/void/test/unit/drizzle-config.test.ts
+++ b/packages/void/test/unit/drizzle-config.test.ts
@@ -27,12 +27,7 @@ describe('writeDrizzleConfig', () => {
     expect(config.schema).toBe('./db/schema.ts');
     expect(config.out).toBe('./db/migrations');
     expect(config.dbCredentials.url).toBe('/tmp/test.sqlite');
-  });
-
-  it('generates SQLite config by default', () => {
-    const configPath = writeDrizzleConfig(root, '/tmp/test.sqlite');
-    const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-    expect(config.dialect).toBe('sqlite');
+    expect(config.migrations).toEqual({ prefix: 'timestamp' });
   });
 
   it('generates PostgreSQL config', () => {
@@ -52,25 +47,6 @@ describe('writeDrizzleConfig', () => {
     expect(config.dbCredentials.url).toBe('mysql://localhost/test');
   });
 
-  it('generates SQLite config with explicit dialect', () => {
-    const configPath = writeDrizzleConfig(root, '/tmp/test.sqlite', 'sqlite');
-    const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-    expect(config.dialect).toBe('sqlite');
-    expect(config.dbCredentials.url).toBe('/tmp/test.sqlite');
-  });
-
-  it('uses timestamp migration prefix for SQLite', () => {
-    const configPath = writeDrizzleConfig(root, '/tmp/test.sqlite');
-    const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-    expect(config.migrations).toEqual({ prefix: 'timestamp' });
-  });
-
-  it('uses timestamp migration prefix for PostgreSQL', () => {
-    const configPath = writeDrizzleConfig(root, 'postgresql://localhost/test', 'postgresql');
-    const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-    expect(config.migrations).toEqual({ prefix: 'timestamp' });
-  });
-
   it('includes generated schemas alongside the application schema', () => {
     const authSchema = join(root, '.void', 'better-auth-schema.ts');
     writeFileSync(authSchema, 'export const user = {};');
diff --git a/packages/void/test/unit/email-args.test.ts b/packages/void/test/unit/email-args.test.ts
index 21e3b6ab3..9a46fa45d 100644
--- a/packages/void/test/unit/email-args.test.ts
+++ b/packages/void/test/unit/email-args.test.ts
@@ -48,7 +48,7 @@ describe('parseEmailArgs', () => {
   });
 
   it('errors on missing subcommand', () => {
-    expect(() => parseEmailArgs([])).toThrow(/email: Usage:/);
+    expect(() => parseEmailArgs([])).toThrow(/email: Usage: void email .*domain/);
   });
 
   it('errors on unknown subcommand', () => {
@@ -76,9 +76,6 @@ describe('parseEmailArgs', () => {
   });
 
   it('errors when allow receives more than one positional argument', () => {
-    // Previously the second address was silently dropped — confusing UX
-    // for users who typed `void email allow a@x.dev b@y.dev` and didn't
-    // realize only the first took effect.
     expect(() => parseEmailArgs(['allow', 'a@x.dev', 'b@y.dev'])).toThrow(
       /takes exactly one positional argument/,
     );
@@ -90,8 +87,6 @@ describe('parseEmailArgs', () => {
     );
   });
 
-  // Mode B (design doc 0078): `status` and `setup` take `--platform cloudflare` and
-  // read the local project, never a Void project.
   it('parses status and setup with --platform cloudflare (space and = forms)', () => {
     expect(parseEmailArgs(['status', '--platform', 'cloudflare'])).toEqual({
       subcommand: 'status',
@@ -109,7 +104,7 @@ describe('parseEmailArgs', () => {
     });
   });
 
-  it('parses --platform void as the platform shape (the "not available yet" exit for setup/status)', () => {
+  it('parses --platform void', () => {
     expect(parseEmailArgs(['setup', '--platform', 'void'])).toEqual({
       subcommand: 'setup',
       projectSlug: undefined,
@@ -151,16 +146,11 @@ describe('parseEmailArgs', () => {
     );
   });
 
-  // `--project` and `--limit` take the same missing-value path as `--platform`. A bare
-  // flag used to fall through as a positional, which the read-only subcommands never
-  // reject: `void email usage --project` silently ran against the linked project and
-  // `void email logs --limit` silently ignored the limit.
   it('errors on --project without a value', () => {
     expect(() => parseEmailArgs(['usage', '--project'])).toThrow(
       'email: --project requires a value (a project name).',
     );
-    // A value that starts with `-` is the next flag, not a project name — previously
-    // `--limit` became the slug and `5` the positional.
+    // A value that starts with `-` is the next flag, not a project name.
     expect(() => parseEmailArgs(['usage', '--project', '--limit', '5'])).toThrow(
       'email: --project requires a value (a project name).',
     );
@@ -169,9 +159,6 @@ describe('parseEmailArgs', () => {
     );
   });
 
-  // An empty slug is not nullish: `runEmailCommand` used to keep `''` over `VOID_PROJECT`
-  // and then fall through to the linked project, so `--project=` (or `--project "$VAR"`
-  // with the variable unset) silently mutated the linked project's allowlist.
   it('errors on --project with an empty or whitespace-only value, same message as a bare flag', () => {
     const message = 'email: --project requires a value (a project name).';
     expect(() => parseEmailArgs(['disallow', 'a@x.dev', '--project='])).toThrow(message);
@@ -195,30 +182,6 @@ describe('parseEmailArgs', () => {
     );
   });
 
-  // The parser is shared, so the read-only subcommands reject the same shapes — they are
-  // exactly the ones that never validate a positional and used to run against the wrong
-  // project without a word.
-  it('rejects an empty or repeated --project on the read-only subcommands too', () => {
-    for (const sub of ['usage', 'logs']) {
-      expect(() => parseEmailArgs([sub, '--project='])).toThrow(
-        'email: --project requires a value (a project name).',
-      );
-      expect(() => parseEmailArgs([sub, '--project', 'a', '--project', 'b'])).toThrow(
-        'email: --project can only be specified once.',
-      );
-    }
-    // A single, non-empty value is still accepted as before.
-    expect(parseEmailArgs(['usage', '--project', 'x'])).toMatchObject({
-      subcommand: 'usage',
-      projectSlug: 'x',
-    });
-    expect(parseEmailArgs(['logs', '--limit', '3', '--project=x'])).toMatchObject({
-      subcommand: 'logs',
-      projectSlug: 'x',
-      limit: 3,
-    });
-  });
-
   it('errors on --limit without a value', () => {
     expect(() => parseEmailArgs(['logs', '--limit'])).toThrow(
       'email: --limit requires a value (a positive integer).',
@@ -232,7 +195,7 @@ describe('parseEmailArgs', () => {
     );
   });
 
-  it('parses --project=<name> and --limit=<n> (the = form --platform already takes)', () => {
+  it('parses --project=<name> and --limit=<n>', () => {
     expect(parseEmailArgs(['usage', '--project=foo'])).toEqual({
       subcommand: 'usage',
       projectSlug: 'foo',
@@ -249,17 +212,6 @@ describe('parseEmailArgs', () => {
     });
   });
 
-  it('still carries an unrelated stray positional on a read-only subcommand', () => {
-    // Positional validation is unchanged: only allow/disallow require one, and only a
-    // second one is rejected. A stray word is still parsed as `address` and left to the
-    // command, exactly as before.
-    expect(parseEmailArgs(['usage', 'stray'])).toMatchObject({
-      subcommand: 'usage',
-      address: 'stray',
-      projectSlug: undefined,
-    });
-  });
-
   it('errors when --platform is repeated, even if the final value is valid', () => {
     expect(() =>
       parseEmailArgs(['setup', '--platform', 'cloudflare', '--platform', 'cloudflare']),
@@ -288,19 +240,10 @@ describe('parseEmailArgs', () => {
       /`void email status --platform cloudflare` takes no argument/,
     );
   });
-  it.each([
-    ['status'],
-    ['setup'],
-    ['usage'],
-    ['logs'],
-    ['destinations'],
-    ['allow', 'a@x.dev'],
-    ['disallow', 'a@x.dev'],
-    ['domain', 'add', 'acme.com', '--project', 'my-app', '--subdomain', 'mx'],
-    ['domain', 'list'],
-  ])('rejects the removed alias before invoking %j', (...command) => {
+
+  it('rejects --backend', () => {
     for (const flags of [['--backend'], ['--backend', 'cloudflare'], ['--backend=cloudflare']]) {
-      expect(() => parseEmailArgs([...command, ...flags])).toThrow(
+      expect(() => parseEmailArgs(['status', ...flags])).toThrow(
         "email: Unknown option '--backend'.",
       );
     }
diff --git a/packages/void/test/unit/email-cli-cloudflare.test.ts b/packages/void/test/unit/email-cli-cloudflare.test.ts
index 2d56c9044..1d4313b4d 100644
--- a/packages/void/test/unit/email-cli-cloudflare.test.ts
+++ b/packages/void/test/unit/email-cli-cloudflare.test.ts
@@ -14,7 +14,7 @@ import { runEmailCloudflareCommand, runEmailCommand } from '../../src/cli/email.
 import * as terminalOutput from '../../src/cli/output.ts';
 
 /**
- * `void email setup|status --platform cloudflare` on the 0078 transcript project:
+ * `void email setup|status --platform cloudflare` on a sample project:
  * `email/support+[ticket].ts` + `email/_default.ts`, `email.from = noreply@mail.acme.com`,
  * zone `acme.com` (routing ready on the apex, Google MX there), nothing on `mail.acme.com`.
  * Every Cloudflare touch is a fake returning structured account data.
@@ -222,7 +222,7 @@ function makeProject(overrides: { from?: string; wrangler?: string } = {}): stri
   return root;
 }
 
-/** The transcript project's fakes, with the apply-side entries overridable. */
+/** The sample project's fakes, with the apply-side entries overridable. */
 function transcriptDeps(
   extra: {
     runnerTable?: Record<string, EmailWranglerRunResult>;
@@ -336,6 +336,12 @@ const sendingRefused: EmailWranglerRunResult = {
   stderr: `${BETA_WARNING}✘ [ERROR] A request to the Cloudflare API (/zones/${ZONE_ID}/email/sending/subdomains) failed.\n\n  something went wrong [code: 10105]\n`,
   errorCode: 10105,
 };
+const sendingOnboarded: EmailWranglerRunResult = {
+  status: 0,
+  stdout: '',
+  data: { name: 'mail.acme.com', enabled: true, tag: ZONE_ID },
+  stderr: BETA_WARNING,
+};
 
 describe('void email setup --platform cloudflare', () => {
   it('first run: checklist, one confirm, exact provider operations + REST calls, wrangler.jsonc written', async () => {
@@ -456,28 +462,6 @@ describe('void email setup --platform cloudflare', () => {
     expect(fetchCalls.every((c) => c.method === 'GET')).toBe(true);
   });
 
-  it('a session without the email scopes: the ✘ row says `void cloudflare logout`, then `login` — exit 1, no prompt', async () => {
-    const root = makeProject();
-    roots.push(root);
-    const who = structuredClone(whoamiResult().data) as { tokenPermissions: Array<string> };
-    who.tokenPermissions = who.tokenPermissions.filter((s) => !s.startsWith('email_'));
-    const { deps, calls, fetchCalls, printed } = transcriptDeps({
-      runnerTable: { 'whoami --json': { status: 0, stdout: '', data: who, stderr: '' } },
-    });
-    const confirm = vi.fn(async () => true);
-
-    const code = await run(root, 'setup', { ...deps, isInteractive: true, confirm });
-
-    expect(code).toBe(1);
-    expect(confirm).not.toHaveBeenCalled();
-    expect(printed[0]).toContain(
-      '    ✘ the Cloudflare session lacks email_routing:write + email_sending:write — run `void cloudflare logout`, then `void cloudflare login` (one browser Allow)',
-    );
-    expect(printed[0]).not.toMatch(/wrangler login/i);
-    expect(calls.map((c) => c.args.slice(0, 2).join(' '))).toEqual(['whoami --json']);
-    expect(fetchCalls).toEqual([]);
-  });
-
   it('an `all` blocker (foreign MX on the apex path) exits 1 without a prompt', async () => {
     const root = makeProject({ from: 'noreply@acme.com' });
     roots.push(root);
@@ -500,32 +484,6 @@ describe('void email setup --platform cloudflare', () => {
     expect(fetchCalls.every((c) => c.method === 'GET')).toBe(true);
   });
 
-  it('a bearer failure keeps going: dashboard fallback printed, addresses withheld, exit 1', async () => {
-    const root = makeProject();
-    roots.push(root);
-    const configPath = join(root, 'wrangler.jsonc');
-    const { deps, printed } = transcriptDeps({
-      runnerTable: { 'email sending enable mail.acme.com': sendingEnabled('mail.acme.com') },
-    });
-
-    const code = await run(root, 'setup', {
-      ...deps,
-      getSessionBearer: async () => null,
-      isInteractive: true,
-      confirm: async () => true,
-    });
-
-    expect(code).toBe(1);
-    const output = printed.join('\n');
-    expect(output).toContain('Email → Settings → Subdomains');
-    expect(output).toContain('addresses withheld this run');
-    // Sending was onboarded, so the binding + sender var are written; `addresses` is not.
-    const config = readJsonc(configPath);
-    expect(config.send_email).toEqual([{ name: 'SEND_EMAIL' }]);
-    expect(config.vars).toEqual({ __VOID_EMAIL_FROM: 'noreply@mail.acme.com' });
-    expect(config.addresses).toBeUndefined();
-  });
-
   it('routing came up but the subaddressing PATCH was refused: exit 1, subaddressing named, addresses withheld', async () => {
     // The apex path: `wrangler email routing enable acme.com` succeeds, then the bearer
     // PATCH `{ support_subaddress: true }` is refused. `addresses` is withheld (no bearer
@@ -751,48 +709,10 @@ describe('void email setup --platform cloudflare', () => {
   });
 
   it('second run, everything ready: no prompt, zero writes, config unchanged, exit 0', async () => {
-    const root = makeProject({
-      wrangler: `{
-  "account_id": "${ACCOUNT}",
-  "name": "acme-support",
-  "send_email": [{ "name": "SEND_EMAIL" }],
-  "addresses": ["support@mail.acme.com"],
-  "vars": { "__VOID_EMAIL_FROM": "noreply@mail.acme.com" },
-}
-`,
-    });
-    roots.push(root);
-    const before = readFileSync(join(root, 'wrangler.jsonc'), 'utf-8');
-    const { deps, calls, fetchCalls, printed } = transcriptDeps({
-      runnerTable: {
-        'email routing rules list acme.com': {
-          status: 0,
-          stdout: '',
-          data: [
-            {
-              id: '1a2b3c',
-              name: 'support',
-              enabled: true,
-              matchers: [{ type: 'literal', field: 'to', value: 'support@mail.acme.com' }],
-              actions: [{ type: 'worker', value: ['acme-support'] }],
-            },
-            { enabled: false, matchers: [{ type: 'all' }], actions: [{ type: 'drop' }] },
-          ],
-          stderr: BETA_WARNING,
-        },
-        'email sending settings mail.acme.com': {
-          status: 0,
-          stdout: '',
-          data: { name: 'mail.acme.com', enabled: true, tag: ZONE_ID },
-          stderr: BETA_WARNING,
-        },
-      },
-      fetchTable: {
-        [`GET /zones/${ZONE_ID}/email/routing`]: () =>
-          jsonResponse(200, { success: true, result: { enabled: true, support_subaddress: true } }),
-      },
-      mx: { 'acme.com': ['aspmx.l.google.com'], 'mail.acme.com': ['route1.mx.cloudflare.net'] },
+    const { root, configPath, deps, calls, fetchCalls, printed } = freeAfterSetup({
+      runnerTable: { 'email sending settings mail.acme.com': sendingOnboarded },
     });
+    const before = readFileSync(configPath, 'utf-8');
     const confirm = vi.fn(async () => true);
 
     const code = await run(root, 'setup', { ...deps, isInteractive: false, confirm });
@@ -801,7 +721,7 @@ describe('void email setup --platform cloudflare', () => {
     expect(confirm).not.toHaveBeenCalled();
     expect(calls.some((c) => c.args.includes('enable'))).toBe(false);
     expect(fetchCalls.every((c) => c.method === 'GET')).toBe(true);
-    expect(readFileSync(join(root, 'wrangler.jsonc'), 'utf-8')).toBe(before);
+    expect(readFileSync(configPath, 'utf-8')).toBe(before);
     // Every row reads ready; the only remaining line is the `!` for the refused catch-all.
     expect(printed[0]).toContain('    rules     support@mail.acme.com → acme-support   (ready)');
     expect(printed[0]).not.toContain('\n    + ');
@@ -961,101 +881,6 @@ describe('void email status --platform cloudflare', () => {
     expect(logged.lines.join('\n')).not.toContain('not set up');
   });
 
-  it("ready but the rule not created yet (right after `setup`): exit 0 — rules are the next deploy's", async () => {
-    const root = makeProject({
-      wrangler: `{
-  "account_id": "${ACCOUNT}",
-  "name": "acme-support",
-  "send_email": [{ "name": "SEND_EMAIL" }],
-  "addresses": ["support@mail.acme.com"],
-  "vars": { "__VOID_EMAIL_FROM": "noreply@mail.acme.com" },
-}
-`,
-    });
-    roots.push(root);
-    const { deps, printed } = transcriptDeps({
-      runnerTable: {
-        'email sending settings mail.acme.com': {
-          status: 0,
-          stdout: '',
-          data: { name: 'mail.acme.com', enabled: true, tag: ZONE_ID },
-          stderr: BETA_WARNING,
-        },
-      },
-      fetchTable: {
-        [`GET /zones/${ZONE_ID}/email/routing`]: () =>
-          jsonResponse(200, { success: true, result: { enabled: true, support_subaddress: true } }),
-      },
-      mx: { 'acme.com': ['aspmx.l.google.com'], 'mail.acme.com': ['route1.mx.cloudflare.net'] },
-    });
-
-    const code = await run(root, 'status', { ...deps, isInteractive: false });
-
-    expect(code).toBe(0);
-    expect(printed[1]).toContain(
-      '    inbound   support@mail.acme.com  →  email/support+[ticket].ts   (no rule yet)',
-    );
-  });
-
-  it('an API-token session reads ready like a login session does (CI on CLOUDFLARE_API_TOKEN)', async () => {
-    const root = makeProject({
-      wrangler: `{
-  "account_id": "${ACCOUNT}",
-  "name": "acme-support",
-  "send_email": [{ "name": "SEND_EMAIL" }],
-  "addresses": ["support@mail.acme.com"],
-  "vars": { "__VOID_EMAIL_FROM": "noreply@mail.acme.com" },
-}
-`,
-    });
-    roots.push(root);
-    const { deps, calls } = transcriptDeps({
-      runnerTable: {
-        'whoami --json': {
-          status: 0,
-          stdout: '',
-          data: {
-            loggedIn: true,
-            authType: 'User API Token',
-            accounts: [{ id: ACCOUNT, name: 'Acme' }],
-          },
-          stderr: '',
-        },
-        'email routing rules list acme.com': {
-          status: 0,
-          stdout: '',
-          data: [
-            {
-              id: '1a2b3c',
-              name: 'support',
-              enabled: true,
-              matchers: [{ type: 'literal', field: 'to', value: 'support@mail.acme.com' }],
-              actions: [{ type: 'worker', value: ['acme-support'] }],
-            },
-            { enabled: false, matchers: [{ type: 'all' }], actions: [{ type: 'drop' }] },
-          ],
-          stderr: BETA_WARNING,
-        },
-        'email sending settings mail.acme.com': {
-          status: 0,
-          stdout: '',
-          data: { name: 'mail.acme.com', enabled: true, tag: ZONE_ID },
-          stderr: BETA_WARNING,
-        },
-      },
-      fetchTable: {
-        [`GET /zones/${ZONE_ID}/email/routing`]: () =>
-          jsonResponse(200, { success: true, result: { enabled: true, support_subaddress: true } }),
-      },
-      mx: { 'acme.com': ['aspmx.l.google.com'], 'mail.acme.com': ['route1.mx.cloudflare.net'] },
-    });
-
-    const code = await run(root, 'status', { ...deps, isInteractive: false });
-
-    expect(code).toBe(0);
-    expect(calls.some((c) => c.args[0] === 'email')).toBe(true);
-  });
-
   it('not signed in: the checklist reaches the terminal as-is and says `void cloudflare login`, exit 1', async () => {
     const root = makeProject();
     roots.push(root);
@@ -1085,45 +910,8 @@ describe('void email status --platform cloudflare', () => {
   });
 
   it('ready: exit 0 and the routed address map', async () => {
-    const root = makeProject({
-      wrangler: `{
-  "account_id": "${ACCOUNT}",
-  "name": "acme-support",
-  "send_email": [{ "name": "SEND_EMAIL" }],
-  "addresses": ["support@mail.acme.com"],
-}
-`,
-    });
-    roots.push(root);
-    const { deps, printed } = transcriptDeps({
-      runnerTable: {
-        'email routing rules list acme.com': {
-          status: 0,
-          stdout: '',
-          data: [
-            {
-              id: '1a2b3c',
-              name: 'support',
-              enabled: true,
-              matchers: [{ type: 'literal', field: 'to', value: 'support@mail.acme.com' }],
-              actions: [{ type: 'worker', value: ['acme-support'] }],
-            },
-            { enabled: false, matchers: [{ type: 'all' }], actions: [{ type: 'drop' }] },
-          ],
-          stderr: BETA_WARNING,
-        },
-        'email sending settings mail.acme.com': {
-          status: 0,
-          stdout: '',
-          data: { name: 'mail.acme.com', enabled: true, tag: ZONE_ID },
-          stderr: BETA_WARNING,
-        },
-      },
-      fetchTable: {
-        [`GET /zones/${ZONE_ID}/email/routing`]: () =>
-          jsonResponse(200, { success: true, result: { enabled: true, support_subaddress: true } }),
-      },
-      mx: { 'acme.com': ['aspmx.l.google.com'], 'mail.acme.com': ['route1.mx.cloudflare.net'] },
+    const { root, deps, printed } = freeAfterSetup({
+      runnerTable: { 'email sending settings mail.acme.com': sendingOnboarded },
     });
 
     const code = await run(root, 'status', { ...deps, isInteractive: false });
@@ -1149,7 +937,7 @@ describe('void email setup|status without --platform cloudflare', () => {
     exitSpy.mockRestore();
   });
 
-  it('explains that both are Mode B commands today and exits 1 before any platform call', async () => {
+  it('explains that both need --platform cloudflare and exits 1 before any platform call', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-email-cli-'));
     roots.push(root);
     for (const subcommand of ['setup', 'status'] as const) {
diff --git a/packages/void/test/unit/email-cli-domain.test.ts b/packages/void/test/unit/email-cli-domain.test.ts
index 9f21f7568..079627a63 100644
--- a/packages/void/test/unit/email-cli-domain.test.ts
+++ b/packages/void/test/unit/email-cli-domain.test.ts
@@ -17,14 +17,13 @@ import {
   emailDomainRotateSecret,
   isValidEmailDomainInput,
   normalizeEmailDomainInput,
-  resolveEmailDomainTarget,
   type EmailDomainAddDeps,
 } from '../../src/cli/email.ts';
 import * as output from '../../src/cli/output.ts';
 import { withPlatformDiscovery } from '../helpers/platform-discovery.ts';
 
 /**
- * `void email domain …` (design doc 0078, "Custom domains on Cloudflare").
+ * `void email domain …`.
  * Every browser, clipboard, DNS and stdin touch is a seam; credential values
  * here are inert placeholders and are never printed.
  */
@@ -179,35 +178,13 @@ describe('domain input helpers', () => {
     expect(isValidEmailDomainInput('-bad.com')).toBe(false);
     expect(isValidEmailDomainInput('nodot')).toBe(false);
   });
-
-  it('resolves --subdomain labels and hosts under the positional domain', () => {
-    expect(resolveEmailDomainTarget('acme.com', undefined)).toEqual({
-      emailDomain: 'acme.com',
-      forced: false,
-    });
-    expect(resolveEmailDomainTarget('acme.com', 'mx')).toEqual({
-      emailDomain: 'mx.acme.com',
-      forced: true,
-    });
-    expect(resolveEmailDomainTarget('acme.com', 'mail.acme.com.')).toEqual({
-      emailDomain: 'mail.acme.com',
-      forced: true,
-    });
-    expect(() => resolveEmailDomainTarget('acme.com', 'acme.com')).toThrow(
-      /must name a subdomain of acme.com/,
-    );
-    expect(() => resolveEmailDomainTarget('acme.com', 'other.com')).toThrow(
-      /must name a subdomain of acme.com/,
-    );
-    expect(() => resolveEmailDomainTarget('acme.com', '!!!')).toThrow(/invalid --subdomain value/);
-  });
 });
 
 describe('PlatformClient.getEmailSettings', () => {
   function clientWith(status: number, body: string) {
     const fetchSpy = vi.fn(async () => new Response(body, { status }));
     vi.stubGlobal('fetch', withPlatformDiscovery(fetchSpy));
-    return new PlatformClient('jwt-dummy', 'https://api.example.test');
+    return new PlatformClient('jwt-dummy', { apiUrl: 'https://api.example.test' });
   }
 
   it('reads the settings the platform reports', async () => {
@@ -274,7 +251,7 @@ describe('emailDomainAdd', () => {
     const api = client();
     const deps = addDeps();
     vi.spyOn(crypto, 'randomUUID').mockReturnValue(ATTEMPT_ID);
-    await emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps);
+    await emailDomainAdd(api, 'prj_1', 'acme.com', deps);
     expect(api.addEmailDomain).toHaveBeenCalledWith('prj_1', {
       domain: 'acme.com',
       apiToken: LEGACY_TOKEN,
@@ -292,13 +269,7 @@ describe('emailDomainAdd', () => {
   it('does not submit a token whose scope was not confirmed', async () => {
     const api = client();
     await expect(
-      emailDomainAdd(
-        api,
-        'prj_1',
-        'acme.com',
-        undefined,
-        addDeps({ confirmScope: async () => false }),
-      ),
+      emailDomainAdd(api, 'prj_1', 'acme.com', addDeps({ confirmScope: async () => false })),
     ).rejects.toThrow('exit 1');
     expect(api.addEmailDomain).not.toHaveBeenCalled();
   });
@@ -308,9 +279,7 @@ describe('emailDomainAdd', () => {
     const deps = addDeps({
       dns: { resolveMx: async () => [{ exchange: 'mx.example.net', priority: 10 }] },
     });
-    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps)).rejects.toThrow(
-      'exit 1',
-    );
+    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', deps)).rejects.toThrow('exit 1');
     expect(printed(errorSpy)).toContain('unused Cloudflare zone apex');
     expect(deps.openUrl).not.toHaveBeenCalled();
     expect(api.addEmailDomain).not.toHaveBeenCalled();
@@ -319,7 +288,7 @@ describe('emailDomainAdd', () => {
   it('refuses --subdomain before any credential prompt', async () => {
     const api = client();
     const deps = addDeps();
-    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', 'notifications', deps)).rejects.toThrow(
+    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', deps, 'notifications')).rejects.toThrow(
       'exit 1',
     );
     expect(printed(errorSpy)).toContain('Omit --subdomain');
@@ -330,9 +299,7 @@ describe('emailDomainAdd', () => {
   it('rejects invalid domains before opening a browser', async () => {
     const api = client();
     const deps = addDeps();
-    await expect(emailDomainAdd(api, 'prj_1', 'https://acme.com', undefined, deps)).rejects.toThrow(
-      'exit 1',
-    );
+    await expect(emailDomainAdd(api, 'prj_1', 'https://acme.com', deps)).rejects.toThrow('exit 1');
     expect(deps.openUrl).not.toHaveBeenCalled();
     expect(api.addEmailDomain).not.toHaveBeenCalled();
   });
@@ -341,9 +308,7 @@ describe('emailDomainAdd', () => {
     const api = client();
     const deps = addDeps();
     api.getEmailSettings.mockResolvedValue({ domains: { management: 'admin' } });
-    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps)).rejects.toThrow(
-      'exit 0',
-    );
+    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', deps)).rejects.toThrow('exit 0');
     expect(deps.openUrl).not.toHaveBeenCalled();
     expect(deps.pasteToken).not.toHaveBeenCalled();
     expect(printed(infoSpy)).toContain('void platform email domain-add acme.com --project prj_1');
@@ -354,7 +319,7 @@ describe('emailDomainAdd', () => {
     const deps = addDeps();
     api.getEmailSettings.mockResolvedValue({ domains: { management: 'admin' } });
     api.listEmailDomains.mockResolvedValue([domainRow({ managed_by: 'owner' })]);
-    await emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps);
+    await emailDomainAdd(api, 'prj_1', 'acme.com', deps);
     expect(api.addEmailDomain).toHaveBeenCalledWith(
       'prj_1',
       expect.objectContaining({ domain: 'acme.com', apiToken: LEGACY_TOKEN }),
@@ -365,16 +330,14 @@ describe('emailDomainAdd', () => {
   it('fails non-interactive setup without opening a browser', async () => {
     const api = client();
     const deps = addDeps({ isInteractive: false });
-    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps)).rejects.toThrow(
-      'exit 1',
-    );
+    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', deps)).rejects.toThrow('exit 1');
     expect(deps.openUrl).not.toHaveBeenCalled();
   });
 
   it('cancels masked paste without storing a credential', async () => {
     const api = client();
     const deps = addDeps({ pasteToken: async () => null });
-    await emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps);
+    await emailDomainAdd(api, 'prj_1', 'acme.com', deps);
     expect(api.addEmailDomain).not.toHaveBeenCalled();
     expect(deps.confirmScope).not.toHaveBeenCalled();
   });
@@ -384,9 +347,7 @@ describe('emailDomainAdd', () => {
     async (token) => {
       const api = client();
       const deps = addDeps({ pasteToken: async () => token });
-      await expect(emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps)).rejects.toThrow(
-        'exit 1',
-      );
+      await expect(emailDomainAdd(api, 'prj_1', 'acme.com', deps)).rejects.toThrow('exit 1');
       expect(deps.verifyToken).not.toHaveBeenCalled();
       expect(api.addEmailDomain).not.toHaveBeenCalled();
     },
@@ -395,26 +356,14 @@ describe('emailDomainAdd', () => {
   it('refuses an inactive token', async () => {
     const api = client();
     await expect(
-      emailDomainAdd(
-        api,
-        'prj_1',
-        'acme.com',
-        undefined,
-        addDeps({ verifyToken: async () => 'inactive' }),
-      ),
+      emailDomainAdd(api, 'prj_1', 'acme.com', addDeps({ verifyToken: async () => 'inactive' })),
     ).rejects.toThrow('exit 1');
     expect(api.addEmailDomain).not.toHaveBeenCalled();
   });
 
   it('leaves authoritative verification to the API if the local token probe is unavailable', async () => {
     const api = client();
-    await emailDomainAdd(
-      api,
-      'prj_1',
-      'acme.com',
-      undefined,
-      addDeps({ verifyToken: async () => 'unknown' }),
-    );
+    await emailDomainAdd(api, 'prj_1', 'acme.com', addDeps({ verifyToken: async () => 'unknown' }));
     expect(api.addEmailDomain).toHaveBeenCalled();
   });
 
@@ -429,7 +378,7 @@ describe('emailDomainAdd', () => {
     // Fake time keeps the 40 ms watch window from closing on a slow machine
     // before the third read; the token arrives on the second 1 ms poll.
     vi.useFakeTimers();
-    const added = emailDomainAdd(api, 'prj_1', 'acme.com', undefined, deps);
+    const added = emailDomainAdd(api, 'prj_1', 'acme.com', deps);
     await vi.advanceTimersByTimeAsync(deps.watchTimeoutMs!);
     await added;
     expect(deps.verifyToken).toHaveBeenCalledTimes(1);
@@ -445,7 +394,7 @@ describe('emailDomainAdd', () => {
     const api = client();
     vi.spyOn(crypto, 'randomUUID').mockReturnValue(ATTEMPT_ID);
     api.addEmailDomain.mockRejectedValue(new Error('connection reset'));
-    await emailDomainAdd(api, 'prj_1', 'acme.com', undefined, addDeps());
+    await emailDomainAdd(api, 'prj_1', 'acme.com', addDeps());
     expect(api.getEmailOperation).toHaveBeenCalledWith('prj_1', ATTEMPT_ID);
     expect(api.getEmailDomain).not.toHaveBeenCalled();
     expect(notedBlocks()).toContain('Operation:   op_1');
@@ -457,9 +406,7 @@ describe('emailDomainAdd', () => {
     const api = client();
     api.addEmailDomain.mockRejectedValue(new Error('connection reset'));
     api.getEmailOperation.mockRejectedValue(new PlatformApiError('not found', 404, '{}'));
-    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', undefined, addDeps())).rejects.toThrow(
-      'exit 1',
-    );
+    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', addDeps())).rejects.toThrow('exit 1');
     expect(api.getEmailOperation).toHaveBeenCalledTimes(15);
     expect(printed(errorSpy)).toContain('outcome is unknown');
     expect(printed(errorSpy)).toContain('Nothing was revoked');
@@ -468,7 +415,7 @@ describe('emailDomainAdd', () => {
   it('does not poll after a definitive validation refusal', async () => {
     const api = client();
     api.addEmailDomain.mockRejectedValue(new PlatformApiError('invalid domain', 400, '{}'));
-    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', undefined, addDeps())).rejects.toThrow(
+    await expect(emailDomainAdd(api, 'prj_1', 'acme.com', addDeps())).rejects.toThrow(
       'invalid domain',
     );
     expect(api.getEmailOperation).not.toHaveBeenCalled();
@@ -481,9 +428,7 @@ describe('emailDomainAdd', () => {
       api.addEmailDomain.mockResolvedValue(
         domainRow({ operationId: 'op_1', operationStatus, error: 'setup unfinished' }),
       );
-      await expect(emailDomainAdd(api, 'prj_1', 'acme.com', undefined, addDeps())).rejects.toThrow(
-        'exit 1',
-      );
+      await expect(emailDomainAdd(api, 'prj_1', 'acme.com', addDeps())).rejects.toThrow('exit 1');
       expect(printed(errorSpy)).toContain('setup unfinished');
       expect(notedBlocks()).toContain(`op_1 · ${operationStatus}`);
     },
diff --git a/packages/void/test/unit/email-cloudflare.test.ts b/packages/void/test/unit/email-cloudflare.test.ts
index 67b5eeaf9..dc2199e23 100644
--- a/packages/void/test/unit/email-cloudflare.test.ts
+++ b/packages/void/test/unit/email-cloudflare.test.ts
@@ -249,7 +249,7 @@ function routingGet(supportSubaddress: boolean) {
 }
 
 /**
- * The 0078 transcript scenario: `email/support+[ticket].ts` + `email/_default.ts`,
+ * The sample scenario: `email/support+[ticket].ts` + `email/_default.ts`,
  * `email.from = noreply@mail.acme.com`, zone `acme.com` (routing ready on the apex,
  * Google MX there), nothing yet on `mail.acme.com`.
  */
@@ -298,6 +298,51 @@ function transcriptInputs(
   return { inputs, calls, fetchCalls };
 }
 
+/** The "second deploy" account state, with the committed config overridable per case. */
+function readyAccount(
+  overrides: Partial<EmailCloudflareInputs> & {
+    runnerTable?: Record<string, EmailWranglerRunResult | (() => EmailWranglerRunResult)>;
+    calls?: Array<Call>;
+    fetchCalls?: Array<FetchCall>;
+    rules?: Array<unknown>;
+  } = {},
+) {
+  const { rules, runnerTable, ...rest } = overrides;
+  return transcriptInputs({
+    runnerTable: {
+      'email routing rules list acme.com': {
+        status: 0,
+        stdout: '',
+        data: rules ?? routingRules({ supportDomain: 'mail.acme.com' }),
+        stderr: BETA_WARNING,
+      },
+      'email sending settings mail.acme.com': {
+        status: 0,
+        stdout: '',
+        data: {
+          name: 'mail.acme.com',
+          enabled: true,
+          tag: '19af4fdbee924a92916afea0de5a8fdd',
+        },
+        stderr: BETA_WARNING,
+      },
+      ...runnerTable,
+    },
+    fetchTable: { [`GET /zones/${ZONE_ID}/email/routing`]: routingGet(true) },
+    dns: fakeDns({
+      mx: {
+        'acme.com': ['aspmx.l.google.com'],
+        'mail.acme.com': ['route1.mx.cloudflare.net', 'route2.mx.cloudflare.net'],
+      },
+    }),
+    handlers: scan(['support+[ticket].ts']),
+    existingSendEmail: [{ name: 'SEND_EMAIL' }],
+    existingAddresses: ['support@mail.acme.com'],
+    existingVars: { __VOID_EMAIL_FROM: 'noreply@mail.acme.com' },
+    ...rest,
+  });
+}
+
 // ── Derivation ───────────────────────────────────────────────────────────────────
 
 describe('deriveAddresses', () => {
@@ -475,11 +520,6 @@ describe('structured email results', () => {
     expect(parseWhoamiJson({ loggedIn: true, tokenPermissions: 'email_routing:write' })).toBeNull();
     expect(parseWhoamiJson({ loggedIn: true, accounts: 'invalid' })).toBeNull();
   });
-
-  it('reads session scopes and API error codes', () => {
-    expect(parseWhoamiJson(whoamiResult().data)?.tokenPermissions).toContain('email_routing:write');
-    expect(apiFailure(2040, '/zones/x/email/sending/subdomains').errorCode).toBe(2040);
-  });
 });
 
 // ── Preflight ────────────────────────────────────────────────────────────────────
@@ -531,53 +571,8 @@ describe('preflightEmail', () => {
     ]);
   });
 
-  it('pins every provider operation to the deploy config', async () => {
-    const base = transcriptInputs();
-    const seen: Array<CloudflareOperation> = [];
-    const { inputs } = transcriptInputs({
-      configPath: 'wrangler.jsonc',
-      runWrangler: (operation, opts) => {
-        seen.push(operation);
-        return base.inputs.runWrangler(operation, opts);
-      },
-    });
-    await preflightEmail(inputs);
-    expect(seen).toHaveLength(5);
-    expect(seen.every((operation) => operation.configPath === 'wrangler.jsonc')).toBe(true);
-  });
-
   it('second deploy, everything set up: ready, zero changes', async () => {
-    const { inputs } = transcriptInputs({
-      runnerTable: {
-        'email routing rules list acme.com': {
-          status: 0,
-          stdout: '',
-          data: routingRules({ supportDomain: 'mail.acme.com' }),
-          stderr: BETA_WARNING,
-        },
-        'email sending settings mail.acme.com': {
-          status: 0,
-          stdout: '',
-          data: {
-            name: 'mail.acme.com',
-            enabled: true,
-            tag: '19af4fdbee924a92916afea0de5a8fdd',
-          },
-          stderr: BETA_WARNING,
-        },
-      },
-      fetchTable: { [`GET /zones/${ZONE_ID}/email/routing`]: routingGet(true) },
-      dns: fakeDns({
-        mx: {
-          'acme.com': ['aspmx.l.google.com'],
-          'mail.acme.com': ['route1.mx.cloudflare.net', 'route2.mx.cloudflare.net'],
-        },
-      }),
-      handlers: scan(['support+[ticket].ts']),
-      existingSendEmail: [{ name: 'SEND_EMAIL' }],
-      existingAddresses: ['support@mail.acme.com'],
-      existingVars: { __VOID_EMAIL_FROM: 'noreply@mail.acme.com' },
-    });
+    const { inputs } = readyAccount();
     const pre = await preflightEmail(inputs);
     expect(pre.routing.state).toBe('ready');
     expect(pre.subaddressing.state).toBe('on');
@@ -598,51 +593,6 @@ describe('preflightEmail', () => {
     expect(renderEmailChecklist(pre)).toContain('Nothing to change — email is set up.');
   });
 
-  /** The "second deploy" account state, with the committed config overridable per case. */
-  function readyAccount(
-    overrides: Partial<EmailCloudflareInputs> & {
-      runnerTable?: Record<string, EmailWranglerRunResult | (() => EmailWranglerRunResult)>;
-      calls?: Array<Call>;
-      fetchCalls?: Array<FetchCall>;
-      rules?: Array<unknown>;
-    } = {},
-  ) {
-    const { rules, runnerTable, ...rest } = overrides;
-    return transcriptInputs({
-      runnerTable: {
-        'email routing rules list acme.com': {
-          status: 0,
-          stdout: '',
-          data: rules ?? routingRules({ supportDomain: 'mail.acme.com' }),
-          stderr: BETA_WARNING,
-        },
-        'email sending settings mail.acme.com': {
-          status: 0,
-          stdout: '',
-          data: {
-            name: 'mail.acme.com',
-            enabled: true,
-            tag: '19af4fdbee924a92916afea0de5a8fdd',
-          },
-          stderr: BETA_WARNING,
-        },
-        ...runnerTable,
-      },
-      fetchTable: { [`GET /zones/${ZONE_ID}/email/routing`]: routingGet(true) },
-      dns: fakeDns({
-        mx: {
-          'acme.com': ['aspmx.l.google.com'],
-          'mail.acme.com': ['route1.mx.cloudflare.net', 'route2.mx.cloudflare.net'],
-        },
-      }),
-      handlers: scan(['support+[ticket].ts']),
-      existingSendEmail: [{ name: 'SEND_EMAIL' }],
-      existingAddresses: ['support@mail.acme.com'],
-      existingVars: { __VOID_EMAIL_FROM: 'noreply@mail.acme.com' },
-      ...rest,
-    });
-  }
-
   it('an API-token session (CLOUDFLARE_API_TOKEN) is not gated on `tokenPermissions`: reads run, ready reads ready', async () => {
     // wrangler fills `tokenPermissions` from the stored login file only, so under an API token
     // it is absent (or describes a stale login file, never the token). The gate is the reads.
@@ -709,31 +659,10 @@ describe('preflightEmail', () => {
     expect(pre.ready).toBe(false);
   });
 
-  it('a Global API Key session is refused by name — there is no bearer to borrow', async () => {
-    const calls: Array<Call> = [];
-    const { inputs } = transcriptInputs({
-      calls,
-      runnerTable: {
-        'whoami --json': {
-          status: 0,
-          stdout: '',
-          data: { loggedIn: true, authType: 'Global API Key' },
-          stderr: '',
-        },
-      },
-    });
-    const pre = await preflightEmail(inputs);
-    expect(pre.session.state).toBe('api-key');
-    expect(pre.blockers[0]?.message).toContain('CLOUDFLARE_API_TOKEN');
-    expect(calls.map((c) => c.args.join(' '))).toEqual(['whoami --json']);
-  });
-
   it('a committed config whose rules wrangler has not created yet still reads ready (rules are `wrangler deploy` work)', async () => {
     // Right after `void email setup`, before the first deploy: the array is committed, the
     // rule is absent. Apply has nothing to do; the deploy creates the rule.
-    const { inputs } = readyAccount({
-      rules: { status: 0, stdout: '', data: emptyRules, stderr: '' }.data,
-    });
+    const { inputs } = readyAccount({ rules: emptyRules });
     const pre = await preflightEmail(inputs);
     expect(pre.rules.state).toBe('pending');
     expect(pre.rules.absent).toEqual(['support@mail.acme.com']);
@@ -804,12 +733,8 @@ describe('preflightEmail', () => {
     );
   });
 
-  it('turns a writer refusal the caller precomputed into an `all` blocker, so apply makes zero calls', async () => {
-    const calls: Array<Call> = [];
-    const fetchCalls: Array<FetchCall> = [];
+  it('turns a writer refusal the caller precomputed into an `all` blocker', async () => {
     const { inputs } = transcriptInputs({
-      calls,
-      fetchCalls,
       configConflicts: findEmailConfigConflicts({ vars: { SEND_EMAIL: 'x' } }),
     });
     const pre = await preflightEmail(inputs);
@@ -820,12 +745,6 @@ describe('preflightEmail', () => {
           'Cloudflare config already uses SEND_EMAIL as a Environment Variable binding; rename it in void.config.ts (Void writes SEND_EMAIL into send_email)',
       },
     ]);
-    calls.length = 0;
-    fetchCalls.length = 0;
-    const out = await applyEmailSetup(pre, inputs);
-    expect(calls).toEqual([]);
-    expect(fetchCalls).toEqual([]);
-    expect(out.patch).toEqual({});
   });
 
   it('refuses the apex when foreign MX already receives mail there', async () => {
@@ -874,26 +793,6 @@ describe('preflightEmail', () => {
     expect(pre.rules.absent).toEqual(['support@acme.com', '*@acme.com']);
   });
 
-  it('blocks on a session without the email scopes (`void cloudflare logout`, then `login`)', async () => {
-    const who = structuredClone(whoamiResult().data) as { tokenPermissions: Array<string> };
-    who.tokenPermissions = who.tokenPermissions.filter((s) => !s.startsWith('email_'));
-    const calls: Array<Call> = [];
-    const { inputs } = transcriptInputs({
-      calls,
-      runnerTable: { 'whoami --json': { status: 0, stdout: '', data: who, stderr: '' } },
-    });
-    const pre = await preflightEmail(inputs);
-    expect(pre.session.state).toBe('missing-scopes');
-    expect(pre.session.missingScopes).toEqual(['email_routing:write', 'email_sending:write']);
-    // `void cloudflare login` re-uses a session `whoami` reads cleanly (it never re-consents
-    // one), so a readable-but-insufficient session must be signed out first.
-    expect(pre.blockers[0]?.message).toBe(
-      'the Cloudflare session lacks email_routing:write + email_sending:write — run `void cloudflare logout`, then `void cloudflare login` (one browser Allow)',
-    );
-    // No other read runs on a session that cannot do the work.
-    expect(calls.map((c) => c.args.join(' '))).toEqual(['whoami --json']);
-  });
-
   it('every session blocker routes Cloudflare login through Void, never through wrangler', async () => {
     // AGENTS.md: user-facing output never asks for a wrangler command. These rows print raw
     // from `void email setup` / `status`, and through `formatCloudflareUserMessage` on the
@@ -901,15 +800,26 @@ describe('preflightEmail', () => {
     // operation" — no guidance at all.
     const who = structuredClone(whoamiResult().data) as { tokenPermissions: Array<string> };
     who.tokenPermissions = who.tokenPermissions.filter((s) => !s.startsWith('email_'));
+    const unreadable = 'could not read the Cloudflare session — run `void cloudflare login`';
     const sessions: Array<{
       state: EmailPreflight['session']['state'];
       whoami: EmailWranglerRunResult;
+      message: string;
     }> = [
-      { state: 'unknown', whoami: { status: 1, stdout: '', data: '', stderr: '✘ [ERROR] boom\n' } },
-      { state: 'unknown', whoami: { status: 0, stdout: '', data: 'not json', stderr: '' } },
+      {
+        state: 'unknown',
+        whoami: { status: 1, stdout: '', data: '', stderr: '✘ [ERROR] boom\n' },
+        message: unreadable,
+      },
+      {
+        state: 'unknown',
+        whoami: { status: 0, stdout: '', data: 'not json', stderr: '' },
+        message: unreadable,
+      },
       {
         state: 'not-logged-in',
         whoami: { status: 0, stdout: '', data: { loggedIn: false }, stderr: '' },
+        message: 'not logged in to Cloudflare — run `void cloudflare login`',
       },
       {
         state: 'api-key',
@@ -919,51 +829,38 @@ describe('preflightEmail', () => {
           data: { loggedIn: true, authType: 'Global API Key' },
           stderr: '',
         },
+        // A Global API Key wins over both an OAuth session and CLOUDFLARE_API_TOKEN in
+        // wrangler's env precedence, so neither alternative works until the key is unset.
+        message:
+          'the Cloudflare session is a Global API Key (CLOUDFLARE_API_KEY), which has no bearer to borrow for the subaddressing calls — unset CLOUDFLARE_API_KEY, then run `void cloudflare login` or set CLOUDFLARE_API_TOKEN to a token with Email Routing Edit + Email Sending Edit',
+      },
+      {
+        state: 'missing-scopes',
+        whoami: { status: 0, stdout: '', data: who, stderr: '' },
+        message:
+          'the Cloudflare session lacks email_routing:write + email_sending:write — run `void cloudflare logout`, then `void cloudflare login` (one browser Allow)',
       },
-      { state: 'missing-scopes', whoami: { status: 0, stdout: '', data: who, stderr: '' } },
     ];
     for (const session of sessions) {
-      const { inputs } = transcriptInputs({ runnerTable: { 'whoami --json': session.whoami } });
+      const calls: Array<Call> = [];
+      const fetchCalls: Array<FetchCall> = [];
+      const { inputs } = transcriptInputs({
+        calls,
+        fetchCalls,
+        runnerTable: { 'whoami --json': session.whoami },
+      });
       const pre = await preflightEmail(inputs);
       expect(pre.session.state).toBe(session.state);
-      expect(pre.blockers.map((b) => b.scope)).toEqual(['all']);
+      expect(pre.blockers).toEqual([{ scope: 'all', message: session.message }]);
       const message = pre.blockers[0]!.message;
       expect(message).toContain('`void cloudflare login`');
       expect(message).not.toMatch(/wrangler/i);
       // The checklist carries the row verbatim on both printing paths.
       expect(renderEmailChecklist(pre)).toContain(`    ✘ ${message}`);
+      // A session that cannot do the work gets no other read and lends no bearer.
+      expect(calls.map((c) => c.args.join(' '))).toEqual(['whoami --json']);
+      expect(fetchCalls).toEqual([]);
     }
-    // A Global API Key wins over both an OAuth session and CLOUDFLARE_API_TOKEN in wrangler's
-    // env precedence, so neither alternative works until the key is unset.
-    const apiKey = await preflightEmail(
-      transcriptInputs({ runnerTable: { 'whoami --json': sessions[3]!.whoami } }).inputs,
-    );
-    expect(apiKey.blockers[0]?.message).toBe(
-      'the Cloudflare session is a Global API Key (CLOUDFLARE_API_KEY), which has no bearer to borrow for the subaddressing calls — unset CLOUDFLARE_API_KEY, then run `void cloudflare login` or set CLOUDFLARE_API_TOKEN to a token with Email Routing Edit + Email Sending Edit',
-    );
-    const notLoggedIn = await preflightEmail(
-      transcriptInputs({ runnerTable: { 'whoami --json': sessions[2]!.whoami } }).inputs,
-    );
-    expect(notLoggedIn.blockers[0]?.message).toBe(
-      'not logged in to Cloudflare — run `void cloudflare login`',
-    );
-    const unreadable = await preflightEmail(
-      transcriptInputs({ runnerTable: { 'whoami --json': sessions[0]!.whoami } }).inputs,
-    );
-    expect(unreadable.blockers[0]?.message).toBe(
-      'could not read the Cloudflare session — run `void cloudflare login`',
-    );
-  });
-
-  it('blocks when not logged in', async () => {
-    const { inputs } = transcriptInputs({
-      runnerTable: {
-        'whoami --json': { status: 0, stdout: '', data: { loggedIn: false }, stderr: '' },
-      },
-    });
-    const pre = await preflightEmail(inputs);
-    expect(pre.session.state).toBe('not-logged-in');
-    expect(pre.blockers.map((b) => b.scope)).toEqual(['all']);
   });
 
   it('keeps apex-mode routing status unlocked / misconfigured blocked — never re-locks', async () => {
@@ -1185,7 +1082,7 @@ describe('preflightEmail', () => {
     expect(preMine.rules.mine).toEqual(['*@acme.com']);
   });
 
-  it('refuses a hand-written `addresses` array holding entries Void did not derive (decision 13)', async () => {
+  it('refuses a hand-written `addresses` array holding entries Void did not derive', async () => {
     const { inputs } = transcriptInputs({
       existingAddresses: ['support@mail.acme.com', 'billing@mail.acme.com'],
     });
@@ -1408,7 +1305,7 @@ describe('preflightEmail', () => {
 // ── Checklist ────────────────────────────────────────────────────────────────────
 
 describe('renderEmailChecklist', () => {
-  it('renders the 0078 transcript block for the first subdomain deploy', async () => {
+  it('renders the checklist for the first subdomain deploy', async () => {
     const who = structuredClone(whoamiResult().data) as {
       email: string;
       accounts: Array<{ id: string; name: string }>;
@@ -1490,7 +1387,6 @@ describe('applyEmailSetup', () => {
     expect(out.routingReady).toBe(true);
     expect(out.subaddressingReady).toBe(true);
     expect(out.sendingReady).toBe(true);
-    expect(out.addressesWithheld).toBe(false);
     expect(out.inboundReady).toBe(true);
     expect(out.patch).toEqual({
       sendEmail: { name: 'SEND_EMAIL' },
@@ -1638,7 +1534,6 @@ describe('applyEmailSetup', () => {
     expect(out.routingReady).toBe(true);
     expect(out.subaddressingReady).toBe(false);
     expect(out.sendingReady).toBe(true);
-    expect(out.addressesWithheld).toBe(true);
     expect(out.inboundReady).toBe(false);
     expect(out.patch).toEqual({
       sendEmail: { name: 'SEND_EMAIL' },
@@ -1666,7 +1561,6 @@ describe('applyEmailSetup', () => {
     calls.length = 0;
     const out = await applyEmailSetup(pre, inputs);
     expect(out.routingReady).toBe(false);
-    expect(out.addressesWithheld).toBe(true);
     expect(out.inboundReady).toBe(false);
     expect(out.patch.addresses).toBeNull();
     // Sending still onboarded → the binding is still written.
@@ -1697,7 +1591,7 @@ describe('applyEmailSetup', () => {
     fetchCalls.length = 0;
     const out = await applyEmailSetup(pre, inputs);
     expect(fetchCalls.map((c) => c.method)).toEqual(['POST']);
-    expect(out.addressesWithheld).toBe(true);
+    expect(out.lines.some((l) => l.includes('addresses withheld this run'))).toBe(true);
     expect(out.inboundReady).toBe(false);
     expect(out.patch.addresses).toBeNull();
     expect(out.lines[0]).toBe(
@@ -1755,7 +1649,6 @@ describe('applyEmailSetup', () => {
     expect(calls.map((c) => c.args)).toEqual([['email', 'sending', 'enable', 'mail.acme.com']]);
     expect(out.routingReady).toBe(false);
     expect(out.subaddressingReady).toBe(false);
-    expect(out.addressesWithheld).toBe(true);
     expect(out.inboundReady).toBe(false);
     expect(out.patch.addresses).toBeNull();
     expect(out.lines).toEqual([
@@ -1874,35 +1767,7 @@ describe('applyEmailSetup', () => {
   it('re-run with everything ready → zero wrangler calls, zero fetches, same patch', async () => {
     const calls: Array<Call> = [];
     const fetchCalls: Array<FetchCall> = [];
-    const { inputs } = transcriptInputs({
-      calls,
-      fetchCalls,
-      runnerTable: {
-        'email routing rules list acme.com': {
-          status: 0,
-          stdout: '',
-          data: routingRules({ supportDomain: 'mail.acme.com' }),
-          stderr: BETA_WARNING,
-        },
-        'email sending settings mail.acme.com': {
-          status: 0,
-          stdout: '',
-          data: {
-            name: 'mail.acme.com',
-            enabled: true,
-            tag: '19af4fdbee924a92916afea0de5a8fdd',
-          },
-          stderr: BETA_WARNING,
-        },
-      },
-      fetchTable: { [`GET /zones/${ZONE_ID}/email/routing`]: routingGet(true) },
-      dns: fakeDns({
-        mx: { 'acme.com': ['aspmx.l.google.com'], 'mail.acme.com': ['route1.mx.cloudflare.net'] },
-      }),
-      handlers: scan(['support+[ticket].ts']),
-      existingSendEmail: [{ name: 'SEND_EMAIL' }],
-      existingAddresses: ['support@mail.acme.com'],
-    });
+    const { inputs } = readyAccount({ calls, fetchCalls });
     const pre = await preflightEmail(inputs);
     expect(pre.ready).toBe(true);
     calls.length = 0;
diff --git a/packages/void/test/unit/email-dev-inbox.test.ts b/packages/void/test/unit/email-dev-inbox.test.ts
index 0f6f289e2..4b764cf0b 100644
--- a/packages/void/test/unit/email-dev-inbox.test.ts
+++ b/packages/void/test/unit/email-dev-inbox.test.ts
@@ -1,24 +1,12 @@
 /**
- * The `void dev` email inbox spans TWO OS processes:
- *
- *   Node (Vite dev server)                 workerd (miniflare child)
- *   ----------------------                 -------------------------
- *   emailDevInboxPlugin                    user route -> void/email
- *     registers the buffer sink              sendEmail() -> hasActiveSink()
- *     serves GET /__void/inbox               globalThis.__voidEmailSinks__ is
- *                                            EMPTY here (different isolate)
- *
- * So `registerEmailSink` can never be the transport for a real `void dev`
- * send. These tests drive the wire boundary instead: `sendEmail` runs with a
- * raw env shaped like the one workerd sees (no sink registered), and its
- * capture POST is routed into the REAL dev-inbox middleware through a fake
- * `ASSETS` fetcher — which is exactly what `@cloudflare/vite-plugin` binds
- * `env.ASSETS` to in dev (`{ node: (req, res) => viteDevServer.middlewares(req, res) }`).
+ * In `void dev`, `sendEmail` runs in workerd while the inbox lives in the Vite
+ * (Node) process, so these tests drive the wire boundary: the capture POST reaches
+ * the real dev-inbox middleware through a fake `ASSETS` fetcher.
  */
 import { EventEmitter } from 'node:events';
 import { Readable } from 'node:stream';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { shouldInjectEmailDevInboxVar } from '../../src/index.ts';
+import { shouldInjectEmailDevInboxVar } from '../../src/plugin-binding-utils.ts';
 import { emailDevInboxPlugin } from '../../src/plugin-email-dev-inbox.ts';
 import { sendEmail } from '../../src/runtime/email.ts';
 import {
@@ -225,16 +213,6 @@ describe('dev inbox capture wire format', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// The capture cap is sized for the SERIALIZED capture, not for the MIME. The
-// wire format carries the raw MIME as base64 and every caller string again as
-// JSON, and JSON escapes a control character to six bytes where the MIME
-// spends three (`=01`, quoted-printable body) or 1.6 (base64 encoded-word
-// header). So a message `buildMime` accepts — legal in production — can
-// serialize to several times MAX_MESSAGE_BYTES, and a cap that ignores that
-// makes `void dev` refuse what a deploy would send.
-// ---------------------------------------------------------------------------
-
 /** Serialized capture size of a message, alongside the MIME it was built from. */
 async function serializedSizeOf(
   opts: Parameters<typeof normalizeEmail>[0],
@@ -246,9 +224,8 @@ async function serializedSizeOf(
 }
 
 describe('dev inbox capture cap (sized for the serialized capture)', () => {
-  // Quoted-printable expands each control byte to `=01` plus soft breaks.
-  // The capture also carries JSON-escaped text and base64 MIME, so even a
-  // message below the 5 MiB sending limit exceeds three times that budget.
+  // A control byte is `=01` in the quoted-printable MIME but `\u0001` in the
+  // JSON text, so this legal message serializes past three MIME budgets.
   it('captures a legal message whose serialized capture exceeds three MIME budgets', async () => {
     const text = '\x01'.repeat(Math.floor(MAX_MESSAGE_BYTES / 3.15));
     const server = createFakeViteServer();
@@ -261,31 +238,22 @@ describe('dev inbox capture cap (sized for the serialized capture)', () => {
     expect(message.subject).toBe('control-heavy');
     expect(message.raw.byteLength).toBeLessThanOrEqual(MAX_MESSAGE_BYTES);
     expect(message.text).toBe(text);
-    // What crossed the wire: the same JSON the worker POSTed (ASCII, so its
-    // length is its byte size), including both expanded representations.
+    // ASCII JSON, so its length is its byte size.
     expect(serializeCapturedMessage(message).length).toBeGreaterThan(3 * MAX_MESSAGE_BYTES);
   });
 
-  // The bound behind the constant: base64 raw (4/3) plus every caller string
-  // at its worst JSON expansion over its own MIME octets (3.75x, a control in
-  // an encoded-word header), plus the fields with no MIME footprint (`bcc`
-  // addresses, framing). Pinned against the real builder and serializer at a
-  // small scale — the ratio is per octet, so it holds at any size — so a new
-  // capture field, or a MIME path that stops rendering a string, changes
-  // this test before it changes the inbox.
-  it('is derived from MAX_MESSAGE_BYTES: base64 raw (4/3) plus caller strings at 3.75x', async () => {
+  // The ratio is per octet, so checking the real serializer at a small scale
+  // holds at any size.
+  it('covers base64 raw (4/3) plus caller strings at their worst JSON expansion (3.75x)', async () => {
     const worstExpansion = 6 / 1.6;
-    expect(DEV_INBOX_MAX_CAPTURE_BYTES).toBe(6 * MAX_MESSAGE_BYTES);
     const framing = 1024;
     const bound =
       (4 / 3 + worstExpansion) * MAX_MESSAGE_BYTES + MAX_RECIPIENTS * MAX_ADDRESS_LENGTH + framing;
     expect(DEV_INBOX_MAX_CAPTURE_BYTES).toBeGreaterThan(bound);
-    // ...and the smallest integer multiple that does.
-    expect(5 * MAX_MESSAGE_BYTES).toBeLessThan(bound);
 
     const base = { from: 'a@x.dev', to: 'b@y.dev', subject: 's' };
     const control = '\x01'.repeat(30_000);
-    const encodedHeaderShapes: Array<[string, Parameters<typeof normalizeEmail>[0]]> = [
+    const shapes: Array<[string, Parameters<typeof normalizeEmail>[0]]> = [
       // encoded-word header: base64 plus framing (1.6) in the MIME, 6 in JSON — 3.75x
       ['control subject', { ...base, subject: control, text: 't' }],
       ['control display name', { ...base, to: [{ email: 'b@y.dev', name: control }], text: 't' }],
@@ -293,8 +261,6 @@ describe('dev inbox capture cap (sized for the serialized capture)', () => {
         'control custom header value',
         { ...base, headers: { 'X-Note': control.slice(0, 8_192) }, text: 't' },
       ],
-    ];
-    const shapes: Array<[string, Parameters<typeof normalizeEmail>[0]]> = [
       // body: `=01` (3) in the MIME, `\u0001` (6) in JSON — 2x
       ['control text', { ...base, text: control }],
       // body, 7bit path: CRLF (2) in the MIME, `\r\n` (4) in JSON — exactly 2x
@@ -312,21 +278,12 @@ describe('dev inbox capture cap (sized for the serialized capture)', () => {
           ),
         },
       ],
-      ...encodedHeaderShapes,
     ];
     for (const [label, opts] of shapes) {
       const { mimeBytes, jsonBytes } = await serializedSizeOf(opts);
       expect(mimeBytes, label).toBeLessThanOrEqual(MAX_MESSAGE_BYTES);
       expect(jsonBytes, label).toBeLessThanOrEqual((4 / 3 + worstExpansion) * mimeBytes + framing);
     }
-
-    // The 3.75x term is load-bearing, not slack: every encoded-header shape
-    // serializes past the body-only figure (4/3 + 2), which is why that
-    // figure could not have been the ratio.
-    for (const [label, opts] of encodedHeaderShapes) {
-      const { mimeBytes, jsonBytes } = await serializedSizeOf(opts);
-      expect(jsonBytes, label).toBeGreaterThan((4 / 3 + 2) * mimeBytes);
-    }
   });
 });
 
@@ -367,7 +324,7 @@ describe('sendEmail -> dev inbox (cross-process transport)', () => {
     expect(messages[0].from.email).toBe('hello@acme.dev');
     expect(messages[0].to[0].email).toBe('user@example.com');
     expect(messages[0].html).toBe('<p>Hi there</p>');
-    expect(messages[0].raw.byteLength).toBeGreaterThan(0);
+    expect(new TextDecoder().decode(messages[0].raw)).toContain('Subject: Cross-process hello');
 
     const listed = await server.dispatch(authed('http://localhost/__void/inbox'));
     expect(subjectsInListHtml(await listed.text())).toContain('Cross-process hello');
@@ -399,45 +356,6 @@ describe('sendEmail -> dev inbox (cross-process transport)', () => {
     expect(message.bcc).toEqual([{ email: 'B@x.dev', name: 'Bob' }, { email: 'b@x.dev' }]);
   });
 
-  it('serves the captured .eml back from the raw route', async () => {
-    const server = createFakeViteServer();
-    const assets = fakeAssetsBinding(server);
-    await withRuntimeEnv(devEnv(assets), () =>
-      sendEmail({ from: 'a@x.dev', to: 'b@y.dev', subject: 'raw-check', text: 'body text' }),
-    );
-    const id = listDevMessages()[0].id;
-    const raw = await server.dispatch(authed(`http://localhost/__void/inbox/${id}/raw`));
-    expect(raw.status).toBe(200);
-    expect(raw.headers.get('content-type')).toBe('message/rfc822');
-    expect(await raw.text()).toContain('Subject: raw-check');
-  });
-
-  it('acknowledges the capture with a marker header so a plain asset 200 is not mistaken for success', async () => {
-    const server = createFakeViteServer();
-    const res = await server.dispatch(
-      authed(`http://localhost${DEV_INBOX_CAPTURE_URL}`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: serializeCapturedMessage({
-          id: 'dev_marker',
-          capturedAt: Date.now(),
-          raw: new Uint8Array([65]),
-          messageId: '<m@x>',
-          from: { email: 'a@x.dev' },
-          to: [{ email: 'b@y.dev' }],
-          cc: [],
-          bcc: [],
-          subject: 'marker',
-          headers: {},
-          attachments: [],
-        }),
-      }),
-    );
-    expect(res.status).toBe(200);
-    expect(res.headers.get(DEV_INBOX_ACK_HEADER)).toBe(DEV_INBOX_ACK_VALUE);
-    expect(listDevMessages()[0].subject).toBe('marker');
-  });
-
   it('reports an honest error when the dev inbox is unreachable — no hang, no crash', async () => {
     const broken = {
       async fetch() {
@@ -487,25 +405,6 @@ describe('sendEmail -> dev inbox (cross-process transport)', () => {
     expect(listDevMessages()).toHaveLength(0);
   });
 
-  it('honors sendInDev: true by skipping the dev inbox entirely', async () => {
-    const server = createFakeViteServer();
-    const assets = fakeAssetsBinding(server);
-    const result = await withRuntimeEnv(devEnv(assets), () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
-    expect(assets.calls).toHaveLength(0);
-    expect(result.ok).toBe(false);
-    if (!result.ok && 'error' in result) {
-      expect(result.error.code).toBe('BINDING_MISSING');
-    }
-  });
-
   it('uses the binding name the var names, not a hardcoded ASSETS', async () => {
     const server = createFakeViteServer();
     const assets = fakeAssetsBinding(server);
@@ -517,13 +416,6 @@ describe('sendEmail -> dev inbox (cross-process transport)', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Every inbox route requires the dev-trigger token. Vite's host validation
-// admits any IP-literal `Host`, so under `--host` (or a shared port) the
-// unauthenticated inbox handed every network peer the raw MIME — Bcc and
-// attachments included — plus DELETE and a capture endpoint to plant messages.
-// ---------------------------------------------------------------------------
-
 function seeded(): CapturedMessage {
   return {
     id: 'dev_seeded',
@@ -713,34 +605,13 @@ describe('dev inbox auth (dev-trigger token on every route)', () => {
 });
 
 describe('shouldInjectEmailDevInboxVar (dev-only gate)', () => {
-  it('injects in dev when email is used and an assets binding exists', () => {
-    expect(shouldInjectEmailDevInboxVar('dev', true, 'ASSETS')).toBe(true);
-  });
-
-  // `prod` covers every build, `void deploy`, AND `vite preview` (which
-  // reports command: 'serve' but runs the built worker, whose assets binding
-  // is a real directory rather than a dev-server loopback).
-  it('never injects outside the dev server — a production wrangler.json must not carry it', () => {
-    expect(shouldInjectEmailDevInboxVar('prod', true, 'ASSETS')).toBe(false);
-  });
-
-  it('does not inject when the app does not use void/email', () => {
-    expect(shouldInjectEmailDevInboxVar('dev', false, 'ASSETS')).toBe(false);
-    expect(shouldInjectEmailDevInboxVar('dev', undefined, 'ASSETS')).toBe(false);
-  });
-
   it('does not inject when there is no assets binding to loop back through', () => {
     expect(shouldInjectEmailDevInboxVar('dev', true, undefined)).toBe(false);
     expect(shouldInjectEmailDevInboxVar('dev', true, '')).toBe(false);
   });
 });
 
-// ---------------------------------------------------------------------------
-// Buffer bounds. The dev buffer lives in the Vite dev server's NODE process,
-// and it retains each message's full raw MIME plus its decoded text and html.
-// A count-only cap of 100 therefore bounds the buffer at ~100 x
-// MAX_MESSAGE_BYTES, i.e. gigabytes — enough to OOM `void dev` itself.
-// ---------------------------------------------------------------------------
+// The buffer lives in the dev server's Node process, so it is bounded by retained bytes.
 
 const MIB = 1024 * 1024;
 
@@ -763,9 +634,7 @@ function capturedOfSize(id: string, rawBytes: number, htmlChars = 0): CapturedMe
 
 describe('dev inbox buffer bounds', () => {
   it('evicts on the retained-byte budget well below the count cap', () => {
-    // 8 MiB of raw MIME + 8 MiB of decoded html is 16 MiB charged per message,
-    // so the fifth push crosses the 64 MiB budget and evicts — at a count of
-    // five, nowhere near the 100-item cap that used to be the only bound.
+    // 16 MiB charged per message, so the fifth push crosses the 64 MiB budget.
     for (let i = 1; i <= 5; i++) {
       pushToDevBuffer(capturedOfSize(`msg-${i}`, 8 * MIB, 8 * MIB));
     }
diff --git a/packages/void/test/unit/email-domain-args.test.ts b/packages/void/test/unit/email-domain-args.test.ts
index bcbccb6ca..7834b293e 100644
--- a/packages/void/test/unit/email-domain-args.test.ts
+++ b/packages/void/test/unit/email-domain-args.test.ts
@@ -2,9 +2,8 @@ import { describe, expect, it } from 'vite-plus/test';
 import { parseEmailArgs } from '../../src/cli/email-args.ts';
 
 /**
- * The nested `void email domain <verb>` group (design doc 0078, "Custom
- * domains on Cloudflare"). `runSubcommandGroup` handles one level, so the
- * group parses its own positionals: verb first, domain second.
+ * The nested `void email domain <verb>` group. `runSubcommandGroup` handles one level,
+ * so the group parses its own positionals: verb first, domain second.
  */
 describe('parseEmailArgs — domain group', () => {
   it('parses domain add with a domain', () => {
@@ -12,7 +11,6 @@ describe('parseEmailArgs — domain group', () => {
       subcommand: 'domain',
       domainVerb: 'add',
       domain: 'acme.com',
-      subdomain: undefined,
       projectSlug: undefined,
       limit: undefined,
       platform: undefined,
@@ -98,6 +96,7 @@ describe('parseEmailArgs — domain group', () => {
       ['domain', 'status', 'acme.com', '--subdomain', 'mx'],
       ['domain', 'list', '--subdomain=mx'],
       ['domain', 'remove', 'acme.com', '--subdomain', 'mx'],
+      ['setup', '--platform', 'cloudflare', '--subdomain', 'mail'],
     ]) {
       expect(() => parseEmailArgs(args)).toThrow(
         'email: --subdomain applies to `void email domain add` only.',
@@ -111,12 +110,6 @@ describe('parseEmailArgs — domain group', () => {
     );
   });
 
-  it('rejects the removed force option instead of silently ignoring it', () => {
-    expect(() => parseEmailArgs(['domain', 'remove', 'acme.com', '--force'])).toThrow(
-      /takes exactly one domain argument/,
-    );
-  });
-
   it('rejects --subdomain without a value, with an empty value, or repeated', () => {
     expect(() => parseEmailArgs(['domain', 'add', 'acme.com', '--subdomain'])).toThrow(
       'email: --subdomain requires a value (a subdomain label or host).',
@@ -132,8 +125,6 @@ describe('parseEmailArgs — domain group', () => {
     ).toThrow('email: --subdomain can only be specified once.');
   });
 
-  // Mode B (0078): the developer's own zone needs none of this group — same
-  // rejection the platform-only subcommands already had.
   it('rejects --platform cloudflare on the domain group, accepts --platform void', () => {
     expect(() => parseEmailArgs(['domain', 'add', 'acme.com', '--platform', 'cloudflare'])).toThrow(
       'email: --platform cloudflare applies to `void email status` and `void email setup` only (`domain` is a Void platform command).',
@@ -143,16 +134,4 @@ describe('parseEmailArgs — domain group', () => {
       platform: 'void',
     });
   });
-
-  it('keeps the existing subcommands parsing unchanged with the group registered', () => {
-    // The shared flag rules still bind inside the group.
-    expect(() => parseEmailArgs(['domain', 'list', '--project', 'a', '--project', 'b'])).toThrow(
-      'email: --project can only be specified once.',
-    );
-    expect(() => parseEmailArgs(['domain', 'add', 'acme.com', '--project='])).toThrow(
-      'email: --project requires a value (a project name).',
-    );
-    // And the top-level usage error names the group.
-    expect(() => parseEmailArgs(['nope'])).toThrow(/email: Usage: void email .*domain/);
-  });
 });
diff --git a/packages/void/test/unit/email-inbound.test.ts b/packages/void/test/unit/email-inbound.test.ts
index 7e72f120a..99941ebf2 100644
--- a/packages/void/test/unit/email-inbound.test.ts
+++ b/packages/void/test/unit/email-inbound.test.ts
@@ -14,7 +14,6 @@ import { compileWorkerEntry } from '../../src/router/compile.ts';
 import {
   compileEmailPattern,
   hasEmailHandlers,
-  scanEmailHandlers,
   scanEmailHandlersSync,
 } from '../../src/router/email.ts';
 import * as emailBarrel from '../../src/runtime/email.ts';
@@ -67,112 +66,54 @@ afterEach(() => {
   rmSync(TMP, { recursive: true, force: true });
 });
 
-describe('scanEmailHandlers', () => {
-  it('returns empty when no email/ files exist', async () => {
+describe('scanEmailHandlersSync', () => {
+  it('returns empty when no email/ files exist', () => {
     const root = setupRoot({});
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     expect(scan.addresses).toEqual([]);
     expect(scan.defaultHandler).toBeUndefined();
     expect(hasEmailHandlers(scan)).toBe(false);
   });
 
-  it('detects per-address handlers under email/', async () => {
+  it('detects per-address handlers under email/', () => {
     const root = setupRoot({
       'email/support.ts': 'export default () => {}',
       'email/billing.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     expect(scan.addresses.map((a) => a.address)).toEqual(['billing', 'support']);
     expect(scan.addresses[0].filePath).toBe('billing.ts');
     expect(hasEmailHandlers(scan)).toBe(true);
   });
 
-  it('detects email/_default.ts as fallback', async () => {
+  it('detects email/_default.ts as fallback', () => {
     const root = setupRoot({
       'email/support.ts': 'export default () => {}',
       'email/_default.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     expect(scan.defaultHandler).toBe('_default.ts');
     expect(scan.addresses.map((a) => a.address)).toEqual(['support']);
   });
 
-  it('lowercases address names for case-insensitive routing', async () => {
+  it('lowercases address names for case-insensitive routing', () => {
     const root = setupRoot({
       'email/Support.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     expect(scan.addresses[0].address).toBe('support');
   });
 
-  it('ignores nested folders', async () => {
+  it('ignores nested folders', () => {
     const root = setupRoot({
       'email/sub/nested.ts': 'export default () => {}',
       'email/support.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
-    expect(scan.addresses.map((a) => a.address)).toEqual(['support']);
-  });
-
-  it('sync variant returns the same shape', () => {
-    const root = setupRoot({
-      'email/support.ts': 'export default () => {}',
-    });
     const scan = scanEmailHandlersSync(root);
-    expect(scan.addresses[0].address).toBe('support');
-  });
-
-  it('compiles tagged + dynamic patterns and orders by specificity', async () => {
-    const root = setupRoot({
-      'email/support.ts': 'export default () => {}',
-      'email/support+[ticket].ts': 'export default () => {}',
-      'email/[user].ts': 'export default () => {}',
-      'email/[user]+[tag].ts': 'export default () => {}',
-    });
-    const scan = await scanEmailHandlers(root);
-    expect(scan.addresses.map((a) => a.address)).toEqual([
-      'support+[ticket]',
-      'support',
-      '[user]+[tag]',
-      '[user]',
-    ]);
-    expect(scan.addresses.map((a) => a.pattern.kind)).toEqual([
-      'static-tag',
-      'static',
-      'dynamic-tag',
-      'dynamic',
-    ]);
-    expect(scan.addresses[0].pattern.regexSource).toBe('^support\\+([^+@]+)$');
-    expect(scan.addresses[0].pattern.paramNames).toEqual(['ticket']);
-    expect(scan.addresses[2].pattern.regexSource).toBe('^([^+@]+)\\+([^+@]+)$');
-    expect(scan.addresses[2].pattern.paramNames).toEqual(['user', 'tag']);
-  });
-
-  it('sorts a literal tag ahead of a captured tag of the same kind', async () => {
-    // Both compile to `static-tag`, both match `support+vip@`, and the
-    // dispatcher returns on the first hit. Alphabetically `[` sorts before
-    // `v`, which used to put the capture first and leave the exact handler
-    // dead for every delivery.
-    const root = setupRoot({
-      'email/support+[tag].ts': 'export default () => {}',
-      'email/support+vip.ts': 'export default () => {}',
-    });
-    const scan = await scanEmailHandlers(root);
-    expect(scan.addresses.map((a) => a.address)).toEqual(['support+vip', 'support+[tag]']);
-    expect(scan.addresses.map((a) => a.pattern.kind)).toEqual(['static-tag', 'static-tag']);
-  });
-
-  it('sorts [user]+vip ahead of [user]+[tag]', async () => {
-    const root = setupRoot({
-      'email/[user]+[tag].ts': 'export default () => {}',
-      'email/[user]+vip.ts': 'export default () => {}',
-    });
-    const scan = await scanEmailHandlers(root);
-    expect(scan.addresses.map((a) => a.address)).toEqual(['[user]+vip', '[user]+[tag]']);
-    expect(scan.addresses.map((a) => a.pattern.kind)).toEqual(['dynamic-tag', 'dynamic-tag']);
+    expect(scan.addresses.map((a) => a.address)).toEqual(['support']);
   });
 
-  it('pins the full six-shape dispatch order', async () => {
+  it('pins the full six-shape dispatch order', () => {
     const root = setupRoot({
       'email/[user].ts': 'export default () => {}',
       'email/[user]+[tag].ts': 'export default () => {}',
@@ -181,7 +122,7 @@ describe('scanEmailHandlers', () => {
       'email/support+[tag].ts': 'export default () => {}',
       'email/support+vip.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     expect(scan.addresses.map((a) => a.address)).toEqual([
       'support+vip',
       'support+[tag]',
@@ -190,6 +131,14 @@ describe('scanEmailHandlers', () => {
       '[user]+[tag]',
       '[user]',
     ]);
+    expect(scan.addresses.map((a) => a.pattern.kind)).toEqual([
+      'static-tag',
+      'static-tag',
+      'static',
+      'dynamic-tag',
+      'dynamic-tag',
+      'dynamic',
+    ]);
     // The generated dispatcher returns on the first regex that matches, so
     // the exact handler must be the first one that matches `support+vip`.
     const first = scan.addresses.find((a) =>
@@ -198,40 +147,37 @@ describe('scanEmailHandlers', () => {
     expect(first?.address).toBe('support+vip');
   });
 
-  it('skips files with invalid pattern shapes', async () => {
+  it('skips files with invalid pattern shapes', () => {
     const root = setupRoot({
       'email/support+ticket+extra.ts': 'export default () => {}', // two `+`
       'email/Bad Name.ts': 'export default () => {}', // space
       'email/[bad-name].ts': 'export default () => {}', // hyphen in param
       'email/ok.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     expect(scan.addresses.map((a) => a.address)).toEqual(['ok']);
   });
 
-  it('rejects a second _default.<ext> file instead of letting glob order pick one', async () => {
+  it('rejects a second _default.<ext> file instead of letting glob order pick one', () => {
     const root = setupRoot({
       'email/_default.ts': 'export default () => {}',
       'email/_default.js': 'export default () => {}',
     });
     // Glob order is readdir order, so either file may be reported as the
     // "second" one — the error must name both regardless.
-    await expect(scanEmailHandlers(root)).rejects.toThrow(/is a second default handler next to/);
-    await expect(scanEmailHandlers(root)).rejects.toThrow(/"_default\.ts"/);
-    await expect(scanEmailHandlers(root)).rejects.toThrow(/"_default\.js"/);
-    await expect(scanEmailHandlers(root)).rejects.toThrow(
-      /keep exactly one email\/_default\.\* file/,
-    );
-    expect(() => scanEmailHandlersSync(root)).toThrow(/is a second default handler/);
+    expect(() => scanEmailHandlersSync(root)).toThrow(/is a second default handler next to/);
+    expect(() => scanEmailHandlersSync(root)).toThrow(/"_default\.ts"/);
+    expect(() => scanEmailHandlersSync(root)).toThrow(/"_default\.js"/);
+    expect(() => scanEmailHandlersSync(root)).toThrow(/keep exactly one email\/_default\.\* file/);
   });
 
-  it('matches _default exactly: _Default.ts and _default.test.ts are private helpers, not a collision', async () => {
+  it('matches _default exactly: _Default.ts and _default.test.ts are private helpers, not a collision', () => {
     const root = setupRoot({
       'email/_default.mjs': 'export default () => {}',
       'email/_Default.ts': 'export default () => {}',
       'email/_default.test.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     expect(scan.defaultHandler).toBe('_default.mjs');
     expect(scan.addresses).toEqual([]);
   });
@@ -299,13 +245,6 @@ describe('compileEmailPattern', () => {
   });
 });
 
-describe('defineEmail', () => {
-  it('is an identity helper that preserves the handler', () => {
-    const handler = defineEmail(async () => {});
-    expect(typeof handler).toBe('function');
-  });
-});
-
 describe('parseEmail', () => {
   it('parses a minimal RFC 5322 message via postal-mime', async () => {
     const raw =
@@ -342,140 +281,54 @@ describe('parseEmail', () => {
   });
 });
 
-describe('compileRouteTable (email)', () => {
-  const baseScan = {
-    routes: [],
-    middleware: [],
-    jobs: [],
-    queues: [],
-    pages: { pages: [], layouts: [], namedLayouts: [] },
-  };
-  // `emailDir` rides on `CompileOptions` rather than `compileRouteTable`'s
-  // positional list — see the note on the field in router/compile.ts.
-  const baseOptions = {
-    honoPath: 'hono',
-
-    runtimeEnvPath: 'void/_env',
-    projectRoot: '/project',
-    homeDir: '/home/test',
-    reactRefresh: false,
-    auth: null,
-    nodeTarget: false,
-    emailDir: '/e',
-  };
+const COMPILE_OPTIONS = {
+  honoPath: 'hono',
+  runtimeEnvPath: 'void/_env',
+  projectRoot: '/project',
+  homeDir: '/home/test',
+  reactRefresh: false,
+  auth: null,
+  nodeTarget: false,
+  emailDir: '/e',
+};
+
+/** A route table whose only content is `email`, with handlers under `/e`. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function compile(email: any): string {
+  return compileRouteTable(
+    {
+      routes: [],
+      middleware: [],
+      jobs: [],
+      queues: [],
+      pages: { pages: [], layouts: [], namedLayouts: [] },
+      email,
+    },
+    '/r',
+    '/m',
+    '/j',
+    '/q',
+    null,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    COMPILE_OPTIONS as any,
+  );
+}
 
+describe('compileRouteTable (email)', () => {
   it('emits __emailHandler with _default only', () => {
-    const code = compileRouteTable(
-      { ...baseScan, email: { addresses: [], defaultHandler: '_default.ts' } },
-      '/r',
-      '/m',
-      '/j',
-      '/q',
-      null,
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      baseOptions as any,
-    );
+    const code = compile({ addresses: [], defaultHandler: '_default.ts' });
     expect(code).toContain('export async function __emailHandler');
     expect(code).toContain('"/e/_default.ts"');
     expect(code).toContain('__emailDefault');
   });
 
-  it('emits per-address dispatch via __emailPatterns regex table', () => {
-    const code = compileRouteTable(
-      {
-        ...baseScan,
-        email: {
-          addresses: [
-            {
-              address: 'support',
-              filePath: 'support.ts',
-              pattern: { kind: 'static', regexSource: '^support$', paramNames: [] },
-            },
-            {
-              address: 'billing',
-              filePath: 'billing.ts',
-              pattern: { kind: 'static', regexSource: '^billing$', paramNames: [] },
-            },
-          ],
-        },
-      },
-      '/r',
-      '/m',
-      '/j',
-      '/q',
-      null,
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      baseOptions as any,
-    );
-    expect(code).toContain('__emailPatterns');
-    expect(code).toContain('^support$');
-    expect(code).toContain('^billing$');
-    expect(code).toContain('"/e/support.ts"');
-    expect(code).toContain('"/e/billing.ts"');
-    expect(code).toContain('mod.default(message, env, ctx, { params');
-  });
-
-  it('emits param extraction for tagged + dynamic patterns', () => {
-    const code = compileRouteTable(
-      {
-        ...baseScan,
-        email: {
-          addresses: [
-            {
-              address: 'support+[ticket]',
-              filePath: 'support+[ticket].ts',
-              pattern: {
-                kind: 'static-tag',
-                regexSource: '^support\\+([^+@]+)$',
-                paramNames: ['ticket'],
-              },
-            },
-            {
-              address: '[user]',
-              filePath: '[user].ts',
-              pattern: { kind: 'dynamic', regexSource: '^([^+@]+)$', paramNames: ['user'] },
-            },
-          ],
-        },
-      },
-      '/r',
-      '/m',
-      '/j',
-      '/q',
-      null,
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      baseOptions as any,
-    );
-    expect(code).toContain('"ticket"');
-    expect(code).toContain('"user"');
-    expect(code).toContain('^support\\\\+([^+@]+)$');
-    expect(code).toContain('^([^+@]+)$');
-  });
-
   it('omits the email block entirely when no handlers exist', () => {
-    const code = compileRouteTable(
-      { ...baseScan, email: { addresses: [] } },
-      '/r',
-      '/m',
-      '/j',
-      '/q',
-      null,
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      baseOptions as any,
-    );
+    const code = compile({ addresses: [] });
     expect(code).not.toContain('__emailHandler');
   });
 });
 
-/**
- * Executes the GENERATED `__emailHandler` instead of asserting on its source.
- *
- * Every other codegen test here is string containment, which is exactly why the
- * double slug strip survived: `createMessageProxy` removed the `<slug>+` prefix
- * from `message.to`, the dispatcher removed it a second time, and the resulting
- * empty tag matched no pattern. Both halves were individually "correct" and the
- * seam between them was untested.
- */
+/** Executes the generated `__emailHandler` instead of asserting on its source. */
 function buildEmailDispatcher(
   code: string,
   modules: Record<string, { default: unknown }>,
@@ -497,41 +350,6 @@ function buildEmailDispatcher(
 }
 
 describe('generated __emailHandler dispatch (behavioural)', () => {
-  const baseScan = {
-    routes: [],
-    middleware: [],
-    jobs: [],
-    queues: [],
-    pages: { pages: [], layouts: [], namedLayouts: [] },
-  };
-
-  const baseOptions = {
-    honoPath: 'hono',
-
-    runtimeEnvPath: 'void/_env',
-    projectRoot: '/project',
-    homeDir: '/home/test',
-    reactRefresh: false,
-    auth: null,
-    nodeTarget: false,
-    emailDir: '/e',
-  };
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  function compile(email: any): string {
-    return compileRouteTable(
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      { ...baseScan, email } as any,
-      '/r',
-      '/m',
-      '/j',
-      '/q',
-      null,
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      baseOptions as any,
-    );
-  }
-
   const SUPPORT = {
     addresses: [
       {
@@ -854,7 +672,7 @@ describe('generated __emailHandler dispatch (behavioural)', () => {
 
   it('runs the exact-tag handler for support+vip@ when a capturing sibling exists (real scan)', async () => {
     // Scanner → codegen → dispatch, end to end. The hand-built scans above
-    // fix their own order; this one takes the order `scanEmailHandlers`
+    // fix their own order; this one takes the order `scanEmailHandlersSync`
     // produces, which is the only thing the generated loop relies on.
     const root = setupRoot({
       'email/[user].ts': 'export default () => {}',
@@ -864,7 +682,7 @@ describe('generated __emailHandler dispatch (behavioural)', () => {
       'email/support+[tag].ts': 'export default () => {}',
       'email/support+vip.ts': 'export default () => {}',
     });
-    const scan = await scanEmailHandlers(root);
+    const scan = scanEmailHandlersSync(root);
     const hits: Array<string> = [];
     const dispatch = buildEmailDispatcher(compile(scan), {
       '/e/[user].ts': { default: () => hits.push('[user]') },
@@ -1049,23 +867,6 @@ describe('createInboundTestHarness', () => {
     expect(exact).toHaveBeenCalledTimes(1);
   });
 
-  it('prefers [user]+vip over [user]+[tag]', async () => {
-    const exact = vi.fn(async () => {});
-    const captured = vi.fn(async () => {});
-    const harness = createInboundTestHarness({
-      routes: { '[user]+[tag]': captured, '[user]+vip': exact },
-    });
-
-    const vip = await harness.deliver({ from: 'u@x.dev', to: 'myslug+alice+vip@app.dev' });
-    expect(vip.handler).toBe('[user]+vip');
-    expect(vip.params).toEqual({ user: 'alice' });
-    expect(captured).not.toHaveBeenCalled();
-
-    const other = await harness.deliver({ from: 'u@x.dev', to: 'myslug+alice+welcome@app.dev' });
-    expect(other.handler).toBe('[user]+[tag]');
-    expect(other.params).toEqual({ user: 'alice', tag: 'welcome' });
-  });
-
   it('falls through to _default when no per-address pattern matches', async () => {
     const def = vi.fn(async () => {});
     const harness = createInboundTestHarness({ routes: { _default: def } });
@@ -1090,46 +891,6 @@ describe('createInboundTestHarness', () => {
     expect(result.handler).toBeUndefined();
   });
 
-  it('walks back forward/reply when setReject fires later in the same dispatch', async () => {
-    // Production: setReject is terminal — forward/reply queued before it
-    // never execute on the real ForwardableEmailMessage. The harness
-    // mirrors that by popping the prior entries off the public arrays so
-    // assertions match what the real router would actually enact.
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    try {
-      const handler = defineEmail(async (message) => {
-        await message.forward('ops@x.dev');
-        message.setReject('not allowed');
-      });
-      const harness = createInboundTestHarness({ routes: { _default: handler } });
-      await harness.deliver({ from: 'u@x.dev', to: 'anything@app.dev' });
-      expect(harness.rejects).toEqual(['not allowed']);
-      expect(harness.forwards).toEqual([]);
-      expect(warn).toHaveBeenCalledTimes(1);
-      expect(String(warn.mock.calls[0][0])).toContain('forward/reply');
-    } finally {
-      warn.mockRestore();
-    }
-  });
-
-  it('setReject is terminal: forward/reply after setReject are dropped', async () => {
-    // Production's createMessageProxy short-circuits forward/reply once
-    // setReject has fired (warns + returns). The harness must mirror
-    // that — without it, a buggy handler that calls setReject then
-    // forward passes the harness tests but in production CF only
-    // honors the reject and silently discards the forward.
-    const handler = defineEmail(async (message) => {
-      message.setReject('not allowed');
-      await message.forward('ops@x.dev');
-      await message.reply({ from: 'support@app.dev', to: 'u@x.dev' } as never);
-    });
-    const harness = createInboundTestHarness({ routes: { _default: handler } });
-    await harness.deliver({ from: 'u@x.dev', to: 'anything@app.dev' });
-    expect(harness.rejects).toEqual(['not allowed']);
-    expect(harness.forwards).toEqual([]);
-    expect(harness.replies).toEqual([]);
-  });
-
   it('setReject is idempotent — subsequent setReject calls are dropped', async () => {
     const handler = defineEmail(async (message) => {
       message.setReject('first reason');
@@ -1153,11 +914,8 @@ describe('createInboundTestHarness', () => {
     expect(result.handler).toBe('support');
   });
 
-  // The harness is the only thing a user tests their handler against, so a
-  // captured tag has to arrive with the case production would give it. The
-  // codegen twin of this assertion is 'captures the tag parameter from the
-  // wire recipient, not the stripped one' above; the two must agree or a
-  // green test suite says nothing about the deployed behavior.
+  // The codegen twin is 'captures the tag parameter from the wire recipient,
+  // not the stripped one'; the two must agree.
   it('preserves the case of a captured tag, like the generated dispatcher', async () => {
     let seen: unknown;
     const harness = createInboundTestHarness({
@@ -1182,13 +940,8 @@ describe('createInboundTestHarness', () => {
 });
 
 describe('harness enforces the proxy action bounds, like production', () => {
-  // The handler under test runs against production's own `createMessageProxy`
-  // in both lanes (the generated `email()` entry builds it from the envelope),
-  // and that proxy is where the queue cap, the address cap, the header-record
-  // check and the reply bounds throw. A harness that recorded every call
-  // instead passed a handler that fails on the 101st forward after deploy —
-  // fourth divergence of this shape on this feature. These pin that the
-  // harness throws the SAME error (class, code, message) at the same call.
+  // The handler runs against production's own `createMessageProxy`, so the
+  // harness throws the same error (class, code, message) at the same call.
   function harnessFor(handler: Parameters<typeof defineEmail>[0]) {
     return createInboundTestHarness({ routes: { _default: defineEmail(handler) } });
   }
@@ -1216,108 +969,6 @@ describe('harness enforces the proxy action bounds, like production', () => {
     expect(harness.forwards[99]).toEqual({ to: 'box99@example.com' });
   });
 
-  it('fails the delivery with that error when the handler does not catch it', async () => {
-    // Production enacts nothing from a handler that throws: the platform
-    // router rejects the message as a handler error, and on your own account
-    // the invocation fails before `enactEmailActions` runs.
-    const harness = harnessFor(async (message) => {
-      for (let i = 0; i <= 100; i++) {
-        await message.forward(`box${i}@example.com`);
-      }
-    });
-    await expect(harness.deliver(DELIVERY)).rejects.toThrow(/handler queued more than 100 actions/);
-    expect(harness.forwards).toEqual([]);
-    expect(harness.deliveries).toEqual([]);
-  });
-
-  it('refuses a forward address over the address-length limit', async () => {
-    let thrown: unknown;
-    const over = `${'a'.repeat(320)}@example.com`;
-    const harness = harnessFor(async (message) => {
-      try {
-        await message.forward(over);
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).code).toBe('INVALID_TO');
-    expect((thrown as MimeError).message).toBe(
-      `to address is ${over.length} characters, over the 320-character limit.`,
-    );
-    expect(harness.forwards).toEqual([]);
-  });
-
-  it('refuses a forward address over the 254-character path limit, by the sendEmail rule', async () => {
-    // Under the 320 total above, so `forward()`'s own pre-check passes and
-    // the refusal comes from `validateAddressParts` — the rule an outbound
-    // `to` gets, inherited rather than mirrored (`email-validator` checks
-    // 254 before its regex).
-    let thrown: unknown;
-    const label = 'b'.repeat(63);
-    const over = `a@${[label, label, label, label].join('.')}`;
-    expect(over).toHaveLength(257);
-    const harness = harnessFor(async (message) => {
-      try {
-        await message.forward(over);
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).code).toBe('INVALID_TO');
-    expect((thrown as MimeError).message).toBe(`to: ${INVALID_ADDRESS}`);
-    expect(harness.forwards).toEqual([]);
-  });
-
-  it('refuses a forward address carrying a control character, by the sendEmail rule', async () => {
-    // The platform router's `isValidEmailAddress` refuses `\u0000-\u001f`
-    // and `\u007f`, and used to be the first thing that did: `forward()`
-    // recorded the address, the harness captured it as a success, and the
-    // router dropped just that forward after earlier actions had fired.
-    // Both sides now apply `email-validator`; the message names the rule
-    // and never echoes the byte.
-    let thrown: unknown;
-    const harness = harnessFor(async (message) => {
-      try {
-        await message.forward('a\x01b@example.com');
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).code).toBe('INVALID_TO');
-    expect((thrown as MimeError).message).toBe(`to: ${INVALID_ADDRESS}`);
-    expect((thrown as MimeError).message).not.toContain('\x01');
-    expect(harness.forwards).toEqual([]);
-  });
-
-  it('refuses a forward address carrying a colon, by the sendEmail rule', async () => {
-    // Same class as the control character above: `:` is an RFC 5322
-    // §3.2.3 special the platform router's `isValidEmailAddress` refuses,
-    // and it was the one missing from the framework's address class —
-    // `forward('a:b@example.com')` was recorded, the harness captured it as
-    // a success, and the router dropped just that forward after the one
-    // before it had fired.
-    let thrown: unknown;
-    const harness = harnessFor(async (message) => {
-      await message.forward('first@example.com');
-      try {
-        await message.forward('a:b@example.com');
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).code).toBe('INVALID_TO');
-    expect((thrown as MimeError).message).toBe(`to: ${INVALID_ADDRESS}`);
-    expect(harness.forwards).toEqual([{ to: 'first@example.com' }]);
-  });
-
   it('refuses a forward header record with a CRLF in a value at the call, recording nothing for it', async () => {
     let thrown: unknown;
     const harness = harnessFor(async (message) => {
@@ -1345,112 +996,6 @@ describe('harness enforces the proxy action bounds, like production', () => {
     expect(harness.forwards[1].headers?.get('X-Forwarded-By')).toBe('void-test');
   });
 
-  it('refuses a malformed forward address at the call, recording nothing for it', async () => {
-    // A harness that captured `Ops <ops@example.com>` as a forward passed a
-    // handler whose deploy fails at native replay (Cloudflare) or loses the
-    // forward at the router (platform). Same error as `sendEmail`'s `to`.
-    let thrown: unknown;
-    const harness = harnessFor(async (message) => {
-      await message.forward('first@example.com');
-      try {
-        await message.forward('Ops <ops@example.com>');
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).code).toBe('INVALID_TO');
-    expect((thrown as MimeError).message).toBe(`to: ${INVALID_ADDRESS}`);
-    expect(harness.forwards).toEqual([{ to: 'first@example.com' }]);
-  });
-
-  it("refuses a forward header bag over the router's bounds at the call, recording nothing for it", async () => {
-    // `new Headers()` accepts 33 headers, so the record-validity check
-    // passes them, and the managed router drops the WHOLE action list on
-    // the count (`forwardHeadersWithinBounds`). A harness that reported
-    // this forward passed a handler whose managed deployment silently
-    // performed no actions.
-    let thrown: unknown;
-    const harness = harnessFor(async (message) => {
-      await message.forward('first@example.com');
-      const bag = new Headers();
-      for (let i = 0; i < 33; i++) {
-        bag.set(`X-Void-${i}`, 'v');
-      }
-      try {
-        await message.forward('archive@example.com', bag);
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).code).toBe('MIME_ERROR');
-    expect((thrown as MimeError).message).toBe('forward: 33 headers, over the 32-header limit.');
-    expect(harness.forwards).toEqual([{ to: 'first@example.com' }]);
-  });
-
-  it('reports the reject reason the router sends: sliced to 1000 and stripped of controls', async () => {
-    // The parser unfolds the encoded CRLF, but the decoded subject still
-    // contains a NUL. The harness must report the bounded, normalized reason
-    // that the managed router and native replay send to the SMTP client.
-    const harness = harnessFor(async (message) => {
-      const parsed = await parseEmail(message);
-      message.setReject(`unwanted: ${parsed.subject}${'!'.repeat(2000)}`);
-    });
-    await harness.deliver({
-      ...DELIVERY,
-      raw:
-        'From: u@x.dev\r\n' +
-        'To: myslug+anything@app.dev\r\n' +
-        'Subject: =?UTF-8?Q?spam=0D=0ABcc:_x=00?=\r\n' +
-        '\r\n' +
-        'body\r\n',
-    });
-    expect(harness.rejects).toHaveLength(1);
-    // "unwanted: spam Bcc: x\0" is 22 characters after parsing. The window
-    // holds 978 "!", and normalizing the NUL to a space preserves its length.
-    expect(harness.rejects[0]).toBe(`unwanted: spam Bcc: x ${'!'.repeat(978)}`);
-    expect(harness.rejects[0]).toHaveLength(1000);
-  });
-
-  it('reply() refuses a native EmailMessage with the proxy error', async () => {
-    let thrown: unknown;
-    const native = Object.freeze({ from: 'support@app.dev', to: 'u@x.dev' });
-    const harness = harnessFor(async (message) => {
-      try {
-        await message.reply(native as unknown as Parameters<ForwardableEmailMessage['reply']>[0]);
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).code).toBe('MIME_ERROR');
-    expect((thrown as MimeError).message).toMatch(/native EmailMessage cannot be replayed/);
-    expect(harness.replies).toEqual([]);
-  });
-
-  it('reply() refuses a Uint8Array raw over MAX_MESSAGE_BYTES', async () => {
-    let thrown: unknown;
-    const harness = harnessFor(async (message) => {
-      try {
-        await message.reply({
-          from: 'support@app.dev',
-          to: 'u@x.dev',
-          raw: new Uint8Array(MAX_MESSAGE_BYTES + 1),
-        } as unknown as Parameters<ForwardableEmailMessage['reply']>[0]);
-      } catch (e) {
-        thrown = e;
-      }
-    });
-    await harness.deliver(DELIVERY);
-    expect(thrown).toBeInstanceOf(MimeError);
-    expect((thrown as MimeError).message).toMatch(/exceeds Void's sending limit/);
-    expect(harness.replies).toEqual([]);
-  });
-
   it('records nothing from a handler that throws, like production', async () => {
     const harness = harnessFor(async (message) => {
       await message.forward('ops@x.dev');
@@ -1464,10 +1009,7 @@ describe('harness enforces the proxy action bounds, like production', () => {
 
 describe('harness rejects an unmatched delivery, like production', () => {
   // The generated dispatcher calls setReject when nothing matches and there
-  // is no _default, so the sender gets an NDR. The harness used to return
-  // silently, so a test for catch-all or anti-spam behavior could observe an
-  // ACCEPTED message where deployment bounces it. Same divergence class as
-  // the captured-tag casing bug: the harness has to mirror the dispatcher.
+  // is no _default, so the sender gets an NDR; the harness mirrors it.
   it('records the reject when nothing matches and there is no _default', async () => {
     const harness = createInboundTestHarness({ routes: { 'support+[ticket]': async () => {} } });
 
@@ -1546,13 +1088,7 @@ describe('harness rejects an unmatched delivery, like production', () => {
 
 describe('harness headers match the bytes, like production', () => {
   // In production `buildEnvelope` copies every wire header verbatim, so
-  // `message.headers` and `message.raw` agree by construction. The harness
-  // rebuilt `headers` from `input` alone, so its own synthetic MIME carried
-  // a Message-ID that its own `headers` did not expose — and `replyEmail`
-  // reads exactly that header, so a harness reply came out UNTHREADED while
-  // the same handler threaded correctly in production. Third divergence of
-  // this shape on this feature, after captured-param casing and the
-  // unmatched-delivery reject.
+  // `message.headers` and `message.raw` agree, and `replyEmail` threads off them.
   it('exposes the generated Message-ID, so replyEmail threads', async () => {
     let seen: string | null = null;
     const harness = createInboundTestHarness({
@@ -1569,9 +1105,7 @@ describe('harness headers match the bytes, like production', () => {
   });
 
   it('exposes headers from a caller-supplied raw MIME', async () => {
-    // The `raw:` override hands the harness exact wire bytes. Ignoring their
-    // headers is the sharpest form of the divergence: the caller supplied
-    // precisely what production would receive.
+    // The `raw:` override hands the harness exact wire bytes.
     const raw = [
       'Message-ID: <fromraw@remote.dev>',
       'From: u@x.dev',
@@ -1642,12 +1176,8 @@ describe('harness headers match the bytes, like production', () => {
 
 describe('admission checks mirrored from the managed router', () => {
   // `routeInbound` refuses a message over `MAX_INBOUND_BYTES` (from
-  // `rawSize`, before the body is read) or with more than
-  // `MAX_INBOUND_HEADERS` distinct names (in `buildEnvelope`) and never
-  // dispatches it. The harness invoked the handler regardless, so a handler
-  // that forwards an oversized message without calling `parseEmail()` was
-  // green here and bounced after deploy. Now: same order, same reasons, no
-  // handler call. Platform lane only — an own-account worker has no router.
+  // `rawSize`) or with more than `MAX_INBOUND_HEADERS` distinct names before
+  // dispatch. Platform lane only — an own-account worker has no router.
   const TO = 'myslug+support@app.dev';
   const HEAD = `From: u@x.dev\r\nTo: ${TO}\r\nSubject: big\r\n\r\n`;
 
@@ -1863,12 +1393,58 @@ describe('admission checks mirrored from the managed router', () => {
   });
 });
 
+/**
+ * Builds a reply in a child Node under the tenant isolate's 128 MB heap cap
+ * and reports what it cost there. `headersSource` is a JS expression
+ * evaluated in the child, so the fixture is built inside the cap too.
+ */
+function replyInIsolate(headersSource: string): {
+  text: string;
+  subject: string;
+  ms: number;
+  heapDeltaMB: number;
+} {
+  const inboundModule = pathToFileURL(
+    toSlash(join(import.meta.dirname, '../../src/runtime/email/inbound.ts')),
+  ).href;
+  const child = `
+    const { buildReplyMessage, createMessageProxy } = await import(process.argv[1]);
+    const headers = ${headersSource};
+    const raw = new TextEncoder().encode('body');
+    const { message } = createMessageProxy(
+      {
+        from: 'sender@remote.dev',
+        to: 'acme+support@mail.void.cloud',
+        headers,
+        raw,
+        rawSize: raw.length,
+      },
+      { slug: 'acme' },
+    );
+    const heap0 = process.memoryUsage().heapUsed;
+    const t0 = performance.now();
+    const reply = await buildReplyMessage(message, { text: 'thanks', from: 'acme+noreply@x.dev' });
+    const ms = performance.now() - t0;
+    const heapDeltaMB = (process.memoryUsage().heapUsed - heap0) / (1024 * 1024);
+    const text = new TextDecoder().decode(reply.raw);
+    console.log(JSON.stringify({ text, subject: reply.subject, ms, heapDeltaMB }));
+  `;
+  const stdout = execFileSync(
+    process.execPath,
+    ['--max-old-space-size=128', '--input-type=module', '-e', child, inboundModule],
+    { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 },
+  );
+  return JSON.parse(stdout.trim().split('\n').at(-1) ?? '{}') as {
+    text: string;
+    subject: string;
+    ms: number;
+    heapDeltaMB: number;
+  };
+}
+
 describe('reply threading survives a hostile inbound header', () => {
-  // `buildReplyMessage` threads the inbound `Message-ID` and `References`
-  // into the reply verbatim, and those are controlled by whoever sent the
-  // mail. The 998-octet line guard would therefore let a remote sender make
-  // an app's reply throw, with the app at fault for nothing. Threading is
-  // best-effort, so an unusable value is dropped and the reply still goes.
+  // A remote sender controls the threaded `Message-ID` and `References`.
+  // Threading is best-effort: an unusable value is dropped, the reply still goes.
   const HUGE = 'x'.repeat(1100);
 
   function inbound(headers: Record<string, string>) {
@@ -1896,52 +1472,8 @@ describe('reply threading survives a hostile inbound header', () => {
     expect(Math.max(...text.split('\r\n').map((l) => l.length))).toBeLessThanOrEqual(998);
   });
 
-  it('survives a References chain with more tokens than Math.max takes arguments', async () => {
-    // ~123k spread arguments is where V8 throws RangeError (measured on
-    // workerd and node). 130k short ids is 780 KB, far inside
-    // MAX_MESSAGE_BYTES, so a remote sender can reach it.
-    const chain = Array.from({ length: 130_000 }, () => '<a@r>').join(' ');
-    const message = inbound({ references: chain, 'message-id': '<abc@remote.dev>', subject: 'hi' });
-
-    const reply = await buildReplyMessage(message, { text: 'thanks', from: 'acme+noreply@x.dev' });
-
-    const text = new TextDecoder().decode(reply.raw);
-    expect(text).toContain('In-Reply-To: <abc@remote.dev>');
-    expect(Math.max(...text.split('\r\n').map((l) => l.length))).toBeLessThanOrEqual(998);
-  });
-
-  it('survives a Subject with more tokens than Math.max takes arguments', async () => {
-    // The cheaper trigger: `prefixReplySubject` collapses whitespace runs, so
-    // 130k single-character tokens is only 260 KB of ASCII.
-    const subject = Array.from({ length: 130_000 }, () => 'a').join(' ');
-    const message = inbound({ subject });
-
-    const reply = await buildReplyMessage(message, { text: 'thanks', from: 'acme+noreply@x.dev' });
-
-    const text = new TextDecoder().decode(reply.raw);
-    expect(Math.max(...text.split('\r\n').map((l) => l.length))).toBeLessThanOrEqual(998);
-  });
-
-  it('drops an unusable References chain rather than failing the reply', async () => {
-    const message = inbound({ references: `<${HUGE}@remote.dev>`, subject: 'hi' });
-
-    const reply = await buildReplyMessage(message, { text: 'thanks', from: 'acme+noreply@x.dev' });
-
-    expect(
-      Math.max(
-        ...new TextDecoder()
-          .decode(reply.raw)
-          .split('\r\n')
-          .map((l) => l.length),
-      ),
-    ).toBeLessThanOrEqual(998);
-  });
-
-  // The line guard measures octets, the way the wire does, and the only
-  // break it may count on is SP or HTAB — the whitespace `foldHeader` folds
-  // at. The chain is carried when every id fits and dropped for the bare
-  // message-id otherwise, and the answer must arrive in one pass with no
-  // per-id allocation: a remote sender can put 10 MiB of ids in one header.
+  // The line guard measures octets, and the only break it may count on is
+  // SP or HTAB — the whitespace `foldHeader` folds at.
   const MESSAGE_ID = '<abc@remote.dev>';
 
   async function replyText(references: string, messageId = MESSAGE_ID): Promise<string> {
@@ -1957,10 +1489,7 @@ describe('reply threading survives a hostile inbound header', () => {
 
   it('keeps an id that exactly fills the line, and drops one octet more', async () => {
     // `References: ` is 12 octets, so 986 is the widest id one line carries.
-    // With no Message-ID to append, the header is that one id, unfolded —
-    // the only shape where the guard's budget is the wire line exactly. In a
-    // chain every id is charged the same 12 octets although a folded
-    // continuation costs 1, so the guard is conservative there, never loose.
+    // With no Message-ID to append, the header is that one id, unfolded.
     const atBudget = `<${'x'.repeat(984)}>`;
     const overBudget = `<${'x'.repeat(985)}>`;
 
@@ -2012,8 +1541,7 @@ describe('reply threading survives a hostile inbound header', () => {
 
   it('does not count whitespace the folder cannot fold at as a break', async () => {
     // `\s` matches NBSP and FF, but RFC 5322 §3.2.2 folds only at SP/HTAB and
-    // so does `foldHeader`. Splitting at either used to pass two fitting ids
-    // that then landed on one 1222-octet line, and `buildMime` threw.
+    // so does `foldHeader`.
     const id = `<${'x'.repeat(600)}@remote.dev>`;
     for (const separator of [' ', '\f']) {
       const text = await replyText(`${id}${separator}${id}`);
@@ -2023,42 +1551,22 @@ describe('reply threading survives a hostile inbound header', () => {
     }
   });
 
-  it('threads a chain at the raw cap’s scale, and every line still fits', async () => {
-    // 9 MiB of two-character ids is 3.1M tokens. The reply carries its newest
-    // 8 KiB, and the answer must not cost per token: a per-token allocation
-    // here was 34 bytes each, which is the isolate.
-    const chain = 'ab '.repeat((9 * 1024 * 1024) / 3).trimEnd();
-    const text = await replyText(chain);
-    expect(text).toContain(`In-Reply-To: ${MESSAGE_ID}`);
-    expect(text).toContain('References: ab ab ab');
-    expect(text).toContain(` ab ${MESSAGE_ID}`);
-    expect(widestLineOctets(text)).toBeLessThanOrEqual(998);
-  });
-
-  it('answers for a 10 MiB chain in one pass', async () => {
-    // The largest header a remote sender can deliver: MAX_MESSAGE_BYTES of
-    // two-character ids (3.5M tokens), with one over-long id at the very end
-    // so the whole chain is scanned before it is refused. `split(/\s+/)`
-    // materialized 3.5M tokens first — measured at 570 ms and 147 MB, which
-    // terminates a 128 MB isolate; the one-pass scan is 20 ms and 0 bytes.
+  it('answers for a chain of MAX_MESSAGE_BYTES in one pass', async () => {
+    // Two-character ids with one over-long id at the very end, so the whole
+    // chain is scanned before it is refused.
     const chain = 'ab '.repeat(Math.floor(MAX_MESSAGE_BYTES / 3)) + `<${HUGE}@remote.dev>`;
     const started = performance.now();
     const text = await replyText(chain);
     const elapsed = performance.now() - started;
     expect(text).not.toContain(HUGE);
     expect(text).toContain(`References: ${MESSAGE_ID}`);
-    // 34 ms here; a loaded 4-vCPU CI runner has measured 6x slower on this
-    // file. The materializing form took 570 ms locally and would not fit a
-    // 128 MB isolate at all — the memory is the real guard, the time a proxy.
+    // A gross bound: time stands in for the memory the runner cannot cap.
     expect(elapsed).toBeLessThan(1000);
   });
 
-  // The line guard bounds one id, not the chain: 10 MiB of short ids passes
-  // it — every id folds — and the folded reply is then over
-  // `MAX_MESSAGE_BYTES`, so `buildMime` threw instead of sending the reply the
-  // guide promises, and the handler's earlier forwards went with it. A chain
-  // is bounded at 8192 characters, checked on `length` alone, and past that
-  // the reply keeps the NEWEST ids whole, the parent's id still last.
+  // The line guard bounds one id, not the chain, so the chain is bounded at
+  // 8192 characters; past that the reply keeps the newest ids whole, the
+  // parent's id still last.
   const REFERENCES_BUDGET = 8192;
 
   /** The `References` value of a rendered reply, unfolded; `undefined` when absent. */
@@ -2071,43 +1579,11 @@ describe('reply threading survives a hostile inbound header', () => {
   }
 
   it('threads the newest ids of a chain over the budget, inside a 128 MB heap', () => {
-    // The reviewer's shape: a `References` just under the inbound cap, of
-    // short ids. Measured before the bound: 156 ms, 55 MB of heap, then
-    // `MimeError: message size 10777129 bytes exceeds Cloudflare limit`.
-    const inboundModule = pathToFileURL(
-      toSlash(join(import.meta.dirname, '../../src/runtime/email/inbound.ts')),
-    ).href;
-    const child = `
-      const { buildReplyMessage, createMessageProxy } = await import(process.argv[1]);
-      const references = '<a@b> '.repeat(Math.floor((${MAX_MESSAGE_BYTES} - 200) / 6)).trimEnd();
-      const raw = new TextEncoder().encode('body');
-      const { message } = createMessageProxy(
-        {
-          from: 'sender@remote.dev',
-          to: 'acme+support@mail.void.cloud',
-          headers: { references, 'message-id': ${JSON.stringify(MESSAGE_ID)}, subject: 'hi' },
-          raw,
-          rawSize: raw.length,
-        },
-        { slug: 'acme' },
-      );
-      const heap0 = process.memoryUsage().heapUsed;
-      const t0 = performance.now();
-      const reply = await buildReplyMessage(message, { text: 'thanks', from: 'acme+noreply@x.dev' });
-      const ms = performance.now() - t0;
-      const heapDeltaMB = (process.memoryUsage().heapUsed - heap0) / (1024 * 1024);
-      console.log(JSON.stringify({ text: new TextDecoder().decode(reply.raw), ms, heapDeltaMB }));
-    `;
-    const stdout = execFileSync(
-      process.execPath,
-      ['--max-old-space-size=128', '--input-type=module', '-e', child, inboundModule],
-      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 },
+    // A `References` just under the inbound cap, of short ids.
+    const result = replyInIsolate(
+      `{ references: '<a@b> '.repeat(Math.floor((${MAX_MESSAGE_BYTES} - 200) / 6)).trimEnd(), ` +
+        `'message-id': ${JSON.stringify(MESSAGE_ID)}, subject: 'hi' }`,
     );
-    const result = JSON.parse(stdout.trim().split('\n').at(-1) ?? '{}') as {
-      text: string;
-      ms: number;
-      heapDeltaMB: number;
-    };
     expect(result.text).toContain(`In-Reply-To: ${MESSAGE_ID}`);
     const references = referencesOf(result.text);
     expect(references).toBeDefined();
@@ -2115,7 +1591,7 @@ describe('reply threading survives a hostile inbound header', () => {
     expect(references!.startsWith('<a@b> ')).toBe(true);
     expect(references!.endsWith(` <a@b> ${MESSAGE_ID}`)).toBe(true);
     expect(widestLineOctets(result.text)).toBeLessThanOrEqual(998);
-    // 4 ms and 0 MB measured; the bound leaves room for CI's slower runner.
+    // The bound leaves room for CI's slower runner.
     expect(result.ms).toBeLessThan(5000);
     expect(result.heapDeltaMB).toBeLessThan(16);
   }, 30_000);
@@ -2167,7 +1643,7 @@ describe('reply threading survives a hostile inbound header', () => {
 
   it('threads the newest ids when the id no line can carry is an old one', async () => {
     const ids = Array.from({ length: 1000 }, (_, i) => `<${String(i).padStart(4, '0')}@r>`);
-    // Oldest: outside the tail, so the tail threads. Every id used to go.
+    // Oldest: outside the tail, so the tail threads.
     const oldestHuge = referencesOf(await replyText(`<${HUGE}@r> ${ids.join(' ')}`));
     expect(oldestHuge).not.toContain(HUGE);
     expect(oldestHuge!.endsWith(` <0999@r> ${MESSAGE_ID}`)).toBe(true);
@@ -2177,10 +1653,8 @@ describe('reply threading survives a hostile inbound header', () => {
   });
 
   it('keeps the actions queued before a reply to a chain over the budget', async () => {
-    // What the throw cost: `handleEmail` returns the queue only once the
-    // handler resolves, so a forward recorded before the reply was lost with
-    // it — bounced as a "project handler error" on the platform, never
-    // enacted on a native message.
+    // `handleEmail` returns the queue only once the handler resolves, so a
+    // reply that threw would take the earlier forward with it.
     const references = '<a@b> '.repeat(Math.floor((MAX_MESSAGE_BYTES - 200) / 6)).trimEnd();
     const raw = new TextEncoder().encode('Subject: hi\r\n\r\nbody\r\n');
     const { message, getActions } = createMessageProxy(
@@ -2209,25 +1683,9 @@ describe('reply threading survives a hostile inbound header', () => {
     expect(new TextDecoder().decode(reply.raw)).toContain(`In-Reply-To: ${MESSAGE_ID}`);
   });
 
-  it('still threads a normal Message-ID', async () => {
-    const message = inbound({ 'message-id': '<abc123@remote.dev>', subject: 'hi' });
-
-    const reply = await buildReplyMessage(message, { text: 'thanks', from: 'acme+noreply@x.dev' });
-
-    const text = new TextDecoder().decode(reply.raw);
-    expect(text).toContain('In-Reply-To: <abc123@remote.dev>');
-    expect(text).toContain('References: <abc123@remote.dev>');
-  });
-
   describe('a control character in a threading id', () => {
-    // A threading value is emitted verbatim, and `\x01` or DEL pass a WHATWG
-    // `Headers` (which refuses only CR, LF and NUL), so a remote sender's
-    // `Message-ID: <abc\x01def@remote.dev>` reached the reply's `In-Reply-To`
-    // and `References` lines raw. An RFC 5322 §3.6.4 `msg-id` admits no
-    // control, so such an id is unrepresentable — dropped, as an over-long
-    // one is, never a throw: the reply is still sent. Unlike the line
-    // guard, which is about the rendered line, this is about one token, so
-    // a bad id in the middle of a chain loses only itself.
+    // `\x01` or DEL pass a WHATWG `Headers`, but an RFC 5322 §3.6.4 `msg-id`
+    // admits no control: such an id is dropped on its own, never a throw.
     // eslint-disable-next-line no-control-regex -- C0 controls and DEL are the point
     const rawControl = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
@@ -2258,22 +1716,12 @@ describe('reply threading survives a hostile inbound header', () => {
         expect(headersOf(text)).not.toMatch(rawControl);
       }
     });
-
-    it('still threads a clean chain and parent exactly as before', async () => {
-      const text = await replyText('<r1@remote.dev> <r2@remote.dev>');
-      expect(text).toContain(`In-Reply-To: ${MESSAGE_ID}\r\n`);
-      expect(referencesOf(text)).toBe(`<r1@remote.dev> <r2@remote.dev> ${MESSAGE_ID}`);
-    });
   });
 });
 
 describe('reply subject survives a hostile inbound header', () => {
-  // The default reply subject is decoded from the inbound `Subject`, which
-  // the remote sender controls. `normalizeEmail` rejects CR, LF and NUL and
-  // `buildMime` rejects any line over 998 octets, so a subject carrying
-  // either would make the app's reply throw — and in production that
-  // rejects the whole delivery, replies AND forwards. Like threading, the
-  // subject is best-effort: repair what can be repaired, fall back to
+  // The default reply subject is decoded from the sender's `Subject`. Like
+  // threading it is best-effort: repair what can be repaired, fall back to
   // `Re:` for what cannot, and always send the reply.
   const FROM = 'acme+noreply@x.dev';
 
@@ -2300,9 +1748,7 @@ describe('reply subject survives a hostile inbound header', () => {
     );
   }
 
-  // The reviewer's case. `parseInt('0G', 16)` is 0, not NaN, so the old
-  // predicate synthesised a NUL from a malformed escape. RFC 2045 §6.7 says
-  // a robust decoder keeps the `=` and the following characters as-is.
+  // RFC 2045 §6.7: a robust decoder keeps a malformed `=` escape as-is.
   it('keeps a malformed Q escape literal instead of decoding half of it', async () => {
     const reply = await buildReplyMessage(inbound('=?UTF-8?Q?bad=0Gsubject?='), {
       text: 'thanks',
@@ -2348,65 +1794,24 @@ describe('reply subject survives a hostile inbound header', () => {
     expect(reply.subject).toBe('Re: good subject');
   });
 
-  it('decodes a subject of 750k encoded-words one word at a time', async () => {
-    // MAX_MESSAGE_BYTES of `=?UTF-8?Q?a?=` is the largest subject a remote
-    // sender can deliver. `replace` with a callback collected all 750k
-    // matches before decoding the first — measured at 138 MB on the whole
-    // reply path, which is the isolate; the lazy scan needs 35 MB. The
-    // runner's heap is not capped, so this pins the behaviour: adjacent
-    // encoded-words join, the decoded subject is one 750k-character ASCII
-    // token no line can carry, and the reply falls back to a bare `Re:`.
+  it('decodes a subject of MAX_MESSAGE_BYTES of encoded-words one word at a time', async () => {
+    // MAX_MESSAGE_BYTES of `=?UTF-8?Q?a?=`: adjacent encoded-words join into
+    // one ASCII token no line can carry, so the reply falls back to `Re:`.
     const subject = '=?UTF-8?Q?a?= '.repeat(Math.floor(MAX_MESSAGE_BYTES / 14));
     const reply = await buildReplyMessage(inbound(subject), { text: 'thanks', from: FROM });
     expect(reply.subject).toBe('Re:');
   });
 
-  // The other shape of the same header: ONE encoded-word carrying the whole
-  // 10 MiB. The payload pattern accepts whitespace, so a folded `Subject`
-  // arrives (unfolded by `Headers`) as a single Q-word and the decoder sees
-  // every character of it. Pushing each byte onto an `Array<number>` first
-  // measured 199 MB of heap for the decode alone and 330 MB peak on the reply
-  // path — `FATAL ERROR: Reached heap limit` under `--max-old-space-size=128`,
-  // which is the tenant isolate — before `buildMime`'s projection could
-  // refuse the subject. Decoding into a preallocated `Uint8Array` peaks at
-  // 10.5 MB on the same path (42 ms). The runner's own heap is not capped,
-  // so the pin runs the reply in a child with the isolate's cap.
-  it('replies to a 10 MiB single Q-encoded word inside a 128 MB heap', () => {
-    const inboundModule = pathToFileURL(
-      toSlash(join(import.meta.dirname, '../../src/runtime/email/inbound.ts')),
-    ).href;
-    const child = `
-      const { buildReplyMessage, createMessageProxy } = await import(process.argv[1]);
-      const subject = '=?UTF-8?Q?' + 'a'.repeat(${MAX_MESSAGE_BYTES} - 20) + '?=';
-      const raw = new TextEncoder().encode('body');
-      const { message } = createMessageProxy(
-        {
-          from: 'sender@remote.dev',
-          to: 'acme+support@mail.void.cloud',
-          headers: { subject },
-          raw,
-          rawSize: raw.length,
-        },
-        { slug: 'acme' },
-      );
-      const t0 = performance.now();
-      const reply = await buildReplyMessage(message, { text: 'thanks', from: ${JSON.stringify(FROM)} });
-      console.log(JSON.stringify({ subject: reply.subject, ms: performance.now() - t0 }));
-    `;
-    const stdout = execFileSync(
-      process.execPath,
-      ['--max-old-space-size=128', '--input-type=module', '-e', child, inboundModule],
-      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 },
+  // ONE encoded-word carrying the whole message: a folded `Subject` arrives
+  // (unfolded by `Headers`) as a single Q-word, so the decoder sees all of it.
+  it('replies to a single Q-encoded word of MAX_MESSAGE_BYTES inside a 128 MB heap', () => {
+    const result = replyInIsolate(
+      `{ subject: '=?UTF-8?Q?' + 'a'.repeat(${MAX_MESSAGE_BYTES} - 20) + '?=' }`,
     );
-    const result = JSON.parse(stdout.trim().split('\n').at(-1) ?? '{}') as {
-      subject: string;
-      ms: number;
-    };
-    // The decoded word is one 10 MiB ASCII token no line can carry, so the
-    // subject falls back — the same answer the 750k-word shape gets.
+    // The decoded word is one ASCII token no line can carry, so the subject
+    // falls back — the same answer the many-word shape gets.
     expect(result.subject).toBe('Re:');
-    // 42 ms measured locally; the bound leaves room for CI's slower runner
-    // (about 6x), where the old `Array<number>` shape did not finish at all.
+    // The bound leaves room for CI's slower runner.
     expect(result.ms).toBeLessThan(5000);
   }, 30_000);
 
@@ -2440,64 +1845,10 @@ describe('reply subject survives a hostile inbound header', () => {
     expect(reply.subject).toBe(expected);
   });
 
-  /**
-   * Build the reply in a child Node under the tenant isolate's 128 MB heap
-   * cap and report what it cost there. `subjectSource` is a JS expression
-   * evaluated in the child, so the fixture is built inside the cap too.
-   */
-  function replyInIsolate(subjectSource: string): {
-    subject: string;
-    ms: number;
-    heapDeltaMB: number;
-  } {
-    const inboundModule = pathToFileURL(
-      join(import.meta.dirname, '../../src/runtime/email/inbound.ts'),
-    ).href;
-    const child = `
-      const { buildReplyMessage, createMessageProxy } = await import(process.argv[1]);
-      const subject = ${subjectSource};
-      const raw = new TextEncoder().encode('body');
-      const { message } = createMessageProxy(
-        {
-          from: 'sender@remote.dev',
-          to: 'acme+support@mail.void.cloud',
-          headers: { subject },
-          raw,
-          rawSize: raw.length,
-        },
-        { slug: 'acme' },
-      );
-      const heap0 = process.memoryUsage().heapUsed;
-      const t0 = performance.now();
-      const reply = await buildReplyMessage(message, { text: 'thanks', from: ${JSON.stringify(FROM)} });
-      const ms = performance.now() - t0;
-      const heapDeltaMB = (process.memoryUsage().heapUsed - heap0) / (1024 * 1024);
-      console.log(JSON.stringify({ subject: reply.subject, ms, heapDeltaMB }));
-    `;
-    const stdout = execFileSync(
-      process.execPath,
-      ['--max-old-space-size=128', '--input-type=module', '-e', child, inboundModule],
-      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 },
-    );
-    return JSON.parse(stdout.trim().split('\n').at(-1) ?? '{}') as {
-      subject: string;
-      ms: number;
-      heapDeltaMB: number;
-    };
-  }
-
-  // The third shape of the same header, aimed past the decoder at the
-  // control-character replacements: a global `replace` materializes one
-  // part per match before it builds the result, about 66 bytes each, so
-  // 5 MiB of alternating tab and letter (2.6M matches, inside
-  // MAX_MESSAGE_BYTES, no encoded-word for the decoder to touch) measured
-  // 165 MB on the first replacement alone, 191 MB and 206 ms on the reply
-  // path, and terminated a 128 MB isolate. The decoded subject is now
-  // bounded BEFORE the replacements run — 2.3 ms and 0.5 MB on the same
-  // path — so the pin runs in a child with the isolate's cap, where the
-  // old shape did not finish at all.
+  // Aimed past the decoder at the control-character replacements: the
+  // decoded subject is bounded before they run.
   it('replies to a 5 MiB subject of alternating tabs and letters inside a 128 MB heap', () => {
-    const result = replyInIsolate(`'\\ta'.repeat(${(5 * 1024 * 1024) / 2})`);
+    const result = replyInIsolate(`{ subject: '\\ta'.repeat(${(5 * 1024 * 1024) / 2}) }`);
     expect(result.subject).toBe('Re:');
     expect(result.ms).toBeLessThan(200);
     expect(result.heapDeltaMB).toBeLessThan(64);
@@ -2517,11 +1868,8 @@ describe('reply subject survives a hostile inbound header', () => {
     expect(over.subject).toBe('Re:');
   });
 
-  // It is the DECODED length that is bounded. B-encoded, 4096 three-octet
-  // characters arrive as a 19,945-character header, so a bound on the raw
-  // header would have refused a CJK subject a quarter that long. The
-  // rendered `Subject` line of that subject is the widest any kept subject
-  // renders to — about 20 KB, against a 10 MiB message limit.
+  // It is the DECODED length that is bounded: B-encoded, 4096 three-octet
+  // characters arrive as a 19,945-character header.
   it('bounds the decoded subject, not the encoded header it arrived in', async () => {
     // Fifteen three-octet characters fill a 45-octet encoded-word exactly,
     // so no character is split across words (RFC 2047 §5).
@@ -2549,13 +1897,9 @@ describe('reply subject survives a hostile inbound header', () => {
     expect(over.subject).toBe('Re:');
   });
 
-  // The residual the previous round left open. A 10 MiB subject WITH spaces
-  // folds — every token is one character — so `fitsHeaderLine` passed it,
-  // `buildMime`'s projection (a lower bound) passed it, and the folded
-  // `Subject` alone rendered to 10,761,941 octets: the final size check
-  // threw `MimeError` out of `replyEmail()`, the throw this path exists to
-  // prevent. Bounded, the subject falls back and the reply is recorded.
-  it('replies to a 10 MiB subject that folds instead of throwing MimeError from the size check', async () => {
+  // A subject with spaces folds, so only the decoded-length bound keeps its
+  // rendered size from failing the reply.
+  it('replies to a subject of MAX_MESSAGE_BYTES that folds instead of throwing MimeError from the size check', async () => {
     const raw = new TextEncoder().encode('body');
     const { message, getActions } = createMessageProxy(
       {
@@ -2579,15 +1923,10 @@ describe('reply subject survives a hostile inbound header', () => {
 });
 
 describe('parseEmail error contract', () => {
-  // `PARSE_FAILED` was declared in the code union but never constructed, so
-  // the one thing that does make postal-mime reject — a deeply nested
-  // message — escaped as a bare Error carrying parser internals. The union
-  // has to be honest: every code it names is reachable.
+  // Every code in `ParseEmailErrorCode` is reachable.
   it('wraps a raw-stream read failure as PARSE_FAILED', async () => {
     // An own-account delivery wraps Cloudflare's native one-shot `raw` with
-    // `createMessageProxy`, so the buffering read is what fails. The
-    // acquisition used to sit above the guarded block, and the stream error
-    // escaped raw.
+    // `createMessageProxy`, so the buffering read is what fails.
     const raw = new ReadableStream<Uint8Array>({
       start(controller) {
         controller.error(new Error('stream broke mid-delivery'));
@@ -2625,34 +1964,11 @@ describe('parseEmail error contract', () => {
     );
   });
 
-  it('still reports an oversized message as INBOUND_TOO_LARGE', async () => {
-    const raw = new TextEncoder().encode('Subject: hi\r\n\r\nbody\r\n');
-    const { message } = createMessageProxy(
-      {
-        from: 'a@b.dev',
-        to: 'acme+x@mail.void.cloud',
-        headers: {},
-        raw,
-        rawSize: 100 * 1024 * 1024,
-      },
-      { slug: 'acme' },
-    );
-
-    await expect(parseEmail(message)).rejects.toSatisfy(
-      (e: unknown) => e instanceof ParseEmailError && e.code === 'INBOUND_TOO_LARGE',
-    );
-  });
-});
-
-describe('void/email barrel exports the error classes it throws', () => {
-  // `package.json` exposes only `./email` and `./email/testing` — there is no
-  // wildcard subpath — so a class a handler author cannot reach through the
-  // barrel is a class they cannot `instanceof` at all, however well it is
-  // documented. The barrel exports two throwing entrypoints (`parseEmail`,
-  // `createEmail`); both error classes have to come with them.
-  it('re-exports ParseEmailError as the same class parseEmail throws', async () => {
+  // `void/email` is the only public path to the error classes, so a handler
+  // can `instanceof` them only through it.
+  it('reports an oversized message as INBOUND_TOO_LARGE, with the classes void/email exports', async () => {
     expect(emailBarrel.ParseEmailError).toBe(ParseEmailError);
-
+    expect(emailBarrel.MimeError).toBe(MimeError);
     const raw = new TextEncoder().encode('Subject: hi\r\n\r\nbody\r\n');
     const { message } = createMessageProxy(
       {
@@ -2666,13 +1982,12 @@ describe('void/email barrel exports the error classes it throws', () => {
     );
 
     await expect(parseEmail(message)).rejects.toSatisfy(
-      (e: unknown) => e instanceof emailBarrel.ParseEmailError && e.code === 'INBOUND_TOO_LARGE',
+      (e: unknown) =>
+        e instanceof emailBarrel.ParseEmailError &&
+        e.code === 'INBOUND_TOO_LARGE' &&
+        /exceeds maximum/.test(e.message),
     );
   });
-
-  it('re-exports MimeError as the same class createEmail throws', () => {
-    expect(emailBarrel.MimeError).toBe(MimeError);
-  });
 });
 
 describe('buildReplyMessage', () => {
@@ -2718,10 +2033,7 @@ describe('buildReplyMessage', () => {
     await withSlug(async () => {
       const message = makeMessage({ Subject: 'Help me' });
       const built = await buildReplyMessage(message, { text: 'sure' });
-      // F3: default `from` no longer mirrors `message.to` (which was the
-      // platform-tagged `<slug>+<tag>@…` and is now slug-stripped to the
-      // bare local-part). Reply-from is anchored to the platform sender
-      // so the slug-pin allowlist accepts it.
+      // Reply-from is the platform sender, so the slug-pin allowlist accepts it.
       expect(built.from).toBe(`myslug+noreply@${MAIL_DOMAIN}`);
       expect(built.to).toBe('user@example.com');
       expect(built.subject).toBe('Re: Help me');
@@ -2765,9 +2077,7 @@ describe('buildReplyMessage', () => {
   it('decodes ISO-8859-1 Q-encoded subjects with the actual charset', async () => {
     await withSlug(async () => {
       // =?iso-8859-1?Q?J=FCrgen?= → "Jürgen"  (0xFC is 'ü' in Latin-1)
-      // Decoding the same bytes as UTF-8 would mojibake to a replacement
-      // char or a different glyph, so this test guards against the old
-      // "always UTF-8" fallback path.
+      // Decoding the same bytes as UTF-8 would mojibake.
       const message = makeMessage({ Subject: '=?iso-8859-1?Q?J=FCrgen?=' });
       const built = await buildReplyMessage(message, { text: 'ack' });
       expect(built.subject).toBe('Re: Jürgen');
@@ -3079,9 +2389,7 @@ describe('end-to-end: envelope → handler → action queue', () => {
 
   it('reply() refuses a native EmailMessage with a named error', async () => {
     // What workerd's `EmailMessage` looks like to JS: `from` and `to` only —
-    // workers-types declares nothing else and the body has no accessor, so
-    // the proxy cannot record it as bytes. It used to die on
-    // `undefined.getReader()`, since the first commit of this file.
+    // the body has no accessor, so the proxy cannot record it as bytes.
     const native = Object.freeze({ from: 'support@app.dev', to: 'sender@example.com' });
     const handler = defineEmail(async (message) => {
       await message.reply(native as unknown as Parameters<ForwardableEmailMessage['reply']>[0]);
@@ -3336,12 +2644,14 @@ describe('end-to-end: envelope → handler → action queue', () => {
   );
 
   it('refuses a forward address over the address-length limit', async () => {
+    const over = `${'a'.repeat(320)}@example.com`;
     const handler = defineEmail(async (message) => {
-      await message.forward(`${'a'.repeat(320)}@example.com`);
+      await message.forward(over);
+    });
+    await expect(dispatchToHandler(makeEnvelope(), handler)).rejects.toMatchObject({
+      code: 'INVALID_TO',
+      message: `to address is ${over.length} characters, over the 320-character limit.`,
     });
-    await expect(dispatchToHandler(makeEnvelope(), handler)).rejects.toThrow(
-      /over the 320-character limit/,
-    );
   });
 
   it('records a plain header record verbatim, keeping the name casing', async () => {
@@ -3420,12 +2730,8 @@ describe('end-to-end: envelope → handler → action queue', () => {
   ])(
     'refuses a forward header bag with %s at the call, recording nothing for it',
     async (_label, headers, expected) => {
-      // `new Headers()` accepts every one of these, so the validity check
-      // above passes them. The platform router then applies its own count
-      // and per-field bounds (`forwardHeadersWithinBounds`) and drops the
-      // WHOLE action list — a handler that recorded this forward deployed as
-      // one whose managed delivery silently performed no actions. The same
-      // bounds, on the record about to be stored, fail the handler's call.
+      // `new Headers()` accepts every one of these, but the platform router's
+      // `forwardHeadersWithinBounds` would drop the whole action list.
       const { message, getActions } = createMessageProxy(makeEnvelope());
       await message.forward('first@example.com');
       let thrown: unknown;
@@ -3483,8 +2789,7 @@ describe('end-to-end: envelope → handler → action queue', () => {
 
   it('bounds a multi-megabyte control-laden reject reason before it is recorded', () => {
     // A reason built from the inbound message can be as large as the message
-    // and carry a remote sender's CRLF; both used to be recorded verbatim and,
-    // on your own account, replayed verbatim into the SMTP reply.
+    // and carry a remote sender's CRLF.
     const { message, getActions } = createMessageProxy(makeEnvelope());
     message.setReject(`${'x'.repeat(5 * 1024 * 1024)}\r\n\x00`);
     const [action] = getActions();
@@ -3514,13 +2819,8 @@ describe('end-to-end: envelope → handler → action queue', () => {
     ['a list separator', 'a@example.com,b@example.com'],
     ['whitespace', 'a b@example.com'],
     ['a 65-character local part', `${'a'.repeat(65)}@example.com`],
-    // Inverted: these used to be recorded here and dropped by the platform
-    // router alone, which always wanted a dot in the domain. One package
-    // (`email-validator`) on both sides now, so the call refuses them.
     ['a dot-less domain', 'user@localhost'],
     ['a one-letter domain', 'x@y'],
-    // Both sides used to accept these; no dot-atom does, and an MTA refuses
-    // them after the handler's test reported a success.
     ['doubled dots in the local part', 'a..b@example.com'],
     ['a leading dot', '.a@example.com'],
     ['a trailing dot before the @', 'a.@example.com'],
@@ -3530,11 +2830,7 @@ describe('end-to-end: envelope → handler → action queue', () => {
   ])(
     'refuses a forward address with %s at the call, recording nothing for it',
     async (_label, to) => {
-      // Same class as the header record above, for the address: Cloudflare
-      // refuses it at native replay, the platform router before enaction.
-      // Checked here with the rule `sendEmail` applies to its `to` — and
-      // the rule the router drops on — so a handler's forward refuses
-      // exactly what an outbound send refuses and nothing the router loses.
+      // The rule `sendEmail` applies to its `to`, and the one the router drops on.
       const { message, getActions } = createMessageProxy(makeEnvelope());
       await message.forward('first@example.com');
       let thrown: unknown;
diff --git a/packages/void/test/unit/email-mime.test.ts b/packages/void/test/unit/email-mime.test.ts
index f8ac74733..8d416febb 100644
--- a/packages/void/test/unit/email-mime.test.ts
+++ b/packages/void/test/unit/email-mime.test.ts
@@ -1,6 +1,3 @@
-import { execFileSync } from 'node:child_process';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
 import { describe, expect, it } from 'vite-plus/test';
 import {
   buildMime,
@@ -148,53 +145,8 @@ describe('normalizeEmail', () => {
     ).rejects.toThrow(/'to'/);
   });
 
-  it('rejects malformed addresses', async () => {
-    await expect(
-      normalizeEmail({ from: 'no-at-sign', to: 'b@y.dev', subject: 's', text: 't' }),
-    ).rejects.toThrow(/from/);
-  });
-
-  // The shape check only required an '@' to be present anywhere, so a
-  // trailing, leading or doubled separator passed the preflight and was
-  // reported as a successful capture in the dev inbox — then failed only
-  // after reaching the platform. Every code below is the ADVERTISED one.
-  it.each(['user@', '@example.com', 'a@b@c'])(
-    'rejects %s, which used to pass the preflight',
-    async (bad) => {
-      await expect(
-        normalizeEmail({ from: bad, to: 'b@y.dev', subject: 's', text: 't' }),
-      ).rejects.toThrow(/from/);
-      await expect(
-        normalizeEmail({ from: 'a@x.dev', to: bad, subject: 's', text: 't' }),
-      ).rejects.toThrow(/to/);
-    },
-  );
-
-  // Inverted: these used to be accepted as legal RFC 5321 mailboxes while
-  // the platform router refused them for the missing dot, so a handler's
-  // `forward('user@localhost')` was recorded here and dropped there. The
-  // rule is now `email-validator` on both sides, which wants a dotted
-  // domain with a letter-first TLD of at least two characters.
-  it.each(['user@localhost', 'x@y', 'a@example'])(
-    'now refuses %s (no dot in the domain), as the router always did',
-    async (bad) => {
-      await expect(
-        normalizeEmail({ from: bad, to: 'b@y.dev', subject: 's', text: 't' }),
-      ).rejects.toThrow(invalidAddress('from'));
-      await expect(
-        normalizeEmail({ from: 'a@x.dev', to: bad, subject: 's', text: 't' }),
-      ).rejects.toThrow(invalidAddress('to'));
-    },
-  );
-
-  // RFC 5322 §2.1.1 makes 998 a MUST and §3.2.2 allows folding ONLY at
-  // whitespace, so a long token with no spaces cannot be folded at all —
-  // `Subject:\r\n <token>` shortens nothing. The RFC 2047 chunking added
-  // earlier only covers NON-ASCII values; a pure-ASCII token bypasses
-  // `encodeWord` entirely and leaks through two separate paths in
-  // `foldHeader`: the single-chunk early return, and the fold loop, which
-  // still gives an over-long chunk its own line. Nothing downstream
-  // repairs it — the proxy streams our bytes verbatim.
+  // RFC 5322 §2.1.1 makes 998 a MUST and §3.2.2 folds only at whitespace,
+  // so a long ASCII token with no spaces cannot be folded at all.
   const TOKEN = 'x'.repeat(1100);
 
   /** Longest physical line of the rendered message, in octets. */
@@ -237,20 +189,10 @@ describe('normalizeEmail', () => {
     ).toBe(998);
   });
 
-  it('leaves foldable values alone', async () => {
-    const spaced = Array.from({ length: 200 }, (_, i) => `word${i}`).join(' ');
-    expect(
-      await longestLine({ from: 'a@x.dev', to: 'b@y.dev', subject: spaced, text: 't' }),
-    ).toBeLessThanOrEqual(998);
-  });
-
   it('measures a line in UTF-8 octets, not UTF-16 units, and reports its number', async () => {
-    // A CJK filename is rendered verbatim into ` filename="…"`: 3 octets per
-    // character inside 12 of framing, so 328 characters land exactly on the
-    // 998-octet limit and 329 are one octet over. The pre-render guard sees
-    // only `length` (341) and lets both through; the post-render scan must
-    // count octets. The line number pins the CRLF-delimited index into the
-    // multipart body, where the part's own headers live.
+    // A CJK filename costs 3 octets per character inside 12 of framing, so
+    // 328 characters land exactly on 998 octets and 329 are one over, though
+    // both pass a `length` check.
     const fits = '漢'.repeat(328);
     const { text } = await build({
       from: 'a@x.dev',
@@ -272,11 +214,7 @@ describe('normalizeEmail', () => {
   });
 
   // A quoted-string parameter carries `\\` and `"` only as quoted-pairs
-  // (RFC 5322 §3.2.4 — qtext excludes both). Deleting quotes and leaving
-  // backslashes raw makes a trailing backslash escape the CLOSING quote,
-  // and silently eats embedded ones: a Windows path `C:\\Users\\bob\\r.pdf`
-  // reached the recipient as `C:Usersbobr.pdf`. This file's own folder
-  // already tracks quoted-pairs, so the emitter was contradicting it.
+  // (RFC 5322 §3.2.4 — qtext excludes both).
   it.each([
     ['a trailing backslash', 'bad\\'],
     ['an embedded backslash', 'a\\b'],
@@ -371,13 +309,8 @@ describe('normalizeEmail', () => {
   });
 
   it("rejects an attachment disposition other than 'attachment' or 'inline'", async () => {
-    // `Attachment.disposition` is a two-literal union at compile time only.
-    // A JS caller, or a JSON-parsed options object, can pass any string,
-    // and `buildAttachmentPart` interpolates it verbatim into
-    // `Content-Disposition`. Unlike its neighbours it never went through
-    // `rejectCRLF`, so a CRLF in it rendered as a second header line inside
-    // the attachment part (`X-Injected: 1; filename="f.txt"`), and a blank
-    // line in it ended the part's header block early.
+    // The union is compile-time only: a JS caller can pass any string, which
+    // would be written verbatim into `Content-Disposition`.
     const base = { from: 'a@x.dev', to: 'b@y.dev', subject: 's', text: 't' };
     const message = "attachment disposition must be 'attachment' or 'inline'.";
     for (const disposition of [
@@ -411,26 +344,11 @@ describe('normalizeEmail', () => {
     expect(defaulted.attachments.map((a) => a.disposition)).toEqual(['attachment', 'inline']);
   });
 
-  it('rejects whitespace inside an address', async () => {
-    await expect(
-      normalizeEmail({ from: 'a b@x.dev', to: 'b@y.dev', subject: 's', text: 't' }),
-    ).rejects.toThrow(/from/);
-  });
-
-  // `MAX_MESSAGE_BYTES` used to be enforced ONLY at the end of `buildMime` —
-  // after every attachment had been materialized in parallel by a
-  // `Promise.all`, base64'd, sliced at 76 columns, joined and re-encoded.
-  // Peak live memory measured about 10x the attachment bytes, so a set over
-  // roughly 12 MiB terminated the isolate instead of returning the
-  // `MIME_ERROR` the docs promise. Base64 expands by `ceil(n / 3) * 4`, so
-  // nothing above three quarters of the message cap can ever fit anyway.
+  // Base64 expands by `ceil(n / 3) * 4`, so attachments above three quarters
+  // of the message cap can never fit.
   const MAX_ATTACHMENT_BYTES_TOTAL = Math.floor((MAX_MESSAGE_BYTES * 3) / 4);
 
-  /**
-   * A one-byte Blob wearing a declared `size`, recording whether anything
-   * ever read it. Shadowing beats allocating: the whole point is that the
-   * second attachment's bytes are never touched.
-   */
+  /** A one-byte Blob wearing a declared `size`, recording whether anything read it. */
   function fakeBlob(name: string, size: number, reads: Array<string>): Blob {
     const blob = new Blob([new Uint8Array(1)]);
     Object.defineProperty(blob, 'size', { value: size });
@@ -460,8 +378,7 @@ describe('normalizeEmail', () => {
     ).rejects.toThrow(
       new RegExp(`exceeds Cloudflare limit of ${MAX_ATTACHMENT_BYTES_TOTAL} bytes`),
     );
-    // The fix, stated as an assertion: the second attachment is charged from
-    // its DECLARED size and rejected before a single byte of it is copied.
+    // The second attachment is charged from its declared size, before any byte is read.
     expect(reads).toEqual(['first']);
   });
 
@@ -477,16 +394,8 @@ describe('normalizeEmail', () => {
   });
 
   describe('attachment count', () => {
-    // `MAX_ATTACHMENT_BYTES_TOTAL` never advances on a zero-byte attachment,
-    // and the size projection in `buildMime` runs only after every entry
-    // has been normalized — about 275 bytes of live heap each. Measured, 2M
-    // empty attachments terminated a 128 MB isolate in 0.3 s instead of
-    // returning `MIME_ERROR`. The count is now refused before the loop, at
-    // the largest count the projection could admit: 119 octets per part —
-    // `ATTACHMENT_PART_MIN_OCTETS` plus a one-character filename rendered
-    // twice — under `MAX_MESSAGE_BYTES`.
-    const PART_MIN_OCTETS = 117 + 2;
-
+    // Zero-byte attachments never advance the byte budget, so the count is
+    // refused before the loop, at the largest count the size projection admits.
     /** An attachment that records any read of the fields the loop touches first. */
     function watchedAttachment(reads: Array<number>, i: number): Attachment {
       return {
@@ -501,11 +410,6 @@ describe('normalizeEmail', () => {
       };
     }
 
-    it('is derived from the per-part floor and the message cap', () => {
-      expect(MAX_ATTACHMENTS).toBe(Math.floor(MAX_MESSAGE_BYTES / PART_MIN_OCTETS));
-      expect(MAX_ATTACHMENTS).toBe(44_057);
-    });
-
     it('refuses one over MAX_ATTACHMENTS before normalizing any of them', async () => {
       const reads: Array<number> = [];
       const attachments = Array.from({ length: MAX_ATTACHMENTS + 1 }, (_, i) =>
@@ -544,12 +448,8 @@ describe('normalizeEmail', () => {
     });
 
     it('never rejects a count the size projection would have admitted', () => {
-      // The smallest part there is: a one-character filename, an empty
-      // media type and no content. One over the cap is refused by the
-      // projection on framing alone, so the count bound only ever refuses
-      // what `buildMime` was going to; exactly at the cap the projection
-      // admits it and the post-render check is the one to refuse the
-      // 12.9 MB it renders to.
+      // The smallest part there is. One over the cap is refused by the
+      // projection on framing alone; at the cap the post-render check refuses it.
       const part = {
         filename: 'a',
         contentType: '',
@@ -605,10 +505,6 @@ describe('normalizeEmail', () => {
   }
 
   it('refuses more than MAX_RECIPIENTS across to, cc and bcc before parsing any of them', async () => {
-    // The platform proxy refuses the same count on the deduplicated list,
-    // but only after the tenant has parsed every entry and rendered the
-    // `To:` header — measured, 230k short valid addresses (a legal 4.8 MiB
-    // message) terminated a 128 MB isolate on the way there.
     const reads: Array<number> = [];
     const to = Array.from({ length: MAX_RECIPIENTS - 1 }, (_, i) => watchedAddress(reads, i));
     let error: unknown;
@@ -647,9 +543,7 @@ describe('normalizeEmail', () => {
 
   it('refuses a quoted filename that could never fold onto a legal line, before rendering it', async () => {
     // ` filename="…"` is the shortest line a quoted parameter can land on:
-    // 12 octets plus the name. The post-render line check refuses the same
-    // input, but only after `quoteParam` has escaped it — measured, a
-    // filename of ~1.7M quote characters killed a 128 MB isolate there.
+    // 12 octets plus the name.
     const longest = 'a'.repeat(998 - 12);
     const { text } = await build({
       from: 'a@x.dev',
@@ -670,7 +564,7 @@ describe('normalizeEmail', () => {
     ).rejects.toThrow(
       /attachment filename is 987 characters; a quoted `filename=` parameter cannot be folded/,
     );
-    // The guard is cheap on the input that used to be fatal.
+    // The guard refuses a huge input without escaping it.
     const started = performance.now();
     await expect(
       build({
@@ -722,14 +616,9 @@ describe('normalizeEmail', () => {
   });
 
   it('refuses a header name that could never sit on a legal line, before rendering it', async () => {
-    // A field name never folds. `Name:` alone is the shortest line it can
-    // sit on — what `foldHeader` emits when the value's first token does
-    // not fit beside a long name — so 997 characters is the longest name
-    // with ANY legal rendering, and only with a value that folds: `Name:`
-    // is 998 octets, then ` a b`. The same name over an empty value is one
-    // 999-octet line, which is the post-render line check's to refuse, not
-    // this guard's: a bound one character tighter would reject a message
-    // that fits.
+    // A field name never folds, and `Name:` alone is the shortest line it can
+    // sit on, so 997 characters is the longest name with any legal rendering
+    // (with a value that folds). Over an empty value the line check refuses it.
     const longest = `X${'a'.repeat(998 - 1 - 1)}`;
     expect(longest).toHaveLength(997);
     const { text } = await build({
@@ -759,10 +648,7 @@ describe('normalizeEmail', () => {
         headers: { [`${longest}b`]: 'a b' },
       }),
     ).rejects.toThrow(/headers: a header name is 998 characters; a field name cannot be folded/);
-    // The guard is cheap on the input that used to be rendered four times
-    // over before the line check saw it: a 5 MiB name took 23 ms and
-    // 5.6 MB of heap to refuse post-render (measured); a 50 MiB one killed
-    // a 128 MB isolate. Refused here in 2 ms with no allocation.
+    // The guard refuses a huge name without rendering it.
     const started = performance.now();
     await expect(
       normalizeEmail({
@@ -777,10 +663,8 @@ describe('normalizeEmail', () => {
   });
 
   it('refuses an address over MAX_ADDRESS_LENGTH, with the code for its field', async () => {
-    // RFC 5321 §4.5.3.1: 64-octet local part + `@` + 255-octet domain is the
-    // sum of the component maxima — the pre-parse bound, not a deliverable
-    // path (the package's 254 total is that). At exactly 320 the package
-    // answers; one over, this one answers first, before anything is scanned.
+    // RFC 5321 §4.5.3.1: 64 + `@` + 255 is the pre-parse bound; the package's
+    // 254 is the deliverable one. At exactly 320 the package answers.
     const longest = `${'a'.repeat(64)}@${'b'.repeat(251)}.dev`;
     expect(longest).toHaveLength(MAX_ADDRESS_LENGTH);
     const over = `${'a'.repeat(65)}@${'b'.repeat(251)}.dev`;
@@ -832,37 +716,28 @@ describe('normalizeEmail', () => {
       text: 't',
     });
     expect(named.to[0].email).toBe(deliverable);
+    // The bound answers before the address is scanned.
+    expect(() => parseAddress(`a\x01${'b'.repeat(320)}@x.dev`, 'to')).toThrow(
+      /over the 320-character limit/,
+    );
   });
 
-  it('refuses an address over 254 characters (RFC 5321 §4.5.3.1.3), by the package rule', async () => {
-    // RFC 5321 §4.5.3.1.3: a 256-octet forward-path `<local@domain>` is the
-    // longest every receiver MUST accept, so the address is at most 254.
-    // The 320 total is the sum of the local-part and domain maxima, not a
-    // path — `a@` + a 255-octet domain is 257 characters, under the
-    // total-length bound, and `void dev` and the test harness once captured
-    // it as a success. `email-validator` checks 254 before its regex, and
-    // the platform router applies the same package, so both sides refuse it.
+  describe('address rule', () => {
+    // `validateAddressParts` is `email-validator`, the package the platform
+    // router applies too; its message names the rule and never echoes the address.
     const label = 'b'.repeat(63);
     const domain255 = [label, label, label, label].join('.');
-    expect(domain255).toHaveLength(255);
-    const over = `a@${domain255}`;
-    expect(over).toHaveLength(257);
-    expect(over.length).toBeLessThan(MAX_ADDRESS_LENGTH);
-    const longest = `a@${domain255.slice(0, 252)}`;
-    expect(longest).toHaveLength(254);
-    const email = await normalizeEmail({ from: longest, to: longest, subject: 's', text: 't' });
-    expect(email.to[0].email).toBe(longest);
-    for (const [field, code] of [
-      ['to', 'INVALID_TO'],
-      ['from', 'INVALID_FROM'],
-      ['cc', 'MIME_ERROR'],
-    ] as const) {
+
+    async function addressError(
+      field: 'to' | 'from' | 'cc' | 'bcc' | 'replyTo',
+      address: string | { name?: string; email: string },
+    ): Promise<MimeError> {
       let error: unknown;
       try {
         await normalizeEmail({
           from: 'a@x.dev',
           to: 'b@y.dev',
-          [field]: over,
+          [field]: address,
           subject: 's',
           text: 't',
         });
@@ -870,182 +745,115 @@ describe('normalizeEmail', () => {
         error = e;
       }
       expect(error).toBeInstanceOf(MimeError);
-      expect((error as MimeError).code).toBe(code);
-      expect((error as MimeError).message).toBe(invalidAddress(field));
+      return error as MimeError;
     }
-    // Inverted: a raw IDN domain used to be accepted and counted in UTF-8
-    // octets (SMTPUTF8). The package is ASCII-only, so octets and characters
-    // are the same thing and a raw `ü` label is refused however short; the
-    // same domain is accepted as punycode, which is what DNS carries.
-    const idnRaw = `a@${'ü'.repeat(31)}.${'b'.repeat(63)}`;
-    await expect(
-      normalizeEmail({ from: 'a@x.dev', to: idnRaw, subject: 's', text: 't' }),
-    ).rejects.toThrow(invalidAddress('to'));
-    const punycode = 'a@xn--bcher-kva.example';
-    const idn = await normalizeEmail({ from: 'a@x.dev', to: punycode, subject: 's', text: 't' });
-    expect(idn.to[0].email).toBe(punycode);
-    // A label over 63 characters is refused on its own, inside the 254 total.
-    const longLabel = `a@${'b'.repeat(64)}.dev`;
-    await expect(
-      normalizeEmail({ from: 'a@x.dev', to: longLabel, subject: 's', text: 't' }),
-    ).rejects.toThrow(invalidAddress('to'));
-    // The display-name form is bounded on the same parsed address, and the
-    // total-length bound still answers first for one over both.
-    expect(() => parseAddress(`Name <${over}>`, 'to')).toThrow(invalidAddress('to'));
-    expect(() => parseAddress(`${'a'.repeat(65)}@${domain255.slice(0, 200)}`, 'to')).toThrow(
-      invalidAddress('to'),
-    );
-    expect(() => parseAddress(`${'a'.repeat(65)}@${domain255}`, 'to')).toThrow(
-      /over the 320-character limit/,
+
+    it.each([
+      ['no @', 'no-at-sign'],
+      ['an empty domain', 'user@'],
+      ['an empty local part', '@example.com'],
+      ['two @', 'a@b@c'],
+      ['whitespace', 'a b@x.dev'],
+      ['a comma', 'victim@example.com,attacker@evil.dev'],
+      ['a semicolon', 'a@x.dev;b@evil.dev'],
+      ['a dot-less domain', 'user@localhost'],
+      ['a one-letter domain', 'x@y'],
+      ['a domain with no TLD', 'a@example'],
+      ['a one-letter TLD', 'a@b.c'],
+      ['a TLD starting with a digit', 'a@b.1c'],
+      ['a TLD ending with a hyphen', 'a@b.c-'],
+      ['a TLD starting with a hyphen', 'a@b.-c'],
+      // RFC 5321 §4.5.3.1.3: a 256-octet path, so at most 254 for the address.
+      ['257 characters, under the 320 bound', `a@${domain255}`],
+      // RFC 5321 §4.5.3.1.1: at most 64 octets before the @.
+      ['a 65-character local part', `${'a'.repeat(65)}@x.dev`],
+      [
+        'a 65-character local part and 266 in total',
+        `${'a'.repeat(65)}@${domain255.slice(0, 200)}`,
+      ],
+      ['a 64-character domain label', `a@${'b'.repeat(64)}.dev`],
+      ['a raw IDN domain', 'a@exämple.com'],
+      ['a long raw IDN domain', `a@${'ü'.repeat(31)}.${'b'.repeat(63)}`],
+      ['a non-ASCII local part', 'ünicode@example.com'],
+      ['an accented local part', 'jöhn@example.com'],
+      ['a CJK local part', `${'漢'.repeat(21)}@x.dev`],
+      ['a quoted local part', '"a b"@example.com'],
+      ['a quoted @', '"a@b"@example.com'],
+      ['a quoted word', '"weird"@x.dev'],
+      ['SOH', 'a\x01b@example.com'],
+      ['ESC', 'a\x1bb@example.com'],
+      ['US', 'a\x1fb@example.com'],
+      ['DEL', 'a\x7fb@example.com'],
+      ['TAB', 'a\tb@example.com'],
+      // `:` is an RFC 5322 §3.2.3 special, not atext.
+      ['a colon in the local part', 'a:b@example.com'],
+      ['a colon in the domain', 'a@b:c.example.com'],
+      ['a leading colon', ':a@example.com'],
+      ['a trailing colon', 'a@example.com:'],
+      ['doubled dots in the local part', 'a..b@example.com'],
+      ['a leading dot', '.a@example.com'],
+      ['a dot before the @', 'a.@example.com'],
+      ['doubled dots in the domain', 'a@example..com'],
+      ['a dot after the @', 'a@.example.com'],
+      ['a trailing dot', 'a@example.com.'],
+    ])(
+      'refuses an address with %s, bare, as an object and in a display name',
+      async (_label, bad) => {
+        expect((await addressError('to', bad)).message).toBe(invalidAddress('to'));
+        expect((await addressError('to', { name: 'Bob', email: bad })).message).toBe(
+          invalidAddress('to'),
+        );
+        expect(() => parseAddress(`Bob <${bad}>`, 'to')).toThrow(invalidAddress('to'));
+      },
     );
-  });
 
-  it('refuses a local part over 64 characters (RFC 5321 §4.5.3.1.1), by the package rule', async () => {
-    // RFC 5321 §4.5.3.1.1: 64 octets is the longest local part every
-    // receiver MUST accept. The total-length bound alone let this through
-    // — `'a'.repeat(65)}@x.dev` is 71 characters — so `void dev` and the
-    // test harness once captured it as a success. `email-validator`
-    // enforces the 64, and the platform router applies the same package.
-    const longest = `${'a'.repeat(64)}@x.dev`;
-    const over = `${'a'.repeat(65)}@x.dev`;
-    expect(over.length).toBeLessThan(MAX_ADDRESS_LENGTH);
-    const email = await normalizeEmail({ from: longest, to: longest, subject: 's', text: 't' });
-    expect(email.to[0].email).toBe(longest);
-    for (const [field, code] of [
+    it.each([
       ['to', 'INVALID_TO'],
       ['from', 'INVALID_FROM'],
       ['cc', 'MIME_ERROR'],
-    ] as const) {
-      let error: unknown;
-      try {
-        await normalizeEmail({
-          from: 'a@x.dev',
-          to: 'b@y.dev',
-          [field]: over,
-          subject: 's',
-          text: 't',
-        });
-      } catch (e) {
-        error = e;
-      }
-      expect(error).toBeInstanceOf(MimeError);
-      expect((error as MimeError).code).toBe(code);
-      expect((error as MimeError).message).toBe(invalidAddress(field));
-    }
-    // Inverted: a non-ASCII local part (SMTPUTF8) used to be accepted and
-    // counted in UTF-8 octets. The package is ASCII-only, so `ünicode@` and
-    // a CJK local part are refused however short, on both sides.
-    for (const bad of ['ünicode@example.com', 'jöhn@example.com', `${'漢'.repeat(21)}@x.dev`]) {
-      await expect(
-        normalizeEmail({ from: 'a@x.dev', to: bad, subject: 's', text: 't' }),
-      ).rejects.toThrow(invalidAddress('to'));
-    }
-    // The display-name form is bounded on the same parsed address, and the
-    // total-length bound still answers first for an address over both.
-    expect(() => parseAddress(`Name <${over}>`, 'to')).toThrow(invalidAddress('to'));
-    expect(() => parseAddress(`${'a'.repeat(65)}@${'b'.repeat(251)}.dev`, 'to')).toThrow(
-      /over the 320-character limit/,
-    );
-  });
-
-  describe('control characters in an address', () => {
-    // Every C0 control and DEL once passed the hand-written rule (which
-    // refused only CR, LF, NUL and what `\s` matches): `a\x01b@example.com`
-    // was accepted and `formatAddress` wrote the byte raw into the `To:`
-    // line, captured as a success under `void dev` and by the test harness,
-    // and dropped by the platform router after earlier actions had fired.
-    // `email-validator` admits only `atext`, so every control is refused,
-    // and the message never echoes the address.
-    const controls = [
-      ['SOH', '\x01'],
-      ['ESC', '\x1b'],
-      ['US', '\x1f'],
-      ['DEL', '\x7f'],
-      ['TAB', '\t'],
-    ] as const;
-
-    it('refuses a bare address carrying one, with the code for its field', async () => {
-      for (const [, ch] of controls) {
-        const bad = `a${ch}b@example.com`;
-        for (const [field, code] of [
-          ['to', 'INVALID_TO'],
-          ['from', 'INVALID_FROM'],
-          ['cc', 'MIME_ERROR'],
-          ['bcc', 'MIME_ERROR'],
-          ['replyTo', 'MIME_ERROR'],
-        ] as const) {
-          let error: unknown;
-          try {
-            await normalizeEmail({
-              from: 'a@x.dev',
-              to: 'b@y.dev',
-              [field]: bad,
-              subject: 's',
-              text: 't',
-            });
-          } catch (e) {
-            error = e;
-          }
-          expect(error).toBeInstanceOf(MimeError);
-          expect((error as MimeError).code).toBe(code);
-          expect((error as MimeError).message).toBe(invalidAddress(field));
-          expect((error as MimeError).message).not.toContain(ch);
-        }
-      }
+      ['bcc', 'MIME_ERROR'],
+      ['replyTo', 'MIME_ERROR'],
+    ] as const)('refuses an invalid %s address with %s', async (field, code) => {
+      const error = await addressError(field, 'a..b@example.com');
+      expect(error.code).toBe(code);
+      expect(error.message).toBe(invalidAddress(field));
     });
 
-    it('refuses it in the object and display-name forms on the same parsed address', async () => {
-      for (const [, ch] of controls) {
-        const bad = `a${ch}b@example.com`;
-        await expect(
-          normalizeEmail({
-            from: 'a@x.dev',
-            to: { name: 'Bob', email: bad },
-            subject: 's',
-            text: 't',
-          }),
-        ).rejects.toThrow(invalidAddress('to'));
-        expect(() => parseAddress(`Bob <${bad}>`, 'to')).toThrow(invalidAddress('to'));
-      }
-      // CR, LF and NUL in the object form reach the address rule directly
-      // (the string form is refused before it is parsed, by `rejectCRLF`):
-      // the package refuses them with the field's own code, so dropping the
-      // separate CRLF scan from the bare address lost nothing.
+    it('refuses CR, LF and NUL in an object address by the rule, and in a string before parsing', async () => {
       for (const ch of ['\r', '\n', '\0']) {
-        let error: unknown;
-        try {
-          await normalizeEmail({
-            from: 'a@x.dev',
-            to: { email: `a${ch}b@example.com` },
-            subject: 's',
-            text: 't',
-          });
-        } catch (e) {
-          error = e;
-        }
-        expect(error).toBeInstanceOf(MimeError);
-        expect((error as MimeError).code).toBe('INVALID_TO');
-        expect((error as MimeError).message).toBe(invalidAddress('to'));
+        const error = await addressError('to', { email: `a${ch}b@example.com` });
+        expect(error.code).toBe('INVALID_TO');
+        expect(error.message).toBe(invalidAddress('to'));
         expect(() => parseAddress(`Bob <a${ch}b@example.com>`, 'to')).toThrow(
           /must not contain CR, LF, or NUL/,
         );
       }
-      // The length bound still answers first: the scan is over at most 320
-      // characters, so an over-long address is refused before it is read.
-      expect(() => parseAddress(`a\x01${'b'.repeat(320)}@x.dev`, 'to')).toThrow(
-        /over the 320-character limit/,
-      );
     });
 
-    it('never renders one raw from a display name, which is encoded instead', async () => {
-      // A name is not an address: a control in it is a character like any
-      // other and `formatAddress` RFC 2047-encodes the non-printable name,
-      // so the byte reaches the wire only inside base64. Pinned so the
-      // address rule is never mistaken for the reason the header is clean.
-      // Every C0 control and DEL except the CR and LF that delimit lines.
+    it.each([
+      ['a 254-character address', `a@${domain255.slice(0, 252)}`],
+      ['a 64-character local part', `${'a'.repeat(64)}@x.dev`],
+      ['a punycode IDN domain', 'a@xn--bcher-kva.example'],
+      ['dots between atoms', 'first.last@example.com'],
+      ['dots on both sides', 'a.b.c@sub.example.co.uk'],
+      ['a dotted domain', 'a@sub.sub.example.com'],
+      ['a TLD ending in a digit', 'a@b.c1'],
+      ['a two-letter TLD', 'a@b.co'],
+      ['a hyphen inside the TLD', 'a@b.c-d'],
+      ['a hyphenated label', 'a@b-c.example'],
+      ['every atext symbol after the first character', "a!#$%&'*+-/=?^_`{|}~@example.com"],
+    ])('accepts %s', async (_label, ok) => {
+      const email = await normalizeEmail({ from: ok, to: ok, subject: 's', text: 't' });
+      expect(email.from.email).toBe(ok);
+      expect(email.to[0].email).toBe(ok);
+    });
+
+    it('never renders a control character raw from a display name, which is encoded instead', async () => {
+      // A name is not an address: `formatAddress` RFC 2047-encodes a
+      // non-printable name, so the byte reaches the wire only inside base64.
       // eslint-disable-next-line no-control-regex -- C0 controls and DEL are the point
       const rawControl = /[\x00-\x09\x0b\x0c\x0e-\x1f\x7f]/;
-      for (const [, ch] of controls) {
+      for (const ch of ['\x01', '\x1b', '\x1f', '\x7f', '\t']) {
         const { text } = await build({
           from: 'a@x.dev',
           to: { name: `Bo${ch}b`, email: 'b@y.dev' },
@@ -1061,15 +869,8 @@ describe('normalizeEmail', () => {
   });
 
   describe('control characters in an attachment filename', () => {
-    // `rejectCRLF` refused only CR, LF and NUL, and a filename is rendered
-    // through `quoteParam` — never `encodeWord` — so `invoice\x01.pdf` was
-    // written raw into both `name="…"` and `filename="…"` (measured on the
-    // wire: `… 69 6e 76 6f 69 63 65 01 2e 70 64 66 22`), captured as a
-    // success under `void dev` and by the harness, and left for the
-    // receiving MTA. RFC 5322 §3.2.4 `qtext` is printable US-ASCII less `"`
-    // and `\`; a control in a quoted-string is `obs-qtext`, which §4 says
-    // MUST NOT be generated. The message names the code point and never
-    // echoes the value.
+    // A filename is rendered raw inside a quoted-string, where a control is
+    // `obs-qtext` (RFC 5322 §3.2.4), which §4 says MUST NOT be generated.
     const base = { from: 'a@x.dev', to: 'b@y.dev', subject: 's', text: 't' };
     const controls = [
       ['SOH', '\x01', 'U+0001'],
@@ -1096,7 +897,7 @@ describe('normalizeEmail', () => {
         );
         expect((error as MimeError).message).not.toContain(ch);
       }
-      // CR, LF and NUL still answer first, with the message they always had.
+      // CR, LF and NUL answer first, by `rejectCRLF`.
       for (const ch of ['\r', '\n', '\0']) {
         await expect(
           normalizeEmail({ ...base, attachments: [{ filename: `a${ch}b.pdf`, content: 'x' }] }),
@@ -1105,11 +906,7 @@ describe('normalizeEmail', () => {
     });
 
     it('accepts HTAB, which is folding white space inside a quoted-string (RFC 5322 §3.2.4), unchanged', async () => {
-      // `quoted-string = DQUOTE *([FWS] qcontent) [FWS] DQUOTE` and `FWS` is
-      // made of `WSP` (SP / HTAB), so a tab between characters is legal
-      // exactly as a space is; `obs-NO-WS-CTL`, the RFC's own list of the
-      // controls that used to be `qtext`, leaves %d9 out. Rendered as it
-      // was: raw, inside the quotes, in both parameters.
+      // `FWS` is SP / HTAB, so a tab inside a quoted-string is legal like a space.
       const { text } = await build({
         ...base,
         attachments: [{ filename: 'a\tb.pdf', content: 'x' }],
@@ -1119,8 +916,8 @@ describe('normalizeEmail', () => {
     });
 
     it('still renders a non-ASCII filename as raw UTF-8 in the quoted parameter', async () => {
-      // The existing path, pinned: no RFC 2231 `filename*=` and no
-      // encoded-word — the UTF-8 octets go inside the quotes as they did.
+      // No RFC 2231 `filename*=` and no encoded-word: the UTF-8 octets go
+      // inside the quotes.
       const { raw, text } = await build({
         ...base,
         attachments: [{ filename: 'résumé.pdf', content: 'x' }],
@@ -1169,14 +966,8 @@ describe('normalizeEmail', () => {
   });
 
   describe('media type syntax of an attachment', () => {
-    // `rejectControls` answered only for CTLs, and `buildAttachmentPart`
-    // writes the media type verbatim ahead of its own `; name="…"`, so
-    // `text/plain; x="` rendered `Content-Type: text/plain; x="; name="a.txt"`
-    // — captured as a success under `void dev` and by the harness, while
-    // Python's `email` reports `end of header inside quoted string` on that
-    // line and reads the builder's `name` as the VALUE of `x`. The grammar
-    // is RFC 2045 §5.1 `type "/" subtype *(";" parameter)`, read as a
-    // generator; the message names the rule and never echoes the value.
+    // The media type is written verbatim ahead of the builder's `; name="…"`,
+    // so it must match RFC 2045 §5.1 `type "/" subtype *(";" parameter)`.
     const base = { from: 'a@x.dev', to: 'b@y.dev', subject: 's', text: 't' };
     const SYNTAX =
       'attachment contentType is not a valid media type (RFC 2045 §5.1: type/subtype, then ; attribute=value parameters).';
@@ -1230,7 +1021,7 @@ describe('normalizeEmail', () => {
       }
     });
 
-    it('accepts every valid form and renders it as it did, byte for byte', async () => {
+    it('accepts every valid form and renders it verbatim', async () => {
       const valid = [
         'TEXT/PLAIN', // case is kept as given; matching is case-insensitive
         'application/vnd.ms-excel',
@@ -1251,8 +1042,7 @@ describe('normalizeEmail', () => {
           ...base,
           attachments: [{ filename: 'a.txt', content: 'x', contentType }],
         });
-        // Verbatim, then the builder's own parameter — exactly the line the
-        // unchecked path rendered.
+        // Verbatim, then the builder's own parameter.
         expect(text, contentType).toContain(`Content-Type: ${contentType}; name="a.txt"\r\n`);
       }
     });
@@ -1276,18 +1066,6 @@ describe('normalizeEmail', () => {
       return lines.slice(start, end);
     }
 
-    it('pins the rendered line for three of them', async () => {
-      expect(await attachmentContentTypeLines('TEXT/PLAIN')).toEqual([
-        'Content-Type: TEXT/PLAIN; name="a.txt"',
-      ]);
-      expect(await attachmentContentTypeLines('text/plain; charset="utf-8"')).toEqual([
-        'Content-Type: text/plain; charset="utf-8"; name="a.txt"',
-      ]);
-      expect(await attachmentContentTypeLines('application/x-foo.bar-baz_1')).toEqual([
-        'Content-Type: application/x-foo.bar-baz_1; name="a.txt"',
-      ]);
-    });
-
     it('keeps the length bound in front of the scan', async () => {
       // "Bound before you scan": the `CONTENT_TYPE_LINE_OVERHEAD` guard
       // answers for an over-long value before the grammar reads it — the
@@ -1339,16 +1117,9 @@ describe('normalizeEmail', () => {
   });
 
   describe('Content-ID syntax of an attachment', () => {
-    // `rejectControls` answered only for CTLs, and `buildAttachmentPart`
-    // writes the Content-ID verbatim, adding `<` `>` unless the value
-    // already starts with `<`: `logo other` rendered `<logo other>`,
-    // `<logo` rendered `<logo` and `logo>` rendered `<logo>>` — captured as
-    // a success under `void dev` and by the harness, and left for the
-    // receiver to refuse or to fail the html's `cid:` reference against.
-    // The grammar is RFC 5322 §3.6.4 `msg-id`, read as a generator, with
-    // the `@` side and the brackets optional (RFC 2392 §2 resolves `cid:x`
-    // against `<x>`, and the builder has always bracketed a bare id); the
-    // message names the rule and never echoes the value.
+    // The Content-ID is written verbatim, bracketed unless it starts with `<`,
+    // so it must be an RFC 5322 §3.6.4 `msg-id`; the `@` side and the
+    // brackets are optional (RFC 2392 §2 resolves `cid:x` against `<x>`).
     const base = { from: 'a@x.dev', to: 'b@y.dev', subject: 's', html: '<img src="cid:logo">' };
     const SYNTAX =
       'attachment contentId is not a valid Content-ID (RFC 5322 §3.6.4 msg-id: an identifier of atext, "." and "@", optionally in one pair of angle brackets).';
@@ -1407,7 +1178,7 @@ describe('normalizeEmail', () => {
         '@b', // an `@` owes both sides
         'a@', //
         'lögo', // atext is US-ASCII
-        '', // used to be validated, then silently not rendered
+        '', //
       ];
       for (const contentId of invalid) {
         const error = await refused(contentId);
@@ -1418,9 +1189,9 @@ describe('normalizeEmail', () => {
       }
     });
 
-    it('accepts every valid form and renders it as it did, byte for byte', async () => {
+    it('accepts every valid form and renders it verbatim', async () => {
       // Bare or bracketed, the wire form is `<id>`; a bracketed id renders
-      // as given, a bare one is wrapped — exactly what the unchecked path did.
+      // as given, a bare one is wrapped.
       const valid: Array<[contentId: string, rendered: string]> = [
         ['logo', '<logo>'], // the documented example: no `@` (RFC 2392 §2)
         ['<logo>', '<logo>'],
@@ -1437,26 +1208,6 @@ describe('normalizeEmail', () => {
       }
     });
 
-    it('keeps the documented inline-image example working verbatim', async () => {
-      const { text } = await build({
-        from: 'Acme <acme+noreply@mail.void.cloud>',
-        to: 'user@example.com',
-        subject: 'Hello',
-        html: '<img src="cid:logo" alt="Acme">',
-        attachments: [
-          {
-            filename: 'logo.png',
-            content: new Uint8Array([1, 2, 3]),
-            contentType: 'image/png',
-            contentId: 'logo',
-            disposition: 'inline',
-          },
-        ],
-      });
-      expect(text).toContain('Content-ID: <logo>\r\n');
-      expect(text).toContain('<img src="cid:logo" alt="Acme">');
-    });
-
     it('still infers disposition from a bracketed id', async () => {
       // `att.contentId ? 'inline' : 'attachment'`: any id the grammar
       // admits is non-empty, so the default is `inline` for both forms.
@@ -1497,196 +1248,21 @@ describe('normalizeEmail', () => {
     });
   });
 
-  describe('a colon in an address', () => {
-    // `:` is an RFC 5322 §3.2.3 special, not `atext`, so a bare
-    // `a:b@example.com` is no addr-spec without quoting — which is refused
-    // too. It was the one special missing from the hand-written address
-    // class: the address passed here, a handler's `forward()` recorded it,
-    // and the platform router's `isValidEmailAddress` dropped that one
-    // forward after earlier actions had fired. `email-validator` admits only
-    // `atext`, so it is refused like `,` and `;`.
-    const colons = ['a:b@example.com', 'a@b:c.example.com', ':a@example.com', 'a@example.com:'];
-
-    it('refuses a bare address carrying one, with the code for its field', async () => {
-      for (const bad of colons) {
-        for (const [field, code] of [
-          ['to', 'INVALID_TO'],
-          ['from', 'INVALID_FROM'],
-          ['cc', 'MIME_ERROR'],
-          ['bcc', 'MIME_ERROR'],
-          ['replyTo', 'MIME_ERROR'],
-        ] as const) {
-          let error: unknown;
-          try {
-            await normalizeEmail({
-              from: 'a@x.dev',
-              to: 'b@y.dev',
-              [field]: bad,
-              subject: 's',
-              text: 't',
-            });
-          } catch (e) {
-            error = e;
-          }
-          expect(error).toBeInstanceOf(MimeError);
-          expect((error as MimeError).code).toBe(code);
-          expect((error as MimeError).message).toBe(invalidAddress(field));
-        }
-      }
-    });
-
-    it('refuses it in the object and display-name forms on the same parsed address', async () => {
-      for (const bad of colons) {
-        await expect(
-          normalizeEmail({
-            from: 'a@x.dev',
-            to: { name: 'Bob', email: bad },
-            subject: 's',
-            text: 't',
-          }),
-        ).rejects.toThrow(invalidAddress('to'));
-        expect(() => parseAddress(`Bob <${bad}>`, 'to')).toThrow(invalidAddress('to'));
-      }
-    });
-
-    it('still accepts one in a display name, where it is quoted', async () => {
-      // A name is a phrase, and a phrase with a special is rendered as one
-      // quoted-string — the address rule is not the name rule.
-      const { text } = await build({
-        from: 'a@x.dev',
-        to: { name: 'Ops: Tier 2', email: 'b@y.dev' },
-        subject: 's',
-        text: 't',
-      });
-      expect(unfoldHeader(text, 'To')).toBe('"Ops: Tier 2" <b@y.dev>');
-    });
-  });
-
-  describe('dot-atom shape of an address', () => {
-    // An RFC 5322 §3.2.3 dot-atom cannot start or end with a dot or carry
-    // two in a row, on either side of the `@`. The hand-written rule and
-    // the platform router's regex BOTH accepted every one of these — no
-    // divergence, just a shared hole that Cloudflare or the next MTA would
-    // refuse after the handler's test had reported a success. One package
-    // on both sides closes it.
-    const dots = [
-      'a..b@example.com',
-      '.a@example.com',
-      'a.@example.com',
-      'a@example..com',
-      'a@.example.com',
-      'a@example.com.',
-    ];
-
-    it('refuses leading, trailing and doubled dots, with the code for its field', async () => {
-      for (const bad of dots) {
-        for (const [field, code] of [
-          ['to', 'INVALID_TO'],
-          ['from', 'INVALID_FROM'],
-          ['cc', 'MIME_ERROR'],
-          ['bcc', 'MIME_ERROR'],
-          ['replyTo', 'MIME_ERROR'],
-        ] as const) {
-          let error: unknown;
-          try {
-            await normalizeEmail({
-              from: 'a@x.dev',
-              to: 'b@y.dev',
-              [field]: bad,
-              subject: 's',
-              text: 't',
-            });
-          } catch (e) {
-            error = e;
-          }
-          expect(error, bad).toBeInstanceOf(MimeError);
-          expect((error as MimeError).code).toBe(code);
-          expect((error as MimeError).message).toBe(invalidAddress(field));
-        }
-        expect(() => parseAddress(`Bob <${bad}>`, 'to')).toThrow(invalidAddress('to'));
-      }
-    });
-
-    it('still accepts dots between atoms, on both sides', async () => {
-      for (const ok of [
-        'first.last@example.com',
-        'a.b.c@sub.example.co.uk',
-        'a@sub.sub.example.com',
-      ]) {
-        const email = await normalizeEmail({ from: ok, to: ok, subject: 's', text: 't' });
-        expect(email.to[0].email).toBe(ok);
-      }
-    });
-  });
-
-  describe('domain and local-part characters of an address', () => {
-    // The package's domain rule: ASCII labels, and a TLD that starts with a
-    // letter and is at least two characters. A quoted local part and a
-    // display name in the bare string stay refused, as they always were.
-    it('applies the TLD rule', async () => {
-      for (const bad of ['a@b.c', 'a@b.1c', 'a@b.c-', 'a@b.-c']) {
-        await expect(
-          normalizeEmail({ from: 'a@x.dev', to: bad, subject: 's', text: 't' }),
-        ).rejects.toThrow(invalidAddress('to'));
-      }
-      for (const ok of [
-        'a@b.c1',
-        'a@b.co',
-        'a@b.c-d',
-        'a@xn--bcher-kva.example',
-        'a@b-c.example',
-      ]) {
-        const email = await normalizeEmail({ from: 'a@x.dev', to: ok, subject: 's', text: 't' });
-        expect(email.to[0].email).toBe(ok);
-      }
-    });
-
-    it('refuses a raw IDN domain and a quoted local part', async () => {
-      for (const bad of [
-        'a@exämple.com',
-        '"a b"@example.com',
-        '"a@b"@example.com',
-        '"weird"@x.dev',
-      ]) {
-        await expect(
-          normalizeEmail({ from: 'a@x.dev', to: bad, subject: 's', text: 't' }),
-        ).rejects.toThrow(invalidAddress('to'));
-      }
-    });
-
-    it('pins the package quirk: a backtick may not be the FIRST local-part character', async () => {
-      // The first character class of `email-validator`'s regex lacks the
-      // backtick that every later class has. Pinned, not worked around: the
-      // point of one package on both sides is that the rule is whatever the
-      // package says, and a wrapper that patched this would be the start of
-      // the next hand-written rule.
-      await expect(
-        normalizeEmail({ from: 'a@x.dev', to: '`a@x.com', subject: 's', text: 't' }),
-      ).rejects.toThrow(invalidAddress('to'));
-      const email = await normalizeEmail({
-        from: 'a@x.dev',
-        to: 'a`b@x.com',
-        subject: 's',
-        text: 't',
-      });
-      expect(email.to[0].email).toBe('a`b@x.com');
-    });
-
-    it('accepts every RFC 5322 atext punctuation after the first character', async () => {
-      const atext = "!#$%&'*+-/=?^_`{|}~";
-      const ok = `a${atext}@example.com`;
-      const email = await normalizeEmail({ from: 'a@x.dev', to: ok, subject: 's', text: 't' });
-      expect(email.to[0].email).toBe(ok);
+  it('accepts a colon in a display name, where it is quoted', async () => {
+    // A name is a phrase, and a phrase with a special is rendered as one
+    // quoted-string — the address rule is not the name rule.
+    const { text } = await build({
+      from: 'a@x.dev',
+      to: { name: 'Ops: Tier 2', email: 'b@y.dev' },
+      subject: 's',
+      text: 't',
     });
+    expect(unfoldHeader(text, 'To')).toBe('"Ops: Tier 2" <b@y.dev>');
   });
 
   it('parses the display-name form in linear time', () => {
-    // `^\s*([^"<]+?)?\s*<` let three quantifiers share one run of
-    // whitespace; the backtracker tried every split, cubic in the run.
-    // Measured on that form: 2,000 spaces took 2 s, 4,000 took 10 s (16 s
-    // when the `>` is missing). A regex cannot be interrupted, so keep the
-    // run where a regression costs seconds, not the test's whole timeout.
-    // (Two-letter TLDs: the address rule wants at least two.)
+    // Quantifiers that share a whitespace run backtrack cubically, and a regex
+    // cannot be interrupted: keep the run where a regression costs seconds.
     const run = ' '.repeat(4000);
     const started = performance.now();
     expect(parseAddress(`${run}a@b.cd`, 'to')).toEqual({ email: 'a@b.cd' });
@@ -1698,9 +1274,7 @@ describe('normalizeEmail', () => {
     expect(performance.now() - started).toBeLessThan(1000);
   });
 
-  it('keeps the display-name form’s language after the regex change', () => {
-    // Shapes the old and new patterns were checked to agree on
-    // (exhaustively to length 7 over a 9-symbol alphabet); pinned here.
+  it('pins the language of the display-name form', () => {
     expect(parseAddress('a>b <c@d.ef>', 'to')).toEqual({ email: 'c@d.ef', name: 'a>b' });
     expect(parseAddress('x<a@b.cd>', 'to')).toEqual({ email: 'a@b.cd', name: 'x' });
     expect(parseAddress('\tJohn\tSmith\t<j@s.ef>', 'to')).toEqual({
@@ -1751,13 +1325,8 @@ describe('normalizeEmail', () => {
   });
 
   it('undoes quoted-pairs in linear time and without a per-pair allocation', () => {
-    // A `replace(/\\(.)/g, '$1')` holds about 60 bytes of heap per match
-    // before it builds its result — measured 307 MB for 10 MiB of `\"`
-    // pairs, past a 128 MB isolate — and nothing bounds the name before
-    // the decode runs: an ASCII name is bounded only on its DECODED form,
-    // and a non-ASCII one never is. The buffer routine peaked at 49 MB on
-    // the same input. Heap is not something a test can pin; time is, and
-    // both shapes are exercised so the output of each path is built.
+    // Nothing bounds the name before the decode, and heap is not something a
+    // test can pin; time is. Both shapes build the output of their path.
     const started = performance.now();
     expect(() => parseAddress(`"${'\\"'.repeat(1_000_000)}" <a@x.dev>`, 'to')).toThrow(
       /cannot be folded/,
@@ -1811,22 +1380,8 @@ describe('buildMime', () => {
     expect(text).toMatch(/Subject: =\?UTF-8\?B\?[^?]+\?=/);
   });
 
-  it('quoted-prints non-ASCII bodies', async () => {
-    const { text } = await build({
-      from: 'a@x.dev',
-      to: 'b@y.dev',
-      subject: 's',
-      text: 'café',
-    });
-    expect(text).toContain('Content-Transfer-Encoding: quoted-printable');
-    // 'é' = 0xC3 0xA9 in UTF-8 → =C3=A9
-    expect(text).toContain('caf=C3=A9');
-  });
-
-  // The encoding decision, pinned: only LF and CRLF end a line, a bare CR
-  // (or any other control character) forces quoted-printable, and a line of
-  // 990 printable characters is the longest that ships as 7bit. Captured
-  // from the regex-and-split implementation the one-pass scanner replaced.
+  // Only LF and CRLF end a line, a bare CR (or any other control character)
+  // forces quoted-printable, and 990 printable characters is the longest 7bit line.
   it.each<[string, string, string, string]>([
     ['a bare CR', 'a\rb', 'quoted-printable', 'a\r\nb'],
     ['a tab', 'a\tb', 'quoted-printable', 'a\tb'],
@@ -1924,21 +1479,9 @@ describe('buildMime', () => {
     expect(text).toContain('Content-ID: <logo>');
   });
 
-  it('rejects oversized messages', async () => {
-    const big = 'x'.repeat(11 * 1024 * 1024);
-    const email = await normalizeEmail({
-      from: 'a@x.dev',
-      to: 'b@y.dev',
-      subject: 's',
-      text: big,
-    });
-    expect(() => buildMime(email)).toThrow(/exceeds Cloudflare limit/);
-  });
-
   it('quotes display names containing RFC 5322 specials (comma is the worst)', async () => {
     // Comma in a name MUST be quoted — without quotes it splits the
-    // address-list field. Pre-fix, the formatAddress fallback emitted
-    // unquoted ASCII names, letting `Smith, John` corrupt the To header.
+    // address-list field.
     const { text } = await build({
       from: { email: 'a@x.dev', name: 'Smith, John' },
       to: { email: 'b@y.dev', name: 'Doe; Jane' },
@@ -1980,10 +1523,7 @@ describe('buildMime', () => {
   });
 
   it('renders a quoted display name with its quoted-pairs escaped exactly once', async () => {
-    // `"Smith \"Bob\"" <a@x.dev>` used to keep the raw `\"` pairs in the
-    // parsed name, and `formatAddress` escaped them again: the header read
-    // `"Smith \\\"Bob\\\""` and the recipient saw `Smith \"Bob\"`. The
-    // object form of the same name was right, so the two forms disagreed.
+    // The string and object forms of the same name render the same header.
     const cases: Array<[string, string, string]> = [
       ['"Smith \\"Bob\\"" <a@x.dev>', 'Smith "Bob"', '"Smith \\"Bob\\""'],
       ['"a\\\\b" <a@x.dev>', 'a\\b', '"a\\\\b"'],
@@ -2019,13 +1559,8 @@ describe('buildMime', () => {
   });
 
   describe('a period in a display name', () => {
-    // `.` is one of RFC 5322 §3.2.3's `specials`, so it is not `atext` and a
-    // name containing one is not a `phrase` of atoms: `Dr. Smith <a@x.dev>`
-    // parses only as `obs-phrase` (§4.1), which §4 says MUST NOT be
-    // generated. `RFC5322_SPECIALS` used to omit it, so every dotted name
-    // went out unquoted; a strict receiver (Python's `email` parser flags
-    // "period in 'phrase'", and `.` alone as an invalid phrase) sees
-    // obsolete syntax on an otherwise valid message.
+    // `.` is one of RFC 5322 §3.2.3's `specials`, so an unquoted dotted name
+    // parses only as `obs-phrase` (§4.1), which §4 says MUST NOT be generated.
     const dotted: Array<[string, string]> = [
       ['Dr. Smith', '"Dr. Smith"'],
       ['J. R. R. Tolkien', '"J. R. R. Tolkien"'],
@@ -2111,13 +1646,9 @@ describe('buildMime', () => {
       expect(decodeEncodedWords(from)).toBe('Dr. Müller <a@x.dev>');
     });
 
-    it('is now bounded by the quoted-string line guard, at the same edge as any other special', async () => {
-      // A quoted-string is one token `foldHeader` never splits, so a
-      // dotted name is now subject to the ` "name"` line bound in
-      // `validateAddressParts`: 995 characters fit a 998-octet line exactly
-      // (the period is `qtext`, so nothing is escaped and the bound is
-      // exact), 996 do not. Before the fix the same 996-character name
-      // rendered unquoted and folded at its spaces.
+    it('is bounded by the quoted-string line guard, at the same edge as any other special', async () => {
+      // A quoted-string is one token `foldHeader` never splits: 995 characters
+      // fit a 998-octet line exactly (the period is `qtext`), 996 do not.
       const fits = `Dr. ${'a'.repeat(998 - 3 - 4)}`;
       expect(fits.length).toBe(995);
       const { text } = await build({
@@ -2142,30 +1673,13 @@ describe('buildMime', () => {
     });
   });
 
-  it('rejects bare addr-spec values containing a comma (header-injection guard)', async () => {
-    // Without this guard, `to: "victim@a.com,attacker@b.com"` slips
-    // through the unquoted addr-spec path and renders as two recipients.
+  it('rejects an addr-spec glued to an angle-bracket address', async () => {
     await expect(
-      normalizeEmail({
-        from: 'a@x.dev',
-        to: 'victim@example.com,attacker@evil.dev',
-        subject: 's',
-        text: 't',
-      }),
-    ).rejects.toThrow(/to/);
-  });
-
-  it('rejects bare addr-spec containing semicolon, angle, or quotes', async () => {
-    for (const bad of ['a@x.dev;b@evil.dev', 'a@x.dev<b@evil.dev>', '"weird"@x.dev']) {
-      await expect(
-        normalizeEmail({ from: bad, to: 'b@y.dev', subject: 's', text: 't' }),
-      ).rejects.toThrow(/from/);
-    }
+      normalizeEmail({ from: 'a@x.dev<b@evil.dev>', to: 'b@y.dev', subject: 's', text: 't' }),
+    ).rejects.toThrow(/from/);
   });
 
   it('rejects unbalanced quotes around display name', async () => {
-    // Pre-fix the parser had two independent optional quotes, so a
-    // single stray `"` slipped through.
     await expect(
       normalizeEmail({
         from: '"Acme <a@x.dev>',
@@ -2192,11 +1706,8 @@ describe('buildMime', () => {
   });
 
   it('folds long whitespace-separated headers (e.g. References) below 78 columns', async () => {
-    // 30 message IDs without commas — historical bug: foldHeader only
-    // split at address-list separators, so the entire References line
-    // emitted as one ~1KB string and breached RFC 5322's 998-octet hard
-    // limit. With whitespace-folding, every physical line stays well
-    // below 78 chars and CRLF + WSP starts each continuation.
+    // 30 message IDs without commas: the fold must split at whitespace, not
+    // only at address-list separators.
     const ids: Array<string> = [];
     for (let i = 0; i < 30; i++) {
       ids.push(`<msg-${i.toString().padStart(3, '0')}@example.com>`);
@@ -2283,10 +1794,8 @@ describe('buildMime', () => {
   });
 
   it('folds a long non-ASCII subject under RFC 5322 §2.1.1 (998 octets)', async () => {
-    // 246 CJK characters used to render as a single 1005-octet physical
-    // line: past RFC 5322 §2.1.1's 998-octet MUST and RFC 5321
-    // §4.5.3.1.6's 1000-octet SMTP text-line limit. Nothing downstream
-    // repairs it — the proxy forwards these bytes verbatim.
+    // Unfolded, 246 CJK characters are one 1005-octet line, past RFC 5322
+    // §2.1.1's 998-octet MUST.
     const subject = '日本語'.repeat(82);
     expect([...subject]).toHaveLength(246);
     const { raw, text } = await build({
@@ -2313,26 +1822,9 @@ describe('buildMime', () => {
     expect(raw.byteLength).toBeGreaterThan(0);
   });
 
-  it('folds a very long non-ASCII subject (500 CJK characters)', async () => {
-    const subject = '確認'.repeat(250);
-    const { text } = await build({
-      from: 'a@x.dev',
-      to: 'b@y.dev',
-      subject,
-      text: 't',
-    });
-    const encoder = new TextEncoder();
-    for (const line of text.split('\r\n')) {
-      expect(encoder.encode(line).byteLength).toBeLessThanOrEqual(998);
-    }
-    expect(decodeEncodedWords(unfoldHeader(text, 'Subject'))).toBe(subject);
-  });
-
   it('folds long non-ASCII display names in From and in address lists', async () => {
-    // Display names run through the same encoder, so `From:` and every
-    // recipient list inherits the same unbounded-line bug. The
-    // multi-recipient case additionally exercises the address-list fold
-    // branch, which never re-folded inside a single part.
+    // Display names run through the same encoder; the recipient list also
+    // exercises the address-list fold branch.
     const name = '株式会社ボイドゼロの営業部'.repeat(20);
     const { text } = await build({
       from: { email: 'j@x.dev', name },
@@ -2384,9 +1876,7 @@ describe('buildMime', () => {
   });
 
   it('keeps folding long ASCII header values at whitespace (control)', async () => {
-    // Pure-ASCII values never reach the encoder, so this pins the
-    // pre-existing whitespace-folding behaviour against regressions from
-    // the encoded-word change.
+    // Pure-ASCII values never reach the encoder; they fold at whitespace.
     const words: Array<string> = [];
     for (let i = 0; i < 40; i++) {
       words.push(`word${i.toString().padStart(3, '0')}`);
@@ -2413,12 +1903,8 @@ function bodyOf(text: string): string {
 }
 
 describe('buildMime body size projection', () => {
-  // A 4 MiB non-ASCII body is 12.6 MiB once quoted-printable encoded, so it
-  // can never fit. Before the projection, `buildMime` found that out only
-  // after encoding it — measured at ~11x the UTF-8 bytes live — and a body a
-  // few times over the limit terminated a 128 MB isolate instead of
-  // returning `MIME_ERROR`. The projection is a single allocation-free pass
-  // over the string, so this test is fast and the rejected string is small.
+  // A 4 MiB non-ASCII body is 12.6 MiB once quoted-printable encoded, so the
+  // projection refuses it before encoding.
   it('rejects a body that cannot fit before encoding it', async () => {
     const cjk = '漢'.repeat(Math.ceil((4 * 1024 * 1024) / 3));
     const email = await normalizeEmail({ from: 'a@x.dev', to: 'b@y.dev', subject: 's', text: cjk });
@@ -2450,11 +1936,9 @@ describe('buildMime body size projection', () => {
   });
 
   it('never rejects a message that fits, and leaves the final check as the authority', async () => {
-    // 3.3 MiB of CJK projects to ~10.38 MiB (under the cap, since the
-    // projection ignores soft breaks and headers) but renders to ~10.8 MiB.
-    // The projection must let it through; the post-render check must reject
-    // it. One full ~10 MB render, so it carries its own timeout (0.4 s here,
-    // several times that on a loaded CI runner).
+    // The projection ignores soft breaks and headers, so this body projects
+    // under the cap but renders over it: the post-render check must refuse it.
+    // One full render, so it carries its own timeout.
     const nearly = '漢'.repeat(Math.ceil((1.65 * 1024 * 1024) / 3));
     const email = await normalizeEmail({
       from: 'a@x.dev',
@@ -2491,11 +1975,7 @@ describe('buildMime header size projection', () => {
   }
 
   // A non-ASCII header value is B-encoded into 45-byte words of 72 octets
-  // each and folded one per line: 5 octets for every CJK character, so 3M
-  // characters (9 MB of UTF-8) is a 15 MB header. Before the header bound,
-  // `buildMime` encoded, folded, joined and re-encoded all of that before
-  // it measured anything, and a 7M-character subject terminated a 128 MB
-  // isolate instead of returning `MIME_ERROR`.
+  // each and folded one per line: 5 octets for every CJK character.
   it('rejects a subject that cannot fit before encoding it', async () => {
     await expectProjected({
       from: 'a@x.dev',
@@ -2547,43 +2027,6 @@ describe('buildMime header size projection', () => {
     expect(text).toContain('X-Note: short note');
   });
 
-  // The runner's own heap is not capped, so the pin runs the projection in
-  // a child with the isolate's cap. 60k empty headers with 996-character
-  // names are 60 MB of names the caller already holds; rendering them held
-  // the folded lines, their join and `rawText` beside the names — three
-  // copies, 180 MB live — and died with `FATAL ERROR: Reached heap limit`
-  // before the size check (measured). The projection refuses them at an
-  // 88 MB peak, in 173 ms.
-  it('refuses 60 MB of header names inside a 128 MB heap', () => {
-    const mimeModule = pathToFileURL(
-      join(import.meta.dirname, '../../src/runtime/email/mime.ts'),
-    ).href;
-    const child = `
-      const { normalizeEmail, buildMime } = await import(process.argv[1]);
-      const headers = {};
-      for (let i = 0; i < 60_000; i++) headers['X' + i + 'a'.repeat(996 - 1 - String(i).length)] = '';
-      const t0 = performance.now();
-      let error;
-      try { const email = await normalizeEmail({ from: 'a@x.dev', to: 'b@y.dev', subject: 's', text: 't', headers }); buildMime(email); } catch (e) { error = e; }
-      console.log(JSON.stringify({ code: error?.code, message: error?.message, ms: performance.now() - t0 }));
-    `;
-    const stdout = execFileSync(
-      process.execPath,
-      ['--max-old-space-size=128', '--input-type=module', '-e', child, mimeModule],
-      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 },
-    );
-    const result = JSON.parse(stdout.trim().split('\n').at(-1) ?? '{}') as {
-      code?: string;
-      message?: string;
-      ms: number;
-    };
-    expect(result.code).toBe('MIME_ERROR');
-    expect(result.message).toContain('16 KiB');
-    // 173 ms measured locally; the bound leaves room for CI's slower runner
-    // (about 6x), where the old shape did not finish at all.
-    expect(result.ms).toBeLessThan(5000);
-  }, 30_000);
-
   it('never charges the whitespace that folding collapses', async () => {
     // `foldHeader` re-joins a long value from its non-WSP tokens, so 11 MiB
     // of spaces renders as one. A bound that counted `length` would reject
@@ -2597,11 +2040,8 @@ describe('buildMime header size projection', () => {
     expect(text).toContain('Subject: a b\r\n');
   });
 
-  // `replyEmail` threads `In-Reply-To` and `References` straight off the
-  // INBOUND message, so a remote sender controls them up to the whole raw
-  // message. They are rendered verbatim — never `encodeWord`ed — but folded
-  // and joined like any other header, so an oversized chain was rendered in
-  // full before the post-render check saw it.
+  // `replyEmail` copies the threading headers off the inbound message, so a
+  // remote sender controls their size.
   it('counts the threading headers', async () => {
     // 900k twelve-character ids: 10.8 MB of non-WSP before a single space.
     await expectProjected({
@@ -2620,17 +2060,9 @@ describe('buildMime header size projection', () => {
     });
   });
 
-  // An attachment part's own headers are built outside `foldHeader`'s
-  // encoded path: `Content-Type: <contentType>; name="<filename>"`,
-  // `Content-Disposition: <disposition>; filename="<filename>"` and
-  // `Content-ID: <contentId>`. Each of the three values is charged, and
-  // each is now also bounded per attachment in `normalizeAttachment` (see
-  // 'media type syntax of an attachment' and 'Content-ID syntax of an
-  // attachment'), so none reaches the projection over-long through
-  // `normalizeEmail`. The charge stays — `buildMime` is the authority on
-  // the final size, whatever handed it the email — so it is pinned on a
-  // hand-built `NormalizedEmail`, as the attachment-count test is.
-  it('counts an attachment Content-ID, even though normalizeAttachment now bounds it', () => {
+  // `normalizeAttachment` bounds the Content-ID, so the charge is pinned on a
+  // hand-built email: `buildMime` is the authority on the final size.
+  it('counts an attachment Content-ID on a hand-built email', () => {
     const over = 'x'.repeat(11 * 1024 * 1024);
     expect(() =>
       buildMime({
@@ -2654,13 +2086,8 @@ describe('buildMime header size projection', () => {
     ).toThrow(PROJECTION);
   });
 
-  // `normalizeAttachment` bounds ONE filename at 986 characters, not the
-  // sum, and nothing bounds the part count: 50k zero-byte attachments with
-  // legal filenames are a 106 MB message — each filename rendered twice,
-  // inside 117 octets of boundary and framing — that was held three to
-  // four times over between the parts, their join, `rawText` and `raw`,
-  // and terminated a 128 MB isolate before the final size check. Every
-  // part is charged its filename twice plus that framing.
+  // `normalizeAttachment` bounds one filename, not the sum, so every part is
+  // charged its filename twice plus the framing around it.
   it('counts every attachment part: its filename twice, and the framing around it', async () => {
     const filename = 'a'.repeat(986);
     const empty = new Uint8Array(0);
@@ -2673,13 +2100,12 @@ describe('buildMime header size projection', () => {
       text: 't',
       attachments: parts(25_000),
     });
-    // The bound is exact for a part with no content: 5,012 parts project to
-    // 640 octets under the cap and render to 10.66 MB, so the post-render
-    // check — not the projection — must be the one to refuse them.
+    // The bound is exact for a part with no content: these project under the
+    // cap and render over it, so the post-render check refuses them.
     await expect(
       build({ from: 'a@x.dev', to: 'b@y.dev', subject: 's', text: 't', attachments: parts(2_506) }),
     ).rejects.toThrow(/message size \d+ bytes exceeds Cloudflare limit/);
-    // And 4,900 parts, a 10.42 MB message, build.
+    // And a few parts fewer build.
     const { raw } = await build({
       from: 'a@x.dev',
       to: 'b@y.dev',
@@ -2691,8 +2117,7 @@ describe('buildMime header size projection', () => {
   });
 
   it('never rejects a References chain that fits, and never charges the whitespace it folds away', async () => {
-    // A 5 MB chain of short ids is a legal message: it folds at its spaces
-    // into 76-column lines and renders under the cap.
+    // A chain of short ids under the cap folds at its spaces and renders.
     const id = '<abcdefgh@x>';
     const chain = Array.from(
       { length: Math.floor((2.5 * 1024 * 1024) / (id.length + 1)) },
@@ -2721,12 +2146,9 @@ describe('buildMime header size projection', () => {
   });
 
   it('never rejects a header-heavy message that fits, and leaves the final check as the authority', async () => {
-    // 2.15M CJK characters project to ~10.32 MiB (4.8 octets each: the bound
-    // omits the fold's CRLF per word) but render to ~10.75 MB at 5 octets
-    // each. The projection must let it through; the post-render check must
-    // reject it. This is the one case that needs a full ~10 MB render (the
-    // property is AT the boundary), so it carries its own timeout: 0.8 s
-    // here, 5.4 s on a loaded 4-vCPU CI runner.
+    // The projection charges 4.8 octets per CJK character (it omits the fold's
+    // CRLF per word) against 5 rendered, so this subject projects under the cap
+    // but renders over it. One full render, so it carries its own timeout.
     const nearly = '漢'.repeat(1_075_000);
     const email = await normalizeEmail({
       from: 'a@x.dev',
@@ -2744,13 +2166,8 @@ describe('buildMime header size projection', () => {
 });
 
 describe('foldHeader memory', () => {
-  // A legal 3 MB subject of one-letter words is 1.5M fold points. The
-  // earlier fold kept a slice, a `{ text, comma }` object and a cons-string
-  // node per token — about 65 bytes of heap per input character — and
-  // terminated a 128 MB isolate on a message that fit. The fold now keeps
-  // only its finished lines (~1 byte per character). This pins the
-  // rendered shape; the memory bound is measured, not asserted, because
-  // the test runner's heap is not the isolate's.
+  // A legal subject of 1.5M fold points. The runner's heap is not the
+  // isolate's, so this pins the rendered shape, not the memory.
   it('folds a legal subject of millions of one-letter words', async () => {
     const words = 1_500_000;
     const { raw, text } = await build({
@@ -2768,18 +2185,8 @@ describe('foldHeader memory', () => {
 });
 
 describe('body line scan memory', () => {
-  // A legal 6 MB body of 3M two-character lines — pasted logs, say — renders
-  // to 9 MB. The encoding decision used to strip every line break with a
-  // global `replace` and `split` the body into an array of lines, the 7bit
-  // path re-joined it with another global `replace` (V8 keeps two or three
-  // parts-array slots per match), and the post-render line check `split`
-  // the whole message again: 240 MB of heap, all of it per LINE and
-  // invisible to any size projection, on a message that fit a 128 MB
-  // isolate four times over. Every pass is now one `charCodeAt` scan and
-  // the 7bit body is written into a buffer of its own size (measured, 32
-  // MB). The memory bound is measured, not asserted, because the test
-  // runner's heap is not the isolate's; this pins the rendered shape and
-  // that the scans stay linear.
+  // A legal body of millions of short lines. The runner's heap is not the
+  // isolate's, so this pins the rendered shape and that the scans stay linear.
   it('builds a legal message of millions of short lines in text and html', async () => {
     const lines = 750_000;
     const started = performance.now();
@@ -2790,8 +2197,7 @@ describe('body line scan memory', () => {
       text: 'a\n'.repeat(lines),
       html: '\n'.repeat(lines),
     });
-    // A gross-regression guard only: the previous code died here, it did not
-    // slow down. 0.2 s locally; a loaded CI runner is several times slower.
+    // A gross-regression guard only.
     expect(performance.now() - started).toBeLessThan(20_000);
     expect(raw.byteLength).toBeLessThanOrEqual(MAX_MESSAGE_BYTES);
     expect(raw.byteLength).toBeGreaterThan(lines * 5);
@@ -2803,8 +2209,6 @@ describe('body line scan memory', () => {
 });
 
 describe('quotedPrintable encoder', () => {
-  // Fixtures captured from the string-concatenating encoder these replace,
-  // so the byte-buffer encoder is pinned to the exact previous output.
   const cases: Array<[string, string, string]> = [
     [
       'soft-breaks at 76 columns',
diff --git a/packages/void/test/unit/email-own-account.test.ts b/packages/void/test/unit/email-own-account.test.ts
index fd03a230c..63a0d51df 100644
--- a/packages/void/test/unit/email-own-account.test.ts
+++ b/packages/void/test/unit/email-own-account.test.ts
@@ -1,6 +1,6 @@
 /**
  * Email on the developer's OWN Cloudflare account (`void deploy --platform
- * cloudflare`, design-doc 0078 "Mode B").
+ * cloudflare`).
  *
  * Two things differ from the managed platform and both are exercised here
  * with `cloudflare:email` faked, since the real module exists only in workerd:
@@ -11,7 +11,7 @@
  *             `ForwardableEmailMessage` and ignores the return value, so the
  *             generated entry must ENACT the recorded actions on it
  */
-import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
+import { describe, expect, it, vi } from 'vite-plus/test';
 import { compileWorkerEntry } from '../../src/router/compile.ts';
 import { sendEmail } from '../../src/runtime/email.ts';
 import {
@@ -256,19 +256,8 @@ describe('sendEmail (SEND_EMAIL binding)', () => {
  * A `ForwardableEmailMessage` as workerd hands it to `email()`: a one-shot
  * raw stream, a `Headers` instance, and the three native methods, each
  * recording its call.
- *
- * `verifiedDestinations` models the one refusal Cloudflare documents for
- * `forward(rcptTo)` — "Forward this email message to a verified destination
- * address of the account" — so a fake with the list set throws, as the real
- * method does, for anything that is not on it. Left unset, every address is
- * accepted, which is what the fake did before the option existed.
  */
-function nativeMessage(opts: {
-  from: string;
-  to: string;
-  mime: string;
-  verifiedDestinations?: ReadonlyArray<string>;
-}): {
+function nativeMessage(opts: { from: string; to: string; mime: string }): {
   message: ForwardableEmailMessage;
   calls: {
     rejects: Array<string>;
@@ -302,9 +291,6 @@ function nativeMessage(opts: {
       calls.rejects.push(reason);
     },
     async forward(to: string, fwdHeaders?: Headers) {
-      if (opts.verifiedDestinations && !opts.verifiedDestinations.includes(to)) {
-        throw bindingError('E_RECIPIENT_NOT_ALLOWED', `destination address ${to} not verified`);
-      }
       calls.forwards.push({ to, headers: fwdHeaders });
       return { messageId: 'fwd' };
     },
@@ -364,10 +350,6 @@ function buildHandleEmail(
 }
 
 describe('generated handleEmail on a native ForwardableEmailMessage', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
   it('enacts setReject on the real message', async () => {
     const handleEmail = buildHandleEmail(async (message) => {
       message.setReject('no thanks');
@@ -425,11 +407,8 @@ describe('generated handleEmail on a native ForwardableEmailMessage', () => {
   });
 
   it('fires nothing on the native message when a later forward carries an invalid header record', async () => {
-    // The plain-record form is stored verbatim, so a value `new Headers()`
-    // rejects used to surface only during native replay — after the first
-    // forward had already fired. Cloudflare then sees a failed invocation
-    // for a message that was partly delivered. The bad header must fail in
-    // the handler's own call, before anything is enacted.
+    // The plain-record form is stored verbatim, so a bad header must fail in
+    // the handler's own call, before the first forward is enacted.
     const handleEmail = buildHandleEmail(async (message) => {
       await message.forward('ops@acme.com');
       // The record form is a runtime affordance (JS handlers, or a cast):
@@ -448,8 +427,6 @@ describe('generated handleEmail on a native ForwardableEmailMessage', () => {
       (e: unknown) => e,
     );
 
-    // The partial delivery is the bug: nothing may have reached the native
-    // message. Asserted before the error shape so a regression names it.
     expect(calls.forwards).toEqual([]);
     expect(calls.replies).toEqual([]);
     expect(calls.rejects).toEqual([]);
@@ -457,75 +434,6 @@ describe('generated handleEmail on a native ForwardableEmailMessage', () => {
     expect((outcome as MimeError).message).toMatch(/^forward: invalid header/);
   });
 
-  it('fires nothing on the native message when a later forward carries a malformed address', async () => {
-    // The address half of the case above. `forward()` used to check only the
-    // length, so `not-an-address` was recorded and surfaced during native
-    // replay — Cloudflare refuses a destination that is not a verified
-    // address — after the first forward had already fired. The fake models
-    // that refusal; the proxy must fail in the handler's own call instead.
-    const handleEmail = buildHandleEmail(async (message) => {
-      await message.forward('ops@acme.com');
-      await message.forward('not-an-address');
-    });
-    const { message, calls } = nativeMessage({
-      from: 'sender@example.com',
-      to: 'support@mail.acme.com',
-      mime: INBOUND_MIME,
-      verifiedDestinations: ['ops@acme.com'],
-    });
-
-    const outcome = await handleEmail(message, {}, {}).then(
-      () => 'resolved',
-      (e: unknown) => e,
-    );
-
-    expect(calls.forwards).toEqual([]);
-    expect(calls.replies).toEqual([]);
-    expect(calls.rejects).toEqual([]);
-    expect(outcome).toBeInstanceOf(MimeError);
-    expect((outcome as MimeError).code).toBe('INVALID_TO');
-    expect((outcome as MimeError).message).toBe(
-      'to: address is not a valid email address (ASCII local part and dotted domain, ' +
-        "RFC 5322 dot-atom; at most 64 characters before the '@' and 254 in total).",
-    );
-  });
-
-  it('fires nothing on the native message when a later hand-built reply carries a malformed address', async () => {
-    // The `{ from, to, raw }` reply form bypasses `normalizeEmail`; it used to
-    // check only the length, so the malformed `to` reached Cloudflare's
-    // native `reply()` after the forward had fired. Same record-time rule
-    // as `forward(to)` now: the handler's own call fails, nothing replays.
-    const handleEmail = buildHandleEmail(async (message) => {
-      await message.forward('ops@acme.com');
-      await message.reply({
-        from: 'support@mail.acme.com',
-        to: 'not-an-address',
-        raw: new TextEncoder().encode('Subject: re\r\n\r\nhi\r\n'),
-      } as unknown as Parameters<ForwardableEmailMessage['reply']>[0]);
-    });
-    const { message, calls } = nativeMessage({
-      from: 'sender@example.com',
-      to: 'support@mail.acme.com',
-      mime: INBOUND_MIME,
-      verifiedDestinations: ['ops@acme.com'],
-    });
-
-    const outcome = await handleEmail(message, {}, {}).then(
-      () => 'resolved',
-      (e: unknown) => e,
-    );
-
-    expect(calls.forwards).toEqual([]);
-    expect(calls.replies).toEqual([]);
-    expect(calls.rejects).toEqual([]);
-    expect(outcome).toBeInstanceOf(MimeError);
-    expect((outcome as MimeError).code).toBe('INVALID_TO');
-    expect((outcome as MimeError).message).toBe(
-      'to: address is not a valid email address (ASCII local part and dotted domain, ' +
-        "RFC 5322 dot-atom; at most 64 characters before the '@' and 254 in total).",
-    );
-  });
-
   it('enacts replyEmail as a real EmailMessage sent from the delivered address', async () => {
     const handleEmail = buildHandleEmail(async (message) => {
       // Both reads of the one-shot native stream must work: the proxy
@@ -576,24 +484,6 @@ describe('generated handleEmail on a native ForwardableEmailMessage', () => {
     expect(reply.from).toBe('acme+noreply@mail.void.cloud');
   });
 
-  it('enacts a reject that followed a forward as the reject alone', async () => {
-    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
-    const handleEmail = buildHandleEmail(async (message) => {
-      await message.forward('ops@acme.com');
-      message.setReject('changed my mind');
-    });
-    const { message, calls } = nativeMessage({
-      from: 'sender@example.com',
-      to: 'support@mail.acme.com',
-      mime: INBOUND_MIME,
-    });
-
-    await handleEmail(message, {}, {});
-
-    expect(calls.forwards).toEqual([]);
-    expect(calls.rejects).toEqual(['changed my mind']);
-  });
-
   it('hands the native setReject() the reason the platform router would send', async () => {
     // The parser unfolds the encoded CRLF, but the decoded subject still
     // contains a NUL. The proxy must bound and normalize the reason before
@@ -622,37 +512,6 @@ describe('generated handleEmail on a native ForwardableEmailMessage', () => {
     expect(actions).toEqual([{ type: 'reject', reason: expected }]);
   });
 
-  it('fires nothing on the native message when a later forward carries too many headers', async () => {
-    // Cloudflare's native `forward()` accepts any bag, so on your own account
-    // a 33-header forward used to go out — while the platform router drops
-    // the WHOLE action list for the same handler. The router's bounds now
-    // fail the handler's own call, before anything is enacted, in both.
-    const handleEmail = buildHandleEmail(async (message) => {
-      await message.forward('ops@acme.com');
-      const bag = new Headers();
-      for (let i = 0; i < 33; i++) {
-        bag.set(`X-Void-${i}`, 'v');
-      }
-      await message.forward('archive@acme.com', bag);
-    });
-    const { message, calls } = nativeMessage({
-      from: 'sender@example.com',
-      to: 'support@mail.acme.com',
-      mime: INBOUND_MIME,
-    });
-
-    const outcome = await handleEmail(message, {}, {}).then(
-      () => 'resolved',
-      (e: unknown) => e,
-    );
-
-    expect(calls.forwards).toEqual([]);
-    expect(calls.replies).toEqual([]);
-    expect(calls.rejects).toEqual([]);
-    expect(outcome).toBeInstanceOf(MimeError);
-    expect((outcome as MimeError).message).toBe('forward: 33 headers, over the 32-header limit.');
-  });
-
   it('returns actions for an authenticated receipt envelope without native enaction', async () => {
     const handleEmail = buildHandleEmail(async (message) => {
       message.setReject('spam');
@@ -677,7 +536,7 @@ describe('generated handleEmail on a native ForwardableEmailMessage', () => {
  * without a `<slug>+` prefix, while
  * provisioning still injects `__VOID_PROJECT_SLUG` unconditionally. The
  * generated `handleEmail` must suppress the slug so the dispatcher runs in
- * no-prefix mode (Mode B item 4) — left applied, the strip would take
+ * no-prefix mode — left applied, the strip would take
  * everything up to the first `+` and `support+T-42@acme.com` would dispatch
  * as `T-42` to `_default` or a wrong `[user]` param.
  */
diff --git a/packages/void/test/unit/email-send.test.ts b/packages/void/test/unit/email-send.test.ts
index c9f19f41a..b17058a4f 100644
--- a/packages/void/test/unit/email-send.test.ts
+++ b/packages/void/test/unit/email-send.test.ts
@@ -71,6 +71,17 @@ const PROXY_ENV_KEYS = {
   __PROJECT_ID: 'p_test',
 };
 
+/** Sends through `__VOID_PROXY`; `sendInDev` keeps a harness sink from capturing it. */
+function send(
+  proxy: ReturnType<typeof fakeProxy>['proxy'],
+  to: string | Array<string> = 'b@y.dev',
+  extra: Partial<Parameters<typeof sendEmail>[0]> = {},
+): ReturnType<typeof sendEmail> {
+  return withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
+    sendEmail({ from: 'a@x.dev', to, subject: 's', text: 't', sendInDev: true, ...extra }),
+  );
+}
+
 describe('sendEmail (test harness)', () => {
   it('captures sends and returns ok with a dev id', async () => {
     const harness = createEmailTestHarness();
@@ -116,13 +127,8 @@ describe('sendEmail (test harness)', () => {
     }
   });
 
-  // A captured result must be the result a deploy returns. Both production
-  // transports send to `uniqueRecipients()` — one envelope per address,
-  // matched case-insensitively and reported lowercased — while the capture
-  // path mapped every `to`/`cc`/`bcc` occurrence in its original case, so a
-  // test written against it expected four deliveries where production makes
-  // two. The captured MESSAGE still carries the fields as given: the inbox
-  // shows what was asked for, `ids` reports what would be sent.
+  // `ids` reports what production sends (one lowercased entry per unique
+  // address); the captured message keeps the fields as given.
   it('reports one id per unique address, the way the production transports do', async () => {
     const opts = {
       from: 'a@x.dev',
@@ -238,63 +244,6 @@ describe('sendEmail (test harness)', () => {
     }
   });
 
-  it('treats an undocumented native binding rejection as an unknown outcome', async () => {
-    const cause = new Error('connection closed after submission');
-    const send = vi.fn().mockRejectedValue(cause);
-    const result = await withRuntimeEnv({ SEND_EMAIL: { send } }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 'ambiguous rejection',
-        text: 'body',
-      }),
-    );
-
-    expect(result).toMatchObject({
-      ok: false,
-      deliveries: [
-        {
-          recipient: 'b@y.dev',
-          state: 'outcome_unknown',
-          error: {
-            code: 'OUTCOME_UNKNOWN',
-            message: 'connection closed after submission',
-            cause,
-          },
-        },
-      ],
-    });
-  });
-
-  it('keeps a documented native provider refusal definitive', async () => {
-    const cause = Object.assign(new Error('recipient is not allowed'), {
-      code: 'E_RECIPIENT_NOT_ALLOWED',
-    });
-    const result = await withRuntimeEnv(
-      { SEND_EMAIL: { send: vi.fn().mockRejectedValue(cause) } },
-      () =>
-        sendEmail({
-          from: 'a@x.dev',
-          to: 'b@y.dev',
-          subject: 'provider refusal',
-          text: 'body',
-        }),
-    );
-
-    expect(result).toMatchObject({
-      ok: false,
-      deliveries: [
-        {
-          recipient: 'b@y.dev',
-          error: { code: 'UNVERIFIED_DESTINATION', cause },
-        },
-      ],
-    });
-    if (!result.ok && 'deliveries' in result) {
-      expect(result.deliveries[0].state).toBeUndefined();
-    }
-  });
-
   it('clear() empties the harness without disposing the sink', async () => {
     const harness = createEmailTestHarness();
     try {
@@ -346,27 +295,8 @@ describe('sendEmail (error mapping)', () => {
     }
   });
 
-  it('returns BINDING_MISSING when no sink and no __VOID_PROXY', async () => {
-    const result = await withRuntimeEnv({}, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
-    expect(result.ok).toBe(false);
-    if (!result.ok && 'error' in result) {
-      expect(result.error.code).toBe('BINDING_MISSING');
-    }
-  });
-
   it('returns INVALID_TO for an oversize recipient list before any transport is tried', async () => {
-    // Pre-flight: it must come back as a top-level `error`, from the
-    // harness (`void dev`) exactly as it would from a deployed worker — the
-    // proxy's own 100-recipient refusal used to be the first place a list
-    // like this was ever rejected, and only after the tenant had built it.
+    // Pre-flight: a top-level `error` from the harness, as from a deployed worker.
     const harness = createEmailTestHarness();
     try {
       const result = await sendEmail({
@@ -504,9 +434,6 @@ describe('sendEmail (from defaulting)', () => {
   });
 
   it('returns INVALID_FROM (never a baked-in domain) when __VOID_EMAIL_DOMAIN is missing', async () => {
-    // Regression guard for the whole point of the binding: with a slug but
-    // no configured domain, the send must fail loudly rather than quietly
-    // addressing the production zone.
     const harness = createEmailTestHarness();
     try {
       const result = await withRuntimeEnv({ __VOID_PROJECT_SLUG: 'acme' }, () =>
@@ -557,8 +484,6 @@ describe('sendEmail (from defaulting)', () => {
   });
 
   it('returns INVALID_FROM (not MIME_ERROR) when from is explicitly null', async () => {
-    // Regression: `null` previously slipped past the empty-from guard
-    // and was passed to parseAddress, surfacing as MIME_ERROR.
     const harness = createEmailTestHarness();
     try {
       const result = await sendEmail({
@@ -607,69 +532,6 @@ describe('sendEmail (from defaulting)', () => {
       harness.dispose();
     }
   });
-
-  it('rejects an explicit 65-character local part before capture, like the slug default', async () => {
-    // The slug default above refuses to BUILD a 65-octet local part, but the
-    // same address passed explicitly used to be captured as a success —
-    // under `void dev` and here — and could only bounce at an MTA.
-    const harness = createEmailTestHarness();
-    try {
-      const from = await sendEmail({
-        from: `${'a'.repeat(57)}+noreply@${MAIL_DOMAIN}`,
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-      });
-      expect(from.ok).toBe(false);
-      if (!from.ok && 'error' in from) {
-        expect(from.error.code).toBe('INVALID_FROM');
-        expect(from.error.message).toMatch(
-          /^from: address is not a valid email address \(ASCII local part/,
-        );
-      }
-      const to = await sendEmail({
-        from: 'a@x.dev',
-        to: `${'a'.repeat(65)}@y.dev`,
-        subject: 's',
-        text: 't',
-      });
-      expect(to.ok).toBe(false);
-      if (!to.ok && 'error' in to) {
-        expect(to.error.code).toBe('INVALID_TO');
-      }
-      expect(harness.messages).toHaveLength(0);
-    } finally {
-      harness.dispose();
-    }
-  });
-
-  it('rejects a 257-character address before capture, whatever its local part', async () => {
-    // `a@` + a 255-octet domain is under the 320 total and the 64-octet
-    // local part, and used to be captured as a success — under `void dev`
-    // and here — when RFC 5321 §4.5.3.1.3 caps the path at 256 octets.
-    const label = 'b'.repeat(63);
-    const over = `a@${[label, label, label, label].join('.')}`;
-    expect(over).toHaveLength(257);
-    const harness = createEmailTestHarness();
-    try {
-      const from = await sendEmail({ from: over, to: 'b@y.dev', subject: 's', text: 't' });
-      expect(from.ok).toBe(false);
-      if (!from.ok && 'error' in from) {
-        expect(from.error.code).toBe('INVALID_FROM');
-        expect(from.error.message).toMatch(
-          /^from: address is not a valid email address \(ASCII local part/,
-        );
-      }
-      const to = await sendEmail({ from: 'a@x.dev', to: over, subject: 's', text: 't' });
-      expect(to.ok).toBe(false);
-      if (!to.ok && 'error' in to) {
-        expect(to.error.code).toBe('INVALID_TO');
-      }
-      expect(harness.messages).toHaveLength(0);
-    } finally {
-      harness.dispose();
-    }
-  });
 });
 
 describe('sendEmail (proxy round trip)', () => {
@@ -678,15 +540,7 @@ describe('sendEmail (proxy round trip)', () => {
       status: 200,
       body: { ok: true, ids: [{ recipient: 'b@y.dev', messageId: 'cf-1' }] },
     }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(calls).toHaveLength(1);
     expect(calls[0].url).toBe('https://email-proxy/email/send');
     const body = calls[0].body as Record<string, unknown>;
@@ -703,40 +557,12 @@ describe('sendEmail (proxy round trip)', () => {
     }
   });
 
-  it('falls back to the locally-generated messageId when the proxy returns an empty one', async () => {
-    const { proxy } = fakeProxy(() => ({
-      status: 200,
-      body: { ok: true, ids: [{ recipient: 'b@y.dev', messageId: '' }] },
-    }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.ids[0].messageId).toMatch(/^<.+@x\.dev>$/);
-    }
-  });
-
   it('surfaces QUOTA_EXCEEDED when the proxy denies the send', async () => {
     const { proxy } = fakeProxy(() => ({
       status: 429,
       body: { ok: false, error: { code: 'QUOTA_EXCEEDED', message: 'monthly cap reached' } },
     }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result.ok).toBe(false);
     if (!result.ok && 'error' in result) {
       expect(result.error.code).toBe('QUOTA_EXCEEDED');
@@ -750,15 +576,7 @@ describe('sendEmail (proxy round trip)', () => {
         throw new Error('network unreachable');
       },
     };
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result.ok).toBe(false);
     if (!result.ok && 'error' in result) {
       expect(result.error.code).toBe('OUTCOME_UNKNOWN');
@@ -791,15 +609,7 @@ describe('sendEmail (proxy round trip)', () => {
             );
           },
         };
-        const pending = withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-          sendEmail({
-            from: 'a@x.dev',
-            to: 'b@y.dev',
-            subject: 's',
-            text: 't',
-            sendInDev: true,
-          }),
-        );
+        const pending = send(proxy);
 
         await started;
         await vi.advanceTimersByTimeAsync(0);
@@ -830,69 +640,17 @@ describe('sendEmail (proxy round trip)', () => {
         );
       },
     };
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result).toMatchObject({ ok: false, error: { code: 'OUTCOME_UNKNOWN' } });
     await vi.waitFor(() => expect(cancel).toHaveBeenCalledOnce());
   });
 
-  it('passes mid-batch deliveries through unchanged', async () => {
-    const { proxy } = fakeProxy(() => ({
-      status: 200,
-      body: {
-        ok: false,
-        deliveries: [
-          { recipient: 'a@y.dev', ok: true, messageId: 'cf-a' },
-          {
-            recipient: 'b@y.dev',
-            ok: false,
-            error: { code: 'UNVERIFIED_DESTINATION', message: 'b@y.dev not verified' },
-          },
-          { recipient: 'c@y.dev', ok: true, messageId: 'cf-c' },
-        ],
-      },
-    }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: ['a@y.dev', 'b@y.dev', 'c@y.dev'],
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
-    expect(result.ok).toBe(false);
-    if (!result.ok && 'deliveries' in result) {
-      expect(result.deliveries).toHaveLength(3);
-      const b = result.deliveries.find((d) => d.recipient === 'b@y.dev');
-      expect(b?.ok).toBe(false);
-      if (b && !b.ok) {
-        expect(b.error.code).toBe('UNVERIFIED_DESTINATION');
-      }
-    }
-  });
-
   it('coerces unknown error codes to UPSTREAM_ERROR', async () => {
     const { proxy } = fakeProxy(() => ({
       status: 500,
       body: { ok: false, error: { code: 'WEIRD_NEW_CODE', message: 'something broke' } },
     }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result.ok).toBe(false);
     if (!result.ok && 'error' in result) {
       expect(result.error.code).toBe('UPSTREAM_ERROR');
@@ -904,15 +662,7 @@ describe('sendEmail (proxy round trip)', () => {
     'keeps the upstream fallback for incomplete error fields: %j',
     async (error) => {
       const { proxy } = fakeProxy(() => ({ status: 500, body: { ok: false, error } }));
-      const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-        sendEmail({
-          from: 'a@x.dev',
-          to: 'b@y.dev',
-          subject: 's',
-          text: 't',
-          sendInDev: true,
-        }),
-      );
+      const result = await send(proxy);
       expect(result).toMatchObject({
         ok: false,
         error: { code: 'UPSTREAM_ERROR', message: 'email: upstream send failed' },
@@ -929,15 +679,7 @@ describe('sendEmail (proxy round trip)', () => {
         deliveries: [{ recipient: 'b@y.dev', ok: true, messageId: 'cf-b' }],
       },
     }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result).toEqual({
       ok: false,
       deliveries: [{ recipient: 'b@y.dev', ok: true, messageId: 'cf-b' }],
@@ -954,15 +696,7 @@ describe('sendEmail (proxy round trip)', () => {
     ['primitive array body', []],
   ])('returns OUTCOME_UNKNOWN (no throw) for malformed proxy response: %s', async (_, payload) => {
     const { proxy } = fakeProxy(() => ({ status: 200, body: payload }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result.ok).toBe(false);
     if (!result.ok && 'error' in result) {
       expect(result.error.code).toBe('OUTCOME_UNKNOWN');
@@ -992,15 +726,7 @@ describe('sendEmail (proxy round trip)', () => {
     ],
   ])('surfaces the proxy refusal text for %s', async (_, status, payload, expected) => {
     const { proxy } = fakeProxy(() => ({ status, body: payload }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result.ok).toBe(false);
     if (!result.ok && 'error' in result) {
       expect(result.error.code).toBe('UPSTREAM_ERROR');
@@ -1011,15 +737,7 @@ describe('sendEmail (proxy round trip)', () => {
 
   it('still reports a flat error body on a 2xx as malformed', async () => {
     const { proxy } = fakeProxy(() => ({ status: 200, body: { error: 'nope' } }));
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result.ok).toBe(false);
     if (!result.ok && 'error' in result) {
       expect(result.error.code).toBe('OUTCOME_UNKNOWN');
@@ -1036,15 +754,7 @@ describe('sendEmail (proxy round trip)', () => {
         });
       },
     };
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy);
     expect(result.ok).toBe(false);
     if (!result.ok && 'error' in result) {
       expect(result.error.code).toBe('OUTCOME_UNKNOWN');
@@ -1062,17 +772,7 @@ describe('sendEmail (proxy round trip)', () => {
         },
       };
     });
-    const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({
-        from: 'a@x.dev',
-        to: 'b@y.dev',
-        cc: 'B@Y.DEV',
-        bcc: ['b@y.dev', 'c@y.dev'],
-        subject: 's',
-        text: 't',
-        sendInDev: true,
-      }),
-    );
+    const result = await send(proxy, 'b@y.dev', { cc: 'B@Y.DEV', bcc: ['b@y.dev', 'c@y.dev'] });
     const recipients = (calls[0].body as { recipients: Array<string> }).recipients;
     expect(recipients).toEqual(['b@y.dev', 'c@y.dev']);
     expect(result.ok).toBe(true);
@@ -1082,20 +782,8 @@ describe('sendEmail (proxy round trip)', () => {
   });
 });
 
-// The proxy answers `ok: true` only after every requested recipient was
-// accepted by the allowlist AND confirmed by `SEND_EMAIL.send()`, and its
-// `ids` is `deliveries.map(({ recipient, messageId }))` — one entry per
-// requested address, `messageId` always a string (`''` when CF returned
-// none). So on `ok: true` the list is the request's recipient set, and a
-// list that does not account for every recipient is a schema-skewed or
-// corrupt proxy: dropping the bad entry and still returning `ok: true`
-// would tell the caller a delivery was confirmed when none was.
+// ok:true must account for every requested recipient.
 describe('sendEmail (proxy delivery list)', () => {
-  const send = (proxy: ReturnType<typeof fakeProxy>['proxy'], to: string | Array<string>) =>
-    withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({ from: 'a@x.dev', to, subject: 's', text: 't', sendInDev: true }),
-    );
-
   it.each([
     [
       'a null entry',
@@ -1195,21 +883,8 @@ describe('sendEmail (proxy delivery list)', () => {
   });
 });
 
-// The mid-batch `deliveries` list is built from the same per-recipient list
-// as `ids`: one entry per requested address, each either
-// `{ recipient, ok: true, messageId }` or `{ recipient, ok: false, error }`
-// (the proxy always attaches `error` to a failed entry — both its producer
-// paths do). A list that skips, repeats or invents a recipient, or an entry
-// that does not state its outcome, cannot be acted on: skipping the bad entry
-// would leave a recipient with no outcome, and treating an entry with no `ok`
-// as failed could lead to a duplicate delivery. Such a response is a
-// schema-skewed or corrupt proxy and is refused as a whole, under the same
-// rules as the success path.
+// A mid-batch list must state one outcome per requested recipient, or it is refused whole.
 describe('sendEmail (proxy mid-batch delivery list)', () => {
-  const send = (proxy: ReturnType<typeof fakeProxy>['proxy'], to: string | Array<string>) =>
-    withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-      sendEmail({ from: 'a@x.dev', to, subject: 's', text: 't', sendInDev: true }),
-    );
   const failed = (recipient: string) => ({
     recipient,
     ok: false,
@@ -1452,15 +1127,7 @@ describe('sendEmail (sendInDev escape hatch)', () => {
         status: 200,
         body: { ok: true, ids: [{ recipient: 'b@y.dev', messageId: 'cf-id-123' }] },
       }));
-      const result = await withRuntimeEnv({ __VOID_PROXY: proxy, ...PROXY_ENV_KEYS }, () =>
-        sendEmail({
-          from: 'a@x.dev',
-          to: 'b@y.dev',
-          subject: 's',
-          text: 't',
-          sendInDev: true,
-        }),
-      );
+      const result = await send(proxy);
       expect(harness.messages).toHaveLength(0);
       expect(calls).toHaveLength(1);
       expect(result.ok).toBe(true);
@@ -1472,13 +1139,8 @@ describe('sendEmail (sendInDev escape hatch)', () => {
     }
   });
 
-  // The test above hand-injects `__VOID_PROXY`, which `void dev` never
-  // produces: the platform adds that service binding only on a deployed
-  // worker, and the own-account `SEND_EMAIL` binding is deleted from the
-  // resolved worker config whenever `viteCommand === 'serve'`. So under a
-  // real dev server `sendInDev: true` bypasses the inbox and lands on
-  // nothing. Pin that, message text included, so re-adding a send binding
-  // to dev has to come past this test.
+  // `void dev` binds neither `__VOID_PROXY` nor `SEND_EMAIL`, so there
+  // `sendInDev: true` reaches no transport.
   it('returns BINDING_MISSING under a real `void dev` env (no transport to fall through to)', async () => {
     const assets = {
       calls: 0,
diff --git a/packages/void/test/unit/env-client-fold.test.ts b/packages/void/test/unit/env-client-fold.test.ts
index 8945016ba..430527359 100644
--- a/packages/void/test/unit/env-client-fold.test.ts
+++ b/packages/void/test/unit/env-client-fold.test.ts
@@ -1,7 +1,5 @@
-import { beforeEach, describe, expect, it } from 'vite-plus/test';
+import { describe, expect, it } from 'vite-plus/test';
 import { envClientFoldPlugin } from '../../src/plugin-env-client-fold.ts';
-import { number, string } from '../../src/runtime/env-helpers.ts';
-import { defineEnv } from '../../src/runtime/env-public.ts';
 
 const ROOT = '/project';
 type MessagePayload = string | { message: string };
@@ -9,7 +7,7 @@ type FoldContext = ReturnType<typeof makeContext>;
 type TransformHandler = (this: FoldContext, code: string, id: string) => unknown | Promise<unknown>;
 type ConfigResolvedHandler = (
   this: FoldContext,
-  config: { envPrefix?: string | Array<string>; env?: Record<string, string> },
+  config: { env?: Record<string, string> },
 ) => unknown | Promise<unknown>;
 type HookWithHandler<T> = { handler: T };
 
@@ -56,7 +54,6 @@ function getConfigResolvedHandler(plugin: ReturnType<typeof envClientFoldPlugin>
 }
 
 type RunOpts = {
-  envPrefix?: string | Array<string>;
   env?: Record<string, string>;
   environmentName?: string;
 };
@@ -70,25 +67,14 @@ async function runFold(
   const ctx = makeContext(opts.environmentName ?? 'client');
   const cr = getConfigResolvedHandler(plugin);
   if (cr) {
-    await cr.call(ctx, {
-      envPrefix: opts.envPrefix ?? 'VITE_',
-      env: opts.env ?? {},
-    });
+    await cr.call(ctx, { env: opts.env ?? {} });
   }
   const handler = getTransformHandler(plugin);
   const result = (await handler.call(ctx, code, id)) as TransformResult | undefined | null;
   return { ctx, result };
 }
 
-function resetSchema() {
-  defineEnv({});
-}
-
 describe('envClientFoldPlugin', () => {
-  beforeEach(() => {
-    resetSchema();
-  });
-
   it('folds a VITE_-prefixed key with a .env value into a string literal', async () => {
     const code = `import { env } from "void/env";\nconsole.log(env.VITE_TITLE);\n`;
     const { result } = await runFold(code, `${ROOT}/src/page.ts`, {
@@ -130,28 +116,6 @@ describe('envClientFoldPlugin', () => {
     expect(result).toBeFalsy();
   });
 
-  it('does not fold custom-prefix keys', async () => {
-    const code = `import { env } from "void/env";\nconsole.log(env.PUBLIC_TITLE);\n`;
-    const { result } = await runFold(code, `${ROOT}/src/page.ts`, {
-      envPrefix: 'PUBLIC_',
-      env: { PUBLIC_TITLE: 'Public' },
-    });
-    expect(result).toBeFalsy();
-  });
-
-  it('does not fold keys from custom prefix arrays', async () => {
-    const code = [
-      `import { env } from "void/env";`,
-      `const a = env.PUBLIC_A;`,
-      `const b = env.NEXT_PUBLIC_B;`,
-    ].join('\n');
-    const { result } = await runFold(code, `${ROOT}/src/page.ts`, {
-      envPrefix: ['PUBLIC_', 'NEXT_PUBLIC_'],
-      env: { PUBLIC_A: 'aa', NEXT_PUBLIC_B: 'bb' },
-    });
-    expect(result).toBeFalsy();
-  });
-
   it('leaves unknown keys untouched so the runtime Proxy can serve them', async () => {
     const code = `import { env } from "void/env";\nconsole.log(env.VITE_MISSING);\n`;
     const { result } = await runFold(code, `${ROOT}/src/page.ts`, {
@@ -214,42 +178,9 @@ describe('envClientFoldPlugin', () => {
     expect(result?.code).toContain(`console.log("1", "2")`);
   });
 
-  it('falls back to schema defaults when a key is absent from .env', async () => {
-    defineEnv({ VITE_PORT: number().default(3000) });
-    const code = `import { env } from "void/env";\nconst p = env.VITE_PORT;\n`;
-    const { result } = await runFold(code, `${ROOT}/src/page.ts`, {
-      env: {}, // nothing from .env; schema default should kick in
-    });
-    expect(result?.code).toContain(`"3000"`);
-  });
-
-  it('does not expose server-only schema defaults to the client', async () => {
-    // Server-only default must not leak into fold output even if it has a
-    // default — it still fails the prefix check.
-    defineEnv({ PORT: number().default(3000) });
-    const code = `import { env } from "void/env";\nconst p = env.PORT;\n`;
-    const { result } = await runFold(code, `${ROOT}/src/page.ts`, {
-      env: {},
-    });
-    expect(result).toBeFalsy();
-  });
-
-  it('prefers .env value over schema default', async () => {
-    defineEnv({ VITE_TITLE: string().default('Default') });
-    const code = `import { env } from "void/env";\nconst t = env.VITE_TITLE;\n`;
-    const { result } = await runFold(code, `${ROOT}/src/page.ts`, {
-      env: { VITE_TITLE: 'FromEnv' },
-    });
-    expect(result?.code).toContain(`"FromEnv"`);
-    expect(result!.code).not.toContain('Default');
-  });
-
   it('reports apply: build and enforce: post', () => {
     const plugin = envClientFoldPlugin();
     expect(plugin.apply).toBe('build');
-    // `enforce: 'post'` ensures we run AFTER framework SFC compilers (Svelte,
-    // Vue, Astro) so `.svelte`/`.vue`/`.astro` ids arrive as compiled JS we
-    // can parse and fold.
     expect(plugin.enforce).toBe('post');
   });
 });
diff --git a/packages/void/test/unit/env-client-guard.test.ts b/packages/void/test/unit/env-client-guard.test.ts
index 0e523bad1..2db6d3da7 100644
--- a/packages/void/test/unit/env-client-guard.test.ts
+++ b/packages/void/test/unit/env-client-guard.test.ts
@@ -12,10 +12,6 @@ type TransformHandler = (
   code: string,
   id: string,
 ) => unknown | Promise<unknown>;
-type ConfigResolvedHandler = (
-  this: ReturnType<typeof makeContext>,
-  config: { envPrefix?: string | Array<string> },
-) => unknown | Promise<unknown>;
 type HookWithHandler<T> = { handler: T };
 
 type ContextHooks = {
@@ -66,37 +62,12 @@ function getTransformHandler(plugin: ReturnType<typeof envClientGuardPlugin>): T
   throw new Error('plugin.transform missing handler');
 }
 
-function getConfigResolvedHandler(
-  plugin: ReturnType<typeof envClientGuardPlugin>,
-): ConfigResolvedHandler | null {
-  const c = plugin.configResolved;
-  if (typeof c === 'function') {
-    return c as unknown as ConfigResolvedHandler;
-  }
-  if (c && typeof c === 'object' && 'handler' in c) {
-    return (c as unknown as HookWithHandler<ConfigResolvedHandler>).handler;
-  }
-  return null;
-}
-
-type RunTransformOptions = {
-  envPrefix?: string | Array<string>;
-};
-
 async function runTransform(
   ctx: ReturnType<typeof makeContext>,
   code: string,
   id: string,
-  options: RunTransformOptions = {},
 ): Promise<{ threw: boolean; error?: Error }> {
-  const plugin = envClientGuardPlugin(ROOT);
-  if (options.envPrefix !== undefined) {
-    const cr = getConfigResolvedHandler(plugin);
-    if (cr) {
-      await cr.call(ctx, { envPrefix: options.envPrefix });
-    }
-  }
-  const handler = getTransformHandler(plugin);
+  const handler = getTransformHandler(envClientGuardPlugin(ROOT));
   try {
     await handler.call(ctx, code, id);
     return { threw: false };
@@ -116,17 +87,12 @@ function resetSchema() {
 // the no-schema test.
 async function withNoSchema(fn: () => Promise<void>): Promise<void> {
   const mod = await import('../../src/runtime/env-public.ts');
-  const originalHas = mod._hasRegisteredSchema;
-  const originalGet = mod._getRegisteredSchema;
   vi.spyOn(mod, '_hasRegisteredSchema').mockReturnValue(false);
   vi.spyOn(mod, '_getRegisteredSchema').mockReturnValue(null);
   try {
     await fn();
   } finally {
     vi.restoreAllMocks();
-    // Restore the originals (defensive — restoreAllMocks should handle it).
-    void originalHas;
-    void originalGet;
   }
 }
 
@@ -146,7 +112,7 @@ describe('envClientGuardPlugin', () => {
     expect(result.threw).toBe(true);
     expect(ctx.errors).toHaveLength(1);
     expect(ctx.errors[0]!.message).toContain('STRIPE_KEY');
-    expect(ctx.errors[0]!.message).toContain('VITE_');
+    expect(ctx.errors[0]!.message).toContain('VITE_*');
     expect(ctx.errors[0]!.loc?.line).toBe(2);
   });
 
@@ -301,43 +267,4 @@ describe('envClientGuardPlugin', () => {
     expect(result.threw).toBe(true);
     expect(ctx.errors).toHaveLength(1);
   });
-
-  it('does not let a custom Vite envPrefix redefine Void client keys', async () => {
-    defineEnv({ PUBLIC_TITLE: string() });
-    const ctx = makeContext('client');
-    const result = await runTransform(
-      ctx,
-      `import { env } from "void/env";\nconst t = env.PUBLIC_TITLE;\n`,
-      `${ROOT}/src/page.ts`,
-      { envPrefix: 'PUBLIC_' },
-    );
-    expect(result.threw).toBe(true);
-    expect(ctx.errors[0]!.message).toContain('VITE_*');
-  });
-
-  it('rejects non-VITE keys even when Vite exposes multiple custom prefixes', async () => {
-    defineEnv({ PUBLIC_A: string(), NEXT_PUBLIC_B: string() });
-    const ctx = makeContext('client');
-    const result = await runTransform(
-      ctx,
-      `import { env } from "void/env";\nconst a = env.PUBLIC_A;\nconst b = env.NEXT_PUBLIC_B;\n`,
-      `${ROOT}/src/page.ts`,
-      { envPrefix: ['PUBLIC_', 'NEXT_PUBLIC_'] },
-    );
-    expect(result.threw).toBe(true);
-    expect(ctx.errors).toHaveLength(1);
-  });
-
-  it('always points to the fixed VITE prefix', async () => {
-    defineEnv({ STRIPE_KEY: string() });
-    const ctx = makeContext('client');
-    const result = await runTransform(
-      ctx,
-      `import { env } from "void/env";\nconst k = env.STRIPE_KEY;\n`,
-      `${ROOT}/src/page.ts`,
-      { envPrefix: 'PUBLIC_' },
-    );
-    expect(result.threw).toBe(true);
-    expect(ctx.errors[0]!.message).toContain('VITE_*');
-  });
 });
diff --git a/packages/void/test/unit/env-export-conditions.test.ts b/packages/void/test/unit/env-export-conditions.test.ts
index 7f21e87b2..16358dbd4 100644
--- a/packages/void/test/unit/env-export-conditions.test.ts
+++ b/packages/void/test/unit/env-export-conditions.test.ts
@@ -2,20 +2,8 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { describe, expect, it } from 'vite-plus/test';
 
-/**
- * Regression guard for the `void/env` package export map.
- *
- * Background: `@cloudflare/vite-plugin` sets the workerd environment's
- * resolve conditions to `["workerd", "worker", "module", "browser"]`. Node
- * export-map resolution walks keys in declaration order, so if `browser`
- * appears before a workerd-specific branch the worker bundle silently
- * picks the client-only stub and throws `readClientKey` at request time
- * for any non-VITE_ key.
- *
- * These tests exercise the raw export map against the condition sets we
- * know real runtimes use, so a future edit that reintroduces the ordering
- * bug fails here instead of in a user's prod deploy.
- */
+// @cloudflare/vite-plugin resolves workerd with ["workerd","worker","module","browser"];
+// export keys match in order, so the worker branches must stay before "browser".
 
 type ExportEntry = string | { [condition: string]: ExportEntry };
 
diff --git a/packages/void/test/unit/env-filtering.test.ts b/packages/void/test/unit/env-filtering.test.ts
index f559ad796..be4792e1a 100644
--- a/packages/void/test/unit/env-filtering.test.ts
+++ b/packages/void/test/unit/env-filtering.test.ts
@@ -9,63 +9,30 @@ import {
 describe('internal binding filtering (real implementation)', () => {
   const testEnv = {
     DB: 'd1-binding',
-    KV: 'kv-binding',
     __VOID_PROXY_TOKEN: 'secret-token',
-    __VOID_PROXY: { fetch: () => {} },
     __PROJECT_ID: 'proj_123',
-    MY_VAR: 'hello',
   };
 
-  it('getRuntimeBinding blocks __VOID_PROXY_TOKEN', () => {
-    const result = withRuntimeEnv(testEnv, () => getRuntimeBinding('__VOID_PROXY_TOKEN'));
-    expect(result).toBeUndefined();
-  });
-
-  it('getRuntimeBinding blocks __VOID_PROXY', () => {
-    const result = withRuntimeEnv(testEnv, () => getRuntimeBinding('__VOID_PROXY'));
-    expect(result).toBeUndefined();
-  });
-
-  it('getRuntimeBinding blocks __PROJECT_ID', () => {
-    const result = withRuntimeEnv(testEnv, () => getRuntimeBinding('__PROJECT_ID'));
-    expect(result).toBeUndefined();
-  });
-
-  it('getRuntimeBinding allows user bindings', () => {
-    const db = withRuntimeEnv(testEnv, () => getRuntimeBinding('DB'));
-    expect(db).toBe('d1-binding');
-    const kv = withRuntimeEnv(testEnv, () => getRuntimeBinding('KV'));
-    expect(kv).toBe('kv-binding');
-  });
-
-  it('requireRuntimeBinding throws for __VOID_ prefixed names', () => {
-    expect(() =>
-      withRuntimeEnv(testEnv, () => requireRuntimeBinding('__VOID_PROXY_TOKEN')),
-    ).toThrow("env: Missing Cloudflare binding '__VOID_PROXY_TOKEN'");
-  });
-
-  it('getRuntimeEnv hides __VOID_ keys from property access', () => {
-    const env = withRuntimeEnv(testEnv, () => getRuntimeEnv());
-    expect(env.__VOID_PROXY_TOKEN).toBeUndefined();
-    expect(env.__VOID_PROXY).toBeUndefined();
-    expect(env.__PROJECT_ID).toBeUndefined();
-    expect(env.DB).toBe('d1-binding');
-  });
-
-  it('getRuntimeEnv hides internal keys from Object.keys', () => {
-    const env = withRuntimeEnv(testEnv, () => getRuntimeEnv());
-    const keys = Object.keys(env);
-    expect(keys).toContain('DB');
-    expect(keys).toContain('KV');
-    expect(keys).toContain('MY_VAR');
-    expect(keys).not.toContain('__VOID_PROXY_TOKEN');
-    expect(keys).not.toContain('__VOID_PROXY');
-    expect(keys).not.toContain('__PROJECT_ID');
-  });
-
-  it("getRuntimeEnv hides internal keys from 'in' operator", () => {
-    const env = withRuntimeEnv(testEnv, () => getRuntimeEnv());
-    expect('DB' in env).toBe(true);
-    expect('__VOID_PROXY_TOKEN' in env).toBe(false);
+  it.each(['__VOID_PROXY_TOKEN', '__PROJECT_ID'])('hides %s from every env accessor', (name) => {
+    withRuntimeEnv(testEnv, () => {
+      const env = getRuntimeEnv();
+      expect(env[name]).toBeUndefined();
+      expect(name in env).toBe(false);
+      expect(Object.keys(env)).not.toContain(name);
+      expect(getRuntimeBinding(name)).toBeUndefined();
+      expect(() => requireRuntimeBinding(name)).toThrow(
+        `env: Missing Cloudflare binding '${name}'`,
+      );
+    });
+  });
+
+  it('keeps user bindings visible', () => {
+    withRuntimeEnv(testEnv, () => {
+      const env = getRuntimeEnv();
+      expect(env.DB).toBe('d1-binding');
+      expect('DB' in env).toBe(true);
+      expect(Object.keys(env)).toContain('DB');
+      expect(getRuntimeBinding('DB')).toBe('d1-binding');
+    });
   });
 });
diff --git a/packages/void/test/unit/env-mask.test.ts b/packages/void/test/unit/env-mask.test.ts
index f3ba0801d..0107a4c98 100644
--- a/packages/void/test/unit/env-mask.test.ts
+++ b/packages/void/test/unit/env-mask.test.ts
@@ -9,17 +9,7 @@ import {
 /** Validator messages redact raw inputs unconditionally unless explicitly unmasked. */
 
 describe('redactMessage', () => {
-  it('redacts credential-shaped raw input', () => {
-    const msg = redactMessage('sk_live_abc', 'got "sk_live_abc"');
-    expect(msg).toBe(`got "${REDACTED}"`);
-  });
-
-  it('redacts invalid numeric input containing a credential', () => {
-    const msg = redactMessage('sk_live_abc123', 'Expected a number, got "sk_live_abc123"');
-    expect(msg).toBe(`Expected a number, got "${REDACTED}"`);
-  });
-
-  it('redacts plain invalid values too', () => {
+  it('replaces the raw value in the message', () => {
     const msg = redactMessage('abc', 'Expected a number, got "abc"');
     expect(msg).toBe(`Expected a number, got "${REDACTED}"`);
   });
diff --git a/packages/void/test/unit/env-prod-validation.test.ts b/packages/void/test/unit/env-prod-validation.test.ts
index 0c1e708ed..18ab45af3 100644
--- a/packages/void/test/unit/env-prod-validation.test.ts
+++ b/packages/void/test/unit/env-prod-validation.test.ts
@@ -2,29 +2,11 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import {
-  formatEnvReport,
-  validateProdEnv,
-  validateSecretValues,
-} from '../../src/cli/env-validation.ts';
+import { formatEnvReport, validateProdEnv } from '../../src/cli/env-validation.ts';
 import { number, string } from '../../src/runtime/env-helpers.ts';
 import { defineEnv } from '../../src/runtime/env-public.ts';
 
-/**
- * Integration coverage for the deploy-time env validation path. The
- * `assertEnvSchemaValid` wrapper inside `deploy.ts` is a thin layer over
- * `validateProdEnv` — it resolves the remote secret list, calls
- * `validateProdEnv`, and throws when the report is invalid. Exercising
- * `validateProdEnv` across the local `.env`, build shell, and remote
- * secret sources is what catches the
- * regressions that silently break `void deploy`.
- *
- * Schema registration is done directly via `defineEnv` rather than via an
- * `await import(envFile)` round-trip, because the fixture only needs
- * `findEnvFile` to return non-null for the schema-load branch to fire —
- * the actual schema is a process-wide singleton. An empty env.ts on disk
- * keeps the file-discovery contract honest.
- */
+// The fixture env.ts only has to exist: tests register the shared schema with defineEnv.
 
 const roots: Array<string> = [];
 
@@ -32,7 +14,6 @@ function createTempProject(opts?: { withEnvTs?: boolean }): string {
   const root = mkdtempSync(join(tmpdir(), 'void-deploy-env-'));
   roots.push(root);
   if (opts?.withEnvTs !== false) {
-    // Empty module body is enough — schema is pre-registered via defineEnv below.
     writeFileSync(join(root, 'env.ts'), 'export default {};\n');
   }
   return root;
@@ -43,43 +24,10 @@ function writeDotenv(root: string, name: string, contents: string): void {
 }
 
 beforeEach(() => {
-  // Clear any schema that leaked from a prior test so missing-key reports
-  // are predictable. `defineEnv({})` resets the registry.
+  // defineEnv({}) resets the shared schema registry.
   defineEnv({});
 });
 
-describe('validateSecretValues — upload-time validation', () => {
-  it('accepts declared server values that pass env.ts validation', async () => {
-    const root = createTempProject();
-    defineEnv({ PORT: number() });
-
-    await expect(
-      validateSecretValues(root, [{ name: 'PORT', value: '8080' }]),
-    ).resolves.toBeUndefined();
-  });
-
-  it('rejects invalid values without echoing the plaintext', async () => {
-    const root = createTempProject();
-    defineEnv({ PORT: number() });
-
-    await expect(
-      validateSecretValues(root, [{ name: 'PORT', value: 'not-a-number' }]),
-    ).rejects.toThrow('PORT failed env.ts validation');
-  });
-
-  it('rejects undeclared and client-exposed names', async () => {
-    const root = createTempProject();
-    defineEnv({ SERVER_URL: string(), VITE_API_URL: string() });
-
-    await expect(validateSecretValues(root, [{ name: 'OTHER', value: 'x' }])).rejects.toThrow(
-      'OTHER is not declared in env.ts',
-    );
-    await expect(
-      validateSecretValues(root, [{ name: 'VITE_API_URL', value: 'https://example.com' }]),
-    ).rejects.toThrow('VITE_API_URL is client-exposed');
-  });
-});
-
 afterEach(() => {
   vi.unstubAllEnvs();
   for (const root of roots.splice(0, roots.length)) {
@@ -104,7 +52,6 @@ describe('validateProdEnv — deploy-time schema enforcement', () => {
     expect(hasSchema).toBe(true);
     expect(report.valid).toBe(false);
     expect(report.missing.sort()).toEqual(['DATABASE_URL', 'STRIPE_KEY']);
-    // The formatter produces the message surfaced by `assertEnvSchemaValid`.
     const formatted = formatEnvReport(report);
     expect(formatted).toContain('STRIPE_KEY');
     expect(formatted).toContain('DATABASE_URL');
@@ -113,24 +60,11 @@ describe('validateProdEnv — deploy-time schema enforcement', () => {
 
   it('treats remote secrets as "present" so a prod secret satisfies a required key', async () => {
     const root = createTempProject();
-    defineEnv({ STRIPE_KEY: string() });
-
-    const { report } = await validateProdEnv(root, {
-      productionOnly: true,
-      remoteSecrets: ['STRIPE_KEY'],
-    });
-
-    expect(report.valid).toBe(true);
-    expect(report.missing).toEqual([]);
-  });
-
-  it('accepts remote secrets for non-string schemas (number/boolean/url) without running the validator against a placeholder', async () => {
-    const root = createTempProject();
-    defineEnv({ PORT: number() });
+    defineEnv({ STRIPE_KEY: string(), PORT: number() });
 
     const { report } = await validateProdEnv(root, {
       productionOnly: true,
-      remoteSecrets: ['PORT'],
+      remoteSecrets: ['STRIPE_KEY', 'PORT'],
     });
 
     expect(report.valid).toBe(true);
@@ -185,19 +119,6 @@ describe('validateProdEnv — deploy-time schema enforcement', () => {
     expect(formatted).toContain('VITE_PORT');
   });
 
-  it('redacts invalid client values in formatEnvReport', async () => {
-    const root = createTempProject();
-    defineEnv({ VITE_PORT: number() });
-    vi.stubEnv('VITE_PORT', 'sk_live_abc123');
-
-    const { report } = await validateProdEnv(root, { productionOnly: true });
-    const formatted = formatEnvReport(report);
-    expect(formatted).not.toContain('sk_live_abc123');
-    expect(formatted).toContain('<redacted>');
-    // Key name is still there so the user can find it.
-    expect(formatted).toContain('VITE_PORT');
-  });
-
   it('rejects reserved __VOID_ names in .env for a local check, with or without env.ts', async () => {
     for (const withEnvTs of [true, false]) {
       const root = createTempProject({ withEnvTs });
diff --git a/packages/void/test/unit/env-scaffold.test.ts b/packages/void/test/unit/env-scaffold.test.ts
index 321649c9f..9694a88d6 100644
--- a/packages/void/test/unit/env-scaffold.test.ts
+++ b/packages/void/test/unit/env-scaffold.test.ts
@@ -71,19 +71,6 @@ describe('renderEnvTs', () => {
     expect(importLine).toBe(`import { defineEnv, string, number } from 'void/env';`);
   });
 
-  it('renders one line per entry using the inferred helper', () => {
-    const out = renderEnvTs([
-      { key: 'DEBUG', helper: 'boolean' },
-      { key: 'PORT', helper: 'number' },
-      { key: 'STRIPE_KEY', helper: 'string' },
-      { key: 'WEBHOOK_URL', helper: 'url' },
-    ]);
-    expect(out).toContain('DEBUG: boolean(),');
-    expect(out).toContain('PORT: number(),');
-    expect(out).toContain('STRIPE_KEY: string(),');
-    expect(out).toContain('WEBHOOK_URL: url(),');
-  });
-
   it('nudges the user to tighten inferred types', () => {
     const out = renderEnvTs([{ key: 'X', helper: 'string' }]);
     expect(out).toMatch(/tighten types/);
@@ -144,14 +131,4 @@ describe('maybeScaffoldEnvTs', () => {
     expect(body).toContain('DEBUG: boolean(),');
     expect(body).toContain('WEBHOOK_URL: url(),');
   });
-
-  it('skips malformed dotenv lines without crashing', () => {
-    const root = tmpProject();
-    writeFileSync(
-      join(root, '.env'),
-      ['# a comment', '', 'NOT A KEY', '123BAD=skip-me', 'GOOD=value', ''].join('\n'),
-    );
-    const entries = collectInferredEntries(root);
-    expect(entries.map((e) => e.key)).toEqual(['GOOD']);
-  });
 });
diff --git a/packages/void/test/unit/env-schema.test.ts b/packages/void/test/unit/env-schema.test.ts
index ee54d0259..890b9a81d 100644
--- a/packages/void/test/unit/env-schema.test.ts
+++ b/packages/void/test/unit/env-schema.test.ts
@@ -167,23 +167,12 @@ describe('defineEnv + env proxy', () => {
   });
 });
 
-describe('redaction roundtrip (heuristic + content)', () => {
+describe('redaction', () => {
   beforeEach(() => {
     resetSchema();
   });
 
-  it('omits placeholder values when a required STRIPE_KEY is missing', async () => {
-    defineEnv({ STRIPE_KEY: string() });
-    const report = await validateAllEnv({});
-    const formatted = report.missing.join(' ');
-    expect(formatted).toContain('STRIPE_KEY');
-    // No secret-looking fragment leaked into the report.
-    expect(formatted).not.toMatch(/sk_|ghp_/);
-  });
-
-  it('redacts a secret-looking value even when the key name is neutral (wrong-file typo)', async () => {
-    // Scenario: user pastes `PORT=sk_live_abc123` into the wrong line.
-    // `number()` rejects it, and the error message must NOT echo the token.
+  it('validateAllEnv redacts invalid values from its messages', async () => {
     defineEnv({ PORT: number() });
     const bad = await validateAllEnv({ PORT: 'sk_live_abc123' });
     expect(bad.valid).toBe(false);
@@ -192,17 +181,6 @@ describe('redaction roundtrip (heuristic + content)', () => {
     expect(msg).toContain('<redacted>');
   });
 
-  it('redacts invalid values when the KEY name matches the heuristic', async () => {
-    defineEnv({ STRIPE_KEY: url() });
-    const bad = await validateAllEnv({ STRIPE_KEY: 'not a url' });
-    expect(bad.valid).toBe(false);
-    // Key-name heuristic alone forces redaction even though the value
-    // itself ("not a url") is not high-entropy.
-    const msg = bad.invalid[0]!.messages.join(' ');
-    expect(msg).not.toContain('not a url');
-    expect(msg).toContain('<redacted>');
-  });
-
   it('runtime proxy throws EnvValidationError with redacted message', () => {
     defineEnv({ STRIPE_KEY: url() });
     withRuntimeEnv({ STRIPE_KEY: 'sk_live_abc_not_a_url' }, () => {
@@ -336,10 +314,7 @@ describe('_validateEnvOnce (boot-time worker check)', () => {
     expect(firstError).toBe(secondError);
   });
 
-  it('is a no-op when no schema is registered', async () => {
-    // resetSchema() registers an empty schema, so re-define with truly empty
-    // input to verify the no-validate path still passes.
-    defineEnv({});
+  it('is a no-op for an empty schema', async () => {
     await expect(_validateEnvOnce(undefined)).resolves.toBeUndefined();
   });
 
@@ -391,19 +366,11 @@ describe('_validateEnvOnce (boot-time worker check)', () => {
   });
 });
 
-// FIX C + FIX D: internal framework bindings (e.g. ISR_CACHE) must never be
-// exposed through void/env WHILE ISR IS ACTIVE — not even when a user's
-// defineEnv schema declares one and boot validation resolved and seeded its RAW
-// value into the sync cache. When ISR is inactive, a schema-declared ISR_CACHE
-// is an ordinary user binding and IS exposed.
 describe('_validateEnvOnce — internal bindings stay hidden from void/env', () => {
   beforeEach(() => {
     resetSchema();
   });
 
-  // A passthrough validator so the RAW binding value (a KV-like object) passes
-  // boot validation and would otherwise be seeded into the sync cache — this is
-  // exactly the leak path FIX C closes (while ISR is active).
   const passthrough = {
     '~standard': {
       version: 1 as const,
@@ -412,7 +379,7 @@ describe('_validateEnvOnce — internal bindings stay hidden from void/env', ()
     },
   };
 
-  it('never exposes a schema-declared ISR_CACHE while ISR is active, even after boot validation seeds its raw value', async () => {
+  it('hides a schema-declared ISR_CACHE while ISR is active, even after boot validation', async () => {
     defineEnv({ ISR_CACHE: passthrough, API_KEY: string() });
 
     const fakeIsrKv = { __brand: 'isr-kv' };
@@ -420,27 +387,16 @@ describe('_validateEnvOnce — internal bindings stay hidden from void/env', ()
     const rawEnv = { ISR_CACHE: fakeIsrKv, API_KEY: 'sk_live', __VOID_ISR_DEPLOYMENT_ID: 'dep_1' };
 
     await withRuntimeEnv(rawEnv, async () => {
-      // Boot validation runs FIRST — as it does at worker boot, before any
-      // request reads env.X. It succeeds (raw ISR_CACHE passes the passthrough
-      // validator) and, without FIX C, seeds the raw KV binding into the sync
-      // cache. Reading env.ISR_CACHE only AFTER this is what exposes the leak: a
-      // pre-validation read would mask it by caching `undefined` (the filtered
-      // value) so the `if (!cache.has(key))` seed guard would skip re-seeding.
+      // Boot validation runs before the first env read, as at worker boot.
       await _validateEnvOnce(rawEnv);
 
-      // Hidden after boot validation — the seeded raw KV binding must not
-      // leak through env.ISR_CACHE / `in` / enumeration.
       expect((env as Record<string, unknown>).ISR_CACHE).toBeUndefined();
       expect('ISR_CACHE' in env).toBe(false);
       expect(Object.keys(env)).not.toContain('ISR_CACHE');
-
-      // Lower-level binding accessors keep hiding it too.
       expect(getRuntimeBinding('ISR_CACHE')).toBeUndefined();
       expect(() => requireRuntimeBinding('ISR_CACHE')).toThrow(
         "env: Missing Cloudflare binding 'ISR_CACHE'.",
       );
-
-      // A normal declared key remains readable (the fix does not over-filter).
       expect(env.API_KEY).toBe('sk_live');
     });
   });
@@ -449,13 +405,11 @@ describe('_validateEnvOnce — internal bindings stay hidden from void/env', ()
     defineEnv({ ISR_CACHE: passthrough, API_KEY: string() });
 
     const fakeIsrKv = { __brand: 'user-kv' };
-    // No `__VOID_ISR_DEPLOYMENT_ID` ⇒ ISR inactive ⇒ ISR_CACHE is a user binding.
     const rawEnv = { ISR_CACHE: fakeIsrKv, API_KEY: 'sk_live' };
 
     await withRuntimeEnv(rawEnv, async () => {
       await _validateEnvOnce(rawEnv);
 
-      // ISR_CACHE is a normal declared binding here — visible everywhere.
       expect((env as Record<string, unknown>).ISR_CACHE).toEqual(fakeIsrKv);
       expect('ISR_CACHE' in env).toBe(true);
       expect(Object.keys(env)).toContain('ISR_CACHE');
diff --git a/packages/void/test/unit/env-types-codegen.test.ts b/packages/void/test/unit/env-types-codegen.test.ts
index eeb913819..a7fabf9c5 100644
--- a/packages/void/test/unit/env-types-codegen.test.ts
+++ b/packages/void/test/unit/env-types-codegen.test.ts
@@ -96,23 +96,6 @@ describe('generateEnvTypes', () => {
       expect(dts).toContain('typeof import("../env.ts")');
       // Resolves both `export default defineEnv(...)` and
       // `export const env = defineEnv(...)` source forms.
-      expect(dts).toContain('_VoidEnvSchema extends { default: infer D } ? D');
-      expect(dts).toContain('_VoidEnvSchema extends { env: infer E } ? E');
-    } finally {
-      cleanup();
-    }
-  });
-
-  it('generates shape resolution that covers `export const env` source form', () => {
-    const { root, outDir, cleanup } = withTempProject((r) => {
-      writeFileSync(
-        join(r, 'env.ts'),
-        'import { defineEnv, string } from "void/env";\nexport const env = defineEnv({ FOO: string() });',
-      );
-    });
-    try {
-      const { dts } = generateEnvTypes(join(root, 'env.ts'), outDir);
-      // Conditional falls back from `default` to `env` to `{}`.
       expect(dts).toContain(
         'type _VoidEnvShape = _VoidEnvSchema extends { default: infer D } ? D : _VoidEnvSchema extends { env: infer E } ? E : {};',
       );
@@ -120,18 +103,4 @@ describe('generateEnvTypes', () => {
       cleanup();
     }
   });
-
-  it('handles env in a nested location', () => {
-    const { root } = withTempProject((r) => {
-      mkdirSync(join(r, 'src'), { recursive: true });
-      writeFileSync(join(r, 'src', 'env.ts'), '');
-    });
-    try {
-      const outDir = join(root, '.void');
-      const { dts } = generateEnvTypes(join(root, 'src', 'env.ts'), outDir);
-      expect(dts).toContain('typeof import("../src/env.ts")');
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
 });
diff --git a/packages/void/test/unit/env-validation-selfhost.test.ts b/packages/void/test/unit/env-validation-selfhost.test.ts
index 1cb3dace8..18421a195 100644
--- a/packages/void/test/unit/env-validation-selfhost.test.ts
+++ b/packages/void/test/unit/env-validation-selfhost.test.ts
@@ -23,20 +23,6 @@ import { defineEnv } from '../../src/runtime/env-public.ts';
 import { _resetUnmaskCacheForTests } from '../../src/shared/env-mask.ts';
 import type { StandardSchemaV1 } from '../../src/standard-schema.ts';
 
-/**
- * Unit coverage for the redesigned self-host (`void deploy --platform cloudflare`)
- * secret gate. The gate now reads GROUND TRUTH — the REAL worker `vars` the build
- * emitted into `dist/ssr/wrangler.json` — plus the env-insensitive schema facts,
- * instead of a pre-build `loadEnv` facsimile. No real wrangler and no network
- * anywhere: the gate tests inject a stub `RunSecretList` seam; the default-runner
- * tests launch tiny Node scripts through the launcher seam (same convention as
- * provision.test.ts).
- *
- * Schema registration for `deriveSelfHostSchemaFacts` is done directly via
- * `defineEnv` (a process-wide singleton) with an empty `env.ts` on disk, exactly
- * like test/integration/env-prod-validation.test.ts.
- */
-
 const roots: Array<string> = [];
 
 function createTempProject(opts?: { withEnvTs?: boolean }): string {
@@ -50,9 +36,7 @@ function createTempProject(opts?: { withEnvTs?: boolean }): string {
 }
 
 beforeEach(() => {
-  // Clear any schema that leaked from a prior test. `defineEnv({})` resets
-  // the registry (the presence flag stays on, which is fine — an empty
-  // schema always validates clean).
+  // The schema registry is process-wide; reset it between tests.
   defineEnv({});
 });
 
@@ -62,7 +46,6 @@ afterEach(() => {
   }
 });
 
-// A stub that records the typed provider operation and returns a fixed result.
 function stubRunner(result: SecretListRunResult): {
   run: (operation: CloudflareOperation) => SecretListRunResult;
   calls: Array<CloudflareOperation>;
@@ -77,7 +60,6 @@ function stubRunner(result: SecretListRunResult): {
   };
 }
 
-// Structured provider data for a given secret name set.
 function okList(names: Array<string>): SecretListRunResult {
   return {
     stdout: '',
@@ -89,51 +71,23 @@ function okList(names: Array<string>): SecretListRunResult {
 
 const CONFIG_PATH = '/tmp/proj/wrangler.jsonc';
 
-// A schema requiring exactly one non-secret key, reused across the gate tests.
 const requiredStripe: SelfHostSchemaFacts = {
   hasSchema: true,
   serverKeys: ['STRIPE_KEY'],
   requiredKeys: ['STRIPE_KEY'],
 };
 
-// ---------------------------------------------------------------------------
-// PURE unit — deriveSelfHostEnvContextFromVars (emitted vars + schema facts)
-// ---------------------------------------------------------------------------
-
 describe('deriveSelfHostEnvContextFromVars — ground-truth context from the emitted worker vars', () => {
-  it('a required key PRESENT-and-EMPTY in the emitted vars is present-empty (shadows a remote secret)', () => {
-    const ctx = deriveSelfHostEnvContextFromVars({ STRIPE_KEY: '' }, requiredStripe);
-
-    expect(ctx.hasSchema).toBe(true);
-    expect(ctx.presentEmptyRequired).toEqual(['STRIPE_KEY']);
-    expect(ctx.presentEmptySources).toEqual({ STRIPE_KEY: { kind: 'emitted' } });
-    expect(ctx.absentRequired).toEqual([]);
-    expect(ctx.invalidKeys).toEqual([]);
-  });
-
   it('a required key ABSENT from the emitted vars is absent (only a remote secret can discharge it)', () => {
     const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
 
     expect(ctx.absentRequired).toEqual(['STRIPE_KEY']);
-    expect(ctx.presentEmptyRequired).toEqual([]);
-    expect(ctx.presentEmptySources).toEqual({});
     expect(ctx.invalidKeys).toEqual([]);
   });
 
-  it('a required key PRESENT-and-NON-EMPTY is neither empty nor absent', () => {
+  it('a required key PRESENT in the emitted vars is not absent', () => {
     const ctx = deriveSelfHostEnvContextFromVars({ STRIPE_KEY: 'sk_live' }, requiredStripe);
 
-    expect(ctx.presentEmptyRequired).toEqual([]);
-    expect(ctx.absentRequired).toEqual([]);
-  });
-
-  it('a required key PRESENT-and-NULL is present-empty too (null shadows like an empty string)', () => {
-    // A parsed wrangler.json var can be null; the validators bucket null as "missing", so
-    // without this it would be neither invalid, empty, nor absent — yet still shadow the secret.
-    const ctx = deriveSelfHostEnvContextFromVars({ STRIPE_KEY: null }, requiredStripe);
-
-    expect(ctx.presentEmptyRequired).toEqual(['STRIPE_KEY']);
-    expect(ctx.presentEmptySources).toEqual({ STRIPE_KEY: { kind: 'emitted' } });
     expect(ctx.absentRequired).toEqual([]);
   });
 
@@ -143,20 +97,10 @@ describe('deriveSelfHostEnvContextFromVars — ground-truth context from the emi
       { hasSchema: false, serverKeys: [], requiredKeys: [] },
     );
 
-    expect(ctx).toEqual({
-      hasSchema: false,
-      presentEmptyRequired: [],
-      presentEmptySources: {},
-      absentRequired: [],
-      invalidKeys: [],
-    });
+    expect(ctx).toEqual({ hasSchema: false, absentRequired: [], invalidKeys: [] });
   });
 });
 
-// ---------------------------------------------------------------------------
-// deriveSelfHostSchemaFacts — env-insensitive schema facts (imports env.ts)
-// ---------------------------------------------------------------------------
-
 describe('deriveSelfHostSchemaFacts — env-insensitive schema facts', () => {
   it('derives server and required key names while excluding client keys', async () => {
     const root = createTempProject();
@@ -184,7 +128,6 @@ describe('deriveSelfHostSchemaFacts — env-insensitive schema facts', () => {
     expect(facts).toEqual({ hasSchema: false, serverKeys: [], requiredKeys: [] });
   });
 
-  // --- schema load / validator throws never leak a value, even under VOID_ENV_UNMASK ---
   const SENTINEL = 'SENTINEL-schema-sk_live_leak-QQZ';
 
   /** Everything an observer could read off the thrown schema error. */
@@ -234,9 +177,7 @@ describe('deriveSelfHostSchemaFacts — env-insensitive schema facts', () => {
 
   it('an env.ts that THROWS at evaluation becomes a values-free SelfHostSchemaError', async () => {
     const root = createTempProject({ withEnvTs: false });
-    // A module that throws at evaluation, embedding the sentinel. Node's import()
-    // rejects; loadUserEnvFile would fold that message into its wrapper — the
-    // boundary must drop it.
+    // loadUserEnvFile folds the thrown message into its own error; the boundary must drop it.
     writeFileSync(join(root, 'env.ts'), `throw new Error('env boom ${SENTINEL}');\n`);
 
     vi.stubEnv('VOID_ENV_UNMASK', '1');
@@ -258,16 +199,10 @@ describe('deriveSelfHostSchemaFacts — env-insensitive schema facts', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// computeInvalidEmittedKeys — VALUE-validate the REAL emitted worker vars against
-// the schema validators, returning the FAILING key NAMES only (values-free).
-// ---------------------------------------------------------------------------
-
 describe('computeInvalidEmittedKeys — schema-invalid emitted values', () => {
   it('flags a required var whose emitted value fails the validator (present, non-empty, malformed)', async () => {
     const root = createTempProject();
     defineEnv({ PORT: number(), API_URL: string() });
-    // PORT ships a non-numeric value; API_URL is fine.
     const invalid = await computeInvalidEmittedKeys(root, {
       PORT: 'not-a-number',
       API_URL: 'https://example.com',
@@ -284,28 +219,18 @@ describe('computeInvalidEmittedKeys — schema-invalid emitted values', () => {
   it('does NOT count a genuinely-ABSENT required value as invalid (a remote secret can still discharge it)', async () => {
     const root = createTempProject();
     defineEnv({ PORT: number(), TOKEN: string() });
-    // Neither key is present in the emitted map — both required keys are ABSENT, the only
-    // state a same-named remote `wrangler secret list` secret can discharge. So neither is a
-    // hard invalid here (the context's absent fence handles them), even though the runtime
-    // buckets both as "missing".
     expect(await computeInvalidEmittedKeys(root, {})).toEqual([]);
   });
 
   it('counts a required value SHIPPED empty (present in the emitted map but rejected)', async () => {
     const root = createTempProject();
     defineEnv({ TOKEN: string() });
-    // TOKEN was baked into the worker vars as "" — shipped-but-rejected. The runtime buckets
-    // it as "missing", but because it is PRESENT in the emitted map it fails closed here too
-    // (the context's present-empty fence also covers it; the two agree, discharge fences first).
     expect(await computeInvalidEmittedKeys(root, { TOKEN: '' })).toEqual(['TOKEN']);
   });
 
   it('flags an OPTIONAL validator key SHIPPED as "" or null (rejected but bucketed "missing")', async () => {
     const root = createTempProject();
-    // A validator that rejects `""`/`null` but accepts `undefined` — exactly `z.url().optional()`.
-    // The runtime buckets a rejected empty/null as "missing" (not "invalid"), and the
-    // required-empty fence covers only `requiredKeys`, so an OPTIONAL key shipped empty would
-    // slip EVERY gate unless the present-in-emitted union catches it here.
+    // Like `z.url().optional()`: accepts undefined, rejects "" and null.
     const optionalRejectingEmpty: StandardSchemaV1<unknown, unknown> = {
       '~standard': {
         version: 1,
@@ -322,30 +247,16 @@ describe('computeInvalidEmittedKeys — schema-invalid emitted values', () => {
       },
     };
     defineEnv({ OPT_URL: optionalRejectingEmpty });
-    // Both empty spellings ship a present-but-rejected value → flagged.
     expect(await computeInvalidEmittedKeys(root, { OPT_URL: '' })).toEqual(['OPT_URL']);
     expect(await computeInvalidEmittedKeys(root, { OPT_URL: null })).toEqual(['OPT_URL']);
-    // A valid optional value validates clean; an absent optional key (accepted undefined) is
-    // never flagged.
     expect(await computeInvalidEmittedKeys(root, { OPT_URL: 'https://ok.dev' })).toEqual([]);
     expect(await computeInvalidEmittedKeys(root, {})).toEqual([]);
   });
-
-  it('returns [] when the project registered no schema', async () => {
-    const root = createTempProject();
-    // beforeEach reset the registry to an empty schema — nothing to validate.
-    expect(await computeInvalidEmittedKeys(root, { ANYTHING: 'x' })).toEqual([]);
-  });
 });
 
-// ---------------------------------------------------------------------------
-// readEmittedWorkerVars — follow the CF deploy pointer to the emitted vars.
-// ---------------------------------------------------------------------------
-
 describe('readEmittedWorkerVars — ground-truth worker vars via the deploy pointer', () => {
   it('reads the vars the build baked into the generated wrangler config', () => {
     const root = createTempProject();
-    // The pointer lives at `.wrangler/deploy/config.json` and redirects to the generated config.
     mkdirSync(join(root, '.wrangler', 'deploy'), { recursive: true });
     writeFileSync(
       join(root, '.wrangler', 'deploy', 'config.json'),
@@ -410,12 +321,7 @@ describe('readEmittedWorkerVars — ground-truth worker vars via the deploy poin
   });
 });
 
-// ---------------------------------------------------------------------------
-// GATE — dischargeSelfHostEnvContext (pure parent work + one wrangler secret list)
-// ---------------------------------------------------------------------------
-
 describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
-  // Minimal wrangler.jsonc fixture (account_id + name) — the pinned `-c` target.
   function writeConfig(root: string, config: Record<string, unknown>): string {
     const path = join(root, 'wrangler.jsonc');
     writeFileSync(path, JSON.stringify(config));
@@ -425,9 +331,8 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
   it('a required key ABSENT from the emitted vars AND from the remote list fails CLOSED naming it', async () => {
     const root = createTempProject({ withEnvTs: false });
     const configPath = writeConfig(root, { name: 'app', account_id: 'acct-1' });
-    // STRIPE_KEY is absent from the emitted vars — only a remote secret could discharge it.
     const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
-    const { run } = stubRunner(okList([])); // no remote secret
+    const { run } = stubRunner(okList([]));
 
     const error = await dischargeSelfHostEnvContext(ctx, {
       root,
@@ -441,7 +346,6 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
 
     expect(error).toBeInstanceOf(SelfHostEnvValidationError);
     const envError = error as SelfHostEnvValidationError;
-    expect(envError.report.missing).toEqual(['STRIPE_KEY']);
     expect(envError.message).toContain('STRIPE_KEY');
     expect(envError.message).toContain('void secret put');
   });
@@ -452,51 +356,20 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
     const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
     const { run, calls } = stubRunner(okList(['STRIPE_KEY']));
 
-    const result = await dischargeSelfHostEnvContext(ctx, {
-      root,
-      configPath,
-      accountId: 'acct-1',
-      runWrangler: run,
-    });
-
-    expect(result).toEqual({ hasSchema: true, remoteSecretNames: ['STRIPE_KEY'] });
-    // The provider operation is pinned to the project's config.
+    await expect(
+      dischargeSelfHostEnvContext(ctx, {
+        root,
+        configPath,
+        accountId: 'acct-1',
+        runWrangler: run,
+      }),
+    ).resolves.toBeUndefined();
     expect(calls).toEqual([{ type: 'secret.list', configPath }]);
   });
 
-  it('a required key PRESENT-and-EMPTY in the emitted vars fails CLOSED before any wrangler spawn', async () => {
-    const root = createTempProject({ withEnvTs: false });
-    // The build baked `STRIPE_KEY=""` into the emitted worker vars, which wrangler
-    // gives precedence over a same-named remote secret — so it fails closed ALWAYS.
-    const ctx = deriveSelfHostEnvContextFromVars({ STRIPE_KEY: '' }, requiredStripe);
-    const { run, calls } = stubRunner(okList(['STRIPE_KEY']));
-
-    const error = await dischargeSelfHostEnvContext(ctx, {
-      root,
-      configPath: CONFIG_PATH,
-      runWrangler: run,
-    }).then(
-      () => null,
-      (e: unknown) => e,
-    );
-
-    expect(error).toBeInstanceOf(SelfHostEnvValidationError);
-    const envError = error as SelfHostEnvValidationError;
-    expect(envError.report.missing).toEqual(['STRIPE_KEY']);
-    expect(envError.message).toContain('Remove the empty assignment');
-    // Names the GROUND-TRUTH source (the emitted worker config), never a .env file.
-    expect(envError.message).toContain('dist/ssr/wrangler.json');
-    expect(envError.message).not.toContain('wrangler secret put');
-    // Rejected before any wrangler spawn — remote membership is irrelevant.
-    expect(calls).toEqual([]);
-  });
-
   it('a folded INVALID key (an optional value the validator rejected) fails CLOSED with no wrangler spawn', async () => {
     const root = createTempProject({ withEnvTs: false });
-    // No required key is absent, so the only failure is the invalid-value set the emitted-var
-    // probe folds in — here an optional key shipped empty that the runtime bucketed "missing"
-    // but `computeInvalidEmittedKeys` caught (present in the emitted map). It must fail closed
-    // BEFORE any remote apply: a remote secret cannot rescue an invalid SHIPPED value.
+    // A remote secret cannot fix a shipped invalid value, even with the same name.
     const ctx = deriveSelfHostEnvContextFromVars(
       {},
       { hasSchema: true, serverKeys: [], requiredKeys: [] },
@@ -515,8 +388,7 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
 
     expect(error).toBeInstanceOf(SelfHostEnvValidationError);
     const envError = error as SelfHostEnvValidationError;
-    expect(envError.report.invalid.map((entry) => entry.key)).toEqual(['OPT_URL']);
-    // No required key is absent → no wrangler spawn; the invalid value fails closed on its own.
+    expect(envError.message).toContain('OPT_URL');
     expect(calls).toEqual([]);
   });
 
@@ -528,23 +400,21 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
     );
     const { run, calls } = stubRunner(okList([]));
 
-    const result = await dischargeSelfHostEnvContext(ctx, {
-      root,
-      configPath: CONFIG_PATH,
-      runWrangler: run,
-    });
-
-    expect(result).toEqual({ hasSchema: false, remoteSecretNames: null });
+    await expect(
+      dischargeSelfHostEnvContext(ctx, {
+        root,
+        configPath: CONFIG_PATH,
+        runWrangler: run,
+      }),
+    ).resolves.toBeUndefined();
     expect(calls).toEqual([]);
   });
 
-  // --- account reconciled against the config BEFORE any spawn ---
-
   describe('account reconciliation before spawn', () => {
     it('hard-errors (naming both accounts) and NEVER spawns wrangler on a config-vs-option mismatch', async () => {
       const root = createTempProject({ withEnvTs: false });
       const configPath = writeConfig(root, { name: 'app', account_id: 'account-X' });
-      // Absent required key → the gate would spawn wrangler, but reconciliation fails first.
+      // An absent required key would list secrets; the mismatch must stop it first.
       const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
       const { run, calls } = stubRunner(okList(['STRIPE_KEY']));
 
@@ -563,37 +433,14 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
       const msg = (error as Error).message;
       expect(msg).toContain('account-X');
       expect(msg).toContain('account-Y');
-      // The seam was never consulted — reconciliation failed before any spawn.
       expect(calls).toEqual([]);
     });
-
-    it('proceeds when the config account matches the option account', async () => {
-      const root = createTempProject({ withEnvTs: false });
-      const configPath = writeConfig(root, { name: 'app', account_id: 'account-X' });
-      const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
-      const { run, calls } = stubRunner(okList(['STRIPE_KEY']));
-
-      const result = await dischargeSelfHostEnvContext(ctx, {
-        root,
-        configPath,
-        accountId: 'account-X',
-        runWrangler: run,
-      });
-
-      expect(result).toEqual({ hasSchema: true, remoteSecretNames: ['STRIPE_KEY'] });
-      expect(calls.length).toBe(1);
-    });
   });
 
-  // --- worker NAME reconciled against the config BEFORE any spawn ---
-
   describe('worker-name reconciliation before spawn', () => {
     it('hard-errors (naming both worker names) and NEVER spawns wrangler on a config-vs-pinned name mismatch', async () => {
       const root = createTempProject({ withEnvTs: false });
-      // The config's name was rewritten to "evil-worker" after the deploy pinned "app" — the gate
-      // would list secrets for the WRONG worker, so it fails closed before any spawn.
       const configPath = writeConfig(root, { name: 'evil-worker', account_id: 'acct-1' });
-      // Absent required key → the gate would spawn wrangler, but name reconciliation fails first.
       const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
       const { run, calls } = stubRunner(okList(['STRIPE_KEY']));
 
@@ -613,8 +460,6 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
       const msg = (error as Error).message;
       expect(msg).toContain('evil-worker');
       expect(msg).toContain('app');
-      expect((error as SelfHostSecretListError).reason).toBe('name-mismatch');
-      // The seam was never consulted — reconciliation failed before any spawn.
       expect(calls).toEqual([]);
     });
 
@@ -624,83 +469,25 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
       const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
       const { run, calls } = stubRunner(okList(['STRIPE_KEY']));
 
-      const result = await dischargeSelfHostEnvContext(ctx, {
-        root,
-        configPath,
-        accountId: 'acct-1',
-        workerName: 'app',
-        runWrangler: run,
-      });
-
-      expect(result).toEqual({ hasSchema: true, remoteSecretNames: ['STRIPE_KEY'] });
-      expect(calls.length).toBe(1);
-    });
-
-    it('does not gate when no pinned worker name is passed (undefined never trips)', async () => {
-      const root = createTempProject({ withEnvTs: false });
-      // Config declares a name, but no pinned name is supplied — mirrors the account guard's
-      // "both set" rule, so a legitimate caller that omits the pin is never false-positived.
-      const configPath = writeConfig(root, { name: 'whatever', account_id: 'acct-1' });
-      const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
-      const { run, calls } = stubRunner(okList(['STRIPE_KEY']));
-
-      const result = await dischargeSelfHostEnvContext(ctx, {
-        root,
-        configPath,
-        accountId: 'acct-1',
-        runWrangler: run,
-      });
-
-      expect(result).toEqual({ hasSchema: true, remoteSecretNames: ['STRIPE_KEY'] });
+      await expect(
+        dischargeSelfHostEnvContext(ctx, {
+          root,
+          configPath,
+          accountId: 'acct-1',
+          workerName: 'app',
+          runWrangler: run,
+        }),
+      ).resolves.toBeUndefined();
       expect(calls.length).toBe(1);
     });
   });
 
-  // --- first-deploy (worker-not-found) surfaces a structured, actionable error ---
-
   describe('first-deploy worker-not-found', () => {
-    // Historical diagnostic prose is intentionally insufficient for classification.
     const WORKER_NOT_FOUND_STDERR =
       'Worker "app" not found.\n\n' +
       'If this is a new Worker, run `wrangler deploy` first to create it.\n' +
       "Otherwise, check that the Worker name is correct and you're logged into the right account.";
 
-    it('throws a structured first-deploy error listing the missing names + secret-put guidance', async () => {
-      const root = createTempProject({ withEnvTs: false });
-      const ctx = deriveSelfHostEnvContextFromVars(
-        {},
-        {
-          hasSchema: true,
-          serverKeys: ['FOO', 'API_TOKEN'],
-          requiredKeys: ['FOO', 'API_TOKEN'],
-        },
-      );
-      const { run } = stubRunner({
-        stdout: '',
-        stderr: WORKER_NOT_FOUND_STDERR,
-        status: 1,
-        errorCode: 10007,
-      });
-
-      const error = await dischargeSelfHostEnvContext(ctx, {
-        root,
-        configPath: CONFIG_PATH,
-        runWrangler: run,
-      }).then(
-        () => null,
-        (e: unknown) => e,
-      );
-
-      expect(error).toBeInstanceOf(SelfHostFirstDeployError);
-      const fde = error as SelfHostFirstDeployError;
-      expect(fde.workerNotFound).toBe(true);
-      expect([...fde.missingKeys].sort()).toEqual(['API_TOKEN', 'FOO']);
-      expect(fde.message).toContain('void secret put FOO');
-      expect(fde.message).toContain('void secret put API_TOKEN');
-      // Still a fail-closed list error at heart (subclass).
-      expect(error).toBeInstanceOf(SelfHostSecretListError);
-    });
-
     it('diagnostic prose cannot authorize a first deploy', async () => {
       const root = createTempProject({ withEnvTs: false });
       const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
@@ -712,7 +499,7 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
       }).catch((error) => error);
       expect(error).toBeInstanceOf(SelfHostSecretListError);
       expect(error).not.toBeInstanceOf(SelfHostFirstDeployError);
-      expect(error.reason).toBe('nonzero-exit');
+      expect(error.message).toContain('reason: nonzero-exit');
     });
 
     it.each([{ errorCode: 10007 }, { errorCode: 10090 }, { failure: 'not-found' as const }])(
@@ -727,7 +514,7 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
           runWrangler: run,
         }).catch((error) => error);
         expect(error).toBeInstanceOf(SelfHostFirstDeployError);
-        expect(error.missingKeys).toEqual(['STRIPE_KEY']);
+        expect(error.message).toContain('void secret put STRIPE_KEY');
       },
     );
 
@@ -736,7 +523,6 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
       async (status) => {
         const root = createTempProject({ withEnvTs: false });
         const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
-        // Deliberately malformed injected results must not imply resource absence.
         const { run } = stubRunner({
           stdout: '',
           stderr: '',
@@ -752,34 +538,8 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
         expect(error).not.toBeInstanceOf(SelfHostFirstDeployError);
       },
     );
-
-    it('a generic nonzero exit (auth/network) stays a GENERIC list failure, not first-deploy', async () => {
-      const root = createTempProject({ withEnvTs: false });
-      const ctx = deriveSelfHostEnvContextFromVars({}, requiredStripe);
-      const { run } = stubRunner({
-        stdout: '',
-        stderr: 'A request to the Cloudflare API failed. [code: 10000]',
-        status: 1,
-      });
-
-      const error = await dischargeSelfHostEnvContext(ctx, {
-        root,
-        configPath: CONFIG_PATH,
-        runWrangler: run,
-      }).then(
-        () => null,
-        (e: unknown) => e,
-      );
-
-      expect(error).toBeInstanceOf(SelfHostSecretListError);
-      expect(error).not.toBeInstanceOf(SelfHostFirstDeployError);
-      expect((error as SelfHostSecretListError).reason).toBe('nonzero-exit');
-      expect((error as Error).message).toContain('status 1');
-    });
   });
 
-  // --- hard wrangler failures are DISTINCT from missing-secret errors, fail closed ---
-
   describe('fail-closed wrangler failures', () => {
     async function expectSecretListError(
       result: SecretListRunResult,
@@ -806,9 +566,7 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
         stderr: 'A request to the Cloudflare API failed.',
         status: 1,
       });
-      expect(error.reason).toBe('nonzero-exit');
-      expect(error.detail.exitCode).toBe(1);
-      expect(error.message).toContain('status 1');
+      expect(error.message).toContain('reason: nonzero-exit, status 1');
       expect(error.message).not.toContain('A request to the Cloudflare API failed.');
     });
 
@@ -821,8 +579,7 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
         errorCode: 10007,
         failure: 'not-found',
       });
-      expect(error.reason).toBe('signal');
-      expect(error.detail.signal).toBe('SIGKILL');
+      expect(error.message).toContain('reason: signal');
       expect(error.message).toContain('SIGKILL');
     });
 
@@ -835,19 +592,10 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
         errorCode: 10007,
         failure: 'not-found',
       });
-      expect(error.reason).toBe('spawn-error');
+      expect(error.message).toContain('reason: spawn-error');
       expect(error.message).not.toContain('spawn ENOENT');
     });
 
-    it('missing structured data is a hard failure', async () => {
-      const error = await expectSecretListError({
-        stdout: 'not json at all',
-        stderr: '',
-        status: 0,
-      });
-      expect(error.reason).toBe('malformed-output');
-    });
-
     it('a non-array JSON payload is a hard failure', async () => {
       await expectSecretListError({ stdout: '', data: { secrets: [] }, stderr: '', status: 0 });
     });
@@ -882,32 +630,21 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
         (e: unknown) => e,
       );
       expect(error).toBeInstanceOf(SelfHostSecretListError);
-      expect((error as SelfHostSecretListError).reason).toBe('spawn-error');
+      expect((error as Error).message).toContain('reason: spawn-error');
       expect((error as Error).message).not.toContain('boom');
     });
   });
 
-  // --- wrangler failure diagnostics never carry a value, even under VOID_ENV_UNMASK ---
-
   describe('wrangler diagnostics are values-free even under VOID_ENV_UNMASK', () => {
-    // A sentinel "secret" a hostile/leaky wrangler could echo into stderr/stdout or
-    // a spawn/rejection message. It must appear NOWHERE in the thrown error.
     const SENTINEL = 'SENTINEL-sk_live_51H8xLeak-abcXYZ';
 
     /** Everything an observer could read off the thrown error. */
     function fullySerialize(error: unknown): string {
-      const e = error as SelfHostSecretListError & {
-        missingKeys?: Array<string>;
-        workerNotFound?: boolean;
-      };
+      const e = error as SelfHostSecretListError;
       return JSON.stringify({
         name: e.name,
         message: e.message,
         stack: e.stack ?? '',
-        reason: e.reason,
-        detail: e.detail,
-        missingKeys: e.missingKeys,
-        workerNotFound: e.workerNotFound,
         own: e,
         ownStr: String(e),
       });
@@ -963,7 +700,7 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
           )) as SelfHostSecretListError;
 
           expect(error).toBeInstanceOf(SelfHostSecretListError);
-          expect(error.reason).toBe(reason);
+          expect(error.message).toContain(`reason: ${reason}`);
           expect(error.message).not.toContain(SENTINEL);
           expect(fullySerialize(error)).not.toContain(SENTINEL);
         } finally {
@@ -983,7 +720,6 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
           requiredKeys: ['FOO', 'API_TOKEN'],
         },
       );
-      // The provider code classifies absence; arbitrary stderr must never leak.
       const { run } = stubRunner({
         stdout: '',
         stderr:
@@ -1004,19 +740,15 @@ describe('dischargeSelfHostEnvContext — ground-truth secret gate', () => {
       )) as SelfHostFirstDeployError;
 
       expect(error).toBeInstanceOf(SelfHostFirstDeployError);
-      expect(error.workerNotFound).toBe(true);
-      expect([...error.missingKeys].sort()).toEqual(['API_TOKEN', 'FOO']);
+      expect(error).toBeInstanceOf(SelfHostSecretListError);
       expect(error.message).toContain('void secret put FOO');
+      expect(error.message).toContain('void secret put API_TOKEN');
       expect(error.message).not.toContain(SENTINEL);
       expect(fullySerialize(error)).not.toContain(SENTINEL);
     });
   });
 });
 
-// ---------------------------------------------------------------------------
-// Default runner — createDefaultSecretListRunner (launcher seam, no wrangler)
-// ---------------------------------------------------------------------------
-
 describe('createDefaultSecretListRunner — async spawn with fail-closed provenance', () => {
   function writeScript(root: string, name: string, source: string): string {
     const file = join(root, name);
@@ -1091,21 +823,6 @@ describe('createDefaultSecretListRunner — async spawn with fail-closed provena
   });
 
   describe('secretListEnv — child env pinning', () => {
-    it('scrubs the CF Access pair, pins sanitized logging, and pins the account id', () => {
-      vi.stubEnv('CF_ACCESS_CLIENT_ID', 'id');
-      vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'secret');
-      vi.stubEnv('WRANGLER_LOG_SANITIZE', 'false');
-      try {
-        const env = secretListEnv('acct-1');
-        expect(env.CF_ACCESS_CLIENT_ID).toBeUndefined();
-        expect(env.CF_ACCESS_CLIENT_SECRET).toBeUndefined();
-        expect(env.WRANGLER_LOG_SANITIZE).toBe('true');
-        expect(env.CLOUDFLARE_ACCOUNT_ID).toBe('acct-1');
-      } finally {
-        vi.unstubAllEnvs();
-      }
-    });
-
     it('leaves ambient transport env (CLOUDFLARE_API_BASE_URL) untouched', () => {
       vi.stubEnv('CLOUDFLARE_API_BASE_URL', 'https://api.staging.example/client/v4');
       try {
@@ -1158,6 +875,7 @@ describe('createDefaultSecretListRunner — async spawn with fail-closed provena
     );
     vi.stubEnv('CF_ACCESS_CLIENT_ID', 'service-token-id');
     vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'service-token-secret');
+    vi.stubEnv('WRANGLER_LOG_SANITIZE', 'false');
     try {
       const run = createDefaultSecretListRunner(root, {
         accountId: 'acct-123',
diff --git a/packages/void/test/unit/env.test.ts b/packages/void/test/unit/env.test.ts
index 13b9252e9..b0aad440c 100644
--- a/packages/void/test/unit/env.test.ts
+++ b/packages/void/test/unit/env.test.ts
@@ -1,11 +1,5 @@
 import { afterAll, beforeEach, describe, expect, it } from 'vite-plus/test';
-import { env } from '../../src/runtime/env-public.ts';
-import {
-  getRuntimeBinding,
-  getRuntimeEnv,
-  requireRuntimeBinding,
-  withRuntimeEnv,
-} from '../../src/runtime/env.ts';
+import { getRuntimeBinding, getRuntimeEnv, withRuntimeEnv } from '../../src/runtime/env.ts';
 
 const globalScope = globalThis as {
   __env__?: unknown;
@@ -48,89 +42,25 @@ describe('runtime env resolution', () => {
   });
 });
 
-// FIX 3 + FIX D: ISR_CACHE is a framework-internal binding with no internal
-// prefix. It is hidden from every public env surface ONLY while ISR is active
-// for the isolate — signalled by `__VOID_ISR_DEPLOYMENT_ID` on the raw env
-// (stamped by the generated worker entry on ISR-emitting builds). This mirrors
-// the build-time `isr` gate on the generated c.env filter. When ISR is NOT
-// active, `ISR_CACHE` is an ordinary user binding and stays visible. Prefix
-// internals (`__VOID_*`, `__PROJECT_*`) are hidden unconditionally in both.
 describe('internal binding filtering — ISR_CACHE (exact-name)', () => {
-  describe('ISR active (raw env has __VOID_ISR_DEPLOYMENT_ID)', () => {
-    it('hides ISR_CACHE from getRuntimeEnv / getRuntimeBinding / requireRuntimeBinding', () => {
-      withRuntimeEnv(
-        {
-          DB: { tag: 'db' },
-          ISR_CACHE: { tag: 'isr-kv' },
-          __VOID_TOKEN: 'secret',
-          __VOID_ISR_DEPLOYMENT_ID: 'dep_1',
-        },
-        () => {
-          const filtered = getRuntimeEnv() as Record<string, unknown>;
-          // Normal binding still visible.
-          expect(filtered.DB).toEqual({ tag: 'db' });
-          expect('DB' in filtered).toBe(true);
-          // ISR_CACHE hidden by exact name.
-          expect(filtered.ISR_CACHE).toBeUndefined();
-          expect('ISR_CACHE' in filtered).toBe(false);
-          expect(Object.keys(filtered)).not.toContain('ISR_CACHE');
-          // Prefixed internal still hidden (regression guard for the prefix path).
-          expect('__VOID_TOKEN' in filtered).toBe(false);
-          expect('__VOID_ISR_DEPLOYMENT_ID' in filtered).toBe(false);
-
-          expect(getRuntimeBinding('DB')).toEqual({ tag: 'db' });
-          expect(getRuntimeBinding('ISR_CACHE')).toBeUndefined();
-          expect(() => requireRuntimeBinding('ISR_CACHE')).toThrow(
-            "env: Missing Cloudflare binding 'ISR_CACHE'.",
-          );
-        },
-      );
-    });
-
-    it('hides ISR_CACHE from the public `env` proxy (absent + not enumerated), keeps normal bindings', () => {
-      withRuntimeEnv(
-        { DB: { tag: 'db' }, ISR_CACHE: { tag: 'isr-kv' }, __VOID_ISR_DEPLOYMENT_ID: 'dep_1' },
-        () => {
-          expect('ISR_CACHE' in env).toBe(false);
-          expect('DB' in env).toBe(true);
-          expect(Object.keys(env)).not.toContain('ISR_CACHE');
-          expect(Object.keys(env)).toContain('DB');
-          expect((env as Record<string, unknown>).ISR_CACHE).toBeUndefined();
-          expect((env as Record<string, unknown>).DB).toEqual({ tag: 'db' });
-        },
-      );
-    });
+  it('hides ISR_CACHE from getRuntimeEnv while ISR is active', () => {
+    withRuntimeEnv(
+      { DB: { tag: 'db' }, ISR_CACHE: { tag: 'isr-kv' }, __VOID_ISR_DEPLOYMENT_ID: 'dep_1' },
+      () => {
+        const filtered = getRuntimeEnv() as Record<string, unknown>;
+        expect(filtered.ISR_CACHE).toBeUndefined();
+        expect('ISR_CACHE' in filtered).toBe(false);
+        expect(Object.keys(filtered)).not.toContain('ISR_CACHE');
+      },
+    );
   });
 
-  describe('ISR inactive (no __VOID_ISR_DEPLOYMENT_ID)', () => {
-    it('treats ISR_CACHE as a normal user binding across getRuntimeEnv / getRuntimeBinding / requireRuntimeBinding', () => {
-      withRuntimeEnv(
-        { DB: { tag: 'db' }, ISR_CACHE: { tag: 'isr-kv' }, __VOID_TOKEN: 'secret' },
-        () => {
-          const filtered = getRuntimeEnv() as Record<string, unknown>;
-          // ISR_CACHE is visible — the user owns this binding when ISR is off.
-          expect(filtered.ISR_CACHE).toEqual({ tag: 'isr-kv' });
-          expect('ISR_CACHE' in filtered).toBe(true);
-          expect(Object.keys(filtered)).toContain('ISR_CACHE');
-          // Prefixed internal is STILL hidden unconditionally.
-          expect('__VOID_TOKEN' in filtered).toBe(false);
-          expect(Object.keys(filtered)).not.toContain('__VOID_TOKEN');
-
-          expect(getRuntimeBinding('ISR_CACHE')).toEqual({ tag: 'isr-kv' });
-          expect(requireRuntimeBinding('ISR_CACHE')).toEqual({ tag: 'isr-kv' });
-          // Prefixed internal still blocked.
-          expect(getRuntimeBinding('__VOID_TOKEN')).toBeUndefined();
-        },
-      );
-    });
-
-    it('exposes ISR_CACHE through the public `env` proxy (present + enumerated)', () => {
-      withRuntimeEnv({ DB: { tag: 'db' }, ISR_CACHE: { tag: 'isr-kv' } }, () => {
-        expect('ISR_CACHE' in env).toBe(true);
-        expect(Object.keys(env)).toContain('ISR_CACHE');
-        expect((env as Record<string, unknown>).ISR_CACHE).toEqual({ tag: 'isr-kv' });
-        expect((env as Record<string, unknown>).DB).toEqual({ tag: 'db' });
-      });
+  it('keeps ISR_CACHE in getRuntimeEnv as a user binding while ISR is inactive', () => {
+    withRuntimeEnv({ DB: { tag: 'db' }, ISR_CACHE: { tag: 'isr-kv' } }, () => {
+      const filtered = getRuntimeEnv() as Record<string, unknown>;
+      expect(filtered.ISR_CACHE).toEqual({ tag: 'isr-kv' });
+      expect('ISR_CACHE' in filtered).toBe(true);
+      expect(Object.keys(filtered)).toContain('ISR_CACHE');
     });
   });
 });
diff --git a/packages/void/test/unit/fetch-worker.test.ts b/packages/void/test/unit/fetch-worker.test.ts
index 4ff6abeb6..c7a286de9 100644
--- a/packages/void/test/unit/fetch-worker.test.ts
+++ b/packages/void/test/unit/fetch-worker.test.ts
@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { describe, expect, it, vi, beforeEach } from 'vite-plus/test';
-import { compileNodeClient, compileWorkerClient } from '../../src/router/compile.ts';
+import { compileWorkerClient } from '../../src/router/compile.ts';
 import { FetchError as RuntimeFetchError } from '../../src/runtime/fetch-error.ts';
 import { interpolateRouteParams } from '../../src/runtime/route-url.ts';
 
@@ -17,36 +17,6 @@ describe('compileWorkerClient', () => {
     const code = compileWorkerClient('/my/path/auth-client.mjs');
     expect(code).toContain('export { auth, createAuthClient } from "/my/path/auth-client.mjs"');
   });
-
-  it('includes param interpolation logic', () => {
-    const code = compileWorkerClient('/resolved/auth-client.mjs');
-    expect(code).toContain('interpolateRouteParams(path, options?.params)');
-  });
-
-  it('includes query string building', () => {
-    const code = compileWorkerClient('/resolved/auth-client.mjs');
-    expect(code).toContain('URLSearchParams');
-  });
-
-  it('includes cookie and authorization forwarding from ALS', () => {
-    const code = compileWorkerClient('/resolved/auth-client.mjs');
-    expect(code).toContain('requestContext.getStore()');
-    expect(code).toContain('"cookie"');
-    expect(code).toContain('"authorization"');
-  });
-
-  it('includes executionCtx passthrough with no-op fallback', () => {
-    const code = compileWorkerClient('/resolved/auth-client.mjs');
-    expect(code).toContain('store?.executionCtx');
-    expect(code).toContain('waitUntil()');
-    expect(code).toContain('passThroughOnException()');
-  });
-
-  it('handles 204 No Content', () => {
-    const code = compileWorkerClient('/resolved/auth-client.mjs');
-    expect(code).toContain('response.status === 204');
-    expect(code).toContain('return undefined');
-  });
 });
 
 // Evaluate the emitted module with only its import boundary substituted.
@@ -92,32 +62,6 @@ describe('worker fetch runtime behavior', () => {
     expect(new URL(req.url).pathname).toBe('/api/hello');
   });
 
-  it('interpolates path params', async () => {
-    mockAppFetch.mockResolvedValue(
-      new Response(JSON.stringify({ id: '42' }), {
-        headers: { 'content-type': 'application/json' },
-      }),
-    );
-
-    await workerFetch('/api/users/:id', { params: { id: '42' } });
-
-    const req = mockAppFetch.mock.calls[0][0] as Request;
-    expect(new URL(req.url).pathname).toBe('/api/users/42');
-  });
-
-  it('encodes path params', async () => {
-    mockAppFetch.mockResolvedValue(
-      new Response(JSON.stringify({}), {
-        headers: { 'content-type': 'application/json' },
-      }),
-    );
-
-    await workerFetch('/api/files/:name', { params: { name: 'hello world.txt' } });
-
-    const req = mockAppFetch.mock.calls[0][0] as Request;
-    expect(new URL(req.url).pathname).toBe('/api/files/hello%20world.txt');
-  });
-
   it('builds query string', async () => {
     mockAppFetch.mockResolvedValue(
       new Response(JSON.stringify([]), {
@@ -330,12 +274,13 @@ function evaluateClient(
   )({ fetch }, env, requestContext, interpolateRouteParams);
 }
 
-it.each([compileWorkerClient, compileNodeClient])(
-  'expands catch-all routes in generated %s clients',
-  async (compile) => {
+it.each([false, true])(
+  'expands catch-all routes in generated clients (nodeTarget: %s)',
+  async (nodeTarget) => {
     const fetch = vi.fn<(...args: Array<unknown>) => Promise<Response>>(async () =>
       Response.json({ ok: true }),
     );
+    const compile = (authClientPath: string) => compileWorkerClient(authClientPath, nodeTarget);
     const client = evaluateClient(compile, fetch, {}, new AsyncLocalStorage());
     await client.fetch('/files/:id2/:id/:path{.+}', {
       params: { id: 'one', id2: 'two', path: 'docs/start here' },
diff --git a/packages/void/test/unit/fetch.test.ts b/packages/void/test/unit/fetch.test.ts
index 44fc8a7e0..63063053d 100644
--- a/packages/void/test/unit/fetch.test.ts
+++ b/packages/void/test/unit/fetch.test.ts
@@ -13,9 +13,6 @@ declare module 'void/routes' {
     '/api/users/:id': {
       GET: { input: { params: { id: string } }; output: { id: string; name: string } };
     };
-    '/api/files/:name': {
-      GET: { input: { params: { name: string } }; output: Record<string, never> };
-    };
     '/api/files/:path{.+}': {
       GET: { input: { params: { path: string } }; output: unknown };
     };
@@ -56,28 +53,6 @@ describe('typed fetch client', () => {
     expect(result).toEqual({ ok: true });
   });
 
-  it('interpolates path params', async () => {
-    vi.mocked(globalThis.fetch).mockResolvedValue(jsonResponse({ id: '42', name: 'Alice' }));
-
-    await typedFetch('/api/users/:id', { params: { id: '42' } });
-
-    expect(globalThis.fetch).toHaveBeenCalledWith(
-      expect.stringContaining('/api/users/42'),
-      expect.anything(),
-    );
-  });
-
-  it('encodes path params', async () => {
-    vi.mocked(globalThis.fetch).mockResolvedValue(jsonResponse({}));
-
-    await typedFetch('/api/files/:name', { params: { name: 'hello world.txt' } });
-
-    expect(globalThis.fetch).toHaveBeenCalledWith(
-      expect.stringContaining('/api/files/hello%20world.txt'),
-      expect.anything(),
-    );
-  });
-
   it('expands complete catch-all tokens', async () => {
     vi.mocked(globalThis.fetch).mockResolvedValue(jsonResponse({}));
     await typedFetch('/api/files/:path{.+}', { params: { path: 'docs/start here' } });
diff --git a/packages/void/test/unit/framework-preset.test.ts b/packages/void/test/unit/framework-preset.test.ts
index 0e84aa561..80420fff3 100644
--- a/packages/void/test/unit/framework-preset.test.ts
+++ b/packages/void/test/unit/framework-preset.test.ts
@@ -49,13 +49,4 @@ describe('FRAMEWORK_PRESETS', () => {
     expect(preset.workerDir).toBe(workerDir);
     expect(preset.workerMain).toBe('index.js');
   });
-
-  it('all presets have required fields', () => {
-    for (const preset of Object.values(FRAMEWORK_PRESETS)) {
-      expect(preset.buildCommand).toBeTruthy();
-      expect(preset.workerDir).toBeTruthy();
-      expect(preset.workerMain).toBeTruthy();
-      expect(preset.assetsDir).toBeTruthy();
-    }
-  });
 });
diff --git a/packages/void/test/unit/gen-args.test.ts b/packages/void/test/unit/gen-args.test.ts
index 4bf75fd50..8ff8eab07 100644
--- a/packages/void/test/unit/gen-args.test.ts
+++ b/packages/void/test/unit/gen-args.test.ts
@@ -157,38 +157,6 @@ describe('parseGenArgs', () => {
     });
   });
 
-  describe('middleware', () => {
-    it('parses middleware name', () => {
-      expect(parseGenArgs(['middleware', 'auth'])).toEqual({
-        subcommand: 'middleware',
-        name: 'auth',
-      });
-    });
-
-    it('errors on missing name', () => {
-      expect(() => parseGenArgs(['middleware'])).toThrow('gen: Usage: void gen middleware <name>.');
-    });
-
-    it('errors on extra argument', () => {
-      expect(() => parseGenArgs(['middleware', 'auth', 'extra'])).toThrow(
-        "gen: Unexpected argument 'extra'.",
-      );
-    });
-
-    it('rejects an invalid name (e.g. a flag) instead of scaffolding a bogus file', () => {
-      expect(() => parseGenArgs(['middleware', '--foo'])).toThrow(
-        'gen: Middleware name must be lowercase alphanumeric with underscores or hyphens and no leading digits.',
-      );
-    });
-
-    it('allows hyphenated middleware names', () => {
-      expect(parseGenArgs(['middleware', 'rate-limit'])).toEqual({
-        subcommand: 'middleware',
-        name: 'rate-limit',
-      });
-    });
-  });
-
   describe('ssr', () => {
     it('parses ssr with no framework (auto-detect)', () => {
       expect(parseGenArgs(['ssr'])).toEqual({
@@ -197,32 +165,8 @@ describe('parseGenArgs', () => {
       });
     });
 
-    it('parses ssr with --react', () => {
-      expect(parseGenArgs(['ssr', '--react'])).toEqual({
-        subcommand: 'ssr',
-        framework: 'react',
-      });
-    });
-
-    it('parses ssr with --vue', () => {
-      expect(parseGenArgs(['ssr', '--vue'])).toEqual({
-        subcommand: 'ssr',
-        framework: 'vue',
-      });
-    });
-
-    it('parses ssr with --svelte', () => {
-      expect(parseGenArgs(['ssr', '--svelte'])).toEqual({
-        subcommand: 'ssr',
-        framework: 'svelte',
-      });
-    });
-
-    it('parses ssr with --solid', () => {
-      expect(parseGenArgs(['ssr', '--solid'])).toEqual({
-        subcommand: 'ssr',
-        framework: 'solid',
-      });
+    it.each(['react', 'vue', 'svelte', 'solid'])('parses ssr with --%s', (framework) => {
+      expect(parseGenArgs(['ssr', `--${framework}`])).toEqual({ subcommand: 'ssr', framework });
     });
 
     it('errors on multiple framework flags', () => {
@@ -236,67 +180,35 @@ describe('parseGenArgs', () => {
     });
   });
 
-  describe('cron', () => {
-    it('parses cron name', () => {
-      expect(parseGenArgs(['cron', 'hourly-sync'])).toEqual({
-        subcommand: 'cron',
-        name: 'hourly-sync',
-      });
-    });
-
-    it('errors on missing name', () => {
-      expect(() => parseGenArgs(['cron'])).toThrow('gen: Usage: void gen cron <name>.');
+  describe.each([
+    ['middleware', 'Middleware'],
+    ['cron', 'Cron'],
+    ['queue', 'Queue'],
+  ])('%s', (subcommand, label) => {
+    it('parses a name', () => {
+      expect(parseGenArgs([subcommand, 'auth'])).toEqual({ subcommand, name: 'auth' });
     });
 
-    it('errors on extra argument', () => {
-      expect(() => parseGenArgs(['cron', 'sync', 'extra'])).toThrow(
-        "gen: Unexpected argument 'extra'.",
-      );
-    });
-
-    it('errors on invalid name', () => {
-      expect(() => parseGenArgs(['cron', '1bad'])).toThrow(
-        'gen: Cron name must be lowercase alphanumeric with underscores or hyphens and no leading digits.',
-      );
-    });
-
-    it('allows hyphens in name', () => {
-      expect(parseGenArgs(['cron', 'daily-report'])).toEqual({
-        subcommand: 'cron',
-        name: 'daily-report',
-      });
-    });
-  });
-
-  describe('queue', () => {
-    it('parses queue name', () => {
-      expect(parseGenArgs(['queue', 'emails'])).toEqual({
-        subcommand: 'queue',
-        name: 'emails',
-      });
+    it('allows hyphenated names', () => {
+      expect(parseGenArgs([subcommand, 'rate-limit'])).toEqual({ subcommand, name: 'rate-limit' });
     });
 
     it('errors on missing name', () => {
-      expect(() => parseGenArgs(['queue'])).toThrow('gen: Usage: void gen queue <name>.');
+      expect(() => parseGenArgs([subcommand])).toThrow(
+        `gen: Usage: void gen ${subcommand} <name>.`,
+      );
     });
 
     it('errors on extra argument', () => {
-      expect(() => parseGenArgs(['queue', 'emails', 'extra'])).toThrow(
+      expect(() => parseGenArgs([subcommand, 'auth', 'extra'])).toThrow(
         "gen: Unexpected argument 'extra'.",
       );
     });
 
-    it('errors on invalid name', () => {
-      expect(() => parseGenArgs(['queue', '1bad'])).toThrow(
-        'gen: Queue name must be lowercase alphanumeric with underscores or hyphens and no leading digits.',
+    it.each(['1bad', '--foo'])('rejects the invalid name %s', (name) => {
+      expect(() => parseGenArgs([subcommand, name])).toThrow(
+        `gen: ${label} name must be lowercase alphanumeric with underscores or hyphens and no leading digits.`,
       );
     });
-
-    it('allows hyphens in name', () => {
-      expect(parseGenArgs(['queue', 'order-notifications'])).toEqual({
-        subcommand: 'queue',
-        name: 'order-notifications',
-      });
-    });
   });
 });
diff --git a/packages/void/test/unit/gen.test.ts b/packages/void/test/unit/gen.test.ts
index 5d59e946c..c60e5dcd2 100644
--- a/packages/void/test/unit/gen.test.ts
+++ b/packages/void/test/unit/gen.test.ts
@@ -1,10 +1,13 @@
 import { mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { outro } from '@voidzero-dev/vite-plus-prompts';
+import { log, outro } from '@voidzero-dev/vite-plus-prompts';
 import { toSlash } from 'pathslash';
 import { describe, it, expect, afterEach, beforeEach, vi } from 'vite-plus/test';
+import type { GenArgs } from '../../src/cli/gen-args.ts';
 import { runGenCommand, formatTimestamp } from '../../src/cli/gen.ts';
+import { collectMigrations } from '../../src/migrations/collect.ts';
+import { assertJournalCoherence } from '../../src/migrations/validate.ts';
 
 const mockSelect = vi.fn();
 
@@ -17,13 +20,9 @@ vi.mock('@voidzero-dev/vite-plus-prompts', () => ({
   cancel: vi.fn(),
 }));
 
-// `vi.hoisted` is required because `vi.mock` is hoisted above imports —
-// referencing a plain `let` from inside the mock factory hits a TDZ at
-// module-init time.
+// `vi.mock` is hoisted above imports, so its factory can only reach `vi.hoisted` state.
 const spawnMockState = vi.hoisted(() => ({
-  // Per-test override. When non-null, the mock delegates to this handler
-  // instead of the default "simulate drizzle-kit generate --custom"
-  // behavior. Used by the rollback tests to simulate failures.
+  // When set, replaces the default simulated `drizzle-kit generate --custom`.
   handler: null as
     | ((
         command: string,
@@ -39,7 +38,7 @@ const spawnMockState = vi.hoisted(() => ({
   calls: [] as Array<{
     command: string;
     args: Array<string>;
-    options: { cwd?: string };
+    options: { cwd?: string; env?: NodeJS.ProcessEnv };
   }>,
 }));
 
@@ -47,31 +46,19 @@ vi.mock('node:child_process', async () => {
   const nodeFs = await vi.importActual<typeof import('node:fs')>('node:fs');
   const nodePath = await vi.importActual<typeof import('node:path')>('node:path');
   return {
-    spawnSync: (command: string, args: Array<string>, options: { cwd?: string }) => {
+    spawnSync: (
+      command: string,
+      args: Array<string>,
+      options: { cwd?: string; env?: NodeJS.ProcessEnv },
+    ) => {
       spawnMockState.calls.push({ command, args, options });
-
-      // Per-test handler wins.
       if (spawnMockState.handler !== null) {
         return spawnMockState.handler(command, args, options);
       }
-
-      // Default behavior: simulate `drizzle-kit generate --custom --name
-      // <name>` success. Detect the shape of the command and, when it
-      // matches, produce the same on-disk side effects drizzle-kit
-      // itself produces:
-      //   - new `<timestamp>_<name>.sql` stub under db/migrations/
-      //   - appended entry in `meta/_journal.json`
-      //   - new `meta/<prefix>_snapshot.json` with a re-issued id chain
-      if (
-        Array.isArray(args) &&
-        args[1] === 'generate' &&
-        args.includes('--custom') &&
-        typeof options?.cwd === 'string'
-      ) {
-        const cwd = options.cwd;
+      if (args[1] === 'generate' && args.includes('--custom') && typeof options?.cwd === 'string') {
         const nameIdx = args.indexOf('--name');
         const name = nameIdx !== -1 ? args[nameIdx + 1] : 'custom';
-        simulateDrizzleCustom(cwd, name, nodeFs, nodePath);
+        simulateDrizzleCustom(options.cwd, name, nodeFs, nodePath);
       }
       return { status: 0, stdout: '', stderr: '' };
     },
@@ -79,14 +66,8 @@ vi.mock('node:child_process', async () => {
 });
 
 /**
- * Simulate what `drizzle-kit generate --custom --name <name>` writes to
- * disk: a new empty `.sql` stub, an updated journal entry, and a new
- * snapshot derived from the current (freshly loaded) schema.
- *
- * The test seeds the previous snapshot, so for simulation purposes we
- * read that snapshot, re-issue the id chain, and write it back — this
- * mirrors the shape of a zero-diff custom migration without actually
- * running a schema compiler.
+ * Writes what `drizzle-kit generate --custom --name <name>` writes: an empty
+ * `.sql` file, a new journal entry and a snapshot chained to the previous one.
  */
 function simulateDrizzleCustom(
   cwd: string,
@@ -100,28 +81,16 @@ function simulateDrizzleCustom(
     return;
   }
 
-  // Derive a unique timestamp that doesn't collide with existing .sql
-  // files on disk.
   const now = new Date();
-  const pad = (n: number) => String(n).padStart(2, '0');
-  const makeTs = (d: Date) =>
-    String(d.getUTCFullYear()) +
-    pad(d.getUTCMonth() + 1) +
-    pad(d.getUTCDate()) +
-    pad(d.getUTCHours()) +
-    pad(d.getUTCMinutes()) +
-    pad(d.getUTCSeconds());
-  let ts = makeTs(now);
+  let ts = formatTimestamp(now);
   while (nodeFs.readdirSync(migrationsDir).some((f) => f.startsWith(ts + '_'))) {
     now.setSeconds(now.getSeconds() + 1);
-    ts = makeTs(now);
+    ts = formatTimestamp(now);
   }
   const tag = `${ts}_${name}`;
 
-  // Write the empty .sql stub that `--custom` emits.
   nodeFs.writeFileSync(nodePath.join(migrationsDir, `${tag}.sql`), '');
 
-  // Append journal entry.
   const journalPath = nodePath.join(metaDir, '_journal.json');
   const journal = JSON.parse(nodeFs.readFileSync(journalPath, 'utf-8')) as {
     version: string;
@@ -146,11 +115,6 @@ function simulateDrizzleCustom(
   });
   nodeFs.writeFileSync(journalPath, JSON.stringify(journal, null, 2) + '\n');
 
-  // Find the prev snapshot (tag-derived) and write a new snapshot
-  // with a re-issued id chain. The new snapshot is a structural clone
-  // of the previous one — in real life drizzle-kit would recompile
-  // `db/schema.ts`, but for mock purposes the chaining shape is all the
-  // tests need.
   if (lastEntry) {
     const prevPrefix = lastEntry.tag.split('_')[0];
     const prevSnapshotPath = nodePath.join(metaDir, `${prevPrefix}_snapshot.json`);
@@ -163,6 +127,7 @@ function simulateDrizzleCustom(
         ...prevSnapshot,
         id: `sim-${ts}`,
         prevId: prevSnapshot.id,
+        tables: { fresh: { name: 'fresh' } },
       };
       const newSnapshotPath = nodePath.join(metaDir, `${ts}_snapshot.json`);
       nodeFs.writeFileSync(newSnapshotPath, JSON.stringify(nextSnapshot, null, 2));
@@ -181,12 +146,7 @@ function writePkg(deps: Record<string, string>): void {
   writeFileSync(join(TMP, 'package.json'), JSON.stringify({ dependencies: deps }));
 }
 
-/**
- * Seed a minimal `db/schema.ts` so `writeDrizzleConfig()` succeeds.
- * `runMigration` writes a drizzle config via `writeDrizzleConfig`
- * before spawning drizzle-kit, and `writeDrizzleConfig` throws with
- * "No Drizzle schema found" if there's no schema on disk.
- */
+/** `writeDrizzleConfig()` throws when there is no `db/schema.ts`. */
 function seedSchema(): void {
   const schemaPath = join(TMP, 'db', 'schema.ts');
   mkdirSync(dirname(schemaPath), { recursive: true });
@@ -196,6 +156,23 @@ function seedSchema(): void {
   );
 }
 
+/** Runs `void gen`, expects it to call `process.exit`, and returns the logged errors. */
+async function expectExit(args: GenArgs): Promise<string> {
+  vi.mocked(log.error).mockClear();
+  const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
+    throw new Error('process.exit');
+  });
+  try {
+    await expect(runGenCommand(TMP, args)).rejects.toThrow('process.exit');
+  } finally {
+    exitSpy.mockRestore();
+  }
+  return vi
+    .mocked(log.error)
+    .mock.calls.map((call) => String(call[0]))
+    .join('\n');
+}
+
 beforeEach(() => {
   spawnMockState.calls = [];
   spawnMockState.handler = null;
@@ -204,14 +181,8 @@ beforeEach(() => {
 afterEach(() => {
   rmSync(TMP, { recursive: true, force: true });
   mockSelect.mockReset();
-  spawnMockState.calls = [];
-  spawnMockState.handler = null;
 });
 
-// ---------------------------------------------------------------------------
-// gen model
-// ---------------------------------------------------------------------------
-
 describe('gen model', () => {
   it('generates Drizzle table definition', async () => {
     writePkg({ valibot: '^1.0.0' });
@@ -576,27 +547,10 @@ describe('gen model', () => {
 
   it('exits when user cancels validator prompt', async () => {
     mockSelect.mockResolvedValueOnce(Symbol.for('cancel'));
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
-      throw new Error('process.exit');
-    });
-    try {
-      await expect(
-        runGenCommand(TMP, {
-          subcommand: 'model',
-          name: 'posts',
-          columns: [],
-        }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
+    await expectExit({ subcommand: 'model', name: 'posts', columns: [] });
   });
 });
 
-// ---------------------------------------------------------------------------
-// formatTimestamp
-// ---------------------------------------------------------------------------
-
 describe('formatTimestamp', () => {
   it('produces YYYYMMDDHHMMSS from a UTC date', () => {
     const date = new Date(Date.UTC(2026, 3, 10, 16, 15, 0)); // April 10, 2026 16:15:00 UTC
@@ -607,42 +561,61 @@ describe('formatTimestamp', () => {
     const date = new Date(Date.UTC(2025, 0, 5, 3, 7, 9)); // Jan 5, 2025 03:07:09 UTC
     expect(formatTimestamp(date)).toBe('20250105030709');
   });
-
-  it('uses UTC regardless of local timezone', () => {
-    const date = new Date(Date.UTC(2026, 11, 31, 23, 59, 59)); // Dec 31, 2026 23:59:59 UTC
-    expect(formatTimestamp(date)).toBe('20261231235959');
-  });
 });
 
-// ---------------------------------------------------------------------------
-// gen migration
-// ---------------------------------------------------------------------------
-
-// Helper: seed a playground-style "placeholder" journal with `entries: []`.
-// This shape ships in the kitchen-sink playground and is treated as NOT
-// drizzle-managed — bare-legacy behavior applies and `gen migration` writes
-// a plain .sql file without touching the journal. A journal with at least
-// one entry is treated as drizzle-managed and the command refuses.
-function seedPlaceholderJournal(dialect: 'sqlite' | 'postgresql' = 'sqlite'): void {
+/** Writes a one-entry journal, its `.sql` file and, by default, its snapshot. */
+function seedJournalBackedProject({
+  dialect = 'sqlite',
+  tag = '20200101000000_initial',
+  snapshot = true,
+}: { dialect?: string; tag?: string; snapshot?: boolean } = {}) {
+  seedSchema();
   const migrationsDir = join(TMP, 'db', 'migrations');
-  mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-  writeFileSync(
-    join(migrationsDir, 'meta', '_journal.json'),
-    JSON.stringify({ version: '7', dialect, entries: [] }, null, 2) + '\n',
-  );
+  const metaDir = join(migrationsDir, 'meta');
+  mkdirSync(metaDir, { recursive: true });
+  const journal = {
+    version: '7',
+    dialect,
+    entries: [{ idx: 0, version: '6', when: 1_700_000_000_000, tag, breakpoints: true }],
+  };
+  const journalPath = join(metaDir, '_journal.json');
+  writeFileSync(journalPath, JSON.stringify(journal, null, 2) + '\n');
+  writeFileSync(join(migrationsDir, `${tag}.sql`), '-- initial\n');
+  const snapshotPath = join(metaDir, `${tag.split('_')[0]}_snapshot.json`);
+  if (snapshot) {
+    writeFileSync(
+      snapshotPath,
+      JSON.stringify(
+        {
+          version: '6',
+          dialect,
+          id: '11111111-1111-1111-1111-111111111111',
+          prevId: '00000000-0000-0000-0000-000000000000',
+          tables: { stale: { name: 'stale' } },
+        },
+        null,
+        2,
+      ),
+    );
+  }
+  return { migrationsDir, journalPath, journal, snapshotPath };
 }
 
-function spyExit(): ReturnType<typeof vi.spyOn> {
-  return vi.spyOn(process, 'exit').mockImplementation(() => {
-    throw new Error('process.exit');
-  });
+function findGenerateCall() {
+  return spawnMockState.calls.find((c) => c.args[1] === 'generate');
+}
+
+function listSql(dir: string): Array<string> {
+  return readdirSync(dir)
+    .filter((f) => f.endsWith('.sql'))
+    .sort();
 }
 
 describe('gen migration', () => {
   it('generates timestamp-prefixed migration file (bare-legacy)', async () => {
     await runGenCommand(TMP, { subcommand: 'migration', name: 'add_avatar_to_users' });
 
-    const files = readdirSync(join(TMP, 'db', 'migrations')).filter((f) => f.endsWith('.sql'));
+    const files = listSql(join(TMP, 'db', 'migrations'));
     expect(files).toHaveLength(1);
     expect(files[0]).toMatch(/^\d{14}_add_avatar_to_users\.sql$/);
 
@@ -650,42 +623,15 @@ describe('gen migration', () => {
     expect(sql).toBe('-- add_avatar_to_users\n');
   });
 
-  it('generates unique timestamps for subsequent migrations (bare-legacy)', async () => {
-    mkdirSync(join(TMP, 'db', 'migrations'), { recursive: true });
-    // Use a timestamp far in the past so the generated one always sorts after it
-    writeFileSync(join(TMP, 'db/migrations/20200101000000_something.sql'), '');
-
-    await runGenCommand(TMP, { subcommand: 'migration', name: 'another' });
-
-    const files = readdirSync(join(TMP, 'db', 'migrations'))
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(files).toHaveLength(2);
-    expect(files[0]).toBe('20200101000000_something.sql');
-    expect(files[1]).toMatch(/^\d{14}_another\.sql$/);
-  });
-
   it('avoids same-second timestamp collisions (bare-legacy)', async () => {
     mkdirSync(join(TMP, 'db', 'migrations'), { recursive: true });
-    // Pre-create a file with the current UTC timestamp to force a collision
-    const now = new Date();
-    const pad = (n: number) => String(n).padStart(2, '0');
-    const currentTs =
-      String(now.getUTCFullYear()) +
-      pad(now.getUTCMonth() + 1) +
-      pad(now.getUTCDate()) +
-      pad(now.getUTCHours()) +
-      pad(now.getUTCMinutes()) +
-      pad(now.getUTCSeconds());
+    const currentTs = formatTimestamp(new Date());
     writeFileSync(join(TMP, `db/migrations/${currentTs}_existing.sql`), '');
 
     await runGenCommand(TMP, { subcommand: 'migration', name: 'new_one' });
 
-    const files = readdirSync(join(TMP, 'db', 'migrations'))
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
+    const files = listSql(join(TMP, 'db', 'migrations'));
     expect(files).toHaveLength(2);
-    // The new file must have a different (later) timestamp than the existing one
     const newFile = files.find((f) => f.includes('new_one'));
     expect(newFile).toBeDefined();
     expect(newFile).not.toContain(currentTs);
@@ -704,31 +650,7 @@ describe('gen migration', () => {
     expect(files[0]).toMatch(/^\d{14}_first\.sql$/);
   });
 
-  it('bare-legacy: does not synthesize a journal when none exists (no prior files)', async () => {
-    // Empty project with no schema, no drizzle metadata, no .sql files.
-    // `gen migration` must write the new .sql file without fabricating a
-    // `_journal.json` — fabricating one without matching snapshot files
-    // would corrupt the snapshot chain the moment the user adopts
-    // drizzle-kit (it would diff against an empty baseline and regenerate
-    // every existing table).
-    const migrationsDir = join(TMP, 'db', 'migrations');
-
-    await runGenCommand(TMP, { subcommand: 'migration', name: 'initial' });
-
-    const files = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
-    expect(files).toHaveLength(1);
-    expect(files[0]).toMatch(/^\d{14}_initial\.sql$/);
-
-    // No journal was created — bare-legacy stays bare-legacy.
-    expect(existsSync(join(migrationsDir, 'meta', '_journal.json'))).toBe(false);
-    // No snapshot files either.
-    expect(existsSync(join(migrationsDir, 'meta'))).toBe(false);
-  });
-
   it('bare-legacy: leaves existing .sql files alone and skips the journal write', async () => {
-    // Project with hand-written .sql files and NO drizzle metadata at all.
-    // `gen migration` must write the new .sql file and leave the on-disk
-    // state otherwise untouched — no synthesized journal, no snapshots.
     const migrationsDir = join(TMP, 'db', 'migrations');
     mkdirSync(migrationsDir, { recursive: true });
     writeFileSync(join(migrationsDir, '0001_create_users.sql'), '-- users\n');
@@ -736,221 +658,60 @@ describe('gen migration', () => {
 
     await runGenCommand(TMP, { subcommand: 'migration', name: 'add_avatar' });
 
-    // The two pre-existing files are still on disk and the new one was
-    // added alongside them.
-    const files = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
+    const files = listSql(migrationsDir);
     expect(files).toHaveLength(3);
     expect(files[0]).toBe('0001_create_users.sql');
     expect(files[1]).toBe('0002_add_email.sql');
     expect(files[2]).toMatch(/^\d{14}_add_avatar\.sql$/);
 
-    // No journal or snapshot files were created.
+    // A journal without matching snapshots would break the chain once the
+    // project adopts drizzle-kit.
     expect(existsSync(join(migrationsDir, 'meta', '_journal.json'))).toBe(false);
     expect(existsSync(join(migrationsDir, 'meta'))).toBe(false);
 
-    // assertJournalCoherence tolerates a missing journal and stays quiet.
-    const { collectMigrations } = await import('../../src/migrations/collect.ts');
-    const { assertJournalCoherence } = await import('../../src/migrations/validate.ts');
     expect(() =>
       assertJournalCoherence(migrationsDir, collectMigrations(migrationsDir)),
     ).not.toThrow();
   });
 
-  it('bare-legacy: writes a .sql file even when void.json says postgresql', async () => {
-    // Bare-legacy with a postgresql project config. The dialect is
-    // irrelevant — no journal is written either way.
-    mkdirSync(TMP, { recursive: true });
-    writeFileSync(join(TMP, 'void.json'), JSON.stringify({ database: 'pg' }));
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(migrationsDir, { recursive: true });
-    writeFileSync(join(migrationsDir, '0001_existing.sql'), '-- existing\n');
-
-    await runGenCommand(TMP, { subcommand: 'migration', name: 'initial_pg' });
-
-    // New migration file was written.
-    const files = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(files).toHaveLength(2);
-    expect(files[0]).toBe('0001_existing.sql');
-    expect(files[1]).toMatch(/^\d{14}_initial_pg\.sql$/);
-
-    // No journal was written.
-    expect(existsSync(join(migrationsDir, 'meta', '_journal.json'))).toBe(false);
-  });
-
   it('allows migration on a journal with empty entries (playground placeholder)', async () => {
-    // The kitchen-sink playground ships a `meta/_journal.json` with
-    // `entries: []` as a placeholder. A journal with zero entries is NOT
-    // treated as drizzle-managed — `gen migration` still runs in its
-    // bare-legacy mode and writes a plain .sql file without touching the
-    // journal. This preserves existing playground ergonomics.
-    seedPlaceholderJournal();
+    // The kitchen-sink playground ships `entries: []`; it is treated like no journal.
+    const migrationsDir = join(TMP, 'db', 'migrations');
+    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
+    const journalPath = join(migrationsDir, 'meta', '_journal.json');
+    const placeholder =
+      JSON.stringify({ version: '7', dialect: 'sqlite', entries: [] }, null, 2) + '\n';
+    writeFileSync(journalPath, placeholder);
 
     await runGenCommand(TMP, { subcommand: 'migration', name: 'add_table' });
 
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    const files = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
+    const files = listSql(migrationsDir);
     expect(files).toHaveLength(1);
     expect(files[0]).toMatch(/^\d{14}_add_table\.sql$/);
-
-    // The placeholder journal is untouched — still has `entries: []`.
-    const journal = JSON.parse(readFileSync(join(migrationsDir, 'meta', '_journal.json'), 'utf-8'));
-    expect(journal.entries).toEqual([]);
-    expect(journal.version).toBe('7');
-    expect(journal.dialect).toBe('sqlite');
-  });
-
-  it('running assertJournalCoherence after gen migration does not throw (bare-legacy)', async () => {
-    const { collectMigrations } = await import('../../src/migrations/collect.ts');
-    const { assertJournalCoherence } = await import('../../src/migrations/validate.ts');
-
-    await runGenCommand(TMP, { subcommand: 'migration', name: 'coherent' });
-
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    expect(() =>
-      assertJournalCoherence(migrationsDir, collectMigrations(migrationsDir)),
-    ).not.toThrow();
+    expect(readFileSync(journalPath, 'utf-8')).toBe(placeholder);
   });
 
   it('refuses to scaffold when _journal.json is missing but meta/*_snapshot.json is present', async () => {
-    // `_journal.json` deleted in isolation (e.g. bad merge / manual
-    // cleanup) while `meta/*_snapshot.json` lingers on disk is the exact
-    // "partial drizzle-kit state" `assertJournalCoherence` rejects across
-    // the rest of the CLI. Writing a new .sql file here would leave a
-    // project every later `void db status`/`migrate`/`deploy` rejects.
-    // `gen migration` must refuse up front,
-    // BEFORE writing any .sql file, with the same partial-state error the
-    // rest of the CLI emits.
     const migrationsDir = join(TMP, 'db', 'migrations');
     mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
     const snapshotPath = join(migrationsDir, 'meta', '0000_silent_the_anarchist_snapshot.json');
     const snapshotBytes = Buffer.from(JSON.stringify({ id: 'snap-0000', prevId: null }));
     writeFileSync(snapshotPath, snapshotBytes);
 
-    const { log } = await import('@voidzero-dev/vite-plus-prompts');
-    const errorMock = log.error as ReturnType<typeof vi.fn>;
-    errorMock.mockClear();
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'add_column' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // No .sql file was written — the refusal happens before any file write.
-    const sqlFiles = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
-    expect(sqlFiles).toEqual([]);
+    const errors = await expectExit({ subcommand: 'migration', name: 'add_column' });
 
-    // The snapshot is still on disk, untouched.
-    expect(existsSync(snapshotPath)).toBe(true);
+    expect(listSql(migrationsDir)).toEqual([]);
     expect(readFileSync(snapshotPath).equals(snapshotBytes)).toBe(true);
-
-    // The error message points at the partial state AND the snapshot path,
-    // so the user knows exactly what to restore or delete.
-    const errorMessages = errorMock.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('partial drizzle-kit state');
-    expect(errorMessages).toContain('db/migrations/meta/0000_silent_the_anarchist_snapshot.json');
-  });
-
-  it('refuses on an empty-entries journal when meta/*_snapshot.json is present', async () => {
-    // A journal with `entries: []` is only "bare-legacy placeholder" when
-    // there are NO accompanying drizzle artifacts. When a
-    // `meta/<tag>_snapshot.json` is also on disk, the project is in the
-    // same partial drizzle-kit shape `assertJournalCoherence` treats as
-    // drizzle-managed; a new .sql file here would be rejected by every
-    // later `void db status`/`migrate`/`deploy`.
-    // Refuse BEFORE writing any .sql file so there's nothing to roll back.
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal =
-      JSON.stringify({ version: '7', dialect: 'sqlite', entries: [] }, null, 2) + '\n';
-    writeFileSync(journalPath, initialJournal);
-    const snapshotPath = join(migrationsDir, 'meta', '0000_silent_the_anarchist_snapshot.json');
-    const snapshotBytes = Buffer.from(JSON.stringify({ id: 'snap-0000', prevId: null }));
-    writeFileSync(snapshotPath, snapshotBytes);
-
-    const { log } = await import('@voidzero-dev/vite-plus-prompts');
-    const errorMock = log.error as ReturnType<typeof vi.fn>;
-    errorMock.mockClear();
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'add_column' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // No new .sql file was written — nothing on disk.
-    const sqlFiles = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
-    expect(sqlFiles).toEqual([]);
-
-    // The placeholder journal and snapshot were left untouched.
-    expect(readFileSync(journalPath, 'utf-8')).toBe(initialJournal);
-    expect(readFileSync(snapshotPath).equals(snapshotBytes)).toBe(true);
-
-    // The error message still points the user at the drizzle-kit workflow.
-    const errorMessages = errorMock.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('drizzle-kit');
-    expect(errorMessages).toContain('void db generate');
+    expect(errors).toContain('partial drizzle-kit state');
+    expect(errors).toContain('db/migrations/meta/0000_silent_the_anarchist_snapshot.json');
   });
 
   it('delegates a data migration to drizzle-kit generate --custom on a journal-backed project', async () => {
-    // Journal-backed integration: when `_journal.json` has entries and a
-    // matching snapshot is on disk, `void gen migration` shells out to
-    // `drizzle-kit generate --custom --name <name>`. Drizzle-kit is the
-    // source of truth for the `.sql` stub, the journal entry, AND the
-    // new snapshot — the earlier in-process path cloned the previous
-    // snapshot, which left the new journal entry pointing at a stale
-    // schema state and caused the next `void db generate` to re-emit
-    // schema changes the custom migration had already applied. This
-    // test asserts the delegation shape: the spawned command is
-    // `drizzle-kit generate --custom --name <name>` against the
-    // project root.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'sqlite',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20200101000000_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    writeFileSync(journalPath, JSON.stringify(initialJournal, null, 2) + '\n');
-    writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-    const initialSnapshotPath = join(migrationsDir, 'meta', '20200101000000_snapshot.json');
-    const initialSnapshot = {
-      version: '6',
-      dialect: 'sqlite',
-      id: 'c6fe9cdc-1e14-40e0-a9c6-c27361e93e98',
-      prevId: '00000000-0000-0000-0000-000000000000',
-      tables: { users: { name: 'users' } },
-      enums: {},
-      _meta: { schemas: {}, tables: {}, columns: {} },
-    };
-    writeFileSync(initialSnapshotPath, JSON.stringify(initialSnapshot, null, 2));
+    const { migrationsDir, journalPath, journal } = seedJournalBackedProject();
 
     await runGenCommand(TMP, { subcommand: 'migration', name: 'backfill_users' });
 
-    // The spawned command was `drizzle-kit generate --custom --name
-    // backfill_users`, invoked with the project root as cwd.
-    const generateCall = spawnMockState.calls.find(
-      (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-    );
+    const generateCall = findGenerateCall();
     expect(generateCall).toBeDefined();
     expect(generateCall!.args).toContain('--custom');
     expect(generateCall!.args).toContain('--name');
@@ -958,917 +719,139 @@ describe('gen migration', () => {
     expect(generateCall!.args).toContain('--config');
     expect(generateCall!.options.cwd).toBe(TMP);
 
-    // After the spawn mock's default handler ran, a second .sql file is on
-    // disk alongside the seeded one.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
+    const sqlFiles = listSql(migrationsDir);
     expect(sqlFiles).toHaveLength(2);
     expect(sqlFiles[0]).toBe('20200101000000_initial.sql');
     expect(sqlFiles[1]).toMatch(/^\d{14}_backfill_users\.sql$/);
 
-    // Journal grew by exactly one entry.
     const updatedJournal = JSON.parse(readFileSync(journalPath, 'utf-8'));
     expect(updatedJournal.entries).toHaveLength(2);
-    expect(updatedJournal.entries[0]).toEqual(initialJournal.entries[0]);
+    expect(updatedJournal.entries[0]).toEqual(journal.entries[0]);
     expect(updatedJournal.entries[1].tag).toMatch(/_backfill_users$/);
 
-    // A second snapshot file exists. Its content shape is drizzle-kit's
-    // responsibility — we only care that the delegation fired and wrote
-    // one.
-    const snapshotFiles = readdirSync(join(migrationsDir, 'meta'))
-      .filter((f) => f.endsWith('_snapshot.json'))
-      .sort();
+    const snapshotFiles = readdirSync(join(migrationsDir, 'meta')).filter((f) =>
+      f.endsWith('_snapshot.json'),
+    );
     expect(snapshotFiles).toHaveLength(2);
+    const newSnapshot = snapshotFiles.find((f) => f !== '20200101000000_snapshot.json')!;
+    expect(
+      JSON.parse(readFileSync(join(migrationsDir, 'meta', newSnapshot), 'utf-8')).tables,
+    ).toEqual({ fresh: { name: 'fresh' } });
   });
 
   it('refuses when the journal dialect disagrees with the void.json dialect', async () => {
-    // Once a journal exists on disk, its `dialect` field is
-    // authoritative. Drizzle-kit chains every snapshot in `meta/` off
-    // that dialect, so if a user flips `void.json`'s `database` field
-    // to `pg` without dropping `db/migrations/`, running `void gen
-    // migration` would append a postgresql snapshot to a sqlite
-    // chain — corrupting the project. The correct behavior is to
-    // refuse loudly BEFORE spawning drizzle-kit.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'sqlite',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20200101000000_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    writeFileSync(journalPath, JSON.stringify(initialJournal, null, 2) + '\n');
-    writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-    writeFileSync(
-      join(migrationsDir, 'meta', '20200101000000_snapshot.json'),
-      JSON.stringify(
-        {
-          version: '6',
-          dialect: 'sqlite',
-          id: 'c6fe9cdc-1e14-40e0-a9c6-c27361e93e98',
-          prevId: '00000000-0000-0000-0000-000000000000',
-          tables: { users: { name: 'users' } },
-        },
-        null,
-        2,
-      ),
-    );
-    // Flip the project config to postgresql, contradicting the journal.
+    const { migrationsDir, journalPath, journal } = seedJournalBackedProject();
     writeFileSync(join(TMP, 'void.json'), JSON.stringify({ database: 'pg' }));
 
-    const { log } = await import('@voidzero-dev/vite-plus-prompts');
-    const errorMock = log.error as ReturnType<typeof vi.fn>;
-    errorMock.mockClear();
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'backfill_users' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
+    const errors = await expectExit({ subcommand: 'migration', name: 'backfill_users' });
 
-    // Refusal must surface BOTH dialects by name so the user knows
-    // which side to reconcile.
-    const errorMessages = errorMock.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('sqlite');
-    expect(errorMessages).toContain('postgresql');
-    expect(errorMessages).toContain('_journal.json');
-
-    // Drizzle-kit must NOT have been spawned — refusal happens before
-    // the spawn, so no new files land on disk.
-    const generateCall = spawnMockState.calls.find(
-      (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-    );
-    expect(generateCall).toBeUndefined();
-
-    // No new .sql file was written — the refusal fires before the
-    // spawn.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toEqual(['20200101000000_initial.sql']);
-
-    // Journal bytes are untouched — the refusal path never writes it.
-    const afterJournal = JSON.parse(readFileSync(journalPath, 'utf-8'));
-    expect(afterJournal).toEqual(initialJournal);
+    expect(errors).toContain('sqlite');
+    expect(errors).toContain('postgresql');
+    expect(errors).toContain('_journal.json');
+    expect(findGenerateCall()).toBeUndefined();
+    expect(listSql(migrationsDir)).toEqual(['20200101000000_initial.sql']);
+    expect(JSON.parse(readFileSync(journalPath, 'utf-8'))).toEqual(journal);
   });
 
   it('proceeds when the journal dialect matches the void.json dialect (postgresql)', async () => {
-    // Positive case: when both sides agree on postgresql, `runMigration`
-    // passes the journal-derived dialect through to `writeDrizzleConfig`
-    // and the spawn proceeds normally.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'postgresql',
-      entries: [
-        {
-          idx: 0,
-          version: '7',
-          when: 1_700_000_000_000,
-          tag: '20200101000000_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    writeFileSync(journalPath, JSON.stringify(initialJournal, null, 2) + '\n');
-    writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-    writeFileSync(
-      join(migrationsDir, 'meta', '20200101000000_snapshot.json'),
-      JSON.stringify(
-        {
-          version: '7',
-          dialect: 'postgresql',
-          id: '11111111-1111-1111-1111-111111111111',
-          prevId: '00000000-0000-0000-0000-000000000000',
-          tables: { users: { name: 'users' } },
-        },
-        null,
-        2,
-      ),
-    );
+    seedJournalBackedProject({ dialect: 'postgresql' });
     writeFileSync(join(TMP, 'void.json'), JSON.stringify({ database: 'pg' }));
 
     await runGenCommand(TMP, { subcommand: 'migration', name: 'backfill_users' });
 
-    // Delegation fired — drizzle-kit was spawned with `--custom`.
-    const generateCall = spawnMockState.calls.find(
-      (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-    );
+    const generateCall = findGenerateCall();
     expect(generateCall).toBeDefined();
     expect(generateCall!.args).toContain('--custom');
     expect(generateCall!.args).toContain('--name');
   });
 
   it('refuses when the journal dialect is unsupported', async () => {
-    // A hand-edited or merge-corrupted journal with e.g. `mariadb`,
-    // `pg`, or an empty string must not be silently
-    // coerced to sqlite. The refusal happens BEFORE the dialect
-    // cross-check against `void.json`, so the user sees a clear
-    // "unsupported dialect" error regardless of what `void.json`
-    // currently says.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'mariadb',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20200101000000_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    writeFileSync(journalPath, JSON.stringify(initialJournal, null, 2) + '\n');
-    writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-    writeFileSync(
-      join(migrationsDir, 'meta', '20200101000000_snapshot.json'),
-      JSON.stringify(
-        {
-          version: '6',
-          dialect: 'mariadb',
-          id: '33333333-3333-3333-3333-333333333333',
-          prevId: '00000000-0000-0000-0000-000000000000',
-          tables: { users: { name: 'users' } },
-        },
-        null,
-        2,
-      ),
-    );
-    // `void.json` dialect is irrelevant — the whitelist fires first.
+    const { journalPath, journal } = seedJournalBackedProject({ dialect: 'mariadb' });
+    // The dialect check runs before the void.json cross-check.
     writeFileSync(join(TMP, 'void.json'), JSON.stringify({}));
 
-    const { log } = await import('@voidzero-dev/vite-plus-prompts');
-    const errorMock = log.error as ReturnType<typeof vi.fn>;
-    errorMock.mockClear();
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'backfill_users' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // The refusal must call out "unsupported dialect" and name the
-    // offending value so the user knows which field to reconcile.
-    const errorMessages = errorMock.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('unsupported dialect');
-    expect(errorMessages).toContain('mariadb');
-    expect(errorMessages).toContain('_journal.json');
-
-    // Drizzle-kit must NOT have been spawned — whitelist fires before
-    // the spawn.
-    const generateCall = spawnMockState.calls.find(
-      (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-    );
-    expect(generateCall).toBeUndefined();
+    const errors = await expectExit({ subcommand: 'migration', name: 'backfill_users' });
 
-    // Journal bytes are untouched — the refusal path never writes it.
-    const afterJournal = JSON.parse(readFileSync(journalPath, 'utf-8'));
-    expect(afterJournal).toEqual(initialJournal);
-  });
-
-  it('preflight checks the journal-tag-derived snapshot, leaving stale lex-higher snapshots untouched', async () => {
-    // The preflight must locate the previous snapshot via
-    // `lastEntry.tag`'s prefix (not by directory-sorting `meta/` and
-    // picking the last one). A stale lex-higher snapshot file — e.g.
-    // left behind by a bad merge or manual cleanup — must not confuse
-    // the preflight: the tag-derived snapshot path exists, so the
-    // command proceeds to spawn drizzle-kit. Drizzle-kit is the source
-    // of truth for the new snapshot's content; this test only confirms
-    // that the preflight path bound to the correct filename and the
-    // stale snapshot was left alone.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'sqlite',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20260412171331_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    writeFileSync(journalPath, JSON.stringify(initialJournal, null, 2) + '\n');
-    writeFileSync(join(migrationsDir, '20260412171331_initial.sql'), '-- initial\n');
-
-    // The correct snapshot (matches `lastEntry.tag`'s prefix).
-    const correctSnapshotPath = join(migrationsDir, 'meta', '20260412171331_snapshot.json');
-    const correctSnapshot = {
-      version: '6',
-      dialect: 'sqlite',
-      id: '11111111-1111-1111-1111-111111111111',
-      prevId: '00000000-0000-0000-0000-000000000000',
-      tables: { correct_table: { name: 'correct_table' } },
-    };
-    writeFileSync(correctSnapshotPath, JSON.stringify(correctSnapshot, null, 2));
-
-    // A stale lex-higher snapshot from a bad merge (distinct content).
-    const staleSnapshotPath = join(migrationsDir, 'meta', '29991231235959_stale_snapshot.json');
-    const staleSnapshot = {
-      version: '6',
-      dialect: 'sqlite',
-      id: '22222222-2222-2222-2222-222222222222',
-      prevId: '00000000-0000-0000-0000-000000000000',
-      tables: { stale_table: { name: 'stale_table' } },
-    };
-    writeFileSync(staleSnapshotPath, JSON.stringify(staleSnapshot, null, 2));
-
-    await runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' });
-
-    // The delegation fired — drizzle-kit was spawned with --custom.
-    const generateCall = spawnMockState.calls.find(
-      (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-    );
-    expect(generateCall).toBeDefined();
-    expect(generateCall!.args).toContain('--custom');
-
-    // The stale snapshot is left untouched on disk.
-    expect(JSON.parse(readFileSync(staleSnapshotPath, 'utf-8'))).toEqual(staleSnapshot);
-    // The correct snapshot is also untouched.
-    expect(JSON.parse(readFileSync(correctSnapshotPath, 'utf-8'))).toEqual(correctSnapshot);
+    expect(errors).toContain('unsupported dialect');
+    expect(errors).toContain('mariadb');
+    expect(errors).toContain('_journal.json');
+    expect(findGenerateCall()).toBeUndefined();
+    expect(JSON.parse(readFileSync(journalPath, 'utf-8'))).toEqual(journal);
   });
 
   it('refuses when the journal tag has no matching snapshot (even if unrelated snapshots exist)', async () => {
-    // The directory-listing approach would happily copy any lex-last
-    // snapshot forward, masking a broken repo state where the snapshot
-    // matching `lastEntry.tag` has been lost. Deriving from the tag
-    // surfaces that immediately as a refusal with a clear recovery path
-    // ("restore the snapshot or regenerate with `void db generate`").
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'sqlite',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20260412171331_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    writeFileSync(journalPath, JSON.stringify(initialJournal, null, 2) + '\n');
-    writeFileSync(join(migrationsDir, '20260412171331_initial.sql'), '-- initial\n');
-    // An unrelated snapshot file that does NOT match the journal tag.
+    // The previous snapshot is named by the last journal tag, not the newest file in meta/.
+    const { migrationsDir } = seedJournalBackedProject({
+      tag: '20260412171331_initial',
+      snapshot: false,
+    });
     const unrelatedPath = join(migrationsDir, 'meta', '99999999_other_snapshot.json');
     writeFileSync(
       unrelatedPath,
       JSON.stringify({ version: '6', dialect: 'sqlite', tables: {}, id: 'other' }, null, 2) + '\n',
     );
 
-    const { log } = await import('@voidzero-dev/vite-plus-prompts');
-    const errorMock = log.error as ReturnType<typeof vi.fn>;
-    errorMock.mockClear();
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
+    const errors = await expectExit({ subcommand: 'migration', name: 'backfill' });
 
-    // The error message must surface the missing snapshot under its
-    // tag-derived name, not a directory-listing heuristic.
-    const errorMessages = errorMock.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('20260412171331_initial');
-    expect(errorMessages).toContain('20260412171331_snapshot.json');
-    expect(errorMessages).toContain('missing under meta/');
-
-    // No new .sql file should have been written — refusal happens before
-    // any writes.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toEqual(['20260412171331_initial.sql']);
-
-    // The unrelated snapshot is left untouched.
+    expect(errors).toContain('20260412171331_initial');
+    expect(errors).toContain('20260412171331_snapshot.json');
+    expect(errors).toContain('missing under meta/');
+    expect(listSql(migrationsDir)).toEqual(['20260412171331_initial.sql']);
     expect(existsSync(unrelatedPath)).toBe(true);
   });
 
-  it('fails and refuses to write when _journal.json has a non-array entries field', async () => {
-    // Seed a journal that parses as JSON but whose `entries` is a non-array
-    // object (e.g. after a bad merge). This is distinct from the bare-legacy
-    // "no journal on disk" path — here the journal exists but is structurally
-    // invalid, so runMigration must fail loudly rather than silently fall
-    // through to bare-legacy and leave the user with a malformed journal
-    // plus a new .sql file on disk (which the next `void db status`/
-    // `migrate`/`deploy` would choke on).
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const invalidBytes = Buffer.from(
-      JSON.stringify({ version: '7', dialect: 'sqlite', entries: {} }, null, 2) + '\n',
-    );
-    writeFileSync(journalPath, invalidBytes);
-
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'bad_shape' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // No .sql file was written — the refusal happens before any file
-    // writes.
-    const sqlFiles = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
-    expect(sqlFiles).toEqual([]);
-
-    // The invalid journal bytes are preserved byte-for-byte.
-    const afterBytes = readFileSync(journalPath);
-    expect(afterBytes.equals(invalidBytes)).toBe(true);
-  });
-
-  it('fails and refuses to write when _journal.json is malformed JSON', async () => {
-    // `readJournal` throws on malformed JSON. Surface that as a refusal
-    // before writing any new .sql file — same treatment as the non-array
-    // `entries` shape.
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const malformedBytes = Buffer.from('{');
-    writeFileSync(journalPath, malformedBytes);
-
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'broken' }),
-      ).rejects.toThrow();
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // No .sql file should remain on disk.
-    const sqlFiles = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
-    expect(sqlFiles).toEqual([]);
-
-    // The malformed journal bytes are preserved verbatim — not overwritten.
-    const afterBytes = readFileSync(journalPath);
-    expect(afterBytes.equals(malformedBytes)).toBe(true);
-  });
-
   it('surfaces partial-drizzle state before bundled-mode guard when migrations.js is present but _journal.json is missing', async () => {
-    // When `migrations.js` survives a bad merge but `_journal.json` is
-    // missing, telling the user to "delete migrations.js" would strip the
-    // last drizzle artifact and leave orphan SQL files in bare-legacy mode.
-    // The coherence check must run BEFORE the bundled guard so the user
-    // gets the partial-state error (restore the journal OR delete every
-    // drizzle artifact) instead of the misleading bundled advice.
     const migrationsDir = join(TMP, 'db', 'migrations');
     mkdirSync(migrationsDir, { recursive: true });
-    // No `_journal.json` on disk, but the bundled `migrations.js` is still
-    // there. Combined, this is the partial-state shape `assertJournalCoherence`
-    // refuses with the "partial drizzle-kit state" message.
     writeFileSync(join(migrationsDir, 'migrations.js'), 'export default {};\n');
 
-    const { log } = await import('@voidzero-dev/vite-plus-prompts');
-    const errorMock = log.error as ReturnType<typeof vi.fn>;
-    errorMock.mockClear();
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'should_refuse' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
+    const errors = await expectExit({ subcommand: 'migration', name: 'should_refuse' });
 
-    // No new .sql file was written.
-    const sqlFiles = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
-    expect(sqlFiles).toEqual([]);
-    // The bundle is left untouched.
+    expect(listSql(migrationsDir)).toEqual([]);
     expect(existsSync(join(migrationsDir, 'migrations.js'))).toBe(true);
-
-    // The error message is the partial-state one, NOT the bundled-mode
-    // "delete migrations.js" advice. The user should be steered toward
-    // restoring the journal (or deleting all drizzle artifacts together),
-    // not toward stripping the bundle in isolation.
-    const errorMessages = errorMock.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(errorMessages).toContain('partial drizzle-kit state');
-    expect(errorMessages).toContain('db/migrations/migrations.js');
-    expect(errorMessages).not.toContain('Either run `drizzle-kit generate`');
+    // Deleting only migrations.js would leave orphan .sql files, so the
+    // bundled-mode advice must not be shown here.
+    expect(errors).toContain('partial drizzle-kit state');
+    expect(errors).toContain('db/migrations/migrations.js');
+    expect(errors).not.toContain('Either run `drizzle-kit generate`');
   });
 
   it('refuses to scaffold a migration when db/migrations/migrations.js exists (bundled mode)', async () => {
-    // Drizzle-kit's bundled migration format (Expo / `bundle: true`) hard-
-    // codes one `import m000N` line per journal entry in `migrations.js`.
-    // Appending a journal entry without rewriting the bundle would throw
-    // `Missing migration: <tag>` at runtime. `gen migration` must refuse
-    // BEFORE writing any .sql file, so there's nothing to roll back.
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal =
-      JSON.stringify(
-        {
-          version: '7',
-          dialect: 'sqlite',
-          entries: [
-            {
-              idx: 0,
-              version: '7',
-              when: 1_700_000_000_000,
-              tag: '20200101000000_existing',
-              breakpoints: true,
-            },
-          ],
-        },
-        null,
-        2,
-      ) + '\n';
-    writeFileSync(journalPath, initialJournal);
-    writeFileSync(join(migrationsDir, '20200101000000_existing.sql'), '-- existing\n');
-    // A stub `migrations.js` is enough to trigger the refusal — `gen
-    // migration` only checks for existence, it doesn't parse the file.
+    const { migrationsDir, journalPath } = seedJournalBackedProject();
+    const journalBefore = readFileSync(journalPath, 'utf-8');
     writeFileSync(join(migrationsDir, 'migrations.js'), 'export default {};\n');
 
-    const exitSpy = spyExit();
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'should_refuse' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // No new .sql file was written. Only the pre-existing migration remains.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toEqual(['20200101000000_existing.sql']);
-
-    // The journal was left untouched — byte-for-byte.
-    expect(readFileSync(journalPath, 'utf-8')).toBe(initialJournal);
-  });
+    await expectExit({ subcommand: 'migration', name: 'should_refuse' });
 
-  it('does not clone the previous snapshot in-process (drizzle-kit is the source of truth)', async () => {
-    // Cloning `meta/<prevPrefix>_snapshot.json` in-process would leave
-    // the new journal entry pointing at a stale schema state: if the user
-    // had edited `db/schema.ts` to match their hand-written DDL, the next
-    // `void db generate` would diff against the stale clone and re-emit
-    // the same change. The whole write goes through
-    // `drizzle-kit generate --custom --name <name>`, which recompiles
-    // the current schema into a fresh snapshot.
-    //
-    // To pin the behavior, this test:
-    //   - Seeds a previous snapshot with a `CANARY` shape.
-    //   - Replaces the spawn mock with a handler that writes a NEW
-    //     snapshot file with content drizzle-kit would have emitted
-    //     from the current schema (i.e. totally different from the
-    //     canary).
-    //   - Asserts the new snapshot content is drizzle-kit's output,
-    //     NOT a clone of the canary.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    writeFileSync(
-      journalPath,
-      JSON.stringify(
-        {
-          version: '7',
-          dialect: 'sqlite',
-          entries: [
-            {
-              idx: 0,
-              version: '6',
-              when: 1_700_000_000_000,
-              tag: '20200101000000_initial',
-              breakpoints: true,
-            },
-          ],
-        },
-        null,
-        2,
-      ) + '\n',
-    );
-    writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-    const canarySnapshotPath = join(migrationsDir, 'meta', '20200101000000_snapshot.json');
-    const canarySnapshot = {
-      version: '6',
-      dialect: 'sqlite',
-      id: 'canary-id',
-      prevId: null,
-      tables: { CANARY_STALE_TABLE: { name: 'CANARY_STALE_TABLE' } },
-    };
-    writeFileSync(canarySnapshotPath, JSON.stringify(canarySnapshot, null, 2));
-
-    // Replace the spawn mock with one that simulates drizzle-kit
-    // compiling the CURRENT schema (post-user-edit) into a fresh
-    // snapshot. Its tables shape must NOT match the canary — that's
-    // the whole point of delegation.
-    spawnMockState.handler = (_command, args, options) => {
-      if (
-        Array.isArray(args) &&
-        args[1] === 'generate' &&
-        args.includes('--custom') &&
-        typeof options?.cwd === 'string'
-      ) {
-        // Write a new journal entry, new .sql stub, and a snapshot
-        // that reflects "fresh compilation" of the current schema.
-        const ts = '20260413120000';
-        writeFileSync(join(options.cwd, 'db', 'migrations', `${ts}_fresh.sql`), '');
-        const updatedJournal = {
-          version: '7',
-          dialect: 'sqlite',
-          entries: [
-            {
-              idx: 0,
-              version: '6',
-              when: 1_700_000_000_000,
-              tag: '20200101000000_initial',
-              breakpoints: true,
-            },
-            { idx: 1, version: '6', when: Date.now(), tag: `${ts}_fresh`, breakpoints: true },
-          ],
-        };
-        writeFileSync(
-          join(options.cwd, 'db', 'migrations', 'meta', '_journal.json'),
-          JSON.stringify(updatedJournal, null, 2) + '\n',
-        );
-        writeFileSync(
-          join(options.cwd, 'db', 'migrations', 'meta', `${ts}_snapshot.json`),
-          JSON.stringify(
-            {
-              version: '6',
-              dialect: 'sqlite',
-              id: 'drizzle-fresh-id',
-              prevId: 'canary-id',
-              // CRITICAL: drizzle-kit's fresh compilation includes
-              // tables that reflect the current schema, NOT the stale
-              // canary shape.
-              tables: { fresh_from_current_schema: { name: 'fresh_from_current_schema' } },
-            },
-            null,
-            2,
-          ),
-        );
-      }
-      return { status: 0, stdout: '', stderr: '' };
-    };
-
-    await runGenCommand(TMP, { subcommand: 'migration', name: 'fresh' });
-
-    // The newly-written snapshot came from drizzle-kit's fresh
-    // compilation, NOT from an in-process clone of the canary. If the
-    // bug ever comes back, the tables shape would match the canary
-    // (`CANARY_STALE_TABLE`) instead of the fresh shape
-    // (`fresh_from_current_schema`).
-    const newSnapshotFiles = readdirSync(join(migrationsDir, 'meta')).filter(
-      (f) => f.endsWith('_snapshot.json') && f !== '20200101000000_snapshot.json',
-    );
-    expect(newSnapshotFiles).toHaveLength(1);
-    const newSnapshot = JSON.parse(
-      readFileSync(join(migrationsDir, 'meta', newSnapshotFiles[0]), 'utf-8'),
-    );
-    expect(newSnapshot.tables).toEqual({
-      fresh_from_current_schema: { name: 'fresh_from_current_schema' },
-    });
-    expect(newSnapshot.tables).not.toHaveProperty('CANARY_STALE_TABLE');
+    expect(listSql(migrationsDir)).toEqual(['20200101000000_initial.sql']);
+    expect(readFileSync(journalPath, 'utf-8')).toBe(journalBefore);
   });
 
   it('rolls back any partial artifacts when drizzle-kit fails mid-run', async () => {
-    // Rollback guarantee: if the spawned `drizzle-kit generate --custom`
-    // exits non-zero after having already emitted SOME artifacts
-    // (partial .sql or snapshot on disk, journal overwritten), the
-    // rollback must byte-restore the journal and unlink any new files
-    // drizzle-kit left behind. Without this, `assertJournalCoherence`
-    // would gate every subsequent `void db` call until the user
-    // manually cleaned up.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'sqlite',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20200101000000_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    const initialJournalBytes = JSON.stringify(initialJournal, null, 2) + '\n';
-    writeFileSync(journalPath, initialJournalBytes);
-    writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-    const initialSnapshotPath = join(migrationsDir, 'meta', '20200101000000_snapshot.json');
-    const initialSnapshotBytes = JSON.stringify(
-      {
-        version: '6',
-        dialect: 'sqlite',
-        id: '11111111-1111-1111-1111-111111111111',
-        prevId: '00000000-0000-0000-0000-000000000000',
-        tables: {},
-      },
-      null,
-      2,
-    );
-    writeFileSync(initialSnapshotPath, initialSnapshotBytes);
-
-    // Arm the spawn mock: write a partial .sql file and an overwritten
-    // journal, then exit non-zero to simulate a crashed drizzle-kit
-    // invocation. The rollback must undo both.
-    spawnMockState.handler = (_command, _args, options) => {
-      if (typeof options?.cwd === 'string') {
-        writeFileSync(join(options.cwd, 'db', 'migrations', '99999999_partial.sql'), '');
-        writeFileSync(
-          join(options.cwd, 'db', 'migrations', 'meta', '_journal.json'),
-          '{"corrupted": true}',
-        );
-      }
+    const { migrationsDir, journalPath, snapshotPath } = seedJournalBackedProject();
+    const journalBefore = readFileSync(journalPath, 'utf-8');
+    const snapshotBefore = readFileSync(snapshotPath, 'utf-8');
+    spawnMockState.handler = () => {
+      writeFileSync(join(migrationsDir, '99999999_partial.sql'), '');
+      writeFileSync(join(migrationsDir, 'meta', '99999999_snapshot.json'), '{}');
+      writeFileSync(journalPath, '{"corrupted": true}');
       return { status: 1, stdout: '', stderr: 'simulated drizzle-kit failure' };
     };
 
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
-      throw new Error('process.exit');
-    });
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // The partial .sql file drizzle-kit emitted was rolled back — only
-    // the seeded migration remains.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toEqual(['20200101000000_initial.sql']);
-
-    // The seeded snapshot is still intact.
-    const snapshotFiles = readdirSync(join(migrationsDir, 'meta'))
-      .filter((f) => f.endsWith('_snapshot.json'))
-      .sort();
-    expect(snapshotFiles).toEqual(['20200101000000_snapshot.json']);
+    await expectExit({ subcommand: 'migration', name: 'backfill' });
 
-    // The journal bytes were restored.
-    expect(readFileSync(journalPath, 'utf-8')).toBe(initialJournalBytes);
-    expect(readFileSync(initialSnapshotPath, 'utf-8')).toBe(initialSnapshotBytes);
-  });
-
-  it('does not delete an unrelated .sql file on rollback', async () => {
-    // Rollback must only unlink files this call actually created.
-    // Unrelated migration files on disk from a previous run must
-    // survive a rollback after a drizzle-kit failure.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'sqlite',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20200101000000_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    const initialJournalBytes = JSON.stringify(initialJournal, null, 2) + '\n';
-    writeFileSync(journalPath, initialJournalBytes);
-    const initialSqlPath = join(migrationsDir, '20200101000000_initial.sql');
-    const initialSqlBytes = '-- initial\n';
-    writeFileSync(initialSqlPath, initialSqlBytes);
-    const initialSnapshotPath = join(migrationsDir, 'meta', '20200101000000_snapshot.json');
-    const initialSnapshotBytes = JSON.stringify(
-      {
-        version: '6',
-        dialect: 'sqlite',
-        id: '11111111-1111-1111-1111-111111111111',
-        prevId: '00000000-0000-0000-0000-000000000000',
-        tables: {},
-      },
-      null,
-      2,
+    expect(listSql(migrationsDir)).toEqual(['20200101000000_initial.sql']);
+    const snapshotFiles = readdirSync(join(migrationsDir, 'meta')).filter((f) =>
+      f.endsWith('_snapshot.json'),
     );
-    writeFileSync(initialSnapshotPath, initialSnapshotBytes);
-
-    // Arm the spawn mock: fail without writing anything.
-    spawnMockState.handler = () => ({
-      status: 1,
-      stdout: '',
-      stderr: 'simulated drizzle-kit failure',
-    });
-
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
-      throw new Error('process.exit');
-    });
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // The unrelated .sql file seeded before the call is untouched.
-    expect(existsSync(initialSqlPath)).toBe(true);
-    expect(readFileSync(initialSqlPath, 'utf-8')).toBe(initialSqlBytes);
-    // The original journal and previous snapshot are also untouched.
-    expect(readFileSync(journalPath, 'utf-8')).toBe(initialJournalBytes);
-    expect(readFileSync(initialSnapshotPath, 'utf-8')).toBe(initialSnapshotBytes);
-  });
-
-  it('byte-restores _journal.json when drizzle-kit corrupts it mid-write', async () => {
-    // Drizzle-kit normally writes `_journal.json` atomically, but a
-    // crashed invocation could leave a partial / garbage payload on
-    // disk — and every subsequent `void db` command would then crash
-    // in `readJournal` / `assertJournalCoherence`. The rollback must
-    // byte-restore the pre-run snapshot so the project stays usable.
-    seedSchema();
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-    const journalPath = join(migrationsDir, 'meta', '_journal.json');
-    const initialJournal = {
-      version: '7',
-      dialect: 'sqlite',
-      entries: [
-        {
-          idx: 0,
-          version: '6',
-          when: 1_700_000_000_000,
-          tag: '20200101000000_initial',
-          breakpoints: true,
-        },
-      ],
-    };
-    const initialJournalBytes = JSON.stringify(initialJournal, null, 2) + '\n';
-    writeFileSync(journalPath, initialJournalBytes);
-    const expectedBuffer = readFileSync(journalPath);
-    writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-    const initialSnapshotPath = join(migrationsDir, 'meta', '20200101000000_snapshot.json');
-    const initialSnapshot = {
-      version: '6',
-      dialect: 'sqlite',
-      id: '11111111-1111-1111-1111-111111111111',
-      prevId: '00000000-0000-0000-0000-000000000000',
-      tables: {},
-    };
-    writeFileSync(initialSnapshotPath, JSON.stringify(initialSnapshot, null, 2));
-
-    // Arm the mock: corrupt the journal with garbage, then fail.
-    spawnMockState.handler = (_command, _args, options) => {
-      if (typeof options?.cwd === 'string') {
-        writeFileSync(join(options.cwd, 'db', 'migrations', 'meta', '_journal.json'), '{invalid');
-      }
-      return { status: 1, stdout: '', stderr: 'simulated drizzle-kit corruption' };
-    };
-
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
-      throw new Error('process.exit');
-    });
-    try {
-      await expect(
-        runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' }),
-      ).rejects.toThrow('process.exit');
-    } finally {
-      exitSpy.mockRestore();
-    }
-
-    // The corrupted bytes were replaced with the original snapshot —
-    // byte-identical to what was on disk before the run.
-    const afterBuffer = readFileSync(journalPath);
-    expect(afterBuffer.equals(expectedBuffer)).toBe(true);
-
-    // No orphan .sql or snapshot artifacts.
-    const sqlFiles = readdirSync(migrationsDir)
-      .filter((f) => f.endsWith('.sql'))
-      .sort();
-    expect(sqlFiles).toEqual(['20200101000000_initial.sql']);
-    const snapshotFiles = readdirSync(join(migrationsDir, 'meta'))
-      .filter((f) => f.endsWith('_snapshot.json'))
-      .sort();
     expect(snapshotFiles).toEqual(['20200101000000_snapshot.json']);
+    expect(readFileSync(journalPath, 'utf-8')).toBe(journalBefore);
+    expect(readFileSync(snapshotPath, 'utf-8')).toBe(snapshotBefore);
   });
 
-  // Yarn Berry PnP guard — under PnP, `node_modules` does not
-  // exist and dependencies resolve through `.pnp.cjs`. `runMigration`
-  // must inject the PnP loaders into the spawned child's NODE_OPTIONS
-  // so `drizzle-kit generate --custom` can resolve user imports like
-  // `void/schema-d1` from `db/schema.ts`. These tests pin that shape.
+  // Under Yarn PnP there is no node_modules, so drizzle-kit needs the PnP
+  // loaders to resolve `void/schema-*` imports from db/schema.ts.
   describe('Yarn PnP NODE_OPTIONS injection', () => {
-    // Seed a minimal journal-backed project so `runMigration` reaches
-    // the spawn call instead of bailing early.
-    function seedJournalBackedProject(): void {
-      seedSchema();
-      const migrationsDir = join(TMP, 'db', 'migrations');
-      mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-      const journalPath = join(migrationsDir, 'meta', '_journal.json');
-      const initialJournal = {
-        version: '7',
-        dialect: 'sqlite',
-        entries: [
-          {
-            idx: 0,
-            version: '6',
-            when: 1_700_000_000_000,
-            tag: '20200101000000_initial',
-            breakpoints: true,
-          },
-        ],
-      };
-      writeFileSync(journalPath, JSON.stringify(initialJournal, null, 2) + '\n');
-      writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-      writeFileSync(
-        join(migrationsDir, 'meta', '20200101000000_snapshot.json'),
-        JSON.stringify(
-          {
-            version: '6',
-            dialect: 'sqlite',
-            id: '11111111-1111-1111-1111-111111111111',
-            prevId: '00000000-0000-0000-0000-000000000000',
-            tables: {},
-          },
-          null,
-          2,
-        ),
-      );
-    }
-
-    // Normalize NODE_OPTIONS across each test so pre-existing values
-    // from the ambient vitest environment don't leak into assertions.
-    // Saved once per test and restored in afterEach.
     let savedNodeOptions: string | undefined;
     beforeEach(() => {
       savedNodeOptions = process.env.NODE_OPTIONS;
@@ -1889,18 +872,14 @@ describe('gen migration', () => {
 
       await runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' });
 
-      const generateCall = spawnMockState.calls.find(
-        (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-      );
+      const generateCall = findGenerateCall();
       expect(generateCall).toBeDefined();
-      const env = (generateCall!.options as { env?: NodeJS.ProcessEnv }).env;
+      const env = generateCall!.options.env;
       expect(env).toBeDefined();
       expect(typeof env!.NODE_OPTIONS).toBe('string');
       expect(env!.NODE_OPTIONS).toContain('--require');
-      // Path is JSON.stringify-quoted so spaces in the project path are
-      // handled by Node's NODE_OPTIONS parser.
+      // Quoted so Node's NODE_OPTIONS parser accepts spaces in the path.
       expect(env!.NODE_OPTIONS).toContain(JSON.stringify(toSlash(pnpCjsPath)));
-      // Without a `.pnp.loader.mjs` on disk, no loader flag is injected.
       expect(env!.NODE_OPTIONS).not.toContain('--experimental-loader');
     });
 
@@ -1913,144 +892,49 @@ describe('gen migration', () => {
 
       await runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' });
 
-      const generateCall = spawnMockState.calls.find(
-        (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-      );
+      const generateCall = findGenerateCall();
       expect(generateCall).toBeDefined();
-      const env = (generateCall!.options as { env?: NodeJS.ProcessEnv }).env;
+      const env = generateCall!.options.env;
       expect(env).toBeDefined();
       expect(typeof env!.NODE_OPTIONS).toBe('string');
       expect(env!.NODE_OPTIONS).toContain('--require');
       expect(env!.NODE_OPTIONS).toContain(JSON.stringify(toSlash(pnpCjsPath)));
       expect(env!.NODE_OPTIONS).toContain('--experimental-loader');
-      // The loader flag must be a file:// URL (Node requires a URL here,
-      // not a plain path). `pathToFileURL` produces the documented form.
+      // Node requires a file:// URL for the loader, not a path.
       expect(env!.NODE_OPTIONS).toContain(pathToFileURL(pnpLoaderPath).href);
     });
 
     it('leaves NODE_OPTIONS untouched when no PnP markers exist', async () => {
       seedJournalBackedProject();
-      // No `.pnp.cjs` or `.pnp.loader.mjs` on disk — non-PnP project.
 
       await runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' });
 
-      const generateCall = spawnMockState.calls.find(
-        (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-      );
+      const generateCall = findGenerateCall();
       expect(generateCall).toBeDefined();
-      const env = (generateCall!.options as { env?: NodeJS.ProcessEnv }).env;
-      // The child env is a clone of process.env (from the spread), so
-      // NODE_OPTIONS should match whatever the parent had — which the
-      // beforeEach normalized to `undefined`.
-      expect(env?.NODE_OPTIONS).toBeUndefined();
+      expect(generateCall!.options.env?.NODE_OPTIONS).toBeUndefined();
     });
 
     it('preserves pre-existing NODE_OPTIONS when injecting the PnP --require flag', async () => {
       seedJournalBackedProject();
       const pnpCjsPath = join(TMP, '.pnp.cjs');
       writeFileSync(pnpCjsPath, '// fake pnp shim\n');
-      // Simulate a user-set NODE_OPTIONS (e.g. extra heap for heavy
-      // projects). The PnP flag must come first so `--require .pnp.cjs`
-      // runs before anything the user registered.
       process.env.NODE_OPTIONS = '--max-old-space-size=4096';
 
       await runGenCommand(TMP, { subcommand: 'migration', name: 'backfill' });
 
-      const generateCall = spawnMockState.calls.find(
-        (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-      );
+      const generateCall = findGenerateCall();
       expect(generateCall).toBeDefined();
-      const env = (generateCall!.options as { env?: NodeJS.ProcessEnv }).env;
+      const env = generateCall!.options.env;
       expect(env).toBeDefined();
       expect(typeof env!.NODE_OPTIONS).toBe('string');
-      // Injected PnP flag comes first so `--require` runs before any
-      // user-registered requires/loaders.
+      // The PnP `--require` must run before anything the user registered.
       expect(env!.NODE_OPTIONS!.startsWith('--require ')).toBe(true);
       expect(env!.NODE_OPTIONS).toContain(JSON.stringify(toSlash(pnpCjsPath)));
-      // And the pre-existing user value is still there.
       expect(env!.NODE_OPTIONS).toContain('--max-old-space-size=4096');
     });
-
-    it('walks ancestors to find `.pnp.cjs` (workspace-root PnP, project is a subpackage)', async () => {
-      // Yarn PnP monorepos keep `.pnp.cjs` at the workspace
-      // root, not in each subpackage. The helper walks ancestors so
-      // this common shape works. Set up a nested "subpackage" under
-      // TMP and place `.pnp.cjs` one directory up from the project
-      // root to simulate the workspace layout.
-      const subProject = join(TMP, 'packages', 'app');
-      const workspaceRoot = join(TMP, 'packages');
-      mkdirSync(subProject, { recursive: true });
-      // Schema + journal must live inside the project that we hand to
-      // runGenCommand, not the workspace root.
-      const schemaPath = join(subProject, 'db', 'schema.ts');
-      mkdirSync(dirname(schemaPath), { recursive: true });
-      writeFileSync(
-        schemaPath,
-        'import { sqliteTable, text } from "drizzle-orm/sqlite-core";\nexport const t = sqliteTable("t", { a: text("a") });\n',
-      );
-      const migrationsDir = join(subProject, 'db', 'migrations');
-      mkdirSync(join(migrationsDir, 'meta'), { recursive: true });
-      writeFileSync(
-        join(migrationsDir, 'meta', '_journal.json'),
-        JSON.stringify(
-          {
-            version: '7',
-            dialect: 'sqlite',
-            entries: [
-              {
-                idx: 0,
-                version: '6',
-                when: 1_700_000_000_000,
-                tag: '20200101000000_initial',
-                breakpoints: true,
-              },
-            ],
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      writeFileSync(join(migrationsDir, '20200101000000_initial.sql'), '-- initial\n');
-      writeFileSync(
-        join(migrationsDir, 'meta', '20200101000000_snapshot.json'),
-        JSON.stringify(
-          {
-            version: '6',
-            dialect: 'sqlite',
-            id: '11111111-1111-1111-1111-111111111111',
-            prevId: '00000000-0000-0000-0000-000000000000',
-            tables: {},
-          },
-          null,
-          2,
-        ),
-      );
-      // `.pnp.cjs` is at the workspace root (the PARENT of the
-      // project) — NOT inside the project itself.
-      const pnpCjsPath = join(workspaceRoot, '.pnp.cjs');
-      writeFileSync(pnpCjsPath, '// fake pnp shim at workspace root\n');
-
-      await runGenCommand(subProject, { subcommand: 'migration', name: 'backfill' });
-
-      const generateCall = spawnMockState.calls.find(
-        (c) => Array.isArray(c.args) && c.args[1] === 'generate',
-      );
-      expect(generateCall).toBeDefined();
-      const env = (generateCall!.options as { env?: NodeJS.ProcessEnv }).env;
-      expect(env).toBeDefined();
-      expect(typeof env!.NODE_OPTIONS).toBe('string');
-      expect(env!.NODE_OPTIONS).toContain('--require');
-      // The helper must have found the ancestor `.pnp.cjs`, not
-      // anything inside the project directory.
-      expect(env!.NODE_OPTIONS).toContain(JSON.stringify(toSlash(pnpCjsPath)));
-    });
   });
 });
 
-// ---------------------------------------------------------------------------
-// gen route
-// ---------------------------------------------------------------------------
-
 describe('gen route', () => {
   it('keeps an existing route and prints no creation success when skipped', async () => {
     const path = join(TMP, 'routes/api/health.ts');
@@ -2091,7 +975,6 @@ describe('gen route', () => {
     expect(content).toContain('"GET api/users"');
     expect(content).toContain('"POST api/users"');
     expect(content).toContain('"DELETE api/users"');
-    // Should not contain methods that weren't requested
     expect(content).not.toContain('export const PUT');
     expect(content).not.toContain('export const PATCH');
   });
@@ -2120,10 +1003,6 @@ describe('gen route', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// gen middleware
-// ---------------------------------------------------------------------------
-
 describe('gen middleware', () => {
   it('generates numbered middleware file', async () => {
     await runGenCommand(TMP, { subcommand: 'middleware', name: 'auth' });
@@ -2150,10 +1029,6 @@ describe('gen middleware', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// gen ssr
-// ---------------------------------------------------------------------------
-
 describe('gen ssr', () => {
   it('generates React SSR files', async () => {
     await runGenCommand(TMP, { subcommand: 'ssr', framework: 'react' });
@@ -2246,22 +1121,12 @@ describe('gen ssr', () => {
     await runGenCommand(TMP, { subcommand: 'ssr', framework: 'react' });
 
     expect(readFileSync(join(TMP, 'src/App.tsx'), 'utf-8')).toBe('// my custom App');
-    // main.ssr.tsx and main.client.tsx are still created since they didn't exist
     expect(existsSync(join(TMP, 'src/main.ssr.tsx'))).toBe(true);
     expect(existsSync(join(TMP, 'src/main.client.tsx'))).toBe(true);
   });
 
   it('exits when no package.json and no framework flag', async () => {
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
-      throw new Error('process.exit');
-    });
-    try {
-      await expect(runGenCommand(TMP, { subcommand: 'ssr', framework: undefined })).rejects.toThrow(
-        'process.exit',
-      );
-    } finally {
-      exitSpy.mockRestore();
-    }
+    await expectExit({ subcommand: 'ssr', framework: undefined });
   });
 
   it('exits when package.json has no supported framework', async () => {
@@ -2271,23 +1136,10 @@ describe('gen ssr', () => {
       JSON.stringify({ dependencies: { angular: '^17.0.0' } }),
     );
 
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
-      throw new Error('process.exit');
-    });
-    try {
-      await expect(runGenCommand(TMP, { subcommand: 'ssr', framework: undefined })).rejects.toThrow(
-        'process.exit',
-      );
-    } finally {
-      exitSpy.mockRestore();
-    }
+    await expectExit({ subcommand: 'ssr', framework: undefined });
   });
 });
 
-// ---------------------------------------------------------------------------
-// gen cron
-// ---------------------------------------------------------------------------
-
 describe('gen cron', () => {
   it('generates cron job file with defineScheduled', async () => {
     mkdirSync(TMP, { recursive: true });
@@ -2310,10 +1162,6 @@ describe('gen cron', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// gen queue
-// ---------------------------------------------------------------------------
-
 describe('gen queue', () => {
   it('generates queue consumer file with defineQueue', async () => {
     mkdirSync(TMP, { recursive: true });
@@ -2338,10 +1186,6 @@ describe('gen queue', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// gen model (postgresql)
-// ---------------------------------------------------------------------------
-
 describe('gen model (postgresql)', () => {
   it('generates pgTable definition', async () => {
     writePkg({ valibot: '^1.0.0' });
@@ -2362,58 +1206,9 @@ describe('gen model (postgresql)', () => {
     expect(schema).toContain('timestamp("created_at").notNull().defaultNow()');
     expect(schema).toContain('text("title").notNull()');
     expect(schema).toContain('integer("views").notNull()');
-    // Should NOT contain SQLite-specific things
     expect(schema).not.toContain('sqliteTable');
     expect(schema).not.toContain('import { sql }');
   });
-
-  it('generates boolean and real as pg types', async () => {
-    writePkg({ valibot: '^1.0.0' });
-    writeFileSync(join(TMP, 'void.json'), JSON.stringify({ database: 'pg' }));
-
-    await runGenCommand(TMP, {
-      subcommand: 'model',
-      name: 'items',
-      columns: [
-        { name: 'active', type: 'boolean', nullable: false },
-        { name: 'price', type: 'real', nullable: false },
-      ],
-    });
-
-    const schema = read('db/schema/items.ts');
-    expect(schema).toContain('boolean("active")');
-    expect(schema).toContain('doublePrecision("price")');
-  });
-
-  it('generates routes with correct imports for pg model', async () => {
-    writePkg({ valibot: '^1.0.0' });
-    writeFileSync(join(TMP, 'void.json'), JSON.stringify({ database: 'pg' }));
-
-    await runGenCommand(TMP, {
-      subcommand: 'model',
-      name: 'posts',
-      columns: [{ name: 'title', type: 'string', nullable: false }],
-    });
-
-    const route = read('routes/api/posts/index.ts');
-    expect(route).toContain('import { defineHandler } from "void"');
-    expect(route).toContain('import { db } from "void/db"');
-    expect(route).toContain('import { posts } from "@schema"');
-  });
-
-  it('creates barrel export for pg model', async () => {
-    writePkg({ valibot: '^1.0.0' });
-    writeFileSync(join(TMP, 'void.json'), JSON.stringify({ database: 'pg' }));
-
-    await runGenCommand(TMP, {
-      subcommand: 'model',
-      name: 'posts',
-      columns: [{ name: 'title', type: 'string', nullable: false }],
-    });
-
-    const barrel = read('db/schema.ts');
-    expect(barrel).toContain('export * from "./schema/posts"');
-  });
 });
 
 describe('gen model (mysql)', () => {
diff --git a/packages/void/test/unit/generate-headers-redirects.test.ts b/packages/void/test/unit/generate-headers-redirects.test.ts
index 0a9ce20b4..bdd98f22d 100644
--- a/packages/void/test/unit/generate-headers-redirects.test.ts
+++ b/packages/void/test/unit/generate-headers-redirects.test.ts
@@ -167,33 +167,11 @@ describe('parseRedirectsFile', () => {
     ]);
   });
 
-  it('handles :splat destinations (preserved as-is)', () => {
-    setup('/blog/* /posts/:splat 301\n');
-    const parsed = parseRedirectsFile(tmpDir);
-    expect(parsed?.rules).toEqual([
-      { source: '/blog/*', destination: '/posts/:splat', status: 301, origin: '_redirects:1' },
-    ]);
-  });
-
   it('returns undefined for file with only comments', () => {
     setup('# just a comment\n# another one\n');
     expect(parseRedirectsFile(tmpDir)).toBeUndefined();
   });
 
-  it('parses file with only 200 rewrites', () => {
-    setup('/app/* /index.html 200\n');
-    const parsed = parseRedirectsFile(tmpDir);
-    expect(parsed?.rules).toEqual([
-      {
-        source: '/app/*',
-        destination: '/index.html',
-        status: 200,
-        force: false,
-        origin: '_redirects:1',
-      },
-    ]);
-  });
-
   it('skips non-200 non-3xx status codes', () => {
     setup('/old /new 404\n/ok /new 301\n');
     const parsed = parseRedirectsFile(tmpDir);
@@ -216,20 +194,6 @@ describe('parseRedirectsFile', () => {
     ]);
   });
 
-  it('skips 200 rewrites whose destination contains a query string', () => {
-    setup('/docs /en/docs?lang=en 200\n/app/* /index.html 200\n');
-    const parsed = parseRedirectsFile(tmpDir);
-    expect(parsed?.rules).toEqual([
-      {
-        source: '/app/*',
-        destination: '/index.html',
-        status: 200,
-        force: false,
-        origin: '_redirects:2',
-      },
-    ]);
-  });
-
   it('skips 200! rewrites whose destination contains a query string', () => {
     setup('/docs /en/docs?lang=en 200!\n');
     const parsed = parseRedirectsFile(tmpDir);
@@ -273,17 +237,8 @@ describe('parseRedirectsFile', () => {
     logSpy.mockRestore();
   });
 
-  it('tags origin with line number when destination is external (skipped)', () => {
-    setup('# header\n/fallback /spa.html 200\n');
-    const parsed = parseRedirectsFile(tmpDir);
-    expect(parsed?.rules[0].origin).toBe('_redirects:2');
-  });
-
   it('skips 200 rewrites whose destination is protocol-relative ("//host/x") and warns', () => {
-    // Symmetric with `c.rewrite()` codegen (compile.ts, commit 3c60d38) and
-    // the `void.json` rewrite/fallback validators. `//evil.com/x` passes the
-    // single-slash check but parses as a cross-origin URL at dispatch,
-    // silently turning an internal rewrite into a proxy.
+    // `//host` parses as a cross-origin URL, which would turn the rewrite into a proxy.
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     setup('/docs //evil.com/docs 200\n/app/* /index.html 200\n');
     const parsed = parseRedirectsFile(tmpDir);
@@ -393,56 +348,12 @@ describe('parseRedirectsFile', () => {
   });
 });
 
-describe('_redirects + void.json merge precedence (same source)', () => {
-  // Mirrors `mergeRoutingRules` (packages/void/src/cli/headers.ts):
-  //   redirectRules = [...redirects(void.json), ...rewrites(void.json), ...always(_redirects)]
-  // First-match-wins means void.json rules override _redirects rules when
-  // they share a source. Regression anchor for that contract — the merge
-  // site is simple array concat, but if someone reverses the order the
-  // silent override flips direction without failing the deploy.
-  it('places void.json rules first and _redirects last, so void.json wins under first-match-wins', async () => {
-    const { mergeRoutingRules } = await import('../../src/cli/headers.ts');
-
-    setup('/x /from-file 301\n');
-    // void.json has a same-source entry under both redirects and rewrites to
-    // cover both pre-asset origins.
-    const merged = mergeRoutingRules({
-      dir: tmpDir,
-      routing: {
-        redirects: { '/x': '/from-config-redirect' },
-        rewrites: { '/x': '/from-config-rewrite' },
-      },
-    });
-
-    expect(merged.redirectRules).toEqual([
-      {
-        source: '/x',
-        destination: '/from-config-redirect',
-        status: 302,
-        origin: 'void.json#routing.redirects',
-      },
-      {
-        source: '/x',
-        destination: '/from-config-rewrite',
-        status: 200,
-        force: true,
-        origin: 'void.json#routing.rewrites',
-      },
-      { source: '/x', destination: '/from-file', status: 301, origin: '_redirects:1' },
-    ]);
-
-    // No _redirects-file fallback entries in this fixture — sanity check
-    // that the fallback bucket doesn't accidentally pick up the 3xx entry.
-    expect(merged.fallbackRules).toBeUndefined();
-  });
-});
-
 describe('warnRedundantForceOn3xx', () => {
   // `parseRedirectsFile` tallies `!` suffixes on 3xx entries into
   // `redundantForceOn3xx` and strips them silently; the deploy pipeline
   // surfaces a single aggregated `log.warn` via `warnRedundantForceOn3xx`.
   it('skips emitting when the count is zero', async () => {
-    const { warnRedundantForceOn3xx } = await import('../../src/cli/deploy.ts');
+    const { warnRedundantForceOn3xx } = await import('../../src/cli/deploy-managed-events.ts');
     const { log } = await import('@voidzero-dev/vite-plus-prompts');
     const warnSpy = log.warn as ReturnType<typeof vi.fn>;
     warnSpy.mockClear();
@@ -453,7 +364,7 @@ describe('warnRedundantForceOn3xx', () => {
   });
 
   it('emits a single aggregated warning including the count when > 0', async () => {
-    const { warnRedundantForceOn3xx } = await import('../../src/cli/deploy.ts');
+    const { warnRedundantForceOn3xx } = await import('../../src/cli/deploy-managed-events.ts');
     const { log } = await import('@voidzero-dev/vite-plus-prompts');
     const warnSpy = log.warn as ReturnType<typeof vi.fn>;
     warnSpy.mockClear();
@@ -465,26 +376,3 @@ describe('warnRedundantForceOn3xx', () => {
     expect(warnSpy.mock.calls[0][0]).toContain('_redirects');
   });
 });
-
-describe('splitRedirectRulesByForce', () => {
-  it('returns empty buckets for undefined input', async () => {
-    const { splitRedirectRulesByForce } = await import('../../src/cli/headers.ts');
-    expect(splitRedirectRulesByForce(undefined)).toEqual({ always: [], fallbacks: [] });
-  });
-
-  it('bucketizes 200 (non-force) into fallbacks and 200! / 3xx into always', async () => {
-    const { splitRedirectRulesByForce } = await import('../../src/cli/headers.ts');
-    const split = splitRedirectRulesByForce([
-      { source: '/a', destination: '/spa.html', status: 200, force: false },
-      { source: '/b', destination: '/api', status: 200, force: true },
-      { source: '/c', destination: '/d', status: 301 },
-    ]);
-    expect(split.fallbacks).toEqual([
-      { source: '/a', destination: '/spa.html', status: 200, force: false },
-    ]);
-    expect(split.always).toEqual([
-      { source: '/b', destination: '/api', status: 200, force: true },
-      { source: '/c', destination: '/d', status: 301 },
-    ]);
-  });
-});
diff --git a/packages/void/test/unit/get-database-url.test.ts b/packages/void/test/unit/get-database-url.test.ts
index 8d0d47636..f2279dbe4 100644
--- a/packages/void/test/unit/get-database-url.test.ts
+++ b/packages/void/test/unit/get-database-url.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { PlatformClient, PlatformApiError } from '../../src/cli/client.ts';
+import { PlatformClient } from '../../src/cli/client.ts';
 import { withPlatformDiscovery } from '../helpers/platform-discovery.ts';
 
 const fetchMock = vi.fn();
@@ -25,19 +25,18 @@ function makeClient(): PlatformClient {
   return new PlatformClient(token, { apiUrl });
 }
 
-function jsonResponse(body: unknown, status = 200): Response {
+function jsonResponse(body: unknown): Response {
   return new Response(JSON.stringify(body), {
-    status,
     headers: { 'content-type': 'application/json' },
   });
 }
 
 describe('PlatformClient.getDatabaseUrl', () => {
-  it('GETs the correct URL with auth headers', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ url: 'postgres://user:pass@host/db' }));
+  it('GETs the database URL with auth headers and no body, and returns it', async () => {
+    const expected = 'postgres://user:pass@host:5432/mydb';
+    fetchMock.mockResolvedValueOnce(jsonResponse({ url: expected }));
 
-    const client = makeClient();
-    await client.getDatabaseUrl(projectId);
+    const result = await makeClient().getDatabaseUrl(projectId);
 
     expect(fetchMock).toHaveBeenCalledTimes(1);
     const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
@@ -45,45 +44,7 @@ describe('PlatformClient.getDatabaseUrl', () => {
     expect((init.method ?? 'GET').toUpperCase()).toBe('GET');
     const headers = init.headers as Record<string, string>;
     expect(headers.Authorization).toBe(`Bearer ${token}`);
-  });
-
-  it('returns the url from a successful response', async () => {
-    const expected = 'postgres://user:pass@host:5432/mydb';
-    fetchMock.mockResolvedValueOnce(jsonResponse({ url: expected }));
-
-    const client = makeClient();
-    const result = await client.getDatabaseUrl(projectId);
-
-    expect(result).toEqual({ url: expected });
-  });
-
-  it('throws PlatformApiError on 404 (database_url_not_stored)', async () => {
-    fetchMock.mockResolvedValue(
-      jsonResponse({ error: 'database_url_not_stored', message: 'No database URL stored.' }, 404),
-    );
-
-    const client = makeClient();
-    const err = await client.getDatabaseUrl(projectId).catch((e: unknown) => e);
-    expect(err).toBeInstanceOf(PlatformApiError);
-    expect((err as PlatformApiError).status).toBe(404);
-  });
-
-  it('throws PlatformApiError on 403 (ownership check failure)', async () => {
-    fetchMock.mockResolvedValue(jsonResponse({ error: 'forbidden' }, 403));
-
-    const client = makeClient();
-    const err = await client.getDatabaseUrl(projectId).catch((e: unknown) => e);
-    expect(err).toBeInstanceOf(PlatformApiError);
-    expect((err as PlatformApiError).status).toBe(403);
-  });
-
-  it('does not send a request body', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ url: 'postgres://host/db' }));
-
-    const client = makeClient();
-    await client.getDatabaseUrl(projectId);
-
-    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
     expect(init.body).toBeUndefined();
+    expect(result).toEqual({ url: expected });
   });
 });
diff --git a/packages/void/test/unit/get-user.test.ts b/packages/void/test/unit/get-user.test.ts
deleted file mode 100644
index 922e62e02..000000000
--- a/packages/void/test/unit/get-user.test.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import { describe, expect, it } from 'vite-plus/test';
-import {
-  getSession,
-  getUser,
-  authContext,
-  type AuthState,
-  type AuthUser,
-} from '../../src/runtime/auth.ts';
-
-function createUser(overrides: Partial<AuthUser> = {}): AuthUser {
-  return {
-    id: 'u1',
-    createdAt: new Date('2026-03-09T00:00:00Z'),
-    updatedAt: new Date('2026-03-09T00:00:00Z'),
-    email: 'test@example.com',
-    emailVerified: true,
-    name: 'Test User',
-    image: null,
-    ...overrides,
-  };
-}
-
-function createState(user: AuthUser = createUser()): AuthState {
-  return {
-    user,
-    session: {
-      id: 's1',
-      createdAt: new Date('2026-03-09T00:00:00Z'),
-      updatedAt: new Date('2026-03-09T00:00:00Z'),
-      token: 'token',
-      expiresAt: new Date('2026-03-10T00:00:00Z'),
-      ipAddress: null,
-      userAgent: null,
-      userId: user.id,
-    },
-  };
-}
-
-describe('getUser', () => {
-  it('returns null outside ALS context', () => {
-    expect(getUser()).toBeNull();
-  });
-
-  it('returns null when user is null', () => {
-    authContext.run({ user: null, state: null }, () => {
-      expect(getUser()).toBeNull();
-    });
-  });
-
-  it('returns user from ALS context', () => {
-    const user = createUser();
-    authContext.run({ user, state: createState(user) }, () => {
-      expect(getUser()).toBe(user);
-    });
-  });
-});
-
-describe('getSession', () => {
-  it('returns null outside ALS context', () => {
-    expect(getSession()).toBeNull();
-  });
-
-  it('returns the auth state from ALS context', () => {
-    const user = createUser();
-    const state = createState(user);
-    authContext.run({ user, state }, () => {
-      expect(getSession()).toBe(state);
-    });
-  });
-});
diff --git a/packages/void/test/unit/git-metadata.test.ts b/packages/void/test/unit/git-metadata.test.ts
index 48a51464b..349f521db 100644
--- a/packages/void/test/unit/git-metadata.test.ts
+++ b/packages/void/test/unit/git-metadata.test.ts
@@ -33,19 +33,13 @@ describe('git deploy metadata', () => {
     );
   });
 
-  // The two git children here run right beside `getGitCommit`, which has
-  // scrubbed the CF Access service-token pair since it was written. These
-  // inherited `process.env` verbatim instead — `execFileSync` with no `env` —
-  // so the pair reached any repo-configured hook or credential helper they
-  // triggered. `childEnv` is what `void deploy` scrubs.
+  // Git hooks and credential helpers must see childEnv, not process.env.
   it.skipIf(process.platform === 'win32')('runs the git children under childEnv', () => {
     const dir = mkdtempSync(join(tmpdir(), 'void-git-meta-'));
     const saved = process.env.CF_ACCESS_CLIENT_SECRET;
     try {
       mkdirSync(join(dir, 'bin'), { recursive: true });
       const shim = join(dir, 'bin', 'git');
-      // Reports back whatever the CHILD's env holds, so an inherited secret is
-      // visible in the return value instead of having to be inferred.
       writeFileSync(shim, '#!/bin/sh\necho "seen=${CF_ACCESS_CLIENT_SECRET:-none}"\n');
       chmodSync(shim, 0o755);
       process.env.CF_ACCESS_CLIENT_SECRET = 'svc-secret.access';
@@ -53,9 +47,7 @@ describe('git deploy metadata', () => {
       const scrubbed = collectGitDeployMetadata(dir, null, {}, { PATH: join(dir, 'bin') });
       expect(scrubbed.gitRef).toBe('seen=none');
 
-      // Control: the same shim DOES see it when the child env carries it, so
-      // the assertion above is about the env we handed over, not about the
-      // shim failing to run.
+      // Control: the shim does run and report the child env.
       const leaked = collectGitDeployMetadata(
         dir,
         null,
diff --git a/packages/void/test/unit/github-args.test.ts b/packages/void/test/unit/github-args.test.ts
index 621a4bc2c..337380f12 100644
--- a/packages/void/test/unit/github-args.test.ts
+++ b/packages/void/test/unit/github-args.test.ts
@@ -2,38 +2,14 @@ import { describe, expect, it } from 'vite-plus/test';
 import { parseGithubArgs } from '../../src/cli/github-args.ts';
 
 describe('parseGithubArgs', () => {
-  describe('install', () => {
-    it('parses install with no args', () => {
-      expect(parseGithubArgs(['install'])).toEqual({ subcommand: 'install' });
+  describe.each(['install', 'installations', 'link', 'join'] as const)('%s', (subcommand) => {
+    it('parses with no args', () => {
+      expect(parseGithubArgs([subcommand])).toEqual({ subcommand });
     });
 
-    it('rejects extra positional', () => {
-      expect(() => parseGithubArgs(['install', 'extra'])).toThrow(
-        "github: Unexpected argument 'extra'.",
-      );
-    });
-
-    it('rejects a flag', () => {
-      expect(() => parseGithubArgs(['install', '--flag'])).toThrow(
-        "github: Unexpected argument '--flag'.",
-      );
-    });
-  });
-
-  describe('installations', () => {
-    it('parses installations with no args', () => {
-      expect(parseGithubArgs(['installations'])).toEqual({ subcommand: 'installations' });
-    });
-
-    it('rejects extra positional', () => {
-      expect(() => parseGithubArgs(['installations', 'extra'])).toThrow(
-        "github: Unexpected argument 'extra'.",
-      );
-    });
-
-    it('rejects a flag', () => {
-      expect(() => parseGithubArgs(['installations', '--flag'])).toThrow(
-        "github: Unexpected argument '--flag'.",
+    it.each(['extra', '--flag'])('rejects %s', (arg) => {
+      expect(() => parseGithubArgs([subcommand, arg])).toThrow(
+        `github: Unexpected argument '${arg}'.`,
       );
     });
   });
@@ -97,30 +73,6 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('parses --executor container', () => {
-      const result = parseGithubArgs(['connect', '--executor', 'container']);
-      expect(result).toEqual({
-        subcommand: 'connect',
-        projectName: '',
-        installationId: undefined,
-        repo: undefined,
-        branch: undefined,
-        executor: 'container',
-      });
-    });
-
-    it('parses --executor github_actions', () => {
-      const result = parseGithubArgs(['connect', '--executor', 'github_actions']);
-      expect(result).toEqual({
-        subcommand: 'connect',
-        projectName: '',
-        installationId: undefined,
-        repo: undefined,
-        branch: undefined,
-        executor: 'github_actions',
-      });
-    });
-
     it('parses --workflow', () => {
       const result = parseGithubArgs(['connect', '--workflow', '.github/workflows/ci.yml']);
       expect(result).toEqual({
@@ -134,12 +86,6 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('throws when --workflow has no value', () => {
-      expect(() => parseGithubArgs(['connect', '--workflow'])).toThrow(
-        'github: --workflow requires a value.',
-      );
-    });
-
     it('parses --project flag', () => {
       const result = parseGithubArgs(['connect', '--project', 'my-project']);
       expect(result).toEqual({
@@ -152,12 +98,6 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('--project flag is an alias for the positional', () => {
-      const positional = parseGithubArgs(['connect', 'my-project']);
-      const flag = parseGithubArgs(['connect', '--project', 'my-project']);
-      expect(flag).toEqual(positional);
-    });
-
     it('rejects --project when positional already set', () => {
       expect(() => parseGithubArgs(['connect', 'my-project', '--project', 'other'])).toThrow(
         "github: Unexpected argument 'other'.",
@@ -194,103 +134,6 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('parses all flags together with --project flag', () => {
-      expect(
-        parseGithubArgs([
-          'connect',
-          '--project',
-          'my-project',
-          '--installation',
-          '42',
-          '--repo',
-          'owner/repo',
-          '--branch',
-          'main',
-          '--executor',
-          'container',
-        ]),
-      ).toEqual({
-        subcommand: 'connect',
-        projectName: 'my-project',
-        installationId: '42',
-        repo: 'owner/repo',
-        branch: 'main',
-        executor: 'container',
-      });
-    });
-
-    it('rejects --installation with no value', () => {
-      expect(() => parseGithubArgs(['connect', '--installation'])).toThrow(
-        'github: --installation requires a value.',
-      );
-    });
-
-    it('rejects --installation with empty value', () => {
-      expect(() => parseGithubArgs(['connect', '--installation', ''])).toThrow(
-        'github: --installation requires a value.',
-      );
-    });
-
-    it('rejects --installation with whitespace-only value', () => {
-      expect(() => parseGithubArgs(['connect', '--installation', '   '])).toThrow(
-        'github: --installation requires a value.',
-      );
-    });
-
-    it('rejects --repo with no value', () => {
-      expect(() => parseGithubArgs(['connect', '--repo'])).toThrow(
-        'github: --repo requires a value.',
-      );
-    });
-
-    it('rejects --repo with empty value', () => {
-      expect(() => parseGithubArgs(['connect', '--repo', ''])).toThrow(
-        'github: --repo requires a value.',
-      );
-    });
-
-    it('rejects --branch with no value', () => {
-      expect(() => parseGithubArgs(['connect', '--branch'])).toThrow(
-        'github: --branch requires a value.',
-      );
-    });
-
-    it('rejects --branch with empty value', () => {
-      expect(() => parseGithubArgs(['connect', '--branch', ''])).toThrow(
-        'github: --branch requires a value.',
-      );
-    });
-
-    it('rejects --project with no value', () => {
-      expect(() => parseGithubArgs(['connect', '--project'])).toThrow(
-        'github: --project requires a value.',
-      );
-    });
-
-    it('rejects --project with empty value', () => {
-      expect(() => parseGithubArgs(['connect', '--project', ''])).toThrow(
-        'github: --project requires a value.',
-      );
-    });
-
-    it('rejects --executor with no value', () => {
-      expect(() => parseGithubArgs(['connect', '--executor'])).toThrow(
-        'github: --executor requires a value.',
-      );
-    });
-
-    it('rejects --executor with empty value', () => {
-      expect(() => parseGithubArgs(['connect', '--executor', ''])).toThrow(
-        'github: --executor requires a value.',
-      );
-    });
-
-    it('rejects invalid --executor value', () => {
-      expect(() => parseGithubArgs(['connect', '--executor', 'docker'])).toThrow(
-        'github: invalid --executor (expected container|github_actions).',
-      );
-    });
-
     it('rejects unknown flag', () => {
       expect(() => parseGithubArgs(['connect', '--unknown'])).toThrow(
         "github: Unexpected argument '--unknown'.",
@@ -332,12 +175,6 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('--project flag is an alias for the positional', () => {
-      const positional = parseGithubArgs(['update', 'my-project']);
-      const flag = parseGithubArgs(['update', '--project', 'my-project']);
-      expect(flag).toEqual(positional);
-    });
-
     it('parses --branch flag', () => {
       expect(parseGithubArgs(['update', '--branch', 'release'])).toEqual({
         subcommand: 'update',
@@ -356,30 +193,6 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('rejects --branch with whitespace-only value', () => {
-      expect(() => parseGithubArgs(['update', '--branch', '   '])).toThrow(
-        'github: --branch requires a value.',
-      );
-    });
-
-    it('parses --executor container', () => {
-      expect(parseGithubArgs(['update', '--executor', 'container'])).toEqual({
-        subcommand: 'update',
-        projectName: '',
-        branch: undefined,
-        executor: 'container',
-      });
-    });
-
-    it('parses --executor github_actions', () => {
-      expect(parseGithubArgs(['update', '--executor', 'github_actions'])).toEqual({
-        subcommand: 'update',
-        projectName: '',
-        branch: undefined,
-        executor: 'github_actions',
-      });
-    });
-
     it('parses --workflow', () => {
       expect(parseGithubArgs(['update', '--workflow', '.github/workflows/ci.yml'])).toEqual({
         subcommand: 'update',
@@ -390,12 +203,6 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('throws when --workflow has no value', () => {
-      expect(() => parseGithubArgs(['update', '--workflow'])).toThrow(
-        'github: --workflow requires a value.',
-      );
-    });
-
     it('parses project name with both flags together', () => {
       expect(
         parseGithubArgs([
@@ -414,42 +221,12 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('rejects --branch with no value', () => {
-      expect(() => parseGithubArgs(['update', '--branch'])).toThrow(
-        'github: --branch requires a value.',
-      );
-    });
-
-    it('rejects --branch with empty value', () => {
-      expect(() => parseGithubArgs(['update', '--branch', ''])).toThrow(
-        'github: --branch requires a value.',
-      );
-    });
-
-    it('rejects --project with no value', () => {
-      expect(() => parseGithubArgs(['update', '--project'])).toThrow(
-        'github: --project requires a value.',
-      );
-    });
-
     it('rejects --project when positional already set', () => {
       expect(() => parseGithubArgs(['update', 'my-project', '--project', 'other'])).toThrow(
         "github: Unexpected argument 'other'.",
       );
     });
 
-    it('rejects --executor with no value', () => {
-      expect(() => parseGithubArgs(['update', '--executor'])).toThrow(
-        'github: --executor requires a value.',
-      );
-    });
-
-    it('rejects invalid --executor value', () => {
-      expect(() => parseGithubArgs(['update', '--executor', 'docker'])).toThrow(
-        'github: invalid --executor (expected container|github_actions).',
-      );
-    });
-
     it('rejects unknown flag', () => {
       expect(() => parseGithubArgs(['update', '--unknown'])).toThrow(
         "github: Unexpected argument '--unknown'.",
@@ -463,6 +240,22 @@ describe('parseGithubArgs', () => {
     });
   });
 
+  describe.each(['connect', 'update'] as const)('%s --executor', (subcommand) => {
+    it.each(['container', 'github_actions'] as const)('parses %s', (executor) => {
+      expect(parseGithubArgs([subcommand, '--executor', executor])).toEqual({
+        subcommand,
+        projectName: '',
+        executor,
+      });
+    });
+
+    it('rejects an invalid value', () => {
+      expect(() => parseGithubArgs([subcommand, '--executor', 'docker'])).toThrow(
+        'github: invalid --executor (expected container|github_actions).',
+      );
+    });
+  });
+
   describe('status', () => {
     it('parses status with no args', () => {
       expect(parseGithubArgs(['status'])).toEqual({
@@ -485,24 +278,12 @@ describe('parseGithubArgs', () => {
       });
     });
 
-    it('--project flag is an alias for the positional', () => {
-      const positional = parseGithubArgs(['status', 'my-project']);
-      const flag = parseGithubArgs(['status', '--project', 'my-project']);
-      expect(flag).toEqual(positional);
-    });
-
     it('rejects --project when positional already set', () => {
       expect(() => parseGithubArgs(['status', 'my-project', '--project', 'other'])).toThrow(
         "github: Unexpected argument 'other'.",
       );
     });
 
-    it('rejects --project with no value', () => {
-      expect(() => parseGithubArgs(['status', '--project'])).toThrow(
-        'github: --project requires a value.',
-      );
-    });
-
     it('rejects an unknown flag', () => {
       expect(() => parseGithubArgs(['status', '--nope'])).toThrow(
         "github: Unexpected argument '--nope'.",
@@ -565,46 +346,32 @@ describe('parseGithubArgs', () => {
         "github: Unexpected argument '--nope'.",
       );
     });
-
-    it('throws when --project has no value', () => {
-      expect(() => parseGithubArgs(['disconnect', '--project'])).toThrow(
-        'github: --project requires a value.',
-      );
-    });
   });
 
-  describe('link', () => {
-    it('parses link with no args', () => {
-      expect(parseGithubArgs(['link'])).toEqual({ subcommand: 'link' });
-    });
-
-    it('rejects extra positional', () => {
-      expect(() => parseGithubArgs(['link', 'extra'])).toThrow(
-        "github: Unexpected argument 'extra'.",
-      );
-    });
-
-    it('rejects a flag', () => {
-      expect(() => parseGithubArgs(['link', '--flag'])).toThrow(
-        "github: Unexpected argument '--flag'.",
-      );
-    });
-  });
-
-  describe('join', () => {
-    it('parses join with no args', () => {
-      expect(parseGithubArgs(['join'])).toEqual({ subcommand: 'join' });
-    });
-
-    it('rejects extra positional', () => {
-      expect(() => parseGithubArgs(['join', 'x'])).toThrow("github: Unexpected argument 'x'.");
-    });
-
-    it('rejects a flag', () => {
-      expect(() => parseGithubArgs(['join', '--flag'])).toThrow(
-        "github: Unexpected argument '--flag'.",
-      );
-    });
+  it.each<[subcommand: string, flag: string, value: string | undefined]>([
+    ['connect', '--installation', undefined],
+    ['connect', '--installation', ''],
+    ['connect', '--installation', '   '],
+    ['connect', '--repo', undefined],
+    ['connect', '--repo', ''],
+    ['connect', '--branch', undefined],
+    ['connect', '--branch', ''],
+    ['connect', '--executor', undefined],
+    ['connect', '--executor', ''],
+    ['connect', '--workflow', undefined],
+    ['connect', '--project', undefined],
+    ['connect', '--project', ''],
+    ['update', '--branch', undefined],
+    ['update', '--branch', ''],
+    ['update', '--branch', '   '],
+    ['update', '--executor', undefined],
+    ['update', '--workflow', undefined],
+    ['update', '--project', undefined],
+    ['status', '--project', undefined],
+    ['disconnect', '--project', undefined],
+  ])('%s %s rejects the value %j', (subcommand, flag, value) => {
+    const args = value === undefined ? [subcommand, flag] : [subcommand, flag, value];
+    expect(() => parseGithubArgs(args)).toThrow(`github: ${flag} requires a value.`);
   });
 
   describe('unknown subcommand', () => {
diff --git a/packages/void/test/unit/github-client.test.ts b/packages/void/test/unit/github-client.test.ts
index 2f18292e2..5d49dee6f 100644
--- a/packages/void/test/unit/github-client.test.ts
+++ b/packages/void/test/unit/github-client.test.ts
@@ -1,9 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import {
-  PlatformClient,
-  type GithubConnection,
-  type GithubInstallation,
-} from '../../src/cli/client.ts';
+import { PlatformClient, type GithubInstallation } from '../../src/cli/client.ts';
+import { makeConnection, projectId } from '../helpers/github-cli.ts';
 import { withPlatformDiscovery } from '../helpers/platform-discovery.ts';
 
 const fetchMock = vi.fn();
@@ -23,7 +20,6 @@ afterEach(() => {
 
 const apiUrl = 'https://api.test';
 const token = 'auth-token-x';
-const projectId = 'proj_test';
 
 function makeClient(): PlatformClient {
   return new PlatformClient(token, { apiUrl });
@@ -98,17 +94,7 @@ describe('PlatformClient.listGithubInstallations', () => {
 
 describe('PlatformClient.connectGithub', () => {
   it('POSTs the right URL with Content-Type and exact JSON body, returns parsed connection', async () => {
-    const connection: GithubConnection = {
-      id: 'conn_1',
-      project_id: projectId,
-      installation_id: '123456',
-      repo_full_name: 'octocat/hello-world',
-      branch: 'main',
-      build_executor: 'container',
-      workflow_path: '.github/workflows/void-deploy.yml',
-      created_at: '2024-01-01T00:00:00Z',
-      updated_at: '2024-01-01T00:00:00Z',
-    };
+    const connection = makeConnection();
 
     fetchMock.mockResolvedValueOnce(jsonResponse(connection));
 
@@ -135,85 +121,6 @@ describe('PlatformClient.connectGithub', () => {
     });
     expect(result).toEqual(connection);
   });
-
-  it('omits optional fields from JSON body when not provided', async () => {
-    const connection: GithubConnection = {
-      id: 'conn_2',
-      project_id: projectId,
-      installation_id: '123456',
-      repo_full_name: 'octocat/hello-world',
-      branch: 'main',
-      build_executor: 'container',
-      workflow_path: '.github/workflows/void-deploy.yml',
-      created_at: '2024-01-01T00:00:00Z',
-      updated_at: '2024-01-01T00:00:00Z',
-    };
-
-    fetchMock.mockResolvedValueOnce(jsonResponse(connection));
-
-    const client = makeClient();
-    await client.connectGithub(projectId, {
-      installationId: '123456',
-      repoFullName: 'octocat/hello-world',
-    });
-
-    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    expect(JSON.parse(init.body as string)).toEqual({
-      installationId: '123456',
-      repoFullName: 'octocat/hello-world',
-    });
-  });
-
-  it('includes connectGrant + codeVerifier in the JSON body when provided', async () => {
-    const connection: GithubConnection = {
-      id: 'conn_3',
-      project_id: projectId,
-      installation_id: '123456',
-      repo_full_name: 'octocat/hello-world',
-      branch: 'main',
-      build_executor: 'container',
-      workflow_path: '.github/workflows/void-deploy.yml',
-      created_at: '2024-01-01T00:00:00Z',
-      updated_at: '2024-01-01T00:00:00Z',
-    };
-
-    fetchMock.mockResolvedValueOnce(jsonResponse(connection));
-
-    const client = makeClient();
-    const result = await client.connectGithub(projectId, {
-      installationId: '123456',
-      repoFullName: 'octocat/hello-world',
-      branch: 'main',
-      buildExecutor: 'container',
-      connectGrant: 'grant-abc',
-      codeVerifier: 'verifier-abc',
-    });
-
-    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    expect(JSON.parse(init.body as string)).toEqual({
-      installationId: '123456',
-      repoFullName: 'octocat/hello-world',
-      branch: 'main',
-      buildExecutor: 'container',
-      connectGrant: 'grant-abc',
-      codeVerifier: 'verifier-abc',
-    });
-    expect(result).toEqual(connection);
-  });
-
-  it('throws PlatformApiError on non-2xx', async () => {
-    fetchMock.mockResolvedValueOnce(new Response('not found', { status: 404 }));
-    const client = makeClient();
-    await expect(
-      client.connectGithub(projectId, {
-        installationId: '123456',
-        repoFullName: 'octocat/hello-world',
-      }),
-    ).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 404,
-    });
-  });
 });
 
 describe('PlatformClient.getGithubConnectAuthorizeUrl', () => {
@@ -261,17 +168,7 @@ describe('PlatformClient.getGithubConnectAuthorizeUrl', () => {
 
 describe('PlatformClient.getGithubConnection', () => {
   it('GETs the right URL, sends auth headers, returns the parsed connection', async () => {
-    const connection: GithubConnection = {
-      id: 'conn_1',
-      project_id: projectId,
-      installation_id: '123456',
-      repo_full_name: 'octocat/hello-world',
-      branch: 'main',
-      build_executor: 'container',
-      workflow_path: '.github/workflows/void-deploy.yml',
-      created_at: '2024-01-01T00:00:00Z',
-      updated_at: '2024-01-01T00:00:00Z',
-    };
+    const connection = makeConnection();
 
     fetchMock.mockResolvedValueOnce(jsonResponse(connection));
 
@@ -286,31 +183,11 @@ describe('PlatformClient.getGithubConnection', () => {
     expect(headers.Authorization).toBe(`Bearer ${token}`);
     expect(result).toEqual(connection);
   });
-
-  it('throws PlatformApiError on non-2xx (e.g. 404 connection not found)', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ error: 'connection not found' }, 404));
-    const client = makeClient();
-    await expect(client.getGithubConnection(projectId)).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 404,
-      code: 'connection not found',
-    });
-  });
 });
 
 describe('PlatformClient.updateGithubConnection', () => {
   it('PATCHes the right URL with Content-Type and exact JSON body, returns parsed connection', async () => {
-    const connection: GithubConnection = {
-      id: 'conn_1',
-      project_id: projectId,
-      installation_id: '123456',
-      repo_full_name: 'octocat/hello-world',
-      branch: 'release',
-      build_executor: 'github_actions',
-      workflow_path: '.github/workflows/void-deploy.yml',
-      created_at: '2024-01-01T00:00:00Z',
-      updated_at: '2024-01-02T00:00:00Z',
-    };
+    const connection = makeConnection({ branch: 'release', build_executor: 'github_actions' });
 
     fetchMock.mockResolvedValueOnce(jsonResponse(connection));
 
@@ -333,39 +210,6 @@ describe('PlatformClient.updateGithubConnection', () => {
     });
     expect(result).toEqual(connection);
   });
-
-  it('sends only the fields provided (executor only)', async () => {
-    const connection: GithubConnection = {
-      id: 'conn_2',
-      project_id: projectId,
-      installation_id: '123456',
-      repo_full_name: 'octocat/hello-world',
-      branch: 'main',
-      build_executor: 'github_actions',
-      workflow_path: '.github/workflows/void-deploy.yml',
-      created_at: '2024-01-01T00:00:00Z',
-      updated_at: '2024-01-02T00:00:00Z',
-    };
-
-    fetchMock.mockResolvedValueOnce(jsonResponse(connection));
-
-    const client = makeClient();
-    await client.updateGithubConnection(projectId, { buildExecutor: 'github_actions' });
-
-    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    expect(JSON.parse(init.body as string)).toEqual({ buildExecutor: 'github_actions' });
-  });
-
-  it('throws PlatformApiError on non-2xx', async () => {
-    fetchMock.mockResolvedValueOnce(new Response('not found', { status: 404 }));
-    const client = makeClient();
-    await expect(
-      client.updateGithubConnection(projectId, { branch: 'main' }),
-    ).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 404,
-    });
-  });
 });
 
 describe('PlatformClient.deleteGithubConnection', () => {
@@ -384,15 +228,6 @@ describe('PlatformClient.deleteGithubConnection', () => {
     expect(headers.Authorization).toBe(`Bearer ${token}`);
     expect(result).toEqual({ ok: true });
   });
-
-  it('throws PlatformApiError on non-2xx', async () => {
-    fetchMock.mockResolvedValueOnce(new Response('forbidden', { status: 403 }));
-    const client = makeClient();
-    await expect(client.deleteGithubConnection(projectId)).rejects.toMatchObject({
-      name: 'PlatformApiError',
-      status: 403,
-    });
-  });
 });
 
 describe('PlatformClient.getGithubLinkUrl', () => {
@@ -451,13 +286,6 @@ describe('PlatformClient.completeGithubLink', () => {
     expect(result).toEqual({ status: 'linked' });
   });
 
-  it('returns already_linked status', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ status: 'already_linked' }));
-    const client = makeClient();
-    const result = await client.completeGithubLink('link-code-2', 'verifier-2');
-    expect(result).toEqual({ status: 'already_linked' });
-  });
-
   it('throws PlatformApiError with status 409 and code on github_identity_conflict', async () => {
     fetchMock.mockResolvedValueOnce(jsonResponse({ error: 'github_identity_conflict' }, 409));
     const client = makeClient();
@@ -526,13 +354,6 @@ describe('PlatformClient.completeGithubJoin', () => {
     expect(result).toEqual({ status: 'joined', count: 3 });
   });
 
-  it('returns a zero count', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ status: 'joined', count: 0 }));
-    const client = makeClient();
-    const result = await client.completeGithubJoin('join-code-2', 'verifier-2');
-    expect(result).toEqual({ status: 'joined', count: 0 });
-  });
-
   it('throws PlatformApiError on non-2xx', async () => {
     fetchMock.mockResolvedValueOnce(new Response('boom', { status: 500 }));
     const client = makeClient();
diff --git a/packages/void/test/unit/github-connect-cmd.test.ts b/packages/void/test/unit/github-connect-cmd.test.ts
index 38e666d5e..6ebb90759 100644
--- a/packages/void/test/unit/github-connect-cmd.test.ts
+++ b/packages/void/test/unit/github-connect-cmd.test.ts
@@ -3,22 +3,24 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test'
 import { createCodeChallenge } from '../../src/cli/auth.ts';
 import {
   PlatformApiError,
-  type GithubConnection,
   type GithubInstallation,
   type PlatformClient,
-  type ProjectResponse,
 } from '../../src/cli/client.ts';
 import * as gitMetadata from '../../src/cli/git-metadata.ts';
 import type { GithubArgs } from '../../src/cli/github-args.ts';
 import { runConnect } from '../../src/cli/github-cmd.ts';
 import * as output from '../../src/cli/output.ts';
+import {
+  browserCallback,
+  makeConnection,
+  makeProject,
+  projectId,
+  slug,
+  throwOnProcessExit,
+} from '../helpers/github-cli.ts';
 
-// Mock node:child_process so openBrowser (called by awaitBrowserCallback) never
-// launches a real browser; the localhost callback is driven directly by fetch.
-const mockExecFile = vi.fn();
-vi.mock('node:child_process', () => ({
-  execFile: (...args: Array<unknown>) => mockExecFile(...args),
-}));
+// Keep openBrowser from launching a real browser.
+vi.mock('node:child_process', () => ({ execFile: vi.fn() }));
 
 // Partial mock of @voidzero-dev/vite-plus-prompts: only `text` is replaced (for the repo
 // prompt); everything else — including `log`, which the spies below target —
@@ -29,25 +31,9 @@ vi.mock('@voidzero-dev/vite-plus-prompts', async (importOriginal) => {
   return { ...actual, text: (...args: Array<unknown>) => mockText(...args) };
 });
 
-const originalFetch = globalThis.fetch.bind(globalThis);
-
-const projectId = 'proj_test';
-const slug = 'my-app';
 const installationId = '123456';
 const repoFullName = 'octocat/hello-world';
 
-function makeProject(): ProjectResponse {
-  return {
-    id: projectId,
-    user_id: 'user_1',
-    slug,
-    type: 'void',
-    created_at: '2024-01-01T00:00:00Z',
-    custom_domain: null,
-    role: 'owner',
-  };
-}
-
 function makeInstallation(): GithubInstallation {
   return {
     id: 'install_1',
@@ -63,21 +49,6 @@ function makeInstallation(): GithubInstallation {
   };
 }
 
-function makeConnection(overrides: Partial<GithubConnection> = {}): GithubConnection {
-  return {
-    id: 'conn_1',
-    project_id: projectId,
-    installation_id: installationId,
-    repo_full_name: repoFullName,
-    branch: 'main',
-    build_executor: 'container',
-    workflow_path: '.github/workflows/void-deploy.yml',
-    created_at: '2024-01-01T00:00:00Z',
-    updated_at: '2024-01-01T00:00:00Z',
-    ...overrides,
-  };
-}
-
 function authRequired(): PlatformApiError {
   return new PlatformApiError(
     'Failed to connect GitHub repository',
@@ -95,15 +66,12 @@ const baseArgs: Extract<GithubArgs, { subcommand: 'connect' }> = {
 };
 
 /**
- * Drive runConnect against a fake client. `getGithubConnectAuthorizeUrl` (the
- * round-trip URL builder) resolves the localhost callback URL the moment the
- * command requests it, so the test can POST back to the callback with whatever
- * query it wants (mirroring the link/join command tests). When `callbackQuery`
- * is omitted the round-trip is never expected to start, so no callback fires.
+ * Runs runConnect against a fake client. `callbackQuery` and `joinCallbackQuery`
+ * build the browser redirects for the connect-authorize and join round-trips;
+ * when one is omitted, that round-trip sends no redirect.
  */
 function driveConnect(opts: {
   connectGithub: ReturnType<typeof vi.fn>;
-  getGithubConnectAuthorizeUrl?: ReturnType<typeof vi.fn>;
   callbackQuery?: (callbackUrl: URL) => URL;
   listGithubInstallations?: ReturnType<typeof vi.fn>;
   getGithubJoinUrl?: ReturnType<typeof vi.fn>;
@@ -118,33 +86,11 @@ function driveConnect(opts: {
   getGithubJoinUrl: ReturnType<typeof vi.fn>;
   completeGithubJoin: ReturnType<typeof vi.fn>;
 } {
-  let resolveCallback: ((url: URL) => void) | undefined;
-  const callbackReady = new Promise<URL>((resolve) => {
-    resolveCallback = resolve;
-  });
-
-  const getGithubConnectAuthorizeUrl =
-    opts.getGithubConnectAuthorizeUrl ??
-    vi.fn(async (redirect: string) => {
-      // `redirect` is the localhost callback URL (with the command's state).
-      resolveCallback?.(new URL(redirect));
-      return { url: 'https://github.com/login/oauth/authorize?client_id=x' };
-    });
-
-  let resolveJoinCallback: ((url: URL) => void) | undefined;
-  const joinCallbackReady = new Promise<URL>((resolve) => {
-    resolveJoinCallback = resolve;
-  });
-
-  const getGithubJoinUrl =
-    opts.getGithubJoinUrl ??
-    vi.fn(async (redirect: string) => {
-      resolveJoinCallback?.(new URL(redirect));
-      return { url: 'https://github.com/login/oauth/authorize?client_id=x' };
-    });
+  const connect = browserCallback(opts.callbackQuery);
+  const join = browserCallback(opts.joinCallbackQuery);
+  const getGithubJoinUrl = opts.getGithubJoinUrl ?? join.authUrl;
   const completeGithubJoin =
     opts.completeGithubJoin ?? vi.fn(async () => ({ status: 'joined', count: 0 }));
-
   const listGithubInstallations =
     opts.listGithubInstallations ?? vi.fn(async () => [makeInstallation()]);
 
@@ -152,34 +98,17 @@ function driveConnect(opts: {
     listProjects: vi.fn(async () => [makeProject()]),
     listGithubInstallations,
     connectGithub: opts.connectGithub,
-    getGithubConnectAuthorizeUrl,
+    getGithubConnectAuthorizeUrl: connect.authUrl,
     getGithubJoinUrl,
     completeGithubJoin,
   } as unknown as PlatformClient;
 
   const run = runConnect('/project', client, { ...baseArgs, ...opts.args });
 
-  // Fire the simulated browser redirect once the round-trip's callback URL is
-  // known. Swallow fetch errors: on the error paths the server is torn down
-  // mid-response (process.exit / throw), which can surface as ECONNRESET.
-  const fired = opts.callbackQuery
-    ? callbackReady.then(async (callbackUrl) => {
-        const hit = opts.callbackQuery!(callbackUrl);
-        await originalFetch(hit).catch(() => {});
-      })
-    : Promise.resolve();
-
-  const joinFired = opts.joinCallbackQuery
-    ? joinCallbackReady.then(async (callbackUrl) => {
-        const hit = opts.joinCallbackQuery!(callbackUrl);
-        await originalFetch(hit).catch(() => {});
-      })
-    : Promise.resolve();
-
   return {
-    promise: run.finally(() => fired.catch(() => {})).finally(() => joinFired.catch(() => {})),
+    promise: join.settle(connect.settle(run)),
     connectGithub: opts.connectGithub,
-    getGithubConnectAuthorizeUrl,
+    getGithubConnectAuthorizeUrl: connect.authUrl,
     listGithubInstallations,
     getGithubJoinUrl,
     completeGithubJoin,
@@ -194,15 +123,12 @@ let infoSpy: ReturnType<typeof vi.spyOn>;
 const originalIsTTY = process.stdin.isTTY;
 
 beforeEach(() => {
-  mockExecFile.mockReset();
   mockText.mockReset();
   // A CI checkout must not supply a default repository for these prompt fixtures.
   vi.stubEnv('GITHUB_REPOSITORY', undefined);
   // Force the non-interactive (non-TTY) path so tests never hit clack prompts.
   (process.stdin as { isTTY?: boolean }).isTTY = false;
-  exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new Error(`process.exit(${code})`);
-  }) as never);
+  exitSpy = throwOnProcessExit();
   successSpy = vi.spyOn(output, 'printSuccess').mockImplementation(() => {});
   errorSpy = vi.spyOn(log, 'error').mockImplementation(() => {});
   messageSpy = vi.spyOn(log, 'message').mockImplementation(() => {});
diff --git a/packages/void/test/unit/github-disconnect-cmd.test.ts b/packages/void/test/unit/github-disconnect-cmd.test.ts
index 024597016..055e43977 100644
--- a/packages/void/test/unit/github-disconnect-cmd.test.ts
+++ b/packages/void/test/unit/github-disconnect-cmd.test.ts
@@ -1,12 +1,9 @@
 import { confirm, log } from '@voidzero-dev/vite-plus-prompts';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import {
-  PlatformApiError,
-  type GithubConnection,
-  type PlatformClient,
-} from '../../src/cli/client.ts';
+import { PlatformApiError, type PlatformClient } from '../../src/cli/client.ts';
 import { runGithubDisconnect } from '../../src/cli/github-cmd.ts';
 import * as output from '../../src/cli/output.ts';
+import { makeConnection, makeProject, projectId, slug } from '../helpers/github-cli.ts';
 
 // `vi.spyOn(clack, 'confirm')` cannot intercept the handler's named `confirm`
 // import under this project's ESM Vitest config ("Module namespace is not
@@ -18,30 +15,6 @@ vi.mock('@voidzero-dev/vite-plus-prompts', async (imp) => ({
   confirm: vi.fn(),
 }));
 
-const projectId = 'proj_1';
-const slug = 'my-app';
-
-function makeProject() {
-  return { id: projectId, slug } as unknown as Awaited<
-    ReturnType<PlatformClient['listProjects']>
-  >[number];
-}
-
-function makeConnection(overrides: Partial<GithubConnection> = {}): GithubConnection {
-  return {
-    id: 'conn_1',
-    project_id: projectId,
-    installation_id: '123456',
-    repo_full_name: 'octocat/hello-world',
-    branch: 'main',
-    build_executor: 'container',
-    workflow_path: '.github/workflows/void-deploy.yml',
-    created_at: '2024-01-01T00:00:00Z',
-    updated_at: '2024-01-02T00:00:00Z',
-    ...overrides,
-  };
-}
-
 type FakeClient = Pick<
   PlatformClient,
   'listProjects' | 'getGithubConnection' | 'deleteGithubConnection'
diff --git a/packages/void/test/unit/github-install-cmd.test.ts b/packages/void/test/unit/github-install-cmd.test.ts
index 7094af5ab..04c202520 100644
--- a/packages/void/test/unit/github-install-cmd.test.ts
+++ b/packages/void/test/unit/github-install-cmd.test.ts
@@ -1,9 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 import { PlatformApiError, type PlatformClient } from '../../src/cli/client.ts';
 import { runInstall } from '../../src/cli/github-cmd.ts';
+import { throwOnProcessExit } from '../helpers/github-cli.ts';
 
-// Mock node:child_process so openBrowser never launches a real browser on the
-// success path.
+// Keep openBrowser from launching a real browser.
 const mockExecFile = vi.fn();
 vi.mock('node:child_process', () => ({
   execFile: (...args: Array<unknown>) => mockExecFile(...args),
@@ -21,11 +21,7 @@ function identityRequired(): PlatformApiError {
 
 beforeEach(() => {
   mockExecFile.mockReset();
-  // process.exit -> throw so we can assert the error-path exit without killing
-  // the test runner.
-  exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new Error(`process.exit(${code})`);
-  }) as never);
+  exitSpy = throwOnProcessExit();
 });
 
 afterEach(() => {
@@ -70,20 +66,6 @@ describe('runInstall', () => {
     expect(exitSpy).not.toHaveBeenCalled();
   });
 
-  it('rethrows a non-403 error without auto-linking', async () => {
-    const err = new PlatformApiError('Failed to get GitHub install URL', 500, 'boom');
-    const getGithubInstallUrl = vi.fn().mockRejectedValue(err);
-    const client = { getGithubInstallUrl } as unknown as PlatformClient;
-    const linkIdentity = vi.fn(async () => {});
-
-    await expect(runInstall(client, linkIdentity)).rejects.toBe(err);
-
-    expect(linkIdentity).not.toHaveBeenCalled();
-    expect(getGithubInstallUrl).toHaveBeenCalledTimes(1);
-    expect(mockExecFile).not.toHaveBeenCalled();
-    expect(exitSpy).not.toHaveBeenCalled();
-  });
-
   it('exits(1) with actionable guidance when the retry still fails after linking', async () => {
     const getGithubInstallUrl = vi
       .fn()
@@ -100,10 +82,7 @@ describe('runInstall', () => {
     expect(exitSpy).toHaveBeenCalledWith(1);
   });
 
-  it('rethrows a non-identity error from the post-link retry (F4)', async () => {
-    // After linking, the install URL fails again — but with a DIFFERENT error
-    // (a 500). The generic "try void github link" guidance must NOT swallow it;
-    // the real error has to surface through normal handling.
+  it('rethrows a non-identity error from the post-link retry', async () => {
     const retryErr = new PlatformApiError('Failed to get GitHub install URL', 500, 'boom');
     const getGithubInstallUrl = vi
       .fn()
@@ -119,24 +98,4 @@ describe('runInstall', () => {
     expect(mockExecFile).not.toHaveBeenCalled();
     expect(exitSpy).not.toHaveBeenCalled();
   });
-
-  it('rethrows a 426 cli_outdated from the post-link retry (F4)', async () => {
-    const retryErr = new PlatformApiError(
-      'Failed to get GitHub install URL',
-      426,
-      JSON.stringify({ error: 'cli_outdated', message: 'Upgrade: npm i -g void@latest' }),
-    );
-    const getGithubInstallUrl = vi
-      .fn()
-      .mockRejectedValueOnce(identityRequired())
-      .mockRejectedValueOnce(retryErr);
-    const client = { getGithubInstallUrl } as unknown as PlatformClient;
-    const linkIdentity = vi.fn(async () => {});
-
-    await expect(runInstall(client, linkIdentity)).rejects.toBe(retryErr);
-
-    expect(linkIdentity).toHaveBeenCalledTimes(1);
-    expect(getGithubInstallUrl).toHaveBeenCalledTimes(2);
-    expect(exitSpy).not.toHaveBeenCalled();
-  });
 });
diff --git a/packages/void/test/unit/github-join-cmd.test.ts b/packages/void/test/unit/github-join-cmd.test.ts
index edd57584b..cbe782d0f 100644
--- a/packages/void/test/unit/github-join-cmd.test.ts
+++ b/packages/void/test/unit/github-join-cmd.test.ts
@@ -3,27 +3,17 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test'
 import { PlatformApiError, type PlatformClient } from '../../src/cli/client.ts';
 import { runGithubJoin } from '../../src/cli/github-cmd.ts';
 import * as output from '../../src/cli/output.ts';
+import { browserCallback, throwOnProcessExit } from '../helpers/github-cli.ts';
 
-// Mock node:child_process so openBrowser never launches a real browser; the
-// localhost callback server is driven directly by fetch in each test.
-const mockExecFile = vi.fn();
-vi.mock('node:child_process', () => ({
-  execFile: (...args: Array<unknown>) => mockExecFile(...args),
-}));
-
-const originalFetch = globalThis.fetch.bind(globalThis);
+// Keep openBrowser from launching a real browser.
+vi.mock('node:child_process', () => ({ execFile: vi.fn() }));
 
 type FakeClient = Pick<PlatformClient, 'getGithubJoinUrl' | 'completeGithubJoin'>;
 
 let exitSpy: ReturnType<typeof vi.spyOn>;
 
 beforeEach(() => {
-  mockExecFile.mockReset();
-  // process.exit -> throw so we can assert the error-path exit without killing
-  // the test runner.
-  exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new Error(`process.exit(${code})`);
-  }) as never);
+  exitSpy = throwOnProcessExit();
 });
 
 afterEach(() => {
@@ -31,46 +21,17 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
-/**
- * Run runGithubJoin against a fake client, intercepting the authorize URL the
- * command requests (via the fake getGithubJoinUrl) so the test can POST back to
- * the localhost callback with whatever query it wants.
- *
- * `completeGithubJoin` and the callback query are configurable per test.
- */
+/** Runs runGithubJoin and sends the callback redirect that `callbackQuery` builds. */
 function drive(opts: {
   completeGithubJoin: FakeClient['completeGithubJoin'];
   callbackQuery: (callbackUrl: URL) => URL;
 }): Promise<void> {
-  let resolveCallback!: (url: URL) => void;
-  const callbackReady = new Promise<URL>((resolve) => {
-    resolveCallback = resolve;
-  });
-
+  const callback = browserCallback(opts.callbackQuery);
   const client: FakeClient = {
-    getGithubJoinUrl: vi.fn(async (redirect: string) => {
-      // `redirect` is the localhost callback URL (with the command's state).
-      resolveCallback(new URL(redirect));
-      return { url: 'https://github.com/login/oauth/authorize?client_id=x' };
-    }),
+    getGithubJoinUrl: callback.authUrl,
     completeGithubJoin: opts.completeGithubJoin,
   };
-
-  const run = runGithubJoin(client as unknown as PlatformClient);
-
-  // Once the command has built the callback URL, fire the simulated browser
-  // redirect back at the localhost server. Swallow fetch errors: on the
-  // error paths the server is torn down mid-response (process.exit / throw),
-  // which can surface as ECONNRESET on the in-flight request — irrelevant to
-  // what we're asserting (the command's outcome).
-  const fired = callbackReady.then(async (callbackUrl) => {
-    const hit = opts.callbackQuery(callbackUrl);
-    await originalFetch(hit).catch(() => {});
-  });
-
-  // Settle on the command's outcome, but make sure the fetch is also drained so
-  // no dangling promise leaks across tests.
-  return run.finally(() => fired.catch(() => {}));
+  return callback.settle(runGithubJoin(client as unknown as PlatformClient));
 }
 
 describe('runGithubJoin', () => {
diff --git a/packages/void/test/unit/github-link-cmd.test.ts b/packages/void/test/unit/github-link-cmd.test.ts
index e70dc2b87..75c3e9d01 100644
--- a/packages/void/test/unit/github-link-cmd.test.ts
+++ b/packages/void/test/unit/github-link-cmd.test.ts
@@ -2,27 +2,17 @@ import { log } from '@voidzero-dev/vite-plus-prompts';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 import { PlatformApiError, type PlatformClient } from '../../src/cli/client.ts';
 import { runGithubLink } from '../../src/cli/github-cmd.ts';
+import { browserCallback, throwOnProcessExit } from '../helpers/github-cli.ts';
 
-// Mock node:child_process so openBrowser never launches a real browser; the
-// localhost callback server is driven directly by fetch in each test.
-const mockExecFile = vi.fn();
-vi.mock('node:child_process', () => ({
-  execFile: (...args: Array<unknown>) => mockExecFile(...args),
-}));
-
-const originalFetch = globalThis.fetch.bind(globalThis);
+// Keep openBrowser from launching a real browser.
+vi.mock('node:child_process', () => ({ execFile: vi.fn() }));
 
 type FakeClient = Pick<PlatformClient, 'getGithubLinkUrl' | 'completeGithubLink'>;
 
 let exitSpy: ReturnType<typeof vi.spyOn>;
 
 beforeEach(() => {
-  mockExecFile.mockReset();
-  // process.exit -> throw so we can assert the error-path exit without killing
-  // the test runner.
-  exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new Error(`process.exit(${code})`);
-  }) as never);
+  exitSpy = throwOnProcessExit();
 });
 
 afterEach(() => {
@@ -30,46 +20,17 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
-/**
- * Run runGithubLink against a fake client, intercepting the authorize URL the
- * command requests (via the fake getGithubLinkUrl) so the test can POST back to
- * the localhost callback with whatever query it wants.
- *
- * `completeGithubLink` and the callback query are configurable per test.
- */
+/** Runs runGithubLink and sends the callback redirect that `callbackQuery` builds. */
 function drive(opts: {
   completeGithubLink: FakeClient['completeGithubLink'];
   callbackQuery: (callbackUrl: URL) => URL;
 }): Promise<void> {
-  let resolveCallback!: (url: URL) => void;
-  const callbackReady = new Promise<URL>((resolve) => {
-    resolveCallback = resolve;
-  });
-
+  const callback = browserCallback(opts.callbackQuery);
   const client: FakeClient = {
-    getGithubLinkUrl: vi.fn(async (redirect: string) => {
-      // `redirect` is the localhost callback URL (with the command's state).
-      resolveCallback(new URL(redirect));
-      return { url: 'https://github.com/login/oauth/authorize?client_id=x' };
-    }),
+    getGithubLinkUrl: callback.authUrl,
     completeGithubLink: opts.completeGithubLink,
   };
-
-  const run = runGithubLink(client as unknown as PlatformClient);
-
-  // Once the command has built the callback URL, fire the simulated browser
-  // redirect back at the localhost server. Swallow fetch errors: on the
-  // error paths the server is torn down mid-response (process.exit / throw),
-  // which can surface as ECONNRESET on the in-flight request — irrelevant to
-  // what we're asserting (the command's outcome).
-  const fired = callbackReady.then(async (callbackUrl) => {
-    const hit = opts.callbackQuery(callbackUrl);
-    await originalFetch(hit).catch(() => {});
-  });
-
-  // Settle on the command's outcome, but make sure the fetch is also drained so
-  // no dangling promise leaks across tests.
-  return run.finally(() => fired.catch(() => {}));
+  return callback.settle(runGithubLink(client as unknown as PlatformClient));
 }
 
 describe('runGithubLink', () => {
diff --git a/packages/void/test/unit/github-oidc.test.ts b/packages/void/test/unit/github-oidc.test.ts
index 5e6d978d4..a1e2ab585 100644
--- a/packages/void/test/unit/github-oidc.test.ts
+++ b/packages/void/test/unit/github-oidc.test.ts
@@ -39,14 +39,6 @@ function jsonResponse(body: unknown, status = 200): Response {
 const REQUEST_URL = 'https://token.actions.githubusercontent.com/abc?api-version=2.0';
 const REQUEST_TOKEN = 'req-token-123';
 
-function restoreEnv(key: string, prev: string | undefined): void {
-  if (prev === undefined) {
-    delete process.env[key];
-  } else {
-    process.env[key] = prev;
-  }
-}
-
 function oidcEnv(overrides: Record<string, string | undefined> = {}): NodeJS.ProcessEnv {
   return {
     GITHUB_ACTIONS: 'true',
@@ -117,114 +109,56 @@ describe('exchangeGithubOidcForDeployToken', () => {
   it('forwards CF Access service-token headers on the API POST but not the GitHub GET', async () => {
     const gatedApiUrl = 'https://api.staging.void.cloud';
     vi.stubEnv('VOID_ACCESS_ORIGIN', gatedApiUrl);
-    const prevId = process.env.CF_ACCESS_CLIENT_ID;
-    const prevSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    process.env.CF_ACCESS_CLIENT_ID = 'cf-id';
-    process.env.CF_ACCESS_CLIENT_SECRET = 'cf-secret';
-    try {
-      fetchMock
-        .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
-        .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
-
-      await exchangeGithubOidcForDeployToken(gatedApiUrl, 'my-app', oidcEnv());
-
-      // GitHub OIDC GET hits token.actions.githubusercontent.com — never CF Access.
-      const [, getInit] = fetchMock.mock.calls[0] as [URL, RequestInit];
-      const getHeaders = getInit.headers as Record<string, string>;
-      expect(getHeaders['CF-Access-Client-Id']).toBeUndefined();
-      expect(getHeaders['CF-Access-Client-Secret']).toBeUndefined();
-
-      // Void API POST carries the service-token pair so Access-gated staging passes.
-      const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
-      const postHeaders = postInit.headers as Record<string, string>;
-      expect(postHeaders['CF-Access-Client-Id']).toBe('cf-id');
-      expect(postHeaders['CF-Access-Client-Secret']).toBe('cf-secret');
-    } finally {
-      restoreEnv('CF_ACCESS_CLIENT_ID', prevId);
-      restoreEnv('CF_ACCESS_CLIENT_SECRET', prevSecret);
-    }
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', 'cf-id');
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'cf-secret');
+    fetchMock
+      .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
+      .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
+
+    await exchangeGithubOidcForDeployToken(gatedApiUrl, 'my-app', oidcEnv());
+
+    // The GitHub OIDC GET goes to token.actions.githubusercontent.com, never through CF Access.
+    const [, getInit] = fetchMock.mock.calls[0] as [URL, RequestInit];
+    const getHeaders = getInit.headers as Record<string, string>;
+    expect(getHeaders['CF-Access-Client-Id']).toBeUndefined();
+    expect(getHeaders['CF-Access-Client-Secret']).toBeUndefined();
+
+    const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
+    const postHeaders = postInit.headers as Record<string, string>;
+    expect(postHeaders['CF-Access-Client-Id']).toBe('cf-id');
+    expect(postHeaders['CF-Access-Client-Secret']).toBe('cf-secret');
   });
 
   it('forwards a CF_ACCESS_TOKEN user JWT on the API POST but not the GitHub GET', async () => {
     const gatedApiUrl = 'https://api.staging.void.cloud';
     vi.stubEnv('VOID_ACCESS_ORIGIN', gatedApiUrl);
-    const prevToken = process.env.CF_ACCESS_TOKEN;
-    process.env.CF_ACCESS_TOKEN = accessJwt;
-    try {
-      fetchMock
-        .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
-        .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
-
-      await exchangeGithubOidcForDeployToken(gatedApiUrl, 'my-app', oidcEnv());
-
-      const [, getInit] = fetchMock.mock.calls[0] as [URL, RequestInit];
-      expect((getInit.headers as Record<string, string>)['cf-access-token']).toBeUndefined();
-
-      const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
-      expect((postInit.headers as Record<string, string>)['cf-access-token']).toBe(accessJwt);
-    } finally {
-      restoreEnv('CF_ACCESS_TOKEN', prevToken);
-    }
-  });
+    vi.stubEnv('CF_ACCESS_TOKEN', accessJwt);
+    fetchMock
+      .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
+      .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
 
-  it('never forwards shared Access credentials to a self-hosted API', async () => {
-    const prevId = process.env.CF_ACCESS_CLIENT_ID;
-    const prevSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    process.env.CF_ACCESS_CLIENT_ID = 'cf-id';
-    process.env.CF_ACCESS_CLIENT_SECRET = 'cf-secret';
-    try {
-      fetchMock
-        .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
-        .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
-
-      await exchangeGithubOidcForDeployToken(apiUrl, 'my-app', oidcEnv());
-
-      const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
-      const postHeaders = postInit.headers as Record<string, string>;
-      expect(postHeaders['CF-Access-Client-Id']).toBeUndefined();
-      expect(postHeaders['CF-Access-Client-Secret']).toBeUndefined();
-    } finally {
-      restoreEnv('CF_ACCESS_CLIENT_ID', prevId);
-      restoreEnv('CF_ACCESS_CLIENT_SECRET', prevSecret);
-    }
-  });
+    await exchangeGithubOidcForDeployToken(gatedApiUrl, 'my-app', oidcEnv());
+
+    const [, getInit] = fetchMock.mock.calls[0] as [URL, RequestInit];
+    expect((getInit.headers as Record<string, string>)['cf-access-token']).toBeUndefined();
 
-  it('omits CF Access headers on the API POST when no CF Access env is set (prod path)', async () => {
-    const prevId = process.env.CF_ACCESS_CLIENT_ID;
-    const prevSecret = process.env.CF_ACCESS_CLIENT_SECRET;
-    const prevToken = process.env.CF_ACCESS_TOKEN;
-    delete process.env.CF_ACCESS_CLIENT_ID;
-    delete process.env.CF_ACCESS_CLIENT_SECRET;
-    delete process.env.CF_ACCESS_TOKEN;
-    try {
-      fetchMock
-        .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
-        .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
-
-      await exchangeGithubOidcForDeployToken(apiUrl, 'my-app', oidcEnv());
-
-      const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
-      const postHeaders = postInit.headers as Record<string, string>;
-      expect(postHeaders['CF-Access-Client-Id']).toBeUndefined();
-      expect(postHeaders['CF-Access-Client-Secret']).toBeUndefined();
-      expect(postHeaders[accessJwt]).toBeUndefined();
-      // The plain Content-Type header is still present.
-      expect(postHeaders['Content-Type']).toBe('application/json');
-    } finally {
-      restoreEnv('CF_ACCESS_CLIENT_ID', prevId);
-      restoreEnv('CF_ACCESS_CLIENT_SECRET', prevSecret);
-      restoreEnv('CF_ACCESS_TOKEN', prevToken);
-    }
+    const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
+    expect((postInit.headers as Record<string, string>)['cf-access-token']).toBe(accessJwt);
   });
 
-  it('strips a trailing slash from the API URL', async () => {
+  it('never forwards shared Access credentials to a self-hosted API', async () => {
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', 'cf-id');
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'cf-secret');
     fetchMock
       .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
       .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
 
-    await exchangeGithubOidcForDeployToken('https://api.test/', 'my-app', oidcEnv());
-    const [postUrl] = fetchMock.mock.calls[1] as [string, RequestInit];
-    expect(postUrl).toBe('https://api.test/auth/github-oidc');
+    await exchangeGithubOidcForDeployToken(apiUrl, 'my-app', oidcEnv());
+
+    const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
+    const postHeaders = postInit.headers as Record<string, string>;
+    expect(postHeaders['CF-Access-Client-Id']).toBeUndefined();
+    expect(postHeaders['CF-Access-Client-Secret']).toBeUndefined();
   });
 
   it('throws before any fetch when the request vars are absent', async () => {
diff --git a/packages/void/test/unit/github-update-cmd.test.ts b/packages/void/test/unit/github-update-cmd.test.ts
index 8bf4286b0..fe259a7c5 100644
--- a/packages/void/test/unit/github-update-cmd.test.ts
+++ b/packages/void/test/unit/github-update-cmd.test.ts
@@ -1,43 +1,15 @@
 import { log } from '@voidzero-dev/vite-plus-prompts';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import {
-  PlatformApiError,
-  type GithubConnection,
-  type PlatformClient,
-  type ProjectResponse,
-} from '../../src/cli/client.ts';
+import { PlatformApiError, type PlatformClient } from '../../src/cli/client.ts';
 import { runGithubUpdate } from '../../src/cli/github-cmd.ts';
 import * as output from '../../src/cli/output.ts';
-
-const projectId = 'proj_test';
-const slug = 'my-app';
-
-function makeProject(): ProjectResponse {
-  return {
-    id: projectId,
-    user_id: 'user_1',
-    slug,
-    type: 'void',
-    created_at: '2024-01-01T00:00:00Z',
-    custom_domain: null,
-    role: 'owner',
-  };
-}
-
-function makeConnection(overrides: Partial<GithubConnection> = {}): GithubConnection {
-  return {
-    id: 'conn_1',
-    project_id: projectId,
-    installation_id: '123456',
-    repo_full_name: 'octocat/hello-world',
-    branch: 'main',
-    build_executor: 'container',
-    workflow_path: '.github/workflows/void-deploy.yml',
-    created_at: '2024-01-01T00:00:00Z',
-    updated_at: '2024-01-01T00:00:00Z',
-    ...overrides,
-  };
-}
+import {
+  makeConnection,
+  makeProject,
+  projectId,
+  slug,
+  throwOnProcessExit,
+} from '../helpers/github-cli.ts';
 
 type FakeClient = Pick<
   PlatformClient,
@@ -78,11 +50,7 @@ const originalIsTTY = process.stdin.isTTY;
 beforeEach(() => {
   // Force the non-interactive (non-TTY) path so tests never hit clack prompts.
   (process.stdin as { isTTY?: boolean }).isTTY = false;
-  // process.exit -> throw so we can assert the error-path exit without killing
-  // the test runner.
-  exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new Error(`process.exit(${code})`);
-  }) as never);
+  exitSpy = throwOnProcessExit();
   successSpy = vi.spyOn(output, 'printSuccess').mockImplementation(() => {});
   infoSpy = vi.spyOn(log, 'info').mockImplementation(() => {});
   errorSpy = vi.spyOn(log, 'error').mockImplementation(() => {});
@@ -242,35 +210,6 @@ describe('runGithubUpdate (non-TTY)', () => {
     expect(updateGithubConnection).not.toHaveBeenCalled();
   });
 
-  it('reports missing flags (not "connect first") for a disconnected project', async () => {
-    // If the guard ran AFTER getGithubConnection, this 404 would surface the
-    // "connect first" message instead of the missing-flags usage error.
-    const { client, listProjects, getGithubConnection, updateGithubConnection } = makeClient({
-      getGithubConnection: vi.fn(async () => {
-        throw new PlatformApiError(
-          'Failed to get GitHub connection',
-          404,
-          JSON.stringify({ error: 'connection not found' }),
-        );
-      }),
-    });
-
-    await expect(
-      runGithubUpdate('/project', client, {
-        subcommand: 'update',
-        projectName: slug,
-      }),
-    ).rejects.toThrow('process.exit(1)');
-
-    expect(exitSpy).toHaveBeenCalledWith(1);
-    expect(errorSpy).toHaveBeenCalledWith(
-      'update: Nothing to update. Pass --branch <name>, --executor <container|github_actions>, and/or --workflow <.github/workflows/...>.',
-    );
-    expect(listProjects).not.toHaveBeenCalled();
-    expect(getGithubConnection).not.toHaveBeenCalled();
-    expect(updateGithubConnection).not.toHaveBeenCalled();
-  });
-
   it('does not call the API when the requested values equal the current ones', async () => {
     const { client, updateGithubConnection } = makeClient({
       getGithubConnection: vi.fn(async () =>
diff --git a/packages/void/test/unit/index.test.ts b/packages/void/test/unit/index.test.ts
deleted file mode 100644
index 34f1da28d..000000000
--- a/packages/void/test/unit/index.test.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import { describe, expect, it } from 'vite-plus/test';
-import { resolveWorkersAiBindingName, shouldBindWorkersAi } from '../../src/index.ts';
-
-// `shouldBindWorkersAi(...)` is the pure, testable surface of the destination
-// gate (the surrounding `mergeBindings`
-// is an unexported closure). It decides whether the built wrangler config gets
-// an injected Workers AI binding. Assert the real return values.
-describe('shouldBindWorkersAi', () => {
-  it('keeps managed dev on the Void proxy path', () => {
-    expect(shouldBindWorkersAi('serve', true, undefined, undefined)).toBe(false);
-  });
-
-  it('binds remote Workers AI during direct Cloudflare dev', () => {
-    expect(shouldBindWorkersAi('serve', true, undefined, undefined, true)).toBe(true);
-  });
-
-  it('binds Workers AI on a self-host build when the app uses AI', () => {
-    expect(shouldBindWorkersAi('build', true, undefined, undefined)).toBe(true);
-  });
-
-  it("does not override a user's root-wrangler `ai` binding", () => {
-    // A resolved root-wrangler `ai` binding wins — never clobber it.
-    expect(shouldBindWorkersAi('build', true, { binding: 'X' }, undefined)).toBe(false);
-  });
-
-  it('does not bind Workers AI when the app does not use AI', () => {
-    expect(shouldBindWorkersAi('build', false, undefined, undefined)).toBe(false);
-    expect(shouldBindWorkersAi('serve', false, undefined, undefined, true)).toBe(false);
-  });
-});
-
-describe('resolveWorkersAiBindingName', () => {
-  it('uses a custom inference binding name', () => {
-    expect(resolveWorkersAiBindingName(undefined, 'MY_AI')).toBe('MY_AI');
-  });
-
-  it('preserves a root Wrangler binding over the inference name', () => {
-    expect(resolveWorkersAiBindingName({ binding: 'ROOT_AI' }, 'MY_AI')).toBe('ROOT_AI');
-  });
-
-  it('defaults to AI', () => {
-    expect(resolveWorkersAiBindingName(undefined)).toBe('AI');
-  });
-});
diff --git a/packages/void/test/unit/inference.test.ts b/packages/void/test/unit/inference.test.ts
index 5733da770..e0b855175 100644
--- a/packages/void/test/unit/inference.test.ts
+++ b/packages/void/test/unit/inference.test.ts
@@ -1,5 +1,33 @@
 import { describe, expect, it } from 'vite-plus/test';
-import { inferBindingsFromSource, mergeBindings } from '../../src/inference/walk.ts';
+import {
+  inferBindingsFromSource,
+  mergeBindings,
+  type InferredBindings,
+} from '../../src/inference/walk.ts';
+
+const NO_BINDINGS: InferredBindings = {
+  needsD1: false,
+  needsKV: false,
+  needsR2: false,
+  needsAuth: false,
+  needsQueues: false,
+  needsAI: false,
+  needsSandbox: false,
+  needsLive: false,
+  needsEmail: false,
+};
+
+const MODULE_BINDINGS = [
+  ['void/db', 'needsD1'],
+  ['void/kv', 'needsKV'],
+  ['void/storage', 'needsR2'],
+  ['void/auth', 'needsAuth'],
+  ['void/queues', 'needsQueues'],
+  ['void/ai', 'needsAI'],
+  ['void/sandbox', 'needsSandbox'],
+  ['void/email', 'needsEmail'],
+  ['void/live', 'needsLive'],
+] as const;
 
 describe('inferBindingsFromSource', () => {
   it.each([
@@ -34,48 +62,18 @@ describe('inferBindingsFromSource', () => {
     expect(inferBindingsFromSource(code, 'test.ts').needsAI).toBe(true);
   });
 
-  it('detects c.env.DB', () => {
-    const code = `
-      export default defineHandler((c) => {
-        return c.env.DB.prepare('SELECT 1').first()
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsD1).toBe(true);
-    expect(result.needsKV).toBe(false);
-    expect(result.needsR2).toBe(false);
-  });
-
-  it('detects c.env.KV', () => {
-    const code = `
-      export default defineHandler(async (c) => {
-        return c.env.KV.get('key')
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsKV).toBe(true);
-  });
-
-  it('detects env.DB in SSR-style handlers', () => {
-    const code = `
-      export async function render(request, env) {
-        return Response.json(await env.DB.prepare('SELECT 1').first())
-      }
-    `;
-    const result = inferBindingsFromSource(code, 'main.ssr.ts');
-    expect(result.needsD1).toBe(true);
-    expect(result.needsKV).toBe(false);
-    expect(result.needsR2).toBe(false);
-  });
-
-  it('detects c.env.STORAGE', () => {
-    const code = `
-      export default defineHandler(async (c) => {
-        await c.env.STORAGE.put('key', 'value')
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsR2).toBe(true);
+  it.each([
+    ['c.env.DB', 'needsD1'],
+    ['env.DB', 'needsD1'],
+    ['c.env.KV', 'needsKV'],
+    ['c.env.STORAGE', 'needsR2'],
+    ['c.env.QUEUE_EMAILS', 'needsQueues'],
+    ['c.env.AI', 'needsAI'],
+    ['env.AI', 'needsAI'],
+    ['c.env.SANDBOX', 'needsSandbox'],
+  ] as const)('detects %s access', (expression, binding) => {
+    const code = `export async function handler(c, env) {\n  return ${expression}.get('key');\n}`;
+    expect(inferBindingsFromSource(code, 'test.ts')).toEqual({ ...NO_BINDINGS, [binding]: true });
   });
 
   it('detects multiple bindings in one file', () => {
@@ -101,80 +99,18 @@ describe('inferBindingsFromSource', () => {
     expect(result.needsD1).toBe(false);
   });
 
-  it('handles env access patterns', () => {
-    // This pattern: obj.env.DB — any *.env.DB triggers it
-    const code = `
-      const handler = (c) => {
-        const result = c.env.DB.prepare('SELECT 1').all()
-        return result
-      }
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsD1).toBe(true);
-  });
-
   it('returns empty for files with no bindings', () => {
     const code = `
       export default defineHandler(() => {
         return { status: 'ok' }
       })
     `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsD1).toBe(false);
-    expect(result.needsKV).toBe(false);
-    expect(result.needsR2).toBe(false);
-    expect(result.needsAuth).toBe(false);
-  });
-
-  it("detects import { db } from 'void/db'", () => {
-    const code = `
-      import { db } from "void/db";
-      export const GET = defineHandler(async () => {
-        return db.list("users");
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsD1).toBe(true);
-    expect(result.needsKV).toBe(false);
-    expect(result.needsR2).toBe(false);
-  });
-
-  it("detects import { kv } from 'void/kv'", () => {
-    const code = `
-      import { kv } from "void/kv";
-      export const GET = defineHandler(async () => {
-        return kv.get("key");
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsKV).toBe(true);
-    expect(result.needsD1).toBe(false);
-    expect(result.needsR2).toBe(false);
-  });
-
-  it("detects import { storage } from 'void/storage'", () => {
-    const code = `
-      import { storage } from "void/storage";
-      export const POST = defineHandler(async () => {
-        await storage.put("file.txt", "content");
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsR2).toBe(true);
-    expect(result.needsD1).toBe(false);
-    expect(result.needsKV).toBe(false);
+    expect(inferBindingsFromSource(code, 'test.ts')).toEqual(NO_BINDINGS);
   });
 
-  it("detects import { createDb } from 'void/db'", () => {
-    const code = `
-      import { createDb } from "void/db";
-      export const GET = defineHandler(async (c) => {
-        const myDb = createDb(c.env.OTHER_DB);
-        return myDb.list("users");
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsD1).toBe(true);
+  it.each(MODULE_BINDINGS)('detects value imports from %s', (source, binding) => {
+    const code = `import { feature } from '${source}';`;
+    expect(inferBindingsFromSource(code, 'test.ts')).toEqual({ ...NO_BINDINGS, [binding]: true });
   });
 
   it('handles invalid code gracefully', () => {
@@ -231,75 +167,7 @@ describe('inferBindingsFromSource', () => {
     expect(result.needsAuth).toBe(false);
   });
 
-  it("detects import from 'void/auth'", () => {
-    const code = `
-      import { requireAuth } from "void/auth";
-      export const GET = defineHandler((c) => {
-        const user = requireAuth(c);
-        return { user };
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsAuth).toBe(true);
-  });
-
-  it('does not detect auth from unrelated imports', () => {
-    const code = `
-      import { db } from "void/db";
-      import { fetch } from "void/client";
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsAuth).toBe(false);
-    expect(result.needsD1).toBe(true);
-  });
-
-  it('detects needsQueues from void/queues import', () => {
-    const code = `
-      import { queues } from "void/queues";
-      await queues.emails.send({});
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsQueues).toBe(true);
-  });
-
-  it('detects needsQueues from env.QUEUE_* access', () => {
-    const code = `
-      export const POST = defineHandler(async (c) => {
-        await c.env.QUEUE_EMAILS.send({ to: "test@example.com" });
-        return c.json({ ok: true });
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsQueues).toBe(true);
-  });
-
-  it('does not detect needsQueues from unrelated identifiers', () => {
-    const code = `
-      export const GET = defineHandler(() => {
-        return { status: 'ok' }
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsQueues).toBe(false);
-  });
-
-  it("detects import { ai } from 'void/ai'", () => {
-    const code =
-      '\n      import { ai } from "void/ai";\n      export const POST = defineHandler(async () => {\n        const result = await ai.run("@cf/meta/llama-3.1-8b-instruct", {\n          messages: [{ role: "user", content: "Hello" }],\n        });\n        return result;\n      })\n    ';
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsAI).toBe(true);
-    expect(result.needsD1).toBe(false);
-  });
-
-  it.each([
-    ['void/db', 'needsD1'],
-    ['void/kv', 'needsKV'],
-    ['void/storage', 'needsR2'],
-    ['void/auth', 'needsAuth'],
-    ['void/queues', 'needsQueues'],
-    ['void/ai', 'needsAI'],
-    ['void/sandbox', 'needsSandbox'],
-  ] as const)('ignores type-only imports from %s', (source, binding) => {
+  it.each(MODULE_BINDINGS)('ignores type-only imports from %s', (source, binding) => {
     const named = inferBindingsFromSource(`import type { Feature } from '${source}';`, 'types.ts');
     const inline = inferBindingsFromSource(`import { type Feature } from '${source}';`, 'types.ts');
     expect(named[binding]).toBe(false);
@@ -339,70 +207,7 @@ describe('inferBindingsFromSource', () => {
     expect(inferBindingsFromSource("export { ai } from 'void/ai';", 'index.ts').needsAI).toBe(true);
   });
 
-  it('detects c.env.AI access', () => {
-    const code = `
-      export const POST = defineHandler(async (c) => {
-        const result = await c.env.AI.run("@cf/meta/llama-3.1-8b-instruct", {
-          messages: [{ role: "user", content: "Hello" }],
-        });
-        return c.json(result);
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsAI).toBe(true);
-  });
-
-  it("detects import { getSandbox } from 'void/sandbox'", () => {
-    const code = `
-      import { getSandbox } from "void/sandbox";
-      export const POST = defineHandler(async () => {
-        const sandbox = await getSandbox("session-1");
-        const result = await sandbox.run(["node", "--version"]);
-        return Response.json({ exitCode: result.exitCode });
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsSandbox).toBe(true);
-  });
-
-  it('detects c.env.SANDBOX access', () => {
-    const code = `
-      export const POST = defineHandler(async (c) => {
-        const id = c.env.SANDBOX.idFromName("session-1");
-        return c.env.SANDBOX.get(id);
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsSandbox).toBe(true);
-  });
-
-  it('detects env.AI access', () => {
-    const code = `
-      export async function handler(request, env) {
-        return Response.json(await env.AI.run("@cf/meta/llama-3.1-8b-instruct", { prompt: "Hi" }))
-      }
-    `;
-    const result = inferBindingsFromSource(code, 'main.ssr.ts');
-    expect(result.needsAI).toBe(true);
-  });
-
-  it("detects import { sendEmail } from 'void/email'", () => {
-    const code = `
-      import { sendEmail } from "void/email";
-      export const POST = defineHandler(async () => {
-        await sendEmail({ from: "a@x.dev", to: "b@y.dev", subject: "hi", text: "hi" });
-      })
-    `;
-    const result = inferBindingsFromSource(code, 'test.ts');
-    expect(result.needsEmail).toBe(true);
-  });
-
-  it('does NOT detect c.env.SEND_EMAIL access (binding lives on the proxy, not the user worker)', () => {
-    // SEND_EMAIL is intentionally absent from the env-binding regex —
-    // outbound email routes through __VOID_PROXY/email/send, so a user
-    // worker accessing `env.SEND_EMAIL` will get undefined regardless of
-    // whether we'd inferred the import. Inference is now solely driven
-    // by `void/email` import-source detection.
+  it('does not infer email from env.SEND_EMAIL access', () => {
     const code = `
       export const POST = defineHandler(async (c) => {
         return c.env.SEND_EMAIL.send(message);
@@ -412,66 +217,6 @@ describe('inferBindingsFromSource', () => {
     expect(result.needsEmail).toBe(false);
   });
 
-  // A type-only import arms nothing at runtime, but `needsEmail` is ORed with
-  // `hasEmailHandlers` in `cli/deploy.ts` to gate the email deploy step: an app
-  // that only imports `SendEmailOptions` would warn with no `email.from`, and
-  // exit 1 under `--require-email`, having never sent an email.
-  it("does not detect email from type-only 'void/email' imports", () => {
-    const code = `
-      import type { SendEmailOptions } from "void/email";
-      export type Options = SendEmailOptions;
-    `;
-    const result = inferBindingsFromSource(code, 'types.ts');
-    expect(result.needsEmail).toBe(false);
-  });
-
-  it("does not detect email from inline type-only 'void/email' imports", () => {
-    const code = `
-      import { type SendEmailOptions, type SendEmailResult } from "void/email";
-      export type Options = SendEmailOptions;
-      export type Result = SendEmailResult;
-    `;
-    const result = inferBindingsFromSource(code, 'types.ts');
-    expect(result.needsEmail).toBe(false);
-  });
-
-  it("detects email from mixed inline type and value 'void/email' imports", () => {
-    const code = `
-      import { type SendEmailOptions, sendEmail } from "void/email";
-      export const send = (o: SendEmailOptions) => sendEmail(o);
-    `;
-    const result = inferBindingsFromSource(code, 'send.ts');
-    expect(result.needsEmail).toBe(true);
-  });
-
-  it("does not detect email from a type-only 'void/email' import in .tsx", () => {
-    const code = `
-      import type { SendEmailOptions } from "void/email";
-      export const Compose = (props: { options: SendEmailOptions }) => (
-        <form className="compose" data-subject={props.options.subject}>
-          <button>Send</button>
-        </form>
-      );
-    `;
-    const result = inferBindingsFromSource(code, 'Compose.tsx');
-    expect(result.needsEmail).toBe(false);
-  });
-
-  it("still detects a runtime 'void/email' import in .tsx", () => {
-    const code = `
-      import { sendEmail } from "void/email";
-      export const Compose = (props: { subject: string }) => (
-        <form className="compose" data-subject={props.subject}>
-          <button onClick={() => sendEmail({ from: "a@x.dev", to: "b@y.dev", subject: props.subject, text: "hi" })}>
-            Send
-          </button>
-        </form>
-      );
-    `;
-    const result = inferBindingsFromSource(code, 'Compose.tsx');
-    expect(result.needsEmail).toBe(true);
-  });
-
   it('does not detect needsAI from unrelated identifiers', () => {
     const code = `
       const AI = someLibrary;
@@ -483,15 +228,6 @@ describe('inferBindingsFromSource', () => {
     expect(result.needsAI).toBe(false);
   });
 
-  it("detects non-type imports from 'void/live'", () => {
-    const code = `
-      import { defineLiveStream } from "void/live";
-      export const live = defineLiveStream({ id: "app" });
-    `;
-    const result = inferBindingsFromSource(code, 'live.ts');
-    expect(result.needsLive).toBe(true);
-  });
-
   it("does not detect live infrastructure from 'void/live/client'", () => {
     const code = `
       import { connectLiveStream } from "void/live/client";
@@ -500,102 +236,24 @@ describe('inferBindingsFromSource', () => {
     const result = inferBindingsFromSource(code, 'client.ts');
     expect(result.needsLive).toBe(false);
   });
-
-  it("does not detect live infrastructure from type-only 'void/live' imports", () => {
-    const code = `
-      import type { LiveClientEvent } from "void/live";
-      export type Event = LiveClientEvent<{ value: string }>;
-    `;
-    const result = inferBindingsFromSource(code, 'types.ts');
-    expect(result.needsLive).toBe(false);
-  });
-
-  it("does not detect live infrastructure from inline type-only 'void/live' imports", () => {
-    const code = `
-      import { type LiveStream, type LiveClientEvent } from "void/live";
-      export type Stream = LiveStream;
-      export type Event = LiveClientEvent<{ value: string }>;
-    `;
-    const result = inferBindingsFromSource(code, 'types.ts');
-    expect(result.needsLive).toBe(false);
-  });
-
-  it("detects live infrastructure from mixed inline type and value 'void/live' imports", () => {
-    const code = `
-      import { type LiveStream, defineLiveStream } from "void/live";
-      export type Stream = LiveStream;
-      export const live = defineLiveStream({ id: "app" });
-    `;
-    const result = inferBindingsFromSource(code, 'live.ts');
-    expect(result.needsLive).toBe(true);
-  });
 });
 
 describe('mergeBindings', () => {
-  const empty = {
-    needsD1: false,
-    needsKV: false,
-    needsR2: false,
-    needsAuth: false,
-    needsQueues: false,
-    needsAI: false,
-    needsSandbox: false,
-  };
+  const flags = Object.keys(NO_BINDINGS) as Array<keyof InferredBindings>;
 
   it('merges multiple binding results (union)', () => {
-    const result = mergeBindings([
-      { ...empty, needsD1: true },
-      { ...empty, needsKV: true },
-      { ...empty, needsR2: true },
-    ]);
-    expect(result.needsD1).toBe(true);
-    expect(result.needsKV).toBe(true);
-    expect(result.needsR2).toBe(true);
-    expect(result.needsAuth).toBe(false);
-    expect(result.needsAI).toBe(false);
+    const merged = mergeBindings(flags.map((flag) => ({ ...NO_BINDINGS, [flag]: true })));
+    expect(merged).toEqual(Object.fromEntries(flags.map((flag) => [flag, true])));
   });
 
-  it('handles empty array', () => {
-    const result = mergeBindings([]);
-    expect(result.needsD1).toBe(false);
-    expect(result.needsKV).toBe(false);
-    expect(result.needsR2).toBe(false);
-    expect(result.needsAuth).toBe(false);
-    expect(result.needsAI).toBe(false);
+  it.each(flags)('merges the %s flag alone', (flag) => {
+    expect(mergeBindings([NO_BINDINGS, { ...NO_BINDINGS, [flag]: true }])).toEqual({
+      ...NO_BINDINGS,
+      [flag]: true,
+    });
   });
 
-  it('merges auth flag', () => {
-    const result = mergeBindings([empty, { ...empty, needsAuth: true }]);
-    expect(result.needsAuth).toBe(true);
-  });
-
-  it('merges queues flag', () => {
-    const result = mergeBindings([empty, { ...empty, needsQueues: true }]);
-    expect(result.needsQueues).toBe(true);
-  });
-
-  it('merges AI flag', () => {
-    const result = mergeBindings([empty, { ...empty, needsAI: true }]);
-    expect(result.needsAI).toBe(true);
-  });
-
-  it('merges sandbox flag', () => {
-    const result = mergeBindings([empty, { ...empty, needsSandbox: true }]);
-    expect(result.needsSandbox).toBe(true);
-  });
-
-  it('merges live flag', () => {
-    const result = mergeBindings([empty, { ...empty, needsLive: true }]);
-    expect(result.needsLive).toBe(true);
-  });
-
-  it('merges AI with other bindings', () => {
-    const result = mergeBindings([
-      { ...empty, needsD1: true },
-      { ...empty, needsAI: true },
-    ]);
-    expect(result.needsD1).toBe(true);
-    expect(result.needsAI).toBe(true);
-    expect(result.needsKV).toBe(false);
+  it('handles empty array', () => {
+    expect(mergeBindings([])).toEqual(NO_BINDINGS);
   });
 });
diff --git a/packages/void/test/unit/info.test.ts b/packages/void/test/unit/info.test.ts
index 23033bf86..c1474d0f4 100644
--- a/packages/void/test/unit/info.test.ts
+++ b/packages/void/test/unit/info.test.ts
@@ -81,6 +81,7 @@ describe('void info', () => {
       },
     ]);
     const output = formatProjectInfo(info);
+    expect(output).toContain('Inferred name: chat-room');
     expect(output).toContain(
       "To preserve this resource when moving its code, add this to 'defineRoom':",
     );
diff --git a/packages/void/test/unit/init-starter-migrations.test.ts b/packages/void/test/unit/init-starter-migrations.test.ts
index 2c24f025e..d946cd8c7 100644
--- a/packages/void/test/unit/init-starter-migrations.test.ts
+++ b/packages/void/test/unit/init-starter-migrations.test.ts
@@ -7,10 +7,10 @@ import {
   symlinkSync,
   writeFileSync,
 } from 'node:fs';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
-import { hasDeploySchemaDrift } from '../../src/cli/deploy.ts';
+import { hasDeploySchemaDrift } from '../../src/cli/deploy-drift.ts';
 import { generateStarterMigration } from '../../src/cli/init.ts';
 import { createPagesStarterTemplate, type ScaffoldStarterMode } from '../../src/cli/template.ts';
 
@@ -74,7 +74,7 @@ function createStarterApp(starterMode: Exclude<ScaffoldStarterMode, 'static'>):
 
   for (const [filePath, content] of Object.entries(template.files)) {
     const fullPath = join(root, filePath);
-    mkdirSync(fullPath.slice(0, fullPath.lastIndexOf('/')), { recursive: true });
+    mkdirSync(dirname(fullPath), { recursive: true });
     writeFileSync(fullPath, content);
   }
 
diff --git a/packages/void/test/unit/init.test.ts b/packages/void/test/unit/init.test.ts
index 66c53f7e5..30ebb3adb 100644
--- a/packages/void/test/unit/init.test.ts
+++ b/packages/void/test/unit/init.test.ts
@@ -14,7 +14,6 @@ import { toSlash } from 'pathslash';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 import {
   detectProjectState,
-  ensureVoidDependency,
   ensureVoidWorkerCompatibilityDate,
   ensureVoidPlatformConnection,
   extractPnpmWorkspacePackages,
@@ -41,7 +40,6 @@ const mockGetToken = vi.fn();
 const mockGetApiUrl = vi.fn();
 const mockRunLogin = vi.fn();
 const mockSaveToken = vi.fn();
-const mockIsStagingMode = vi.fn();
 const mockListProjects = vi.fn();
 const mockCreateProject = vi.fn();
 const mockDiscoverPlatform = vi.fn();
@@ -175,11 +173,9 @@ describe('GitHub Actions deployment workflows', () => {
 
 function expectPnpmAllowBuilds(root: string): void {
   const yaml = readFileSync(join(root, 'pnpm-workspace.yaml'), 'utf-8');
-  expect(yaml).toContain('allowBuilds:\n');
-  expect(yaml).toContain('  better-sqlite3: false');
-  expect(yaml).toContain('  esbuild: true');
-  expect(yaml).toContain('  sharp: true');
-  expect(yaml).toContain('  workerd: true');
+  expect(yaml.match(/^allowBuilds:\n(?: {2}.*\n)*/m)?.[0]).toBe(
+    'allowBuilds:\n  better-sqlite3: false\n  esbuild: true\n  sharp: true\n  workerd: true\n',
+  );
   expect(yaml).not.toContain('onlyBuiltDependencies:');
 }
 
@@ -207,9 +203,8 @@ vi.mock('@voidzero-dev/vite-plus-prompts', () => ({
 vi.mock('../../src/cli/auth', () => ({
   getApiUrl: (...args: Array<unknown>) => mockGetApiUrl(...args),
   getToken: (...args: Array<unknown>) => mockGetToken(...args),
-  runLogin: (...args: Array<unknown>) => mockRunLogin(...args),
-  saveToken: (...args: Array<unknown>) => mockSaveToken(...args),
-  isStagingMode: (...args: Array<unknown>) => mockIsStagingMode(...args),
+  runPlatformLogin: (...args: Array<unknown>) => mockRunLogin(...args),
+  savePlatformToken: (...args: Array<unknown>) => mockSaveToken(...args),
   getSiteDomain: () => 'void.app',
 }));
 
@@ -308,6 +303,101 @@ function listMigrationSqlFiles(root: string): Array<string> {
     .sort();
 }
 
+/** The cwd of a mocked `drizzle-kit generate` spawn, or undefined for any other spawn. */
+function drizzleGenerateCwd(command: unknown, args: unknown, options: unknown): string | undefined {
+  if (command !== process.execPath || !Array.isArray(args) || args[1] !== 'generate') {
+    return undefined;
+  }
+  const cwd = (options as { cwd?: unknown } | null | undefined)?.cwd;
+  return typeof cwd === 'string' ? cwd : undefined;
+}
+
+/** Every spawn succeeds; drizzle-kit writes a migration and `yarn install` runs `onYarnInstall`. */
+function mockSpawnSuccess(onYarnInstall?: (cwd: string) => void): void {
+  mockSpawnSync.mockImplementation((command, args, options) => {
+    const cwd = (options as { cwd?: unknown } | null | undefined)?.cwd;
+    if (
+      onYarnInstall &&
+      command === 'yarn' &&
+      Array.isArray(args) &&
+      args[0] === 'install' &&
+      typeof cwd === 'string'
+    ) {
+      onYarnInstall(cwd);
+    }
+    const generateCwd = drizzleGenerateCwd(command, args, options);
+    if (generateCwd) {
+      writeMockGeneratedMigration(generateCwd);
+    }
+    return { status: 0, stdout: '', stderr: '' };
+  });
+}
+
+function installCalls() {
+  return mockSpawnSync.mock.calls.filter(
+    (call) => Array.isArray(call[1]) && call[1][0] === 'install',
+  );
+}
+
+function drizzleGenerateCalls() {
+  return mockSpawnSync.mock.calls.filter(
+    (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
+  );
+}
+
+function workspaceNotes() {
+  return mockNote.mock.calls.filter((call) => call[1] === 'Workspace subpackage');
+}
+
+function writeInstalledVoid(dir: string): void {
+  mkdirSync(join(dir, 'node_modules', 'void'), { recursive: true });
+  writeFileSync(
+    join(dir, 'node_modules', 'void', 'package.json'),
+    JSON.stringify({ name: 'void', version: '0.0.0' }, null, 2) + '\n',
+  );
+}
+
+/** An existing Vite app, so init offers the demo instead of the Pages starter. */
+function writeExistingViteApp(
+  root: string,
+  options: { void?: string; packageManager?: string } = {},
+): void {
+  mkdirSync(root, { recursive: true });
+  const devDependencies: Record<string, string> = { vite: '^8.0.0' };
+  if (options.void !== undefined) {
+    devDependencies.void = options.void;
+  }
+  writeFileSync(
+    join(root, 'package.json'),
+    JSON.stringify(
+      {
+        name: 'app',
+        private: true,
+        type: 'module',
+        packageManager: options.packageManager,
+        devDependencies,
+      },
+      null,
+      2,
+    ) + '\n',
+  );
+}
+
+/** Full init flow with no database, the demo accepted and GitHub Actions declined. */
+async function runInitWithDemo(root: string): Promise<void> {
+  mockSelect.mockResolvedValueOnce('none');
+  mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
+  await runInitCommand(root);
+}
+
+function expectVoidDeclared(root: string): void {
+  const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
+  const voidSpec =
+    pkg.devDependencies?.void ?? pkg.dependencies?.void ?? pkg.peerDependencies?.void;
+  expect(typeof voidSpec).toBe('string');
+  expect(voidSpec.length).toBeGreaterThan(0);
+}
+
 function writeExistingAstroProject(root: string): void {
   writeFileSync(
     join(root, 'package.json'),
@@ -371,7 +461,6 @@ afterEach(() => {
   mockGetApiUrl.mockReset();
   mockRunLogin.mockReset();
   mockSaveToken.mockReset();
-  mockIsStagingMode.mockReset();
   mockListProjects.mockReset();
   mockCreateProject.mockReset();
   mockDiscoverPlatform.mockReset();
@@ -392,24 +481,10 @@ beforeEach(() => {
   mockSelect.mockImplementation((options: { message?: string }) =>
     options.message === 'Where should this project deploy?' ? 'void' : undefined,
   );
-  mockSpawnSync.mockImplementation((command, args, options) => {
-    if (
-      command === process.execPath &&
-      Array.isArray(args) &&
-      args[1] === 'generate' &&
-      options &&
-      typeof options === 'object' &&
-      'cwd' in options &&
-      typeof options.cwd === 'string'
-    ) {
-      writeMockGeneratedMigration(options.cwd);
-    }
-    return { status: 0, stdout: '', stderr: '' };
-  });
+  mockSpawnSuccess();
   mockGetToken.mockReturnValue(null);
   mockGetApiUrl.mockReturnValue('https://api.void.cloud');
   mockRunLogin.mockResolvedValue('token_123');
-  mockIsStagingMode.mockReturnValue(false);
   mockListProjects.mockResolvedValue([]);
   mockCreateProject.mockResolvedValue({ id: 'proj_123', slug: 'my-app' });
   mockDiscoverPlatform.mockResolvedValue({
@@ -518,10 +593,6 @@ describe('extractPnpmWorkspacePackages', () => {
   });
 
   it('parses inline flow-style list with a single quoted element', () => {
-    // Real pnpm manifests also accept the flow-style inline form (e.g.
-    // generated by some tooling). Without it, `isWorkspaceSubpackage`
-    // falls back to the fresh-clone install path inside a subpackage
-    // with `workspace:` specs.
     expect(extractPnpmWorkspacePackages("packages: ['packages/*']\n")).toEqual(['packages/*']);
   });
 
@@ -554,10 +625,6 @@ describe('extractPnpmWorkspacePackages', () => {
     expect(extractPnpmWorkspacePackages('catalog:\n  vite: ^8.0.0\n')).toEqual([]);
   });
 
-  // Comment stripping must respect quoted scalars. Truncating
-  // `- "path #hash/*"` to `- "path` would silently fail the
-  // `isWorkspaceSubpackage` membership check and misroute a valid
-  // subpackage into the fresh-clone install path.
   it('preserves `#` inside a double-quoted workspace pattern', () => {
     const yaml = ['packages:', '  - "path #hash/*"', ''].join('\n');
     expect(extractPnpmWorkspacePackages(yaml)).toEqual(['path #hash/*']);
@@ -582,20 +649,22 @@ describe('extractPnpmWorkspacePackages', () => {
 });
 
 describe('isVoidResolvableFrom', () => {
-  // `.pnp.cjs` / `.pnp.loader.mjs` at an ancestor count as "void is
-  // resolvable" — Yarn Berry PnP projects have no `node_modules` tree.
-  //
-  // The PnP branch additionally requires the post-install marker `.yarn/install-state.gz` in the same directory as the
-  // runtime file — a committed-but-unfetched `.pnp.cjs` is NOT proof
-  // that `yarn install` has actually populated the archives.
+  function probeCalls(kind: 'cjs' | 'esm'): number {
+    const argv =
+      kind === 'cjs'
+        ? ['-e', "require.resolve('void')"]
+        : ['--input-type=module', '-e', "import.meta.resolve('void')"];
+    return mockSpawnSync.mock.calls.filter((call) => {
+      const args: unknown = call[1];
+      return Array.isArray(args) && argv.every((arg, index) => args[index] === arg);
+    }).length;
+  }
+
   it('returns true when a PnP runtime sits at an ancestor directory', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-'));
     try {
       const subApp = join(root, 'packages', 'app');
       mkdirSync(subApp, { recursive: true });
-      // `.pnp.cjs` at the workspace root — the common shape. No
-      // `node_modules` anywhere. The post-install marker must sit in
-      // the same directory as `.pnp.cjs` to count as "installed".
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
@@ -605,48 +674,22 @@ describe('isVoidResolvableFrom', () => {
     }
   });
 
-  it('returns true when only `.pnp.loader.mjs` is present (ESM-only shape)', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-'));
-    try {
-      writeFileSync(join(root, '.pnp.loader.mjs'), '// pnp loader\n');
-      mkdirSync(join(root, '.yarn'), { recursive: true });
-      writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-      expect(isVoidResolvableFrom(root)).toBe(true);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  // Committed-but-unfetched PnP fresh clone — `.pnp.cjs`
-  // lives in version control but `yarn install` hasn't run yet, so
-  // `.yarn/install-state.gz` is absent. Trusting `.pnp.cjs` existence
-  // alone misrouts `runInitCommand` into the "void is already
-  // installed" branch and the subsequent `drizzle-kit generate` spawn
-  // crashes because PnP points at missing ZIP archives. Refuse.
+  // Before `yarn install`, a committed `.pnp.cjs` points at archives that are not fetched yet.
   it('returns false when .pnp.cjs exists but .yarn/install-state.gz is missing', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-fresh-'));
     try {
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
-      // No `.yarn/install-state.gz` anywhere — fresh clone state.
       expect(isVoidResolvableFrom(root)).toBe(false);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
   });
 
-  // Yarn Berry zero-install repos commit `.yarn/cache/*.zip`
-  // to version control and commonly gitignore `.yarn/install-state.gz`
-  // (or never write it). A populated cache next to `.pnp.cjs` is
-  // sufficient proof that the checkout can resolve dependencies — the
-  // whole point of zero-install. Refusing this shape misrouts valid
-  // workspace subpackages into the "fresh clone" path and skips the
-  // starter migration generation.
+  // Zero-install repos commit `.yarn/cache` and often have no install-state.gz.
   it('returns true when .pnp.cjs exists with a populated .yarn/cache (zero-install)', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-zero-'));
     try {
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
-      // No `install-state.gz`, but the cache has at least one zip —
-      // the classic zero-install shape.
       mkdirSync(join(root, '.yarn', 'cache'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'cache', 'pkg-npm-1.0.0-abcd.zip'), '');
       expect(isVoidResolvableFrom(root)).toBe(true);
@@ -655,15 +698,10 @@ describe('isVoidResolvableFrom', () => {
     }
   });
 
-  // Inverse of the zero-install case — when `.pnp.cjs` is
-  // present but `.yarn/cache/` is empty AND `install-state.gz` is
-  // absent, neither marker proves the checkout has been populated.
-  // Refuse so the caller triggers the install step.
   it('returns false when .pnp.cjs exists but .yarn/cache is empty and install-state.gz is missing', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-empty-cache-'));
     try {
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
-      // Empty cache directory (no `.zip` entries), no install-state.gz.
       mkdirSync(join(root, '.yarn', 'cache'), { recursive: true });
       expect(isVoidResolvableFrom(root)).toBe(false);
     } finally {
@@ -671,47 +709,12 @@ describe('isVoidResolvableFrom', () => {
     }
   });
 
-  it('returns true when .pnp.cjs AND .yarn/install-state.gz both exist', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-installed-'));
-    try {
-      writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
-      mkdirSync(join(root, '.yarn'), { recursive: true });
-      writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-      expect(isVoidResolvableFrom(root)).toBe(true);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  it('finds installed PnP at an ancestor directory', () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-ancestor-'));
-    try {
-      const subApp = join(root, 'packages', 'app');
-      mkdirSync(subApp, { recursive: true });
-      writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
-      mkdirSync(join(root, '.yarn'), { recursive: true });
-      writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-      expect(isVoidResolvableFrom(subApp)).toBe(true);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  // The same-directory invariant — when we find `.pnp.cjs`
-  // at `<root>/app`, we stop walking and check for `install-state.gz`
-  // next to it. An `install-state.gz` at an UNRELATED ancestor (for
-  // example the parent workspace) must not retroactively validate the
-  // subdirectory's `.pnp.cjs`.
   it('returns false when .yarn/install-state.gz is at a DIFFERENT ancestor than .pnp.cjs', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-mismatch-'));
     try {
       const subApp = join(root, 'app');
       mkdirSync(subApp, { recursive: true });
-      // `.pnp.cjs` at the subdirectory — this is where the walk stops.
       writeFileSync(join(subApp, '.pnp.cjs'), '// pnp stub\n');
-      // `install-state.gz` only at the ROOT, NOT at `<root>/app`. The
-      // stricter helper should refuse because the two markers live in
-      // different directories.
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
       expect(isVoidResolvableFrom(subApp)).toBe(false);
@@ -723,8 +726,6 @@ describe('isVoidResolvableFrom', () => {
   it('returns false for a bare directory with no node_modules and no PnP runtime', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-bare-'));
     try {
-      // No node_modules/void, no .pnp.cjs, no .pnp.loader.mjs
-      // anywhere up to the filesystem root.
       expect(isVoidResolvableFrom(root)).toBe(false);
     } finally {
       rmSync(root, { recursive: true, force: true });
@@ -734,11 +735,7 @@ describe('isVoidResolvableFrom', () => {
   it('returns true when `node_modules/void/package.json` exists at `start` (unchanged legacy shape)', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-nm-'));
     try {
-      mkdirSync(join(root, 'node_modules', 'void'), { recursive: true });
-      writeFileSync(
-        join(root, 'node_modules', 'void', 'package.json'),
-        JSON.stringify({ name: 'void', version: '0.0.1' }, null, 2) + '\n',
-      );
+      writeInstalledVoid(root);
       expect(isVoidResolvableFrom(root)).toBe(true);
     } finally {
       rmSync(root, { recursive: true, force: true });
@@ -748,11 +745,7 @@ describe('isVoidResolvableFrom', () => {
   it('returns true when `node_modules/void/package.json` exists at an ancestor (hoisted monorepo shape)', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-hoist-'));
     try {
-      mkdirSync(join(root, 'node_modules', 'void'), { recursive: true });
-      writeFileSync(
-        join(root, 'node_modules', 'void', 'package.json'),
-        JSON.stringify({ name: 'void', version: '0.0.1' }, null, 2) + '\n',
-      );
+      writeInstalledVoid(root);
       const subApp = join(root, 'packages', 'app');
       mkdirSync(subApp, { recursive: true });
       expect(isVoidResolvableFrom(subApp)).toBe(true);
@@ -761,39 +754,17 @@ describe('isVoidResolvableFrom', () => {
     }
   });
 
-  // An installed PnP runtime proves that `yarn install` ran at
-  // least once, but it does NOT prove that `void` is currently on the
-  // dependency graph. A branch switch / `package.json` edit that removes
-  // `void` leaves stale `.pnp.cjs` that still points at the old graph.
-  // `isVoidResolvableFrom` must actually spawn a probe under the PnP
-  // loaders and observe `require.resolve('void')` succeeding.
+  // Installed PnP data can be stale (for example after `void` was removed on another branch).
   it('returns false when the PnP probe for `require.resolve("void")` fails (stale .pnp.cjs)', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-stale-'));
     try {
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-
-      // Probe spawn for `require.resolve('void')` returns a non-zero
-      // exit — void is not in the current PnP graph.
-      mockSpawnSync.mockImplementationOnce(
-        (_command: unknown, _args: unknown, _options: unknown) => ({
-          status: 1,
-          stdout: '',
-          stderr: '',
-        }),
-      );
+      mockSpawnSync.mockReturnValueOnce({ status: 1, stdout: '', stderr: '' });
 
       expect(isVoidResolvableFrom(root)).toBe(false);
-
-      // Verify the probe was actually spawned with the expected argv.
-      const probeCalls = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '-e' &&
-          (call[1] as Array<unknown>)[1] === "require.resolve('void')",
-      );
-      expect(probeCalls.length).toBe(1);
+      expect(probeCalls('cjs')).toBe(1);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
@@ -805,71 +776,27 @@ describe('isVoidResolvableFrom', () => {
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-
-      // Probe spawn returns 0 — void resolves in the current PnP graph.
-      mockSpawnSync.mockImplementationOnce(
-        (_command: unknown, _args: unknown, _options: unknown) => ({
-          status: 0,
-          stdout: '',
-          stderr: '',
-        }),
-      );
+      mockSpawnSync.mockReturnValueOnce({ status: 0, stdout: '', stderr: '' });
 
       expect(isVoidResolvableFrom(root)).toBe(true);
-
-      const probeCalls = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '-e' &&
-          (call[1] as Array<unknown>)[1] === "require.resolve('void')",
-      );
-      expect(probeCalls.length).toBe(1);
+      expect(probeCalls('cjs')).toBe(1);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
   });
 
-  // When only `.pnp.loader.mjs` is
-  // present (no `.pnp.cjs`), `buildDrizzleKitSpawnEnv` only injects
-  // `--experimental-loader` and does NOT inject `--require`. A CJS
-  // probe (`node -e "require.resolve('void')"`) therefore cannot see
-  // the PnP loader and falsely reports "not resolvable". The probe
-  // must switch to the ESM resolver — `import.meta.resolve('void')`
-  // under `--input-type=module` — which goes through the loader's
-  // `resolve` hook.
+  // A loader-only runtime gets no `--require`, so a CJS probe cannot see it.
   it('uses an ESM probe when only `.pnp.loader.mjs` is present (loader-only PnP)', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-loader-only-'));
     try {
       writeFileSync(join(root, '.pnp.loader.mjs'), '// pnp loader\n');
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-
-      mockSpawnSync.mockImplementationOnce(
-        (_command: unknown, _args: unknown, _options: unknown) => ({
-          status: 0,
-          stdout: '',
-          stderr: '',
-        }),
-      );
+      mockSpawnSync.mockReturnValueOnce({ status: 0, stdout: '', stderr: '' });
 
       expect(isVoidResolvableFrom(root)).toBe(true);
-
-      // Only the ESM probe shape should have been spawned — NO CJS probe.
-      const esmProbes = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '--input-type=module' &&
-          (call[1] as Array<unknown>)[1] === '-e' &&
-          (call[1] as Array<unknown>)[2] === "import.meta.resolve('void')",
-      );
-      expect(esmProbes.length).toBe(1);
-      const cjsProbes = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '-e' &&
-          (call[1] as Array<unknown>)[1] === "require.resolve('void')",
-      );
-      expect(cjsProbes.length).toBe(0);
+      expect(probeCalls('esm')).toBe(1);
+      expect(probeCalls('cjs')).toBe(0);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
@@ -881,124 +808,55 @@ describe('isVoidResolvableFrom', () => {
       writeFileSync(join(root, '.pnp.loader.mjs'), '// pnp loader\n');
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-
-      mockSpawnSync.mockImplementationOnce(
-        (_command: unknown, _args: unknown, _options: unknown) => ({
-          status: 1,
-          stdout: '',
-          stderr: '',
-        }),
-      );
+      mockSpawnSync.mockReturnValueOnce({ status: 1, stdout: '', stderr: '' });
 
       expect(isVoidResolvableFrom(root)).toBe(false);
-
-      const esmProbes = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '--input-type=module' &&
-          (call[1] as Array<unknown>)[1] === '-e' &&
-          (call[1] as Array<unknown>)[2] === "import.meta.resolve('void')",
-      );
-      expect(esmProbes.length).toBe(1);
+      expect(probeCalls('esm')).toBe(1);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
   });
 
   it('still uses the CJS probe when both `.pnp.cjs` and `.pnp.loader.mjs` are present', () => {
-    // Common Yarn 4 shape: both files exist. `.pnp.cjs` is the primary
-    // runtime and the CJS probe is idiomatic under `--require`. Pin
-    // this so a future refactor doesn't silently flip the probe
-    // shape for the common case.
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-both-'));
     try {
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
       writeFileSync(join(root, '.pnp.loader.mjs'), '// pnp loader\n');
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
-
-      mockSpawnSync.mockImplementationOnce(
-        (_command: unknown, _args: unknown, _options: unknown) => ({
-          status: 0,
-          stdout: '',
-          stderr: '',
-        }),
-      );
+      mockSpawnSync.mockReturnValueOnce({ status: 0, stdout: '', stderr: '' });
 
       expect(isVoidResolvableFrom(root)).toBe(true);
-
-      const cjsProbes = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '-e' &&
-          (call[1] as Array<unknown>)[1] === "require.resolve('void')",
-      );
-      expect(cjsProbes.length).toBe(1);
-      const esmProbes = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) && (call[1] as Array<unknown>)[0] === '--input-type=module',
-      );
-      expect(esmProbes.length).toBe(0);
+      expect(probeCalls('cjs')).toBe(1);
+      expect(probeCalls('esm')).toBe(0);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
   });
 
-  // The `node_modules/void` ancestor walk must short-circuit
-  // the PnP probe. When the hoisted node_modules is already present we
-  // don't need to spawn a probe process at all.
   it('does not spawn the PnP probe when node_modules/void exists at start (even with PnP markers)', () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-pnp-nm-'));
     try {
-      mkdirSync(join(root, 'node_modules', 'void'), { recursive: true });
-      writeFileSync(
-        join(root, 'node_modules', 'void', 'package.json'),
-        JSON.stringify({ name: 'void', version: '0.0.1' }, null, 2) + '\n',
-      );
-      // PnP markers also present — but node_modules walk should return
-      // true first and avoid the probe entirely.
+      writeInstalledVoid(root);
       writeFileSync(join(root, '.pnp.cjs'), '// pnp stub\n');
       mkdirSync(join(root, '.yarn'), { recursive: true });
       writeFileSync(join(root, '.yarn', 'install-state.gz'), '');
 
-      const probeCallsBefore = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '-e' &&
-          (call[1] as Array<unknown>)[1] === "require.resolve('void')",
-      ).length;
-
+      const probesBefore = probeCalls('cjs');
       expect(isVoidResolvableFrom(root)).toBe(true);
-
-      const probeCallsAfter = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '-e' &&
-          (call[1] as Array<unknown>)[1] === "require.resolve('void')",
-      ).length;
-      expect(probeCallsAfter).toBe(probeCallsBefore);
+      expect(probeCalls('cjs')).toBe(probesBefore);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
   });
 
-  // A leaf-managed nested project sitting inside an unrelated Yarn PnP
-  // monorepo must not inherit the outer `.pnp.cjs`.
-  // `findInstalledYarnPnpRuntime` stops at `start`
-  // when the leaf has its own lockfile or Corepack pin. The node_modules
-  // ancestor walk above already short-circuits when the leaf has an
-  // installed `void`; this test covers the state BEFORE install, where
-  // both branches must refuse to fall back to the outer graph.
+  // A nested project with its own lockfile must not inherit an outer PnP graph.
   it('does not walk past a leaf-managed lockfile into an ancestor Yarn PnP monorepo', () => {
     const outer = mkdtempSync(join(tmpdir(), 'void-init-pnp-leaf-lock-'));
     try {
-      // Ancestor: installed Yarn PnP monorepo with runtime + marker.
       writeFileSync(join(outer, '.pnp.cjs'), '// pnp stub\n');
       mkdirSync(join(outer, '.yarn'), { recursive: true });
       writeFileSync(join(outer, '.yarn', 'install-state.gz'), '');
-      // Nested leaf npm project with its own lockfile. No node_modules
-      // yet (fresh clone), no local PnP files — the gate must stop the
-      // ancestor walk here instead of finding the outer `.pnp.cjs`.
       const leaf = join(outer, 'scratch', 'my-app');
       mkdirSync(leaf, { recursive: true });
       writeFileSync(join(leaf, 'package.json'), '{"name":"my-app"}\n');
@@ -1006,64 +864,36 @@ describe('isVoidResolvableFrom', () => {
 
       const probesBefore = mockSpawnSync.mock.calls.length;
       expect(isVoidResolvableFrom(leaf)).toBe(false);
-      // No PnP probe should have been spawned — `findInstalledYarnPnpRuntime`
-      // must return undefined before we reach the probe branch.
       expect(mockSpawnSync.mock.calls.length).toBe(probesBefore);
     } finally {
       rmSync(outer, { recursive: true, force: true });
     }
   });
 
-  // A `packageManager` Corepack pin at
-  // a subpackage must NOT stop the ancestor walk. Yarn Berry workspace
-  // members can legitimately carry their own `packageManager: "yarn@..."`
-  // while still resolving through the workspace root's `.pnp.cjs`.
-  // Treating the pin as leaf-managed would regress valid PnP monorepos.
+  // Yarn workspace members may carry their own Corepack pin and still use the root `.pnp.cjs`.
   it('still walks to an ancestor `.pnp.cjs` when a subpackage has only a `packageManager` pin (no lockfile)', () => {
     const outer = mkdtempSync(join(tmpdir(), 'void-init-pnp-pkgmgr-ws-'));
     try {
       writeFileSync(join(outer, '.pnp.cjs'), '// pnp stub\n');
       mkdirSync(join(outer, '.yarn'), { recursive: true });
       writeFileSync(join(outer, '.yarn', 'install-state.gz'), '');
-      // Workspace subpackage with its own `packageManager` pin — this
-      // is a common shape for generator-scaffolded Yarn subpackages
-      // and must NOT block the ancestor walk.
       const sub = join(outer, 'packages', 'app');
       mkdirSync(sub, { recursive: true });
       writeFileSync(
         join(sub, 'package.json'),
         JSON.stringify({ name: 'app', packageManager: 'yarn@4.5.3' }, null, 2) + '\n',
       );
+      mockSpawnSync.mockReturnValueOnce({ status: 0, stdout: '', stderr: '' });
 
-      mockSpawnSync.mockImplementationOnce(
-        (_command: unknown, _args: unknown, _options: unknown) => ({
-          status: 0,
-          stdout: '',
-          stderr: '',
-        }),
-      );
-
-      // Must resolve through the ancestor PnP graph — the probe fires
-      // and reports success under the outer `.pnp.cjs`.
       expect(isVoidResolvableFrom(sub)).toBe(true);
-      const probeCalls = mockSpawnSync.mock.calls.filter(
-        (call) =>
-          Array.isArray(call[1]) &&
-          (call[1] as Array<unknown>)[0] === '-e' &&
-          (call[1] as Array<unknown>)[1] === "require.resolve('void')",
-      );
-      expect(probeCalls.length).toBe(1);
+      expect(probeCalls('cjs')).toBe(1);
     } finally {
       rmSync(outer, { recursive: true, force: true });
     }
   });
 });
 
-// A leaf-managed nested project inside an unrelated Yarn PnP monorepo
-// must not get the outer `.pnp.cjs` injected into `NODE_OPTIONS`, or
-// drizzle-kit resolves local deps through the outer graph and crashes.
-// The gate in `findYarnPnpRuntime` must stop the walk at any directory
-// that owns its own install.
+// An outer `.pnp.cjs` in NODE_OPTIONS would resolve a leaf project's deps through the wrong graph.
 describe('buildDrizzleKitSpawnEnv leaf-managed gate', () => {
   it('does not inject NODE_OPTIONS for a leaf project with a local lockfile inside a Yarn PnP monorepo', () => {
     const outer = mkdtempSync(join(tmpdir(), 'void-init-env-leaf-lock-'));
@@ -1079,8 +909,6 @@ describe('buildDrizzleKitSpawnEnv leaf-managed gate', () => {
       writeFileSync(join(leaf, 'package-lock.json'), '{}\n');
 
       const env = buildDrizzleKitSpawnEnv(leaf);
-      // The returned env must NOT contain a NODE_OPTIONS that references
-      // the ancestor PnP runtime — that would break local resolution.
       expect(env.NODE_OPTIONS).toBeUndefined();
     } finally {
       if (savedNodeOptions === undefined) {
@@ -1092,11 +920,6 @@ describe('buildDrizzleKitSpawnEnv leaf-managed gate', () => {
     }
   });
 
-  // A subpackage that only carries a
-  // `packageManager` Corepack pin is NOT proof of leaf-managed
-  // ownership — Yarn workspace members legitimately do this. The gate
-  // must still inject the ancestor PnP loader in that case. This
-  // mirrors the `isVoidResolvableFrom` regression test above.
   it('still injects NODE_OPTIONS for a workspace subpackage that only has a `packageManager` pin', () => {
     const outer = mkdtempSync(join(tmpdir(), 'void-init-env-pkgmgr-ws-'));
     const savedNodeOptions = process.env.NODE_OPTIONS;
@@ -1126,10 +949,6 @@ describe('buildDrizzleKitSpawnEnv leaf-managed gate', () => {
   });
 
   it('still injects NODE_OPTIONS when local PnP files exist alongside a lockfile (local PnP precedence)', () => {
-    // A real Yarn Berry project commits both `yarn.lock` AND `.pnp.cjs`
-    // at the same directory. The local lockfile should NOT gate out
-    // the local PnP runtime — local PnP files at `start` are
-    // authoritative over the leaf-managed ownership check.
     const root = mkdtempSync(join(tmpdir(), 'void-init-env-local-pnp-'));
     const savedNodeOptions = process.env.NODE_OPTIONS;
     delete process.env.NODE_OPTIONS;
@@ -1152,36 +971,6 @@ describe('buildDrizzleKitSpawnEnv leaf-managed gate', () => {
       rmSync(root, { recursive: true, force: true });
     }
   });
-
-  it('still walks to an ancestor Yarn PnP monorepo for a true workspace subpackage (no local ownership)', () => {
-    // Sanity: the common shape — a workspace subpackage with no
-    // lockfile, no Corepack pin, no local PnP files — must still pick
-    // up the ancestor's `.pnp.cjs` so drizzle-kit spawns under PnP.
-    const outer = mkdtempSync(join(tmpdir(), 'void-init-env-monorepo-'));
-    const savedNodeOptions = process.env.NODE_OPTIONS;
-    delete process.env.NODE_OPTIONS;
-    try {
-      writeFileSync(join(outer, '.pnp.cjs'), '// pnp stub\n');
-      mkdirSync(join(outer, '.yarn'), { recursive: true });
-      writeFileSync(join(outer, '.yarn', 'install-state.gz'), '');
-      const sub = join(outer, 'packages', 'app');
-      mkdirSync(sub, { recursive: true });
-      // Package manifest for the workspace member — NO lockfile, NO
-      // packageManager field.
-      writeFileSync(join(sub, 'package.json'), '{"name":"app"}\n');
-
-      const env = buildDrizzleKitSpawnEnv(sub);
-      expect(env.NODE_OPTIONS).toBeDefined();
-      expect(env.NODE_OPTIONS).toContain(JSON.stringify(toSlash(join(outer, '.pnp.cjs'))));
-    } finally {
-      if (savedNodeOptions === undefined) {
-        delete process.env.NODE_OPTIONS;
-      } else {
-        process.env.NODE_OPTIONS = savedNodeOptions;
-      }
-      rmSync(outer, { recursive: true, force: true });
-    }
-  });
 });
 
 describe('isScaffoldableEmptyProject', () => {
@@ -1616,28 +1405,6 @@ describe('isScaffoldableEmptyProject', () => {
     }
   });
 
-  it('scaffolds plain Vite scripts when the Vite toolchain is selected', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      mockSelect
-        .mockResolvedValueOnce('vite')
-        .mockResolvedValueOnce('react')
-        .mockResolvedValueOnce('static');
-      mockConfirm.mockResolvedValueOnce(false);
-
-      await runInitCommand(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      expect(pkg.devDependencies.vite).toBe('^8.0.10');
-      expect(pkg.devDependencies['vite-plus']).toBeUndefined();
-      expect(pkg.scripts.dev).toBe('vite');
-      expect(pkg.scripts.build).toBe('vite build');
-      expect(pkg.scripts.preview).toBe('vite preview');
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
   it('prompts for the scaffold toolchain after pnpm add -D void creates pnpm-workspace.yaml', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
@@ -1826,20 +1593,13 @@ describe('isScaffoldableEmptyProject', () => {
       await runInitCommand(root, { github: true, tsconfig: false });
 
       const yaml = readFileSync(join(root, '.github', 'workflows', 'void-deploy.yml'), 'utf-8');
-      // OIDC, not a stored secret.
       expect(yaml).not.toContain('secrets.VOID_TOKEN');
-      // `id-token: write` is retained — `void deploy` mints the OIDC token.
       expect(yaml).toContain('id-token: write');
       expect(yaml).toContain('contents: read');
-      // No linked project → placeholder repository variable.
       expect(yaml).toContain('VOID_PROJECT: ${{ vars.VOID_PROJECT }}');
       expect(yaml).toContain("VOID_API_URL: ${{ vars.VOID_API_URL || 'https://api.void.cloud' }}");
-      // npm project → npx runner, deploy passes the project slug (the only step
-      // that runs void).
       expect(yaml).toContain('npx void deploy --platform void --project "$VOID_PROJECT"');
       expect(yaml.match(/deploy --platform void --project "\$VOID_PROJECT"/g)).toHaveLength(1);
-      // Latest-push-wins concurrency keyed by repo + ref (no env context, which
-      // is unavailable to workflow-level concurrency).
       expect(yaml).toContain('concurrency:');
       expect(yaml).toContain('group: void-deploy-${{ github.repository }}-${{ github.ref }}');
       expect(yaml).toContain('cancel-in-progress: true');
@@ -1870,8 +1630,6 @@ describe('isScaffoldableEmptyProject', () => {
       const yaml = readFileSync(join(root, '.github', 'workflows', 'void-deploy.yml'), 'utf-8');
       expect(yaml).toContain('VOID_PROJECT: my-app');
       expect(yaml).not.toContain('vars.VOID_PROJECT');
-      // Latest-push-wins concurrency keyed by repo + ref (no env context, which
-      // is unavailable to workflow-level concurrency).
       expect(yaml).toContain('concurrency:');
       expect(yaml).toContain('group: void-deploy-${{ github.repository }}-${{ github.ref }}');
       expect(yaml).toContain('cancel-in-progress: true');
@@ -1885,9 +1643,7 @@ describe('isScaffoldableEmptyProject', () => {
   });
 
   it('bakes the slug into void-deploy.yml when a project is linked during the same interactive init', async () => {
-    // Step 8 (GitHub Actions) runs before Step 9 (project link), so the workflow
-    // is first written with the `${{ vars.VOID_PROJECT }}` placeholder. After the
-    // interactive link resolves a slug it must be patched into the workflow.
+    // The workflow is written before the project link, so the slug is patched in afterwards.
     const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
       writeFileSync(
@@ -1913,13 +1669,11 @@ describe('isScaffoldableEmptyProject', () => {
           custom_domain: null,
         },
       ]);
-      // database → none, then the project-selection prompt → proj_789.
+      // Selects: database, deployment platform, project.
       mockSelect
         .mockResolvedValueOnce('none')
         .mockResolvedValueOnce('void')
         .mockResolvedValueOnce('proj_789');
-      // GitHub Actions confirm → true; deploy-setup link confirm → true;
-      // overwrite-existing-project confirm → true.
       mockConfirm
         .mockResolvedValueOnce(true)
         .mockResolvedValueOnce(true)
@@ -1927,7 +1681,6 @@ describe('isScaffoldableEmptyProject', () => {
 
       await runInitCommand(root);
 
-      // The link was written...
       expect(JSON.parse(readFileSync(join(root, '.void', 'project.json'), 'utf-8'))).toEqual({
         applicationDomain: 'void.app',
         platform: 'void',
@@ -1936,7 +1689,6 @@ describe('isScaffoldableEmptyProject', () => {
         projectId: 'proj_789',
         slug: 'linked-app',
       });
-      // ...and the workflow has the resolved slug, not the placeholder.
       const yaml = readFileSync(join(root, '.github', 'workflows', 'void-deploy.yml'), 'utf-8');
       expect(yaml).toContain('VOID_PROJECT: linked-app');
       expect(yaml).not.toContain('vars.VOID_PROJECT');
@@ -1947,8 +1699,6 @@ describe('isScaffoldableEmptyProject', () => {
   });
 
   it('writes void-deploy.yml and never touches an existing deploy.yml (no migration)', async () => {
-    // `void init --github` does not migrate, rename, or delete any pre-existing
-    // `.github/workflows/deploy.yml` — it only writes `void-deploy.yml`.
     const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
       writeFileSync(
@@ -1972,10 +1722,8 @@ jobs:
 
       await runInitCommand(root, { github: true, tsconfig: false });
 
-      // The pre-existing workflow is preserved byte-for-byte...
       expect(existsSync(existingPath)).toBe(true);
       expect(readFileSync(existingPath, 'utf-8')).toBe(existing);
-      // ...and void-deploy.yml was written alongside it.
       const workflows = readdirSync(join(root, '.github', 'workflows')).sort();
       expect(workflows).toEqual(['deploy.yml', 'void-deploy.yml']);
       const oidc = readFileSync(join(root, '.github', 'workflows', 'void-deploy.yml'), 'utf-8');
@@ -2026,42 +1774,46 @@ jobs:
     }
   });
 
-  it('prints a Nuxt-specific manual config step for existing Nuxt projects', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'existing-nuxt-app',
-            private: true,
-            dependencies: {
-              nuxt: '^4.0.0',
-              void: '^0.6.0',
+  it.each(['peerDependencies', 'optionalDependencies'] as const)(
+    'prints a Nuxt-specific manual config step and keeps void declared in %s',
+    async (field) => {
+      const root = mkdtempSync(join(tmpdir(), 'void-init-'));
+      try {
+        writeFileSync(
+          join(root, 'package.json'),
+          JSON.stringify(
+            {
+              name: 'existing-nuxt-app',
+              private: true,
+              dependencies: { nuxt: '^4.0.0' },
+              [field]: { void: '^0.6.0' },
             },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(false).mockResolvedValueOnce(false);
+            null,
+            2,
+          ) + '\n',
+        );
+        mockSelect.mockResolvedValueOnce('none');
+        mockConfirm.mockResolvedValueOnce(false).mockResolvedValueOnce(false);
 
-      await runInitCommand(root);
+        await runInitCommand(root);
 
-      expect(existsSync(join(root, 'vite.config.ts'))).toBe(false);
-      expect(mockNote).toHaveBeenCalledWith(
-        expect.stringContaining('Add `voidPlugin()` to the Nuxt Vite plugins option'),
-        'Manual Nuxt config step',
-      );
-      expect(mockNote).toHaveBeenCalledWith(
-        expect.stringContaining('export default defineNuxtConfig'),
-        'Manual Nuxt config step',
-      );
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
+        const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
+        expect(pkg[field].void).toBe('^0.6.0');
+        expect(pkg.devDependencies?.void).toBeUndefined();
+        expect(existsSync(join(root, 'vite.config.ts'))).toBe(false);
+        expect(mockNote).toHaveBeenCalledWith(
+          expect.stringContaining('Add `voidPlugin()` to the Nuxt Vite plugins option'),
+          'Manual Nuxt config step',
+        );
+        expect(mockNote).toHaveBeenCalledWith(
+          expect.stringContaining('export default defineNuxtConfig'),
+          'Manual Nuxt config step',
+        );
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+  );
 
   it('adds voidPlugin to an existing Vite plugins array without replacing scripts', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-'));
@@ -2825,28 +2577,6 @@ export default config;
     }
   });
 
-  it('removes the pg config when switching back to implicit sqlite', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(root, 'void.json'), JSON.stringify({ database: 'pg' }, null, 2) + '\n');
-      mockSelect.mockResolvedValueOnce('sqlite');
-      mockConfirm
-        .mockResolvedValueOnce(false)
-        .mockResolvedValueOnce(false)
-        .mockResolvedValueOnce(false);
-
-      await runInitCommand(root);
-
-      expect(readConfig(root)).toEqual({
-        worker: {
-          compatibility_date: LATEST_KNOWN_COMPAT_DATE,
-        },
-      });
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
   it('preserves other void.json fields when switching from pg to sqlite', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
@@ -2920,8 +2650,12 @@ export default config;
       expect(mockConfirm.mock.calls[1]?.[0]).toMatchObject({
         message: 'Log in now and link or create a Void project?',
       });
-      expect(mockRunLogin).toHaveBeenCalledWith(root, 'github', expect.any(Function));
-      expect(mockSaveToken).toHaveBeenCalledWith('token_123', root);
+      expect(mockRunLogin).toHaveBeenCalledWith(
+        'https://api.void.cloud',
+        'github',
+        expect.any(Function),
+      );
+      expect(mockSaveToken).toHaveBeenCalledWith('token_123', 'https://api.void.cloud');
       expect(mockListProjects).toHaveBeenCalledOnce();
       expect(mockCreateProject).toHaveBeenCalledWith('my-live-app');
       expect(JSON.parse(readFileSync(join(root, '.void', 'project.json'), 'utf-8'))).toEqual({
@@ -3057,12 +2791,12 @@ export default config;
             configPath: toSlash(join(root, '.void-wrangler.jsonc')),
           }),
         ]),
-        expect.objectContaining({ cwd: root, stdio: ['ignore', 'pipe', 'pipe'] }),
+        expect.objectContaining({ cwd: root, stdio: ['pipe', 'pipe', 'pipe'] }),
       );
       expect(mockSpawnSync).toHaveBeenCalledWith(
         process.execPath,
         expect.arrayContaining([JSON.stringify({ type: 'auth.login' })]),
-        expect.objectContaining({ cwd: root, stdio: 'inherit' }),
+        expect.objectContaining({ cwd: root, stdio: ['inherit', 'inherit', 'inherit'] }),
       );
       expect(mockNote).toHaveBeenCalledWith(
         expect.stringContaining('Run `void connect --platform cloudflare`'),
@@ -3141,7 +2875,7 @@ export default config;
       expect(mockSpawnSync).toHaveBeenCalledWith(
         process.execPath,
         expect.arrayContaining([JSON.stringify({ type: 'auth.login' })]),
-        expect.objectContaining({ cwd: root, stdio: 'inherit' }),
+        expect.objectContaining({ cwd: root, stdio: ['inherit', 'inherit', 'inherit'] }),
       );
       const accountPrompt = mockSelect.mock.calls.find(
         ([options]) => options.message === 'Choose a Cloudflare account:',
@@ -3313,273 +3047,73 @@ export default config;
   });
 
   it('skips install after demo scaffold when node_modules/void is already populated (workspace subpackage)', async () => {
-    // Workspace subpackages with a `workspace:` spec and no lockfile
-    // must not hit a spurious `npm install` that aborts on `workspace:`
-    // ranges. `node_modules/void` is already populated here
-    // via the parent workspace install, so `generateStarterMigration`
-    // can resolve `void/schema-d1` without re-running install. This
-    // path must stay silent on the package manager — no install call.
     const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'workspace-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:../packages/void',
-              // `vite` keeps `isScaffoldableEmptyProject` from taking the
-              // Pages starter branch so we fall through to the demo prompt.
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      // Pre-populate node_modules/void so `voidResolvable` is true.
-      mkdirSync(join(root, 'node_modules', 'void'), { recursive: true });
-      writeFileSync(
-        join(root, 'node_modules', 'void', 'package.json'),
-        JSON.stringify({ name: 'void', version: '0.0.0' }, null, 2) + '\n',
-      );
-      // No lockfile, no packageManager — `detectProjectState` falls back
-      // to `npm`, which would blow up on the `workspace:` spec if install
-      // actually ran.
-      mockSelect.mockResolvedValueOnce('none');
-      // Demo confirm → true; GitHub Actions confirm → false; deploy-setup
-      // confirm falls through to the mock default (undefined).
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
+      // Without a lockfile init falls back to npm, which rejects `workspace:` specs.
+      writeExistingViteApp(root, { void: 'workspace:../packages/void' });
+      writeInstalledVoid(root);
 
-      await runInitCommand(root);
+      await runInitWithDemo(root);
 
-      // The install call for a workspace subpackage must NOT fire: the
-      // post-demo install is gated on (a) scaffoldDemo mutating
-      // package.json OR (b) node_modules/void being missing. Neither is
-      // true here, so `installProjectDependencies` is skipped entirely.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
+      expect(installCalls()).toHaveLength(0);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
   });
 
   it('skips install after demo scaffold when void is hoisted at the workspace root (ancestor node_modules)', async () => {
-    // Workspace subpackages typically don't have `void` in their own
-    // `node_modules` — the package manager hoists it to the workspace
-    // root. Node's module resolution walks up the directory tree, so
-    // drizzle-kit can still `require('void/schema-d1')` from the
-    // subpackage via the ancestor install. The hoisted case must count as
-    // "already installed" so no spurious subpackage install runs.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Workspace root: stub `void` package in the root's `node_modules`.
-      // No `package.json` is needed at the workspace root for the walk
-      // itself — `isVoidResolvableFrom` only checks `<dir>/node_modules/
-      // void/package.json` at each level.
-      mkdirSync(join(wsroot, 'node_modules', 'void'), { recursive: true });
-      writeFileSync(
-        join(wsroot, 'node_modules', 'void', 'package.json'),
-        JSON.stringify({ name: 'void', version: '0.0.0' }, null, 2) + '\n',
-      );
-
-      // Subpackage: has `package.json` but NO local `node_modules/void`.
+      writeInstalledVoid(wsroot);
       const subpkgRoot = join(wsroot, 'subpkg');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'workspace-sub-hoisted',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:../packages/void',
-              // Keep us out of the Pages starter branch so we hit the
-              // demo prompt.
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
+      writeExistingViteApp(subpkgRoot, { void: 'workspace:../packages/void' });
 
-      await runInitCommand(subpkgRoot);
+      await runInitWithDemo(subpkgRoot);
 
-      // Install MUST NOT be invoked: `void` is resolvable from
-      // `subpkgRoot` via the ancestor `wsroot/node_modules`, so the demo
-      // gate treats the subpackage as already installed.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
+      expect(installCalls()).toHaveLength(0);
     } finally {
       rmSync(wsroot, { recursive: true, force: true });
     }
   });
 
   it('runs install after demo scaffold when void resolves from an ancestor but the child package.json was mutated', async () => {
-    // The workspace skip branch requires an actual workspace marker
-    // (`pnpm-workspace.yaml` or `package.json#workspaces`) AND declared
-    // membership via `isWorkspaceSubpackage`. The setup below has
-    // NEITHER — the parent is a plain directory with a hoisted
-    // `node_modules/void`, not a workspace root.
-    //
-    // Skipping install for a nested non-workspace app would leave the
-    // child's `package.json` disagreeing with any lockfile the child may
-    // already have, and the next frozen-install fails the integrity check.
-    // So install runs whenever we changed the child's `package.json`,
-    // unless a workspace-subpackage branch already decided to skip.
+    // The parent is not a workspace root, so the child's own lockfile must
+    // pick up the `void` dependency that init adds.
     const parentRoot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Parent dir: hoisted `node_modules/void`, but NOT a workspace
-      // root. No `pnpm-workspace.yaml`, no `package.json#workspaces`.
-      mkdirSync(join(parentRoot, 'node_modules', 'void'), { recursive: true });
-      writeFileSync(
-        join(parentRoot, 'node_modules', 'void', 'package.json'),
-        JSON.stringify({ name: 'void', version: '0.0.0' }, null, 2) + '\n',
-      );
-
-      // Child app: `package.json` does NOT declare `void` yet.
-      // `ensureVoidDependency` will write the alias during `scaffoldDemo`.
+      writeInstalledVoid(parentRoot);
       const childRoot = join(parentRoot, 'subpkg');
-      mkdirSync(childRoot, { recursive: true });
-      writeFileSync(
-        join(childRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'nested-hoisted-app',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              // Keep us out of the Pages starter branch so we hit the
-              // demo prompt. No `void` declared here — scaffoldDemo
-              // (via ensureVoidDependency) must add it.
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      // Signal npm via a lockfile so the install invocation is
-      // unambiguous.
+      writeExistingViteApp(childRoot);
       writeFileSync(join(childRoot, 'package-lock.json'), '{}\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(childRoot);
-
-      // The alias WAS written to the child's own package.json —
-      // `ensureVoidDependency` declares it so post-install state
-      // matches the new dependency.
-      const updatedPkg = JSON.parse(readFileSync(join(childRoot, 'package.json'), 'utf-8'));
-      const voidSpec =
-        updatedPkg.devDependencies?.void ??
-        updatedPkg.dependencies?.void ??
-        updatedPkg.peerDependencies?.void;
-      expect(typeof voidSpec).toBe('string');
-      expect(voidSpec.length).toBeGreaterThan(0);
-
-      // Install MUST be invoked: the parent is not a workspace root, so
-      // the workspace-subpackage skip branches don't apply, and the
-      // child's package.json now declares a new dep that the child's
-      // lockfile doesn't know about yet.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
 
-      // The "Workspace subpackage" note MUST NOT fire — there's no
-      // workspace root above the child.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
+      await runInitWithDemo(childRoot);
+
+      expectVoidDeclared(childRoot);
+      expect(installCalls().length).toBeGreaterThan(0);
+      expect(workspaceNotes()).toHaveLength(0);
     } finally {
       rmSync(parentRoot, { recursive: true, force: true });
     }
   });
 
   it('skips install and starter migration in a fresh workspace subpackage', async () => {
-    // A fresh clone of a monorepo (no lockfile anywhere, no
-    // `node_modules` populated yet) running `void init` inside a workspace
-    // subpackage finds no `node_modules/void`. Forcing an `npm install`
-    // would abort on the subpackage's `workspace:` specs. Instead the
-    // workspace-subpackage shape is detected via `findWorkspaceRoot`
-    // (pnpm-workspace.yaml or parent `package.json` with a `workspaces`
-    // field) and BOTH the install AND `generateStarterMigration` are
-    // skipped — surfacing a `note()` that tells the user how to finish.
+    // Before the first workspace install, a leaf install rejects `workspace:`
+    // specs and drizzle-kit cannot resolve `void/schema-d1`.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Workspace root: pnpm-workspace.yaml, NO node_modules.
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
-
-      // Subpackage: has `package.json` declaring `void` as a
-      // `workspace:` spec and no local node_modules.
       const subpkgRoot = join(wsroot, 'packages', 'app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'workspace-fresh-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:*',
-              // `vite` keeps `isScaffoldableEmptyProject` from taking the
-              // Pages starter branch so we fall through to the demo prompt.
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
+      writeExistingViteApp(subpkgRoot, { void: 'workspace:*' });
 
-      await runInitCommand(subpkgRoot);
-
-      // Install MUST NOT be invoked — running `npm install` here would
-      // abort on the `workspace:*` spec.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
+      await runInitWithDemo(subpkgRoot);
 
-      // `generateStarterMigration` MUST NOT spawn drizzle-kit — there's
-      // no `node_modules` yet to resolve `void/schema-d1` through.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-
-      // The alias write from `scaffoldDemo` still landed in the
-      // subpackage's `package.json` so the next real workspace-root
-      // install picks up the dep.
-      const updatedPkg = JSON.parse(readFileSync(join(subpkgRoot, 'package.json'), 'utf-8'));
-      const voidSpec =
-        updatedPkg.devDependencies?.void ??
-        updatedPkg.dependencies?.void ??
-        updatedPkg.peerDependencies?.void;
-      expect(typeof voidSpec).toBe('string');
-      expect(voidSpec.length).toBeGreaterThan(0);
-
-      // The user-facing `note()` was emitted with "Workspace subpackage".
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-      // And the body mentions the next-step instructions.
+      expect(installCalls()).toHaveLength(0);
+      expect(drizzleGenerateCalls()).toHaveLength(0);
+      expectVoidDeclared(subpkgRoot);
+      const notes = workspaceNotes();
+      expect(notes.length).toBeGreaterThan(0);
       const body = String(
-        matching.find((call) => String(call[0]).includes('Scaffolded the starter demo'))?.[0] ?? '',
+        notes.find((call) => String(call[0]).includes('Scaffolded the starter demo'))?.[0] ?? '',
       );
       expect(body).toMatch(/Scaffolded the starter demo/);
       expect(body).toMatch(/void db generate/);
@@ -3588,149 +3122,65 @@ export default config;
     }
   });
 
-  it('skips install and starter migration in a fresh workspace subpackage (npm workspaces root)', async () => {
-    // Symmetric case: workspace root marker is a parent
-    // `package.json` with a top-level `workspaces` field (npm/yarn/bun
-    // workspaces shape, not pnpm). `findWorkspaceRoot` must still
-    // detect the subpackage so the install/migration skip applies.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(
-        join(wsroot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'ws-root',
-            private: true,
-            workspaces: ['packages/*'],
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      const subpkgRoot = join(wsroot, 'packages', 'app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'workspace-npm-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:^0.2.3',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
+  it.each([
+    { marker: 'npm', pattern: 'packages/*', subPath: 'packages/app', member: true },
+    { marker: 'pnpm', pattern: './packages/*', subPath: 'packages/app', member: true },
+    { marker: 'pnpm', pattern: 'packages/*-app', subPath: 'packages/my-app', member: true },
+    { marker: 'pnpm', pattern: '{apps,packages}/*', subPath: 'packages/my-app', member: true },
+    { marker: 'pnpm', pattern: '{apps,packages}/*', subPath: 'apps/my-app', member: true },
+    { marker: 'npm', pattern: '{apps,packages}/*', subPath: 'apps/web', member: true },
+    { marker: 'pnpm', pattern: 'packages/*', subPath: 'scratch/my-app', member: false },
+    { marker: 'npm', pattern: 'packages/*', subPath: 'scratch/my-app', member: false },
+    { marker: 'pnpm', pattern: 'packages/*-app', subPath: 'packages/other', member: false },
+    { marker: 'pnpm', pattern: '{apps,packages}/*', subPath: 'other/my-app', member: false },
+  ] as const)(
+    'defers install and starter migration only for members ($marker `$pattern`, $subPath)',
+    async ({ marker, pattern, subPath, member }) => {
+      const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
+      try {
+        if (marker === 'pnpm') {
+          writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), `packages:\n  - '${pattern}'\n`);
+        } else {
+          writeFileSync(
+            join(wsroot, 'package.json'),
+            JSON.stringify({ name: 'ws-root', private: true, workspaces: [pattern] }, null, 2) +
+              '\n',
+          );
+        }
+        const appRoot = join(wsroot, ...subPath.split('/'));
+        writeExistingViteApp(appRoot, { void: member ? 'workspace:*' : '^0.0.1' });
+        if (!member) {
+          writeFileSync(join(appRoot, 'package-lock.json'), '{}\n');
+        }
 
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
+        await runInitWithDemo(appRoot);
 
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
+        expect(installCalls().length > 0).toBe(!member);
+        expect(drizzleGenerateCalls().length > 0).toBe(!member);
+        expect(workspaceNotes().length > 0).toBe(member);
+      } finally {
+        rmSync(wsroot, { recursive: true, force: true });
+      }
+    },
+  );
 
-  it('emits a lockfile-sync note when void is hoisted and scaffoldDemo mutated package.json in a workspace subpackage', async () => {
-    // `scaffoldDemo` (via `ensureVoidDependency`) writes a new `void`
-    // entry into the subpackage's `package.json` while `void` is already
-    // resolvable via an ancestor `node_modules/void`. Without a note, the
-    // workspace lockfile silently disagrees with `package.json` and the
-    // next `pnpm install --frozen-lockfile` fails the integrity check.
-    // The note points at the workspace root so the user re-runs their
-    // workspace install; `generateStarterMigration` is still skipped,
-    // matching the other workspace-subpackage branch.
+  it('emits a lockfile-sync note when init adds void to a workspace subpackage with void hoisted', async () => {
+    // The workspace lockfile must pick up the new `void` entry before the next frozen install.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Workspace root: `pnpm-workspace.yaml` with `packages/*` AND a
-      // hoisted `node_modules/void` (→ `isVoidResolvableFrom` returns
-      // true via the ancestor walk).
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
-      mkdirSync(join(wsroot, 'node_modules', 'void'), { recursive: true });
-      writeFileSync(
-        join(wsroot, 'node_modules', 'void', 'package.json'),
-        JSON.stringify({ name: 'void', version: '0.0.0' }, null, 2) + '\n',
-      );
-
-      // Subpackage: `package.json` does NOT declare `void` yet, so
-      // `ensureVoidDependency` will mutate it during `scaffoldDemo`.
+      writeInstalledVoid(wsroot);
       const subpkgRoot = join(wsroot, 'packages', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'workspace-hoisted-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              // Keep us out of the Pages starter branch so we hit the
-              // demo prompt. No `void` declared here — scaffoldDemo
-              // (via ensureVoidDependency) must add it.
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
+      writeExistingViteApp(subpkgRoot);
 
-      // `scaffoldDemo` ran — the subpackage's `package.json` now
-      // declares a `void` dep.
-      const updatedPkg = JSON.parse(readFileSync(join(subpkgRoot, 'package.json'), 'utf-8'));
-      const voidSpec =
-        updatedPkg.devDependencies?.void ??
-        updatedPkg.dependencies?.void ??
-        updatedPkg.peerDependencies?.void;
-      expect(typeof voidSpec).toBe('string');
-      expect(voidSpec.length).toBeGreaterThan(0);
-
-      // Install MUST NOT be invoked — we're a workspace subpackage
-      // and a subpackage `npm install` would break on the
-      // `workspace:` specs in sibling packages.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
+      await runInitWithDemo(subpkgRoot);
 
-      // drizzle-kit MUST NOT be invoked — we skip the starter
-      // migration because the workspace lockfile is now stale and
-      // emitting a migration against a drifted workspace invites
-      // confusing state mismatches.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-
-      // The user-facing `note()` was emitted with
-      // `'Workspace subpackage'` title and the body mentions lockfile
-      // sync (so the user knows to re-run the workspace install).
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-      const body = String(matching[0][0]);
+      expectVoidDeclared(subpkgRoot);
+      expect(installCalls()).toHaveLength(0);
+      expect(drizzleGenerateCalls()).toHaveLength(0);
+      const notes = workspaceNotes();
+      expect(notes.length).toBeGreaterThan(0);
+      const body = String(notes[0][0]);
       expect(body).toMatch(/lockfile/);
       expect(body).toMatch(/void db generate/);
     } finally {
@@ -3738,934 +3188,96 @@ export default config;
     }
   });
 
-  it('runs install for a standalone scratch app nested under a pnpm workspace ancestor', async () => {
-    // `findWorkspaceRoot` only walks ancestors looking for a
-    // `pnpm-workspace.yaml` / `package.json#workspaces` marker — it
-    // doesn't verify that `root` is actually a declared member of that
-    // workspace. A standalone scratch app at `<wsroot>/scratch/my-app`
-    // under a workspace that only declares `packages/*` is NOT a
-    // subpackage; treating it as one would skip the install and leave
-    // unresolved `void` imports. Non-members fall through to the
-    // fresh-clone install branch.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
+  it('runs install after demo scaffold when node_modules/void is missing (fresh clone)', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Workspace root: pnpm-workspace.yaml with `packages/*` only.
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
-
-      // Standalone nested app: under `scratch/`, not `packages/`.
-      const subpkgRoot = join(wsroot, 'scratch', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'standalone-scratch-app',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: '^0.0.1',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      // Signal npm via lockfile so install is unambiguous.
-      writeFileSync(join(subpkgRoot, 'package-lock.json'), '{}\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      // Install MUST have been invoked — the app is not a declared
-      // member of `packages/*`, so the workspace-skip branch must not
-      // fire.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
+      writeExistingViteApp(root, { void: '^0.0.1' });
+      writeFileSync(join(root, 'package-lock.json'), '{}\n');
 
-      // drizzle-kit generate was invoked — the initial migration was
-      // scaffolded via `generateStarterMigration`.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls.length).toBeGreaterThan(0);
+      await runInitWithDemo(root);
 
-      // The "Workspace subpackage" note MUST NOT have been emitted.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
+      const installs = installCalls();
+      expect(installs.length).toBeGreaterThan(0);
+      expect(installs[0][0]).toBe('npm');
     } finally {
-      rmSync(wsroot, { recursive: true, force: true });
+      rmSync(root, { recursive: true, force: true });
     }
   });
 
-  it('runs install for a standalone scratch app nested under an npm workspaces ancestor', async () => {
-    // Symmetric case: workspace root marker is a parent
-    // `package.json` with a `workspaces: ["packages/*"]` array (npm/
-    // yarn/bun shape, not pnpm). A non-member standalone app under
-    // `scratch/` must also fall through to the install branch.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
+  it('runs starter migration with injected PnP NODE_OPTIONS in a Yarn Berry PnP project', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      writeFileSync(
-        join(wsroot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'ws-root',
-            private: true,
-            workspaces: ['packages/*'],
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      const subpkgRoot = join(wsroot, 'scratch', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'standalone-npm-scratch-app',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: '^0.0.1',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      writeFileSync(join(subpkgRoot, 'package-lock.json'), '{}\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
+      writeExistingViteApp(root, { void: '^0.0.1', packageManager: 'yarn@4.5.3' });
+      writeFileSync(join(root, 'yarn.lock'), '# yarn lockfile v1\n');
 
-      await runInitCommand(subpkgRoot);
+      const savedNodeOptions = process.env.NODE_OPTIONS;
+      delete process.env.NODE_OPTIONS;
 
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
+      mockSpawnSuccess((cwd) => {
+        writeFileSync(join(cwd, '.pnp.cjs'), '// pnp stub\n');
+        mkdirSync(join(cwd, '.yarn'), { recursive: true });
+        writeFileSync(join(cwd, '.yarn', 'install-state.gz'), '');
+      });
 
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls.length).toBeGreaterThan(0);
+      try {
+        await runInitWithDemo(root);
+      } finally {
+        if (savedNodeOptions === undefined) {
+          delete process.env.NODE_OPTIONS;
+        } else {
+          process.env.NODE_OPTIONS = savedNodeOptions;
+        }
+      }
 
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
+      expect(existsSync(join(root, 'db', 'schema.ts'))).toBe(true);
+      const installs = installCalls();
+      expect(installs.length).toBeGreaterThan(0);
+      expect(installs[0][0]).toBe('yarn');
+      expect(existsSync(join(root, '.pnp.cjs'))).toBe(true);
 
-  it('runs install after demo scaffold when node_modules/void is missing (fresh clone)', async () => {
-    // A fresh clone of a regular project that already declares `void` in
-    // `package.json` but has no `node_modules` yet must still install, or
-    // `generateStarterMigration` spawns drizzle-kit where
-    // `void/schema-d1` can't resolve. Install is forced when
-    // `node_modules/void/package.json` is absent.
-    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'fresh-clone',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: '^0.0.1',
-              // `vite` keeps `isScaffoldableEmptyProject` from taking the
-              // Pages starter branch so we fall through to the demo prompt.
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      // Signal npm via lockfile. No `node_modules` directory — drizzle-
-      // kit couldn't resolve `void/schema-d1` without an install first.
-      writeFileSync(join(root, 'package-lock.json'), '{}\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(root);
-
-      // Install MUST have been invoked for the fresh-clone case so
-      // `node_modules/void` is populated before `generateStarterMigration`
-      // spawns drizzle-kit.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-      // Sanity: the first install call uses `npm` (our lockfile signal).
-      expect(installCalls[0][0]).toBe('npm');
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  it('runs starter migration with injected PnP NODE_OPTIONS in a Yarn Berry PnP project', async () => {
-    // `generateStarterMigration()` injects the PnP loaders into the
-    // spawned child's `NODE_OPTIONS` via `buildDrizzleKitSpawnEnv`,
-    // matching what `gen.ts:runMigration` does — so `drizzle-kit
-    // generate` resolves `void/schema-d1` even when there is no
-    // `node_modules` tree. The init flow completes the migration itself
-    // instead of asking the user to run it manually.
-    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'yarn-pnp-app',
-            private: true,
-            type: 'module',
-            packageManager: 'yarn@4.5.3',
-            devDependencies: {
-              void: '^0.0.1',
-              // `vite` keeps `isScaffoldableEmptyProject` from taking
-              // the Pages starter branch so we fall through to the
-              // demo prompt.
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      // Yarn Berry lockfile exists but `.pnp.cjs` does NOT yet —
-      // `yarn install` creates it below.
-      writeFileSync(join(root, 'yarn.lock'), '# yarn lockfile v1\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      // Normalize NODE_OPTIONS so assertions aren't contaminated by
-      // the ambient vitest environment.
-      const savedNodeOptions = process.env.NODE_OPTIONS;
-      delete process.env.NODE_OPTIONS;
-
-      // Simulate `yarn install` writing `.pnp.cjs` AND the post-install
-      // marker `.yarn/install-state.gz` as its side effect.
-      // `isVoidResolvableFrom` requires BOTH — a committed-but-unfetched
-      // `.pnp.cjs` on a fresh clone is not proof that `yarn install` has
-      // actually populated the archives.
-      mockSpawnSync.mockImplementation((command, args, options) => {
-        if (
-          command === 'yarn' &&
-          Array.isArray(args) &&
-          args[0] === 'install' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          writeFileSync(join(options.cwd, '.pnp.cjs'), '// pnp stub\n');
-          mkdirSync(join(options.cwd, '.yarn'), { recursive: true });
-          writeFileSync(join(options.cwd, '.yarn', 'install-state.gz'), '');
-        }
-        if (
-          command === process.execPath &&
-          Array.isArray(args) &&
-          args[1] === 'generate' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          writeMockGeneratedMigration(options.cwd);
-        }
-        return { status: 0, stdout: '', stderr: '' };
-      });
-
-      try {
-        await runInitCommand(root);
-      } finally {
-        if (savedNodeOptions === undefined) {
-          delete process.env.NODE_OPTIONS;
-        } else {
-          process.env.NODE_OPTIONS = savedNodeOptions;
-        }
-      }
-
-      // Scaffolded files landed: the schema file is written by
-      // `scaffoldDemo` regardless of the PnP detection.
-      expect(existsSync(join(root, 'db', 'schema.ts'))).toBe(true);
-
-      // Install WAS invoked — the demo flow still needs to run
-      // `yarn install` to pick up the newly-added `void` dep.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-      expect(installCalls[0][0]).toBe('yarn');
-
-      // The install mock wrote `.pnp.cjs` — verify the post-install
-      // marker is present on disk.
-      expect(existsSync(join(root, '.pnp.cjs'))).toBe(true);
-
-      // `generateStarterMigration` MUST have spawned drizzle-kit with
-      // NODE_OPTIONS containing `--require <pnp-cjs-path>` so the
-      // child can resolve `void/schema-d1` through PnP.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
+      const drizzleCalls = drizzleGenerateCalls();
       expect(drizzleCalls.length).toBeGreaterThan(0);
       const spawnOptions = drizzleCalls[0][2] as { env?: NodeJS.ProcessEnv };
-      expect(spawnOptions.env).toBeDefined();
-      expect(typeof spawnOptions.env!.NODE_OPTIONS).toBe('string');
-      expect(spawnOptions.env!.NODE_OPTIONS).toContain('--require');
-      expect(spawnOptions.env!.NODE_OPTIONS).toContain(
-        JSON.stringify(toSlash(join(root, '.pnp.cjs'))),
-      );
-
-      // No "Yarn PnP" skip note — the migration runs inline.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Yarn PnP');
-      expect(matching).toHaveLength(0);
-
-      // And the starter migration file was actually written by the
-      // mock — sanity check the full flow reached migration scaffold.
-      expect(existsSync(join(root, 'db', 'migrations', '0000_generated.sql'))).toBe(true);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  it('runs starter migration in a Yarn 4 project with `.yarnrc.yml` but `nodeLinker: node-modules`', async () => {
-    // Yarn 3/4 projects configured with
-    // `nodeLinker: node-modules` commit `.yarnrc.yml` and still produce
-    // a normal `node_modules` tree. Those projects work fine with
-    // `generateStarterMigration()` because drizzle-kit can resolve
-    // `void/schema-d1` through standard Node module resolution.
-    //
-    // `.yarnrc.yml` alone is NOT a PnP marker; only the real
-    // post-install markers `.pnp.cjs` / `.pnp.loader.mjs` count, which
-    // exist iff PnP was the actual linker.
-    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'yarn-node-modules-app',
-            private: true,
-            type: 'module',
-            packageManager: 'yarn@4.5.3',
-            devDependencies: {
-              void: '^0.0.1',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      // Yarn 4 with nodeLinker: node-modules — `.yarnrc.yml` is
-      // committed but there is NO `.pnp.cjs` because PnP is not the
-      // active linker. `yarn install` would populate `node_modules`
-      // instead.
-      writeFileSync(join(root, 'yarn.lock'), '# yarn lockfile v1\n');
-      writeFileSync(join(root, '.yarnrc.yml'), 'nodeLinker: node-modules\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      // Simulate `yarn install` populating `node_modules/void` — no
-      // `.pnp.cjs` is written because PnP is not active.
-      mockSpawnSync.mockImplementation((command, args, options) => {
-        if (
-          command === 'yarn' &&
-          Array.isArray(args) &&
-          args[0] === 'install' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          mkdirSync(join(options.cwd, 'node_modules', 'void'), { recursive: true });
-          writeFileSync(
-            join(options.cwd, 'node_modules', 'void', 'package.json'),
-            JSON.stringify({ name: 'void', version: '0.0.1' }, null, 2) + '\n',
-          );
-        }
-        if (
-          command === process.execPath &&
-          Array.isArray(args) &&
-          args[1] === 'generate' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          writeMockGeneratedMigration(options.cwd);
-        }
-        return { status: 0, stdout: '', stderr: '' };
-      });
-
-      await runInitCommand(root);
-
-      // Install ran (needed to populate node_modules for drizzle-kit).
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-      expect(installCalls[0][0]).toBe('yarn');
-
-      // `.pnp.cjs` MUST NOT have been created — PnP is not the linker.
-      expect(existsSync(join(root, '.pnp.cjs'))).toBe(false);
-
-      // drizzle-kit generate MUST have been invoked — node-modules
-      // linker produces a resolvable `void/schema-d1`.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls.length).toBeGreaterThan(0);
-
-      // The "Yarn PnP" note MUST NOT have been emitted — this is not a
-      // PnP project.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Yarn PnP');
-      expect(matching).toHaveLength(0);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  it('runs starter migration in a Yarn Classic project (yarn.lock + node_modules)', async () => {
-    // Yarn Classic (`yarn@1.22.x`) always uses the
-    // node-modules linker and never writes `.pnp.cjs`. Those projects
-    // must run `generateStarterMigration()` normally — the
-    // post-install check finds no PnP marker and falls through to the
-    // migration branch.
-    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'yarn-classic-app',
-            private: true,
-            type: 'module',
-            packageManager: 'yarn@1.22.22',
-            devDependencies: {
-              void: '^0.0.1',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      writeFileSync(join(root, 'yarn.lock'), '# yarn lockfile v1\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      mockSpawnSync.mockImplementation((command, args, options) => {
-        if (
-          command === 'yarn' &&
-          Array.isArray(args) &&
-          args[0] === 'install' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          mkdirSync(join(options.cwd, 'node_modules', 'void'), { recursive: true });
-          writeFileSync(
-            join(options.cwd, 'node_modules', 'void', 'package.json'),
-            JSON.stringify({ name: 'void', version: '0.0.1' }, null, 2) + '\n',
-          );
-        }
-        if (
-          command === process.execPath &&
-          Array.isArray(args) &&
-          args[1] === 'generate' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          writeMockGeneratedMigration(options.cwd);
-        }
-        return { status: 0, stdout: '', stderr: '' };
-      });
-
-      await runInitCommand(root);
-
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-      expect(installCalls[0][0]).toBe('yarn');
-
-      expect(existsSync(join(root, '.pnp.cjs'))).toBe(false);
-
-      // Yarn Classic is a node-modules linker — drizzle-kit generate
-      // must run.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls.length).toBeGreaterThan(0);
-
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Yarn PnP');
-      expect(matching).toHaveLength(0);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  it('skips starter migration in a workspace subpackage declared via inline `packages: [...]`', async () => {
-    // A valid `pnpm-workspace.yaml` can declare the packages list inline
-    // as
-    //   packages: ['packages/*']
-    // instead of the multiline block form. The subpackage-skip branch
-    // must fire for both shapes; otherwise `void init` falls through to
-    // the fresh-clone install path, which aborts on the subpackage's
-    // `workspace:*` spec.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages: ['packages/*']\n");
-
-      const subpkgRoot = join(wsroot, 'packages', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'inline-workspace-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:*',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      // Install MUST NOT have run — the inline form is now
-      // recognized as declaring the subpackage, so the workspace-
-      // subpackage skip branch fires.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
-
-      // drizzle-kit was not invoked — starter migration is skipped
-      // along with the install for workspace subpackages.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-
-      // The "Workspace subpackage" note was emitted (so the user
-      // knows to run the workspace install).
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('skips starter migration in a workspace subpackage using a leading `./` glob', async () => {
-    // A real-world `pnpm-workspace.yaml` sometimes writes
-    // `- './packages/*'` instead of `- 'packages/*'`. The leading `./`
-    // must be stripped before segment splitting, or no subpackage path
-    // matches and the fresh-clone install branch aborts on the
-    // subpackage's `workspace:*` spec.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - './packages/*'\n");
-
-      const subpkgRoot = join(wsroot, 'packages', 'app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'dot-slash-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:*',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
-
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('skips starter migration in a workspace subpackage whose pattern uses a partial glob', async () => {
-    // Real workspaces sometimes declare partial-segment globs like
-    // `packages/*-app`, `packages/app-*`, or `apps/*-service`. Each
-    // segment compiles to a regex so these match.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*-app'\n");
-
-      const subpkgRoot = join(wsroot, 'packages', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'partial-glob-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:*',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
-
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('runs install for a non-matching subpackage when the workspace uses a partial glob', async () => {
-    // Negative case: a workspace that declares `packages/*-app`
-    // must NOT treat `packages/other` as a member. The partial-glob
-    // matcher is an anchored regex (`^.*-app$`), so `other` must
-    // fall through to the fresh-clone install branch.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*-app'\n");
-
-      const subpkgRoot = join(wsroot, 'packages', 'other');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'non-matching-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: '^0.0.1',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      writeFileSync(join(subpkgRoot, 'package-lock.json'), '{}\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      // Install MUST have run — `packages/other` does not match
-      // `packages/*-app`.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-
-      // drizzle-kit generate was invoked — the initial migration
-      // scaffolded via `generateStarterMigration`.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls.length).toBeGreaterThan(0);
-
-      // The "Workspace subpackage" note MUST NOT have been emitted.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('skips starter migration in a workspace subpackage whose pattern uses brace expansion', async () => {
-    // Real `pnpm-workspace.yaml` files frequently use
-    // `{apps,packages}/*` and similar brace expansions.
-    // `{apps,packages}/*` is expanded into `['apps/*', 'packages/*']`
-    // BEFORE matching; otherwise no subpackage path matches and the
-    // fresh-clone install branch aborts on the subpackage's
-    // `workspace:*` spec.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - '{apps,packages}/*'\n");
-
-      const subpkgRoot = join(wsroot, 'packages', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'brace-glob-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:*',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
-
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('skips starter migration in a workspace subpackage using brace expansion under `apps/`', async () => {
-    // Same fix as the previous test, but exercises the other branch
-    // of the brace expansion: the subpackage lives under `apps/`, not
-    // `packages/`. Both expansions of `{apps,packages}/*` must match
-    // so neither subpackage path falls through to the fresh-clone
-    // install branch.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - '{apps,packages}/*'\n");
-
-      const subpkgRoot = join(wsroot, 'apps', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'brace-glob-apps',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:*',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
-
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('runs install for a non-matching subpackage when the workspace uses brace expansion', async () => {
-    // Brace expansion is a positive-match operation, not a catch-all.
-    // `{apps,packages}/*` must NOT match `other/my-app` — neither
-    // expansion (`apps/*` nor `packages/*`) lines up with `other/`,
-    // so the subpackage correctly falls through to the fresh-clone
-    // install branch.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - '{apps,packages}/*'\n");
-
-      const subpkgRoot = join(wsroot, 'other', 'my-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'non-matching-brace',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: '^0.0.1',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      writeFileSync(join(subpkgRoot, 'package-lock.json'), '{}\n');
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      // Install must have run — `other/my-app` does not match
-      // `{apps,packages}/*`.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('skips starter migration in a workspace subpackage whose `package.json#workspaces` uses brace expansion', async () => {
-    // Brace expansion also has to work when the workspace is declared
-    // via `package.json#workspaces` (the npm/yarn convention) rather
-    // than `pnpm-workspace.yaml`. Same pattern, same fix — the glob
-    // expansion happens before segment matching either way.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(
-        join(wsroot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'brace-ws-root',
-            private: true,
-            workspaces: ['{apps,packages}/*'],
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-      // An npm lockfile at the workspace root — this establishes the
-      // ancestor workspace marker without touching pnpm-workspace.yaml.
-      writeFileSync(join(wsroot, 'package-lock.json'), '{}\n');
-
-      const subpkgRoot = join(wsroot, 'apps', 'web');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'brace-npm-ws-sub',
-            private: true,
-            type: 'module',
-            devDependencies: {
-              void: 'workspace:*',
-              vite: '^8.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
+      expect(spawnOptions.env).toBeDefined();
+      expect(typeof spawnOptions.env!.NODE_OPTIONS).toBe('string');
+      expect(spawnOptions.env!.NODE_OPTIONS).toContain('--require');
+      expect(spawnOptions.env!.NODE_OPTIONS).toContain(
+        JSON.stringify(toSlash(join(root, '.pnp.cjs'))),
       );
-      mockSelect.mockResolvedValueOnce('none');
-      mockConfirm.mockResolvedValueOnce(true).mockResolvedValueOnce(false);
+      expect(existsSync(join(root, 'db', 'migrations', '0000_generated.sql'))).toBe(true);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
 
-      await runInitCommand(subpkgRoot);
+  it('runs starter migration in a Yarn 4 project with `.yarnrc.yml` but `nodeLinker: node-modules`', async () => {
+    // `.yarnrc.yml` is not a PnP marker; only `.pnp.cjs` and `.pnp.loader.mjs` are.
+    const root = mkdtempSync(join(tmpdir(), 'void-init-'));
+    try {
+      writeExistingViteApp(root, { void: '^0.0.1', packageManager: 'yarn@4.5.3' });
+      writeFileSync(join(root, 'yarn.lock'), '# yarn lockfile v1\n');
+      writeFileSync(join(root, '.yarnrc.yml'), 'nodeLinker: node-modules\n');
+      mockSpawnSuccess((cwd) => writeInstalledVoid(cwd));
 
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
+      await runInitWithDemo(root);
 
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
+      const installs = installCalls();
+      expect(installs.length).toBeGreaterThan(0);
+      expect(installs[0][0]).toBe('yarn');
+      expect(existsSync(join(root, '.pnp.cjs'))).toBe(false);
+      expect(drizzleGenerateCalls().length).toBeGreaterThan(0);
     } finally {
-      rmSync(wsroot, { recursive: true, force: true });
+      rmSync(root, { recursive: true, force: true });
     }
   });
 
   it('void init in an empty pnpm workspace subpackage skips leaf install and starter migration', async () => {
-    // The empty-project Pages starter branch
-    // (`isScaffoldableEmptyProject(root)` → `scaffoldPagesApp`) must
-    // detect workspace subpackages too. Installing with the fallback
-    // `npm` package manager inside a pnpm workspace subpackage either
-    // writes a stray `node_modules/` / `package-lock.json` that fights the
-    // workspace manager's hoisting, or aborts on the template's
-    // `workspace:` specs; `generateStarterMigration` fails the same way
-    // because drizzle-kit can't resolve `void/schema-d1` from an
-    // un-installed subpackage. Mirror the demo branch's skip.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Workspace root: pnpm-workspace.yaml declaring `packages/*`.
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
-
-      // Subpackage: truly empty directory — no `package.json`, no files.
-      // `isScaffoldableEmptyProject` returns true and
-      // `runInitCommand` takes the Pages starter branch.
       const subpkgRoot = join(wsroot, 'packages', 'my-new-app');
       mkdirSync(subpkgRoot, { recursive: true });
 
-      // Toolchain prompt → Vite+, framework prompt → vue, starter mode → sqlite.
       mockSelect
         .mockResolvedValueOnce('vite-plus')
         .mockResolvedValueOnce('vue')
@@ -4674,33 +3286,14 @@ export default config;
 
       await runInitCommand(subpkgRoot);
 
-      // `scaffoldPagesApp` still ran: the template files and a fresh
-      // `package.json` landed in the subpackage.
       const pkg = JSON.parse(readFileSync(join(subpkgRoot, 'package.json'), 'utf-8'));
       expect(pkg.devDependencies.void).toBeDefined();
       expect(pkg.devDependencies['@void/vue']).toBeDefined();
-
-      // Install MUST NOT be invoked — running `npm install` here would
-      // either pollute the workspace or abort on `workspace:` specs.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls).toHaveLength(0);
-
-      // `generateStarterMigration` MUST NOT spawn drizzle-kit — the
-      // subpackage has no `node_modules` yet to resolve `void/schema-d1`
-      // through.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-
-      // The user-facing `note()` was emitted with "Workspace subpackage"
-      // and points the user at the workspace root.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-      const body = String(matching[0][0]);
+      expect(installCalls()).toHaveLength(0);
+      expect(drizzleGenerateCalls()).toHaveLength(0);
+      const notes = workspaceNotes();
+      expect(notes.length).toBeGreaterThan(0);
+      const body = String(notes[0][0]);
       expect(body).toMatch(/Scaffolded the Pages starter/);
       expect(body).toMatch(/void db generate/);
       expect(body).toContain(toSlash(wsroot));
@@ -4710,9 +3303,6 @@ export default config;
   });
 
   it('omits the `void db generate` follow-up in the workspace skip note AND outro for static starter mode', async () => {
-    // Static starter projects have no `db/schema.ts`, so the
-    // workspace-subpackage note and outro must not tell the user to run
-    // `void db generate`.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
@@ -4728,73 +3318,29 @@ export default config;
 
       await runInitCommand(subpkgRoot);
 
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
-      const body = String(matching[0][0]);
-      // Static mode → no migration scaffold → no `void db generate`
-      // follow-up in the note.
+      const notes = workspaceNotes();
+      expect(notes.length).toBeGreaterThan(0);
+      const body = String(notes[0][0]);
       expect(body).not.toMatch(/void db generate/);
-      // The install half of the message is still required.
       expect(body).toMatch(/Run your workspace install/);
 
-      // The outro must also drop the migration follow-up for static.
       const outroCalls = mockOutro.mock.calls;
       expect(outroCalls.length).toBeGreaterThan(0);
       const outroText = String(outroCalls[outroCalls.length - 1][0]);
       expect(outroText).not.toMatch(/void db generate/);
       expect(outroText).toMatch(/Run your workspace install/);
 
-      // Sanity: no migration was generated (drizzle-kit was never spawned).
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls).toHaveLength(0);
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('skips GitHub Actions setup for `void init --github` in a workspace subpackage', async () => {
-    // `workspaceSubpackageSkip` is only set inside the interactive
-    // `!targeted` scaffold branches, so a targeted `void init --github`
-    // must detect membership itself. Step 8 checks
-    // `isInsideWorkspaceSubpackage(root)` so the skip applies
-    // independently of the interactive flag AND of whether the
-    // subpackage manages its own install — GitHub does not read
-    // `.github/workflows/deploy.yml` under a subpackage root.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
-
-      const subpkgRoot = join(wsroot, 'packages', 'targeted-gha');
-      mkdirSync(subpkgRoot, { recursive: true });
-      writeFileSync(
-        join(subpkgRoot, 'package.json'),
-        JSON.stringify({ name: 'targeted-gha-sub', private: true, type: 'module' }, null, 2) + '\n',
-      );
-
-      // Targeted `void init --github` — no scaffolding, no prompts.
-      await runInitCommand(subpkgRoot, { github: true, tsconfig: false });
-
-      // The deploy.yml MUST NOT have been written under the subpackage.
-      const deployYmlPath = join(subpkgRoot, '.github', 'workflows', 'void-deploy.yml');
-      expect(existsSync(deployYmlPath)).toBe(false);
+      expect(drizzleGenerateCalls()).toHaveLength(0);
     } finally {
       rmSync(wsroot, { recursive: true, force: true });
     }
   });
 
-  it('skips GitHub Actions setup for `void init --github` in a leaf-managed workspace subpackage', async () => {
-    // `resolveWorkspaceDeferral()` returns `undefined` for leaf-managed
-    // subpackages (local lockfile or a non-pnpm Corepack pin) because the
-    // leaf owns its install. That's right for install/migration deferral,
-    // but GitHub only reads `.github/workflows/*` from the repository
-    // root regardless of who manages the install. Step 8 therefore uses
-    // `isInsideWorkspaceSubpackage`, which only checks structural
-    // membership. Cover both leaf-managed arms (local lockfile AND local
-    // non-pnpm Corepack pin).
-    for (const shape of ['local-lockfile', 'local-corepack-pin'] as const) {
+  // GitHub reads workflows only from the repository root, even when a member
+  // manages its own install.
+  it.each(['member', 'local-lockfile', 'local-corepack-pin'] as const)(
+    'skips GitHub Actions setup for `void init --github` in a workspace subpackage (%s)',
+    async (shape) => {
       const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
       try {
         writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
@@ -4821,20 +3367,16 @@ export default config;
       } finally {
         rmSync(wsroot, { recursive: true, force: true });
       }
-    }
-  });
+    },
+  );
 
   it('runs install (does NOT take the workspace skip path) for a starter init when the subpackage has a local `packageManager: bun@…` Corepack pin', async () => {
-    // `resolveWorkspaceDeferral` honors a local non-pnpm `packageManager`
-    // Corepack pin as a self-management signal. This covers that arm
-    // through `runInitCommand`'s starter branch.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
 
       const subpkgRoot = join(wsroot, 'packages', 'leaf-bun');
       mkdirSync(subpkgRoot, { recursive: true });
-      // No local lockfile, but a local Corepack pin → self-managed.
       writeFileSync(
         join(subpkgRoot, 'package.json'),
         JSON.stringify(
@@ -4857,41 +3399,22 @@ export default config;
 
       await runInitCommand(subpkgRoot);
 
-      // Install MUST run — the leaf is self-managed via the local
-      // Corepack pin, not deferred to the workspace. Assert it ran
-      // through `bun`, not some other manager, which proves the local
-      // Corepack pin was actually honored.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-      expect(installCalls[0][0]).toBe('bun');
-
-      // No "Workspace subpackage" note — we did not defer.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
+      const installs = installCalls();
+      expect(installs.length).toBeGreaterThan(0);
+      expect(installs[0][0]).toBe('bun');
+      expect(workspaceNotes()).toHaveLength(0);
     } finally {
       rmSync(wsroot, { recursive: true, force: true });
     }
   });
 
   it('honors a local `package-lock.json` veto for a yarn-leaf nested under a pnpm workspace', async () => {
-    // `isPnpmProject` and the workspace-skip path must agree on the same
-    // root: a leaf-managed subpackage with its own `package-lock.json` is
-    // non-pnpm AND not deferred to the workspace.
-    //
-    // `resolveWorkspaceDeferral` honors local lockfiles — a
-    // `package-lock.json` inside the subpackage means "I manage my own
-    // install", so the workspace skip MUST NOT fire and the normal
-    // standalone install path must run.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
 
       const subpkgRoot = join(wsroot, 'packages', 'leaf-managed');
       mkdirSync(subpkgRoot, { recursive: true });
-      // Local `package-lock.json` claims leaf management.
       writeFileSync(join(subpkgRoot, 'package-lock.json'), '{}\n');
 
       mockSelect
@@ -4902,28 +3425,14 @@ export default config;
 
       await runInitCommand(subpkgRoot);
 
-      // Install MUST run — the leaf is self-managed via its own
-      // `package-lock.json`, not deferred to the workspace.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-
-      // The "Workspace subpackage" note MUST NOT fire — we're not
-      // deferring to the workspace.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
+      expect(installCalls().length).toBeGreaterThan(0);
+      expect(workspaceNotes()).toHaveLength(0);
     } finally {
       rmSync(wsroot, { recursive: true, force: true });
     }
   });
 
   it('skips GitHub Actions setup when the workspace-subpackage skip path fires', async () => {
-    // GitHub only reads `.github/workflows/*` from the repository root,
-    // so writing `deploy.yml` UNDER the subpackage root would be silently
-    // ignored. In skip mode, GitHub Actions setup is skipped entirely and
-    // a note points the user back to the repo root.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
@@ -4935,36 +3444,21 @@ export default config;
         .mockResolvedValueOnce('vite-plus')
         .mockResolvedValueOnce('vue')
         .mockResolvedValueOnce('sqlite');
-      // Demo prompt → no, GitHub Actions prompt → yes (the user opts in
-      // but the skip path must override it because the workflow file
-      // would land in the wrong place).
       mockConfirm.mockResolvedValueOnce(false).mockResolvedValueOnce(true);
 
       await runInitCommand(subpkgRoot);
 
-      // No `.github/workflows/deploy.yml` was written under the
-      // subpackage — that file would never be read by GitHub.
       const deployYmlPath = join(subpkgRoot, '.github', 'workflows', 'void-deploy.yml');
       expect(existsSync(deployYmlPath)).toBe(false);
-
-      // The workspace skip note still fired.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching.length).toBeGreaterThan(0);
+      expect(workspaceNotes().length).toBeGreaterThan(0);
     } finally {
       rmSync(wsroot, { recursive: true, force: true });
     }
   });
 
   it('void init in an empty STANDALONE app (not a workspace subpackage) still runs install and starter migration', async () => {
-    // Symmetric proof that the workspace-subpackage skip ONLY
-    // fires when `root` is a declared member of an ancestor workspace.
-    // A bare `my-app/` under a parent dir with no `pnpm-workspace.yaml`
-    // and no `package.json#workspaces` must still take the normal
-    // install + migration path.
     const parent = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // No workspace marker anywhere.
       const appRoot = join(parent, 'my-app');
       mkdirSync(appRoot, { recursive: true });
 
@@ -4976,43 +3470,20 @@ export default config;
 
       await runInitCommand(appRoot);
 
-      // Install WAS invoked — the fallback `npm install` runs against
-      // the standalone leaf app.
-      const installCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][0] === 'install',
-      );
-      expect(installCalls.length).toBeGreaterThan(0);
-
-      // `generateStarterMigration` DID spawn drizzle-kit.
-      const drizzleCalls = mockSpawnSync.mock.calls.filter(
-        (call) => Array.isArray(call[1]) && call[1][1] === 'generate',
-      );
-      expect(drizzleCalls.length).toBeGreaterThan(0);
-
-      // The "Workspace subpackage" note was NOT emitted — this path is
-      // reserved for declared workspace members.
-      const noteCalls = mockNote.mock.calls;
-      const matching = noteCalls.filter((call) => call[1] === 'Workspace subpackage');
-      expect(matching).toHaveLength(0);
-
-      // And the migration actually landed.
+      expect(installCalls().length).toBeGreaterThan(0);
+      expect(drizzleGenerateCalls().length).toBeGreaterThan(0);
+      expect(workspaceNotes()).toHaveLength(0);
       expect(listMigrationSqlFiles(appRoot)).toEqual(['0000_generated.sql']);
     } finally {
       rmSync(parent, { recursive: true, force: true });
     }
   });
 
-  // For a workspace subpackage with no local lockfile / Corepack pin,
-  // `detectProjectState` returns `'npm'`. Gating pnpm build approvals on
-  // that would drop the subpackage's built-deps allowlist and suppress
-  // better-sqlite3 / esbuild / sharp / workerd postinstalls on the next
-  // workspace-root `pnpm install`. The allowlist is gated on the
-  // ancestor-aware `isPnpmProject` check instead.
-  it('writes pnpm allowBuilds for a pnpm workspace subpackage', async () => {
+  it('keeps the pnpm build policy and Corepack pin at the root of a pnpm workspace', async () => {
+    // The member has no lockfile or pin, so `detectProjectState` reports npm;
+    // pnpm still installs it from the workspace root.
     const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Workspace root: pnpm-workspace.yaml with `packages/*`. The root
-      // holds the Corepack pin — NOT the subpackage.
       writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
       writeFileSync(
         join(wsroot, 'package.json'),
@@ -5023,8 +3494,6 @@ export default config;
         ) + '\n',
       );
 
-      // Subpackage: empty directory, no local lockfile, no local
-      // Corepack pin. `detectProjectState` returns `'npm'` here.
       const subpkgRoot = join(wsroot, 'packages', 'my-new-app');
       mkdirSync(subpkgRoot, { recursive: true });
 
@@ -5037,46 +3506,8 @@ export default config;
       await runInitCommand(subpkgRoot);
 
       const pkg = JSON.parse(readFileSync(join(subpkgRoot, 'package.json'), 'utf-8'));
-
-      // The built-deps allowlist MUST be present in the workspace
-      // config — this is the regression target. Mirrors the
-      // standalone-pnpm assertion above.
       expectPnpmAllowBuilds(wsroot);
       expect(pkg.pnpm).toBeUndefined();
-    } finally {
-      rmSync(wsroot, { recursive: true, force: true });
-    }
-  });
-
-  it('does NOT write a per-package `packageManager` pin in a pnpm workspace subpackage', async () => {
-    // The Corepack pin belongs to the workspace root. Duplicating it
-    // per-subpackage confuses Corepack and can conflict with the root
-    // pin on future upgrades — so the subpackage's `package.json` must
-    // be left without a `packageManager` field.
-    const wsroot = mkdtempSync(join(tmpdir(), 'void-init-'));
-    try {
-      writeFileSync(join(wsroot, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
-      writeFileSync(
-        join(wsroot, 'package.json'),
-        JSON.stringify(
-          { name: 'workspace-root', private: true, packageManager: 'pnpm@^12.4.1' },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      const subpkgRoot = join(wsroot, 'packages', 'my-new-app');
-      mkdirSync(subpkgRoot, { recursive: true });
-
-      mockSelect
-        .mockResolvedValueOnce('vite-plus')
-        .mockResolvedValueOnce('react')
-        .mockResolvedValueOnce('sqlite');
-      mockConfirm.mockResolvedValueOnce(false).mockResolvedValueOnce(false);
-
-      await runInitCommand(subpkgRoot);
-
-      const pkg = JSON.parse(readFileSync(join(subpkgRoot, 'package.json'), 'utf-8'));
       expect(pkg.packageManager).toBeUndefined();
     } finally {
       rmSync(wsroot, { recursive: true, force: true });
@@ -5084,11 +3515,8 @@ export default config;
   });
 
   it('writes BOTH pnpm allowBuilds AND packageManager pin in a standalone pnpm project', async () => {
-    // The standalone-pnpm path writes both the allowlist AND the
-    // Corepack pin.
     const root = mkdtempSync(join(tmpdir(), 'void-init-'));
     try {
-      // Local `pnpm-lock.yaml` → `detectProjectState` picks pnpm.
       writeFileSync(join(root, 'pnpm-lock.yaml'), "lockfileVersion: '9.0'\n");
 
       mockSelect
@@ -5108,217 +3536,8 @@ export default config;
   });
 });
 
-describe('ensureVoidDependency', () => {
-  it('creates package.json with type: "module" when none exists (greenfield)', () => {
-    withTempDir((root) => {
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      expect(pkg.type).toBe('module');
-      expect(pkg.private).toBe(true);
-      expect(typeof pkg.devDependencies.void).toBe('string');
-    });
-  });
-
-  it('leaves existing CommonJS package.json alone (does not add type: "module")', () => {
-    withTempDir((root) => {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'legacy-app',
-            private: true,
-            dependencies: { express: '^4.18.0' },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      // Critical assertion: the absent `type` must stay absent so sibling
-      // `.js` scripts keep being interpreted as CommonJS.
-      expect(pkg.type).toBeUndefined();
-      // The helper still ensures `void` is declared as a devDependency.
-      expect(typeof pkg.devDependencies.void).toBe('string');
-      // Pre-existing fields are preserved.
-      expect(pkg.name).toBe('legacy-app');
-      expect(pkg.dependencies.express).toBe('^4.18.0');
-    });
-  });
-
-  it('leaves existing ESM package.json alone (type: "module" stays)', () => {
-    withTempDir((root) => {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'esm-app',
-            private: true,
-            type: 'module',
-            dependencies: {},
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      expect(pkg.type).toBe('module');
-      expect(typeof pkg.devDependencies.void).toBe('string');
-      expect(pkg.name).toBe('esm-app');
-    });
-  });
-
-  it('does not clobber an existing void dependency declaration', () => {
-    withTempDir((root) => {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'pinned-void-app',
-            private: true,
-            devDependencies: {
-              void: '^0.2.3',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      expect(pkg.devDependencies.void).toBe('^0.2.3');
-      expect(pkg.type).toBeUndefined();
-    });
-  });
-
-  it('does not add private: true to an existing package.json that omits it', () => {
-    // An existing package.json that intentionally omits `private` (e.g. a
-    // library or app meant to be published to a registry) must stay
-    // non-private after `ensureVoidDependency`. Flipping it to `private:
-    // true` silently would change publish semantics.
-    withTempDir((root) => {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'publishable-app',
-            version: '1.2.3',
-            dependencies: { react: '^18.0.0' },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      // Critical: `private` must stay absent so publish semantics are
-      // preserved.
-      expect(pkg.private).toBeUndefined();
-      // Pre-existing fields are still preserved and void was added to
-      // devDependencies.
-      expect(pkg.name).toBe('publishable-app');
-      expect(pkg.version).toBe('1.2.3');
-      expect(pkg.dependencies.react).toBe('^18.0.0');
-      expect(typeof pkg.devDependencies.void).toBe('string');
-    });
-  });
-
-  it('does not flip private: false to private: true on an existing package.json', () => {
-    // An existing package.json with `private: false` (e.g. an explicitly
-    // publishable package) must stay that way after `ensureVoidDependency`.
-    withTempDir((root) => {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'explicitly-public',
-            private: false,
-            dependencies: {},
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      expect(pkg.private).toBe(false);
-      expect(typeof pkg.devDependencies.void).toBe('string');
-    });
-  });
-
-  it('does NOT add a duplicate `void` entry when `void` is already declared in `peerDependencies`', () => {
-    // A project with `peerDependencies.void` (e.g. a plugin author) must
-    // not get a redundant `devDependencies.void` written on top, which can
-    // confuse package managers and dependency dedup.
-    withTempDir((root) => {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'plugin-with-peer',
-            private: true,
-            peerDependencies: {
-              void: '^1.0.0',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      expect(pkg.peerDependencies.void).toBe('^1.0.0');
-      expect(pkg.devDependencies?.void).toBeUndefined();
-    });
-  });
-
-  it('does NOT add a duplicate `void` entry when `void` is already declared in `optionalDependencies`', () => {
-    // Same fix scope as the peerDependencies case above.
-    withTempDir((root) => {
-      writeFileSync(
-        join(root, 'package.json'),
-        JSON.stringify(
-          {
-            name: 'optional-void',
-            private: true,
-            optionalDependencies: {
-              void: '^2.5.1',
-            },
-          },
-          null,
-          2,
-        ) + '\n',
-      );
-
-      ensureVoidDependency(root);
-
-      const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-      expect(pkg.optionalDependencies.void).toBe('^2.5.1');
-      expect(pkg.devDependencies?.void).toBeUndefined();
-    });
-  });
-});
-
 describe('detectProjectState', () => {
-  // When a repo pins a non-npm package manager via
-  // `package.json#packageManager` (Corepack field) but hasn't committed a
-  // lockfile yet, falling back to `npm` would run `npm install` on
-  // pnpm/yarn workspaces, corrupting lockfiles or rejecting `workspace:`
-  // specs before `generateStarterMigration()` could run.
+  // Without a lockfile, an npm fallback would reject `workspace:` specs or write the wrong lockfile.
   it('prefers package.json#packageManager when no lockfile is present (pnpm)', () => {
     withTempDir((root) => {
       writeFileSync(
@@ -5330,9 +3549,6 @@ describe('detectProjectState', () => {
   });
 
   it('prefers package.json#packageManager when no lockfile is present (yarn berry pin)', () => {
-    // Fresh Yarn repos honor the Corepack pin. Falling back to
-    // `npm install` on a committed `packageManager: yarn@…` pin creates the
-    // wrong lockfile and bypasses Yarn's linker/plugin settings.
     withTempDir((root) => {
       writeFileSync(
         join(root, 'package.json'),
@@ -5343,10 +3559,6 @@ describe('detectProjectState', () => {
   });
 
   it('prefers package.json#packageManager when no lockfile is present (yarn classic pin)', () => {
-    // Yarn Classic projects usually commit `yarn.lock`, so the lockfile
-    // branch catches them. This guards the fresh-repo sliver where only a
-    // Corepack `yarn@1.x` pin exists — those projects still want
-    // `yarn install`, not `npm install`.
     withTempDir((root) => {
       writeFileSync(
         join(root, 'package.json'),
@@ -5357,9 +3569,6 @@ describe('detectProjectState', () => {
   });
 
   it('prefers a committed yarn.lock over a Corepack yarn field', () => {
-    // The lockfile branch must still pick up Yarn Classic projects — they
-    // commit `yarn.lock` and use `node_modules`, so drizzle-kit resolution
-    // works. Only the no-lockfile Corepack sliver falls back to npm.
     withTempDir((root) => {
       writeFileSync(
         join(root, 'package.json'),
@@ -5392,8 +3601,6 @@ describe('detectProjectState', () => {
   });
 
   it('prefers a committed lockfile over the packageManager field', () => {
-    // Lockfile is the stronger signal about what the project actually has
-    // installed; the packageManager field is only consulted as a fallback.
     withTempDir((root) => {
       writeFileSync(
         join(root, 'package.json'),
@@ -5422,13 +3629,6 @@ describe('detectProjectState', () => {
   });
 
   it('treats pnpm-workspace.yaml as a pnpm signal when no lockfile is present', () => {
-    // A fresh pnpm workspace whose only pnpm marker is
-    // `pnpm-workspace.yaml` (no `pnpm-lock.yaml` yet, no
-    // `package.json#packageManager` pin) must not fall through to `npm`:
-    // `npm install` either rejects `workspace:` specs outright or creates a stray
-    // `package-lock.json` in a pnpm workspace. `isPnpmProject()` already
-    // treats `pnpm-workspace.yaml` as authoritative — `detectProjectState`
-    // must agree so the install step uses the right manager.
     withTempDir((root) => {
       writeFileSync(join(root, 'package.json'), JSON.stringify({ name: 'app' }, null, 2) + '\n');
       writeFileSync(join(root, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
@@ -5437,10 +3637,6 @@ describe('detectProjectState', () => {
   });
 
   it('prefers a committed yarn.lock over pnpm-workspace.yaml', () => {
-    // The lockfile check order is authoritative — a concrete lockfile is
-    // a stronger signal than a workspace-root marker, and the lockfile
-    // describes what is actually installed. A repo that somehow committed
-    // both files should follow the lockfile.
     withTempDir((root) => {
       writeFileSync(join(root, 'package.json'), JSON.stringify({ name: 'app' }, null, 2) + '\n');
       writeFileSync(join(root, 'pnpm-workspace.yaml'), "packages:\n  - 'packages/*'\n");
@@ -5451,48 +3647,22 @@ describe('detectProjectState', () => {
 });
 
 describe('generateStarterMigration', () => {
-  // When `drizzle-kit generate` crashes mid-write — truncated journal,
-  // partial snapshot, or an interrupted write during `void init` —
-  // leftover artifacts in `db/migrations/` would make the next
-  // `void db status` / `void db generate` / `void gen migration` refuse
-  // in `assertJournalCoherence`, wedging the repo.
-  // `generateStarterMigration` snapshots everything drizzle-kit might
-  // touch before spawning, then restores/unlinks on failure. Mirrors the rollback pattern in
-  // `gen.ts`'s `runMigration`, extended to handle the
-  // "migrations dir didn't exist yet" case that's unique to the
-  // starter path.
-
-  function seedStarterSchema(root: string, dialect: 'sqlite' | 'postgresql'): void {
+  // Partial drizzle-kit output would make the next journal coherence check refuse.
+  function seedStarterSchema(root: string): void {
     mkdirSync(join(root, 'db'), { recursive: true });
     writeFileSync(
       join(root, 'db', 'schema.ts'),
-      dialect === 'postgresql'
-        ? 'import { sqliteTable } from "void/schema-pg";\nexport const messages = sqliteTable("messages", {});\n'
-        : 'import { sqliteTable } from "void/schema-d1";\nexport const messages = sqliteTable("messages", {});\n',
+      'import { sqliteTable } from "void/schema-d1";\nexport const messages = sqliteTable("messages", {});\n',
     );
   }
 
   it('rolls back partial artifacts when drizzle-kit fails and migrations/ did not exist before', () => {
-    // Empty-dir case: `db/migrations/` does not exist at all before
-    // the spawn. Drizzle-kit plants a partial journal + one partial
-    // snapshot, then exits non-zero. Rollback must nuke both the
-    // snapshot/journal files AND the `meta/` directory so the next
-    // retry is not wedged on a coherence check.
     withTempDir((root) => {
-      seedStarterSchema(root, 'sqlite');
+      seedStarterSchema(root);
       mockSpawnSync.mockImplementationOnce((command, args, options) => {
-        if (
-          command === process.execPath &&
-          Array.isArray(args) &&
-          args[1] === 'generate' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          // Plant a partial journal + snapshot mid-write before
-          // "crashing" with a non-zero exit.
-          const migrationsDir = join(options.cwd, 'db', 'migrations');
+        const cwd = drizzleGenerateCwd(command, args, options);
+        if (cwd) {
+          const migrationsDir = join(cwd, 'db', 'migrations');
           const metaDir = join(migrationsDir, 'meta');
           mkdirSync(metaDir, { recursive: true });
           writeFileSync(
@@ -5513,18 +3683,11 @@ describe('generateStarterMigration', () => {
         /Failed to generate the starter database migration/,
       );
 
-      // Rollback must have removed everything the failed spawn
-      // planted. The meta/ dir and the journal must be gone because
-      // they didn't exist before the spawn.
       expect(existsSync(join(root, 'db', 'migrations', 'meta', '_journal.json'))).toBe(false);
       expect(existsSync(join(root, 'db', 'migrations', 'meta', '0000_snapshot.json'))).toBe(false);
-      // Best-effort — the meta/ dir itself may or may not be removed,
-      // but it must at least be empty so subsequent retries are not
-      // blocked by partial artifacts.
       if (existsSync(join(root, 'db', 'migrations', 'meta'))) {
         expect(readdirSync(join(root, 'db', 'migrations', 'meta'))).toEqual([]);
       }
-      // No fresh .sql files in migrations/.
       const sqlFiles = existsSync(join(root, 'db', 'migrations'))
         ? readdirSync(join(root, 'db', 'migrations')).filter((f) => f.endsWith('.sql'))
         : [];
@@ -5533,16 +3696,8 @@ describe('generateStarterMigration', () => {
   });
 
   it('restores the journal and keeps prior entries when drizzle-kit fails and a journal existed before', () => {
-    // Existing-journal case: `db/migrations/meta/_journal.json` is
-    // already on disk with some known content, plus a prior
-    // `0000_prev.sql` and `0000_snapshot.json`. The spawn overwrites
-    // the journal, plants a new `0001_new.sql` / `0001_snapshot.json`,
-    // then exits non-zero. Rollback must:
-    //   - byte-restore the original journal
-    //   - preserve `0000_prev.sql` and `0000_snapshot.json`
-    //   - unlink the new `0001_new.sql` and `0001_snapshot.json`
     withTempDir((root) => {
-      seedStarterSchema(root, 'sqlite');
+      seedStarterSchema(root);
       const migrationsDir = join(root, 'db', 'migrations');
       const metaDir = join(migrationsDir, 'meta');
       mkdirSync(metaDir, { recursive: true });
@@ -5568,21 +3723,11 @@ describe('generateStarterMigration', () => {
       );
 
       mockSpawnSync.mockImplementationOnce((command, args, options) => {
-        if (
-          command === process.execPath &&
-          Array.isArray(args) &&
-          args[1] === 'generate' &&
-          options &&
-          typeof options === 'object' &&
-          'cwd' in options &&
-          typeof options.cwd === 'string'
-        ) {
-          const cwdMigrationsDir = join(options.cwd, 'db', 'migrations');
+        const cwd = drizzleGenerateCwd(command, args, options);
+        if (cwd) {
+          const cwdMigrationsDir = join(cwd, 'db', 'migrations');
           const cwdMetaDir = join(cwdMigrationsDir, 'meta');
-          // Overwrite the journal with a corrupted / partial write.
           writeFileSync(join(cwdMetaDir, '_journal.json'), '{"truncated":true');
-          // Plant a new snapshot + sql file for a migration that
-          // never finishes.
           writeFileSync(join(cwdMetaDir, '0001_snapshot.json'), '{"new":"partial"');
           writeFileSync(join(cwdMigrationsDir, '0001_new.sql'), '-- half-written new migration\n');
         }
@@ -5597,35 +3742,11 @@ describe('generateStarterMigration', () => {
         /Failed to generate the starter database migration/,
       );
 
-      // Journal must be byte-restored.
       expect(readFileSync(join(metaDir, '_journal.json'), 'utf-8')).toBe(originalJournal);
-      // Prior migration artifacts must still exist.
       expect(existsSync(join(metaDir, '0000_snapshot.json'))).toBe(true);
       expect(existsSync(join(migrationsDir, '0000_prev.sql'))).toBe(true);
-      // Fresh partial artifacts must be gone.
       expect(existsSync(join(metaDir, '0001_snapshot.json'))).toBe(false);
       expect(existsSync(join(migrationsDir, '0001_new.sql'))).toBe(false);
     });
   });
-
-  it('leaves all new artifacts in place on the success path', () => {
-    // Regression guard: the rollback path must only fire when the
-    // spawn fails. On a successful spawn, every file drizzle-kit
-    // wrote (journal, snapshot, sql migration) must survive untouched.
-    withTempDir((root) => {
-      seedStarterSchema(root, 'sqlite');
-
-      // The default beforeEach mock already writes a full mock
-      // migration on success — let it run.
-      generateStarterMigration(root, 'sqlite');
-
-      expect(existsSync(join(root, 'db', 'migrations', '0000_generated.sql'))).toBe(true);
-      expect(existsSync(join(root, 'db', 'migrations', 'meta', '_journal.json'))).toBe(true);
-      expect(existsSync(join(root, 'db', 'migrations', 'meta', '0000_snapshot.json'))).toBe(true);
-      // Sanity: journal is non-empty and mentions the generated entry.
-      expect(
-        readFileSync(join(root, 'db', 'migrations', 'meta', '_journal.json'), 'utf-8'),
-      ).toContain('0000_generated');
-    });
-  });
 });
diff --git a/packages/void/test/unit/integration-helpers.test.ts b/packages/void/test/unit/integration-helpers.test.ts
deleted file mode 100644
index 2eb1e6207..000000000
--- a/packages/void/test/unit/integration-helpers.test.ts
+++ /dev/null
@@ -1,253 +0,0 @@
-import { spawn, spawnSync } from 'node:child_process';
-import {
-  existsSync,
-  globSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readlinkSync,
-  realpathSync,
-  rmSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { createServer as createHttpServer } from 'node:http';
-import { createServer, type Server } from 'node:net';
-import { tmpdir } from 'node:os';
-import { isAbsolute, join, relative } from 'node:path';
-import { describe, expect, it } from 'vite-plus/test';
-import {
-  createIsolatedPlayground,
-  killChild,
-  shouldCopyPlaygroundPath,
-  startServer,
-} from '../../../../test/integration-helpers.ts';
-
-// Answers HTTP on 127.0.0.1:<port> after a short delay, like a dev server that is still starting,
-// and prints its URL once it listens.
-const SERVER = `setTimeout(() => {
-  const port = Number(process.argv[1]);
-  require('node:http')
-    .createServer((_, res) => res.end('ok'))
-    .listen(port, '127.0.0.1', () => console.log('Listening on http://127.0.0.1:' + port));
-}, 200);`;
-
-describe('startServer', () => {
-  it('starts the server again on a new port when another process takes its port first', async () => {
-    const ports: Array<number> = [];
-    let other: Server | undefined;
-    try {
-      const server = await startServer((port) => {
-        ports.push(port);
-        if (!other) {
-          other = createServer((socket) => socket.destroy()).listen(port, '127.0.0.1');
-        }
-        return spawn(process.execPath, ['-e', SERVER, String(port)], { stdio: 'pipe' });
-      }, 10_000);
-      try {
-        expect(ports).toHaveLength(2);
-        expect(server.port).toBe(ports[1]);
-        expect(server.port).not.toBe(ports[0]);
-        expect(await (await fetch(server.base)).text()).toBe('ok');
-      } finally {
-        await killChild(server.child);
-      }
-    } finally {
-      other?.close();
-    }
-  });
-
-  it('does not accept another server that answers on the port before this one listens', async () => {
-    const ports: Array<number> = [];
-    let other: Server | undefined;
-    try {
-      const server = await startServer((port) => {
-        ports.push(port);
-        if (!other) {
-          other = createHttpServer((_, res) => res.end('other')).listen(port, '127.0.0.1');
-        }
-        return spawn(process.execPath, ['-e', SERVER, String(port)], { stdio: 'pipe' });
-      }, 10_000);
-      try {
-        expect(ports).toHaveLength(2);
-        expect(server.port).toBe(ports[1]);
-        expect(await (await fetch(server.base)).text()).toBe('ok');
-      } finally {
-        await killChild(server.child);
-      }
-    } finally {
-      other?.close();
-    }
-  });
-
-  it('starts the server again when it moves to another port instead of exiting', async () => {
-    const ports: Array<number> = [];
-    const server = await startServer((port) => {
-      ports.push(port);
-      // What Vite without --strictPort prints before it listens on the next port.
-      const script =
-        ports.length === 1
-          ? `console.log('Port ${port} is in use, trying another one...'); setInterval(() => {}, 1000);`
-          : SERVER;
-      return spawn(process.execPath, ['-e', script, String(port)], { stdio: 'pipe' });
-    }, 10_000);
-    try {
-      expect(ports).toHaveLength(2);
-      expect(await (await fetch(server.base)).text()).toBe('ok');
-    } finally {
-      await killChild(server.child);
-    }
-  });
-
-  it('does not retry a server that fails for another reason', async () => {
-    let starts = 0;
-    await expect(
-      startServer(() => {
-        starts++;
-        return spawn(process.execPath, ['-e', 'console.error("config error"); process.exit(1)'], {
-          stdio: 'pipe',
-        });
-      }, 10_000),
-    ).rejects.toThrow(/Server stopped while waiting[\s\S]*config error/);
-    expect(starts).toBe(1);
-  });
-});
-
-describe('shouldCopyPlaygroundPath', () => {
-  it('excludes generated top-level entries from native Windows paths', () => {
-    const sourceRoot = String.raw`D:\a\void\void\playground\spa`;
-
-    expect(shouldCopyPlaygroundPath(sourceRoot, String.raw`${sourceRoot}\node_modules`)).toBe(
-      false,
-    );
-    expect(shouldCopyPlaygroundPath(sourceRoot, String.raw`${sourceRoot}\.void`)).toBe(false);
-    expect(
-      shouldCopyPlaygroundPath(sourceRoot, String.raw`${sourceRoot}\.next\types\routes.d.ts`),
-    ).toBe(false);
-    expect(shouldCopyPlaygroundPath(sourceRoot, String.raw`${sourceRoot}\src\index.ts`)).toBe(true);
-  });
-
-  it('only excludes generated entries at the playground root', () => {
-    const sourceRoot = '/workspace/playground/spa';
-
-    expect(shouldCopyPlaygroundPath(sourceRoot, `${sourceRoot}/dist`)).toBe(false);
-    expect(shouldCopyPlaygroundPath(sourceRoot, `${sourceRoot}/.next/types/routes.d.ts`)).toBe(
-      false,
-    );
-    expect(shouldCopyPlaygroundPath(sourceRoot, `${sourceRoot}/src/dist/example.ts`)).toBe(true);
-    expect(shouldCopyPlaygroundPath(sourceRoot, `${sourceRoot}/src/.next/example.ts`)).toBe(true);
-  });
-});
-
-it('keeps scratch apps and copied manifests outside the actual workspace package globs', () => {
-  const workspace = mkdtempSync(join(tmpdir(), 'void-isolated-playground-'));
-  const source = join(workspace, 'playground', 'app');
-  mkdirSync(source, { recursive: true });
-  writeFileSync(join(source, 'package.json'), JSON.stringify({ name: 'original-app' }));
-  writeFileSync(join(source, 'entry.ts'), 'export const marker = "original";');
-  const scratch = join(workspace, 'playground-local', 'ad-hoc');
-  mkdirSync(scratch, { recursive: true });
-  writeFileSync(join(scratch, 'package.json'), JSON.stringify({ name: 'scratch-app' }));
-  const patterns = readFileSync(new URL('../../../../pnpm-workspace.yaml', import.meta.url), 'utf8')
-    .split('\n\n')[0]!
-    .split('\n')
-    .flatMap((line) => line.match(/^ {2}- (\S+)$/)?.[1] ?? []);
-  expect(patterns).toContain('playground/*');
-  const first = createIsolatedPlayground(workspace, 'playground/app');
-  const second = createIsolatedPlayground(workspace, 'playground/app');
-  try {
-    const manifests = () =>
-      patterns
-        .flatMap((pattern) => globSync(`${pattern}/package.json`, { cwd: workspace }))
-        .map((path) => path.replaceAll('\\', '/'));
-    expect(manifests()).toEqual(['playground/app/package.json']);
-    expect(readFileSync(join(first.root, 'entry.ts'), 'utf8')).toContain('original');
-    expect(JSON.parse(readFileSync(join(first.root, 'package.json'), 'utf8')).name).not.toBe(
-      JSON.parse(readFileSync(join(second.root, 'package.json'), 'utf8')).name,
-    );
-    first.cleanup();
-    expect(manifests()).toEqual(['playground/app/package.json']);
-    expect(existsSync(join(second.root, 'package.json'))).toBe(true);
-    expect(JSON.parse(readFileSync(join(source, 'package.json'), 'utf8')).name).toBe(
-      'original-app',
-    );
-  } finally {
-    first.cleanup();
-    second.cleanup();
-    rmSync(workspace, { recursive: true, force: true });
-  }
-});
-
-it('clears the shutdown deadline after a real child exits', () => {
-  const helper = new URL('../../../../test/integration-helpers.ts', import.meta.url).href;
-  const result = spawnSync(
-    process.execPath,
-    [
-      '--input-type=module',
-      '-e',
-      `
-    import { spawn } from 'node:child_process';
-    import { killChild } from ${JSON.stringify(helper)};
-    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 10000)'], { stdio: 'ignore' });
-    try {
-      await killChild(child);
-      console.log(JSON.stringify(process.getActiveResourcesInfo().filter(type => type === 'Timeout')));
-    } finally {
-      child.kill('SIGKILL');
-    }
-    process.exit(0);
-  `,
-    ],
-    { encoding: 'utf8', timeout: 15_000 },
-  );
-  expect(result.status, result.stderr).toBe(0);
-  expect(result.stdout.trim()).toBe('[]');
-}, 20_000);
-
-it('resolves installed dependency links absolutely at the isolated fixture depth', () => {
-  const workspace = mkdtempSync(join(tmpdir(), 'void-fixture-dependencies-'));
-  const source = join(workspace, 'playground', 'app');
-  const modules = join(source, 'node_modules');
-  mkdirSync(join(modules, '@fixture'), { recursive: true });
-  mkdirSync(join(modules, '$app'), { recursive: true });
-  writeFileSync(join(modules, '$app/tsconfig.json'), '{"files":["original.d.ts"]}');
-  writeFileSync(join(source, 'package.json'), JSON.stringify({ name: 'dependency-app' }));
-  writeFileSync(
-    join(source, 'entry.mjs'),
-    'import plain from "plain"; import scoped from "@fixture/scoped"; console.log(JSON.stringify([plain, scoped]));',
-  );
-  for (const name of ['plain', '@fixture/scoped']) {
-    const installed = join(workspace, 'packages', name);
-    mkdirSync(installed, { recursive: true });
-    writeFileSync(
-      join(installed, 'package.json'),
-      JSON.stringify({ name, type: 'module', exports: './index.mjs' }),
-    );
-    writeFileSync(join(installed, 'index.mjs'), `export default ${JSON.stringify(name)};`);
-    const link = join(modules, name);
-    symlinkSync(
-      relative(join(link, '..'), installed),
-      link,
-      process.platform === 'win32' ? 'junction' : 'dir',
-    );
-  }
-  const fixture = createIsolatedPlayground(workspace, 'playground/app');
-  try {
-    expect(existsSync(join(fixture.root, 'node_modules/$app'))).toBe(false);
-    for (const name of ['plain', '@fixture/scoped']) {
-      const link = join(fixture.root, 'node_modules', name);
-      expect(isAbsolute(readlinkSync(link))).toBe(true);
-      expect(realpathSync(link)).toBe(realpathSync(join(workspace, 'packages', name)));
-    }
-    const result = spawnSync(process.execPath, ['entry.mjs'], {
-      cwd: fixture.root,
-      encoding: 'utf8',
-      timeout: 10_000,
-    });
-    expect(result.status, result.stderr).toBe(0);
-    expect(JSON.parse(result.stdout)).toEqual(['plain', '@fixture/scoped']);
-  } finally {
-    fixture.cleanup();
-    rmSync(workspace, { recursive: true, force: true });
-  }
-});
diff --git a/packages/void/test/unit/island-css-rewrite.test.ts b/packages/void/test/unit/island-css-rewrite.test.ts
index e87f884e2..4695e221d 100644
--- a/packages/void/test/unit/island-css-rewrite.test.ts
+++ b/packages/void/test/unit/island-css-rewrite.test.ts
@@ -69,16 +69,4 @@ describe('rewriteCssImportForVirtualModule', () => {
     );
     expect(result).toBe('import "some-lib/styles.css";');
   });
-
-  it('normalizes backslashes to forward slashes', () => {
-    // normalizePath ensures Windows-style paths become valid import specifiers
-    const result = rewriteCssImportForVirtualModule(
-      'import "./card.css"',
-      './card.css',
-      p('/project/pages/components/deep/Card.tsx'),
-    );
-    // Should always use forward slashes regardless of OS
-    expect(result).not.toContain('\\');
-    expect(result).toBe(`import "${p('/project/pages/components/deep/card.css')}";`);
-  });
 });
diff --git a/packages/void/test/unit/isr-cache.test.ts b/packages/void/test/unit/isr-cache.test.ts
index 019bcbbc5..a02b332db 100644
--- a/packages/void/test/unit/isr-cache.test.ts
+++ b/packages/void/test/unit/isr-cache.test.ts
@@ -160,13 +160,8 @@ function currentSharedCacheResponse(response: Response): Response {
   return response;
 }
 
-// ---------------------------------------------------------------------------
-// Corrupt-KV fail-open table (critical). A KV entry whose metadata/headers make
-// a Response un-constructible must be rejected at the `readIsrCache` choke point
-// so `isrCacheResponse` can never throw. Shared by two suites: the low-level
-// `readIsrCache` fail-open tests AND the end-to-end `handleIsr` live-render
-// path (every corrupt shape must degrade to a live render, never a 500).
-// ---------------------------------------------------------------------------
+// KV entries that cannot build a valid Response. `readIsrCache` must reject
+// each one, so a cache hit never throws.
 const corruptCases: Array<{ name: string; seed: () => KvRecord }> = [
   {
     name: 'entry admitted before Vary was checked',
@@ -338,7 +333,6 @@ describe('writeIsrCache / readIsrCache / deleteIsrCache', () => {
       60,
     );
 
-    // Real KV contents: exactly one entry under the collapsed key.
     expect(store.has(isrKey(DPL, HOST, '/blog/post'))).toBe(true);
     const meta = store.get(isrKey(DPL, HOST, '/blog/post'))!.metadata!;
     expect(meta).toEqual({ s: 200, c: BASE, t: 60, p: SHARED_CACHE_POLICY_VERSION });
@@ -374,8 +368,6 @@ describe('writeIsrCache / readIsrCache / deleteIsrCache', () => {
     await expect(readIsrCache(makeEnv(kv), HOST, '/x')).resolves.toBeNull();
   });
 
-  // Corrupt-KV fail-open: the `corruptCases` table is module-scoped (shared with
-  // the `handleIsr` live-render suite). readIsrCache must reject every shape.
   for (const c of corruptCases) {
     it(`readIsrCache returns null for a corrupt entry: ${c.name}`, async () => {
       const { store, kv } = createKvMock();
@@ -386,13 +378,8 @@ describe('writeIsrCache / readIsrCache / deleteIsrCache', () => {
 });
 
 // ===========================================================================
-// cloneWithoutVoidPages — the background-render request stripper
+// cloneWithoutVoidPages
 // ===========================================================================
-// A request that carries `X-VoidPages` takes the JSON branch in `handleIsr` and
-// returns before ever reaching the HTML stale path where the stripper runs, so
-// the public API cannot deliver an X-VoidPages request to it. Test it directly
-// so the mandated stripping is actually exercised (the stale-path test can only
-// ever hand it a request that already lacks the header — a tautology otherwise).
 
 describe('cloneWithoutVoidPages', () => {
   it('removes X-VoidPages while preserving method, url, and every other header', () => {
@@ -404,30 +391,15 @@ describe('cloneWithoutVoidPages', () => {
         Accept: 'text/html',
       },
     });
-    // Precondition: the input genuinely carries the header we expect stripped.
-    expect(original.headers.has('X-VoidPages')).toBe(true);
 
     const cleaned = cloneWithoutVoidPages(original);
 
-    // Only X-VoidPages is dropped; everything else is preserved verbatim. This
-    // fails if `cloneWithoutVoidPages` stops deleting the header (regression).
     expect(cleaned.headers.has('X-VoidPages')).toBe(false);
     expect(cleaned.headers.get('X-Test-Marker')).toBe('keep');
     expect(cleaned.headers.get('Accept')).toBe('text/html');
     expect(cleaned.method).toBe('GET');
     expect(cleaned.url).toBe(`https://${HOST}/blog/post`);
   });
-
-  it('is a no-op on the header set when X-VoidPages is absent', () => {
-    const original = new Request(`https://${HOST}/blog/post`, {
-      method: 'GET',
-      headers: { 'X-Test-Marker': 'keep' },
-    });
-    const cleaned = cloneWithoutVoidPages(original);
-    expect(cleaned.headers.has('X-VoidPages')).toBe(false);
-    expect(cleaned.headers.get('X-Test-Marker')).toBe('keep');
-    expect(cleaned.url).toBe(`https://${HOST}/blog/post`);
-  });
 });
 
 // ===========================================================================
@@ -609,7 +581,6 @@ describe('handleIsr', () => {
       render,
     );
     await poisoned.flush();
-    // The caller renders this request live; nothing reaches a shared cache.
     expect(response).toBeNull();
     expect(render).not.toHaveBeenCalled();
     expect([...store.keys()].filter((k) => k.startsWith(isrPrefix(DPL)))).toEqual([]);
@@ -676,15 +647,13 @@ describe('handleIsr', () => {
     expect(spy).toHaveBeenCalledTimes(1);
 
     await flush();
-    // Real KV contents: the live render was persisted under the collapsed key.
     const entry = await readIsrCache(env, HOST, '/blog/post');
     expect(entry).not.toBeNull();
     expect(await new Response(entry!.body).text()).toBe('<html>live</html>');
-    // HTML edge variant warmed; plain HTML (no page data) never warms the JSON variant.
+    // Without page data the JSON variant stays cold.
     expect(edge.store.has(htmlEdgeKey(HOST, '/blog/post', DPL))).toBe(true);
     expect(edge.store.has(jsonEdgeKey(HOST, '/blog/post', DPL))).toBe(false);
-    // Exactly one page-cache entry persisted; the host-registry
-    // bookkeeping key (`void-isr-hosts/…`) is separate and excluded here.
+    // The host-registry key (`void-isr-hosts/…`) is not a page-cache entry.
     expect([...store.keys()].filter((k) => k.startsWith(isrPrefix(DPL))).length).toBe(1);
   });
 
@@ -759,35 +728,6 @@ describe('handleIsr', () => {
     expect(edge.store.has(jsonEdgeKey(HOST, '/blog/post', DPL))).toBe(false);
   });
 
-  it.each(['private', 'no-store', 'no-cache'])(
-    'does not share a MISS with Cache-Control: %s through HTML or Pages JSON',
-    async (cacheControl) => {
-      const { store, kv } = createKvMock();
-      const env = makeEnv(kv);
-      const { render } = createRender(
-        () =>
-          new Response('<html>private</html>', {
-            headers: {
-              'Cache-Control': cacheControl,
-              'content-type': 'text/html',
-              'x-void-page-data': '{"component":"Private","props":{"user":"alice"}}',
-            },
-          }),
-      );
-      const { ctx, flush } = createCtx();
-
-      const response = await handleIsr(htmlRequest(), env, ctx, OPTS, render);
-      expect(await response!.text()).toBe('<html>private</html>');
-      expect(response!.headers.get('Cache-Control')).toBe(cacheControl);
-      expect(response!.headers.get('x-isr-cache')).toBeNull();
-
-      await flush();
-      expect(store.has(isrKey(DPL, HOST, '/blog/post'))).toBe(false);
-      expect(edge.store.has(htmlEdgeKey(HOST, '/blog/post', DPL))).toBe(false);
-      expect(edge.store.has(jsonEdgeKey(HOST, '/blog/post', DPL))).toBe(false);
-    },
-  );
-
   it('KV HIT (fresh) → serves HIT from KV without a live render and warms the edge', async () => {
     const { kv, store } = createKvMock();
     const env = makeEnv(kv);
@@ -798,13 +738,11 @@ describe('handleIsr', () => {
     const res = await handleIsr(htmlRequest(), env, ctx, OPTS, render);
     expect(res!.status).toBe(200);
     expect(res!.headers.get('x-isr-cache')).toBe('HIT');
-    // Client response revalidates on every hit.
     expect(res!.headers.get('Cache-Control')).toBe('public, max-age=0, must-revalidate');
     expect(await res!.text()).toBe('<html>kv</html>');
     expect(spy).not.toHaveBeenCalled();
 
     await flush();
-    // Edge warmed from KV with the fresh (HIT) response — s-maxage tracks remaining freshness.
     const warmed = edge.store.get(htmlEdgeKey(HOST, '/blog/post', DPL));
     expect(warmed).toBeDefined();
     expect(warmed!.headers.get('x-isr-cache')).toBe('HIT');
@@ -820,12 +758,8 @@ describe('handleIsr', () => {
     seedEntry(store, '/blog/post', { body: '<html>stale</html>', createdAt: BASE, ttl: 60 });
     vi.setSystemTime(BASE + 200_000);
 
-    // A DEFERRED render we control: the background revalidation cannot produce a
-    // response until we call `release()`. This is the crux of proving background
-    // vs. inline — if `handleIsr` awaited the revalidation INLINE (instead of
-    // `ctx.waitUntil`), the `await handleIsr(...)` below would deadlock on this
-    // gate and the test would time out. It resolves only because the stale
-    // response is served WITHOUT waiting on the re-render.
+    // The render blocks until `release()`, so `handleIsr` resolves only if the
+    // revalidation runs in the background rather than inline.
     const requests: Array<Request> = [];
     let release!: () => void;
     const gate = new Promise<void>((resolve) => {
@@ -833,7 +767,7 @@ describe('handleIsr', () => {
     });
     const spy = vi.fn(async (req: Request) => {
       requests.push(req);
-      await gate; // block until the test explicitly releases the render
+      await gate;
       return new Response('<html>revalidated</html>', {
         headers: { 'content-type': 'text/html' },
       });
@@ -841,8 +775,6 @@ describe('handleIsr', () => {
     const render = spy as unknown as RenderFn;
     const { ctx, tasks, flush } = createCtx();
 
-    // Original request carries a marker header (and NO X-VoidPages — an
-    // X-VoidPages request would take the JSON branch and never reach here).
     const res = await handleIsr(
       htmlRequest('/blog/post', { 'X-Test-Marker': 'keep' }),
       env,
@@ -851,43 +783,26 @@ describe('handleIsr', () => {
       render,
     );
 
-    // (a) Resolves to the STALE response BEFORE the deferred render resolves —
-    // the gate is still closed, yet the client already has its answer.
     expect(res!.headers.get('x-isr-cache')).toBe('STALE');
     expect(await res!.text()).toBe('<html>stale</html>');
     // The revalidation is the one tracked background task. A stale edge warm
     // here would race a private/no-store revalidation that evicts the old page.
     expect(tasks.length).toBe(1);
-    // The revalidation was KICKED OFF (render invoked) but NOT awaited inline:
-    // KV still holds the ORIGINAL stale entry because the gate hasn't opened.
     expect(spy).toHaveBeenCalledTimes(1);
     const midEntry = await readIsrCache(env, HOST, '/blog/post');
     expect(midEntry!.createdAt).toBe(BASE);
     expect(isStale(midEntry!)).toBe(true);
     expect(await new Response(midEntry!.body).text()).toBe('<html>stale</html>');
 
-    // Now release the deferred render and drain the queued background task.
     release();
     await flush();
 
-    // Background re-render ran exactly once (queued via ctx.waitUntil).
     expect(spy).toHaveBeenCalledTimes(1);
     const rerender = requests[0]!;
-    // The re-render request is derived from the original (marker preserved, GET,
-    // same URL). X-VoidPages stripping itself is proven directly by the
-    // `cloneWithoutVoidPages` suite above (an X-VoidPages request cannot reach
-    // this HTML stale path through the public `handleIsr` API).
-    // NOTE: cloneWithoutVoidPages uses `new Request(request, { headers })`, which
-    // preserves `request.cf` on real workerd (verified empirically). These unit
-    // tests run on Node's default vitest pool where `request.cf` does not exist,
-    // so cf preservation is not representable here and is intentionally not asserted.
-    expect(rerender.headers.has('X-VoidPages')).toBe(false);
     expect(rerender.headers.get('X-Test-Marker')).toBe('keep');
     expect(rerender.method).toBe('GET');
     expect(rerender.url).toBe(`https://${HOST}/blog/post`);
 
-    // KV re-put with the fresh render (KV is only written by the background task,
-    // so this is race-free) — createdAt advanced, entry is fresh again.
     const entry = await readIsrCache(env, HOST, '/blog/post');
     expect(entry!.createdAt).toBe(BASE + 200_000);
     expect(isStale(entry!)).toBe(false);
@@ -952,48 +867,16 @@ describe('handleIsr', () => {
 
     expect(res!.status).toBe(200);
     expect(await res!.text()).toBe('{"component":"Blog"}');
-    // JSON path renders with the ORIGINAL request (X-VoidPages preserved).
     expect(requests[0]!.headers.has('X-VoidPages')).toBe(true);
     expect(spy).toHaveBeenCalledTimes(1);
-    // No writes on the JSON path — the JSON variant is warmed only by the HTML render path.
     expect(tasks).toHaveLength(0);
     expect(edge.store.size).toBe(0);
     expect(store.size).toBe(0);
   });
 
-  it('JSON (X-VoidPages) edge HIT → serves the cached JSON variant, no render', async () => {
-    const { kv } = createKvMock();
-    const env = makeEnv(kv);
-    edge.store.set(
-      jsonEdgeKey(HOST, '/blog/post', DPL),
-      currentSharedCacheResponse(new Response('{"cached":true}')),
-    );
-    const { render, spy } = createRender(() => new Response('SHOULD-NOT-RENDER'));
-    const { ctx } = createCtx();
-
-    const res = await handleIsr(
-      htmlRequest('/blog/post', { 'X-VoidPages': '1' }),
-      env,
-      ctx,
-      OPTS,
-      render,
-    );
-    expect(await res!.text()).toBe('{"cached":true}');
-    expect(res!.headers.get('Cache-Control')).toBe('public, max-age=0, must-revalidate');
-    expect(spy).not.toHaveBeenCalled();
-  });
-
-  // Regression: when an HTML render warms the JSON edge variant, the STORED JSON
-  // response must mirror the live responder `pageJsonResponse` (pages/protocol.ts)
-  // by carrying `X-VoidPages: true` + `Vary: X-VoidPages`. The Pages client gates
-  // JSON parsing on `X-VoidPages` (navigation-engine.ts) — a cached JSON variant
-  // served on a later navigation WITHOUT it is treated as non-JSON and triggers a
-  // full-page hard reload. Prove the served header end to end (warm → HIT serve).
   it('cached JSON variant (warmed by an HTML render) carries X-VoidPages + Vary on a later navigation HIT', async () => {
     const { kv } = createKvMock();
     const env = makeEnv(kv);
-    // HTML MISS render exposes embedded page data via the x-void-page-data header,
-    // which `populateJsonEdgeCache` stores as the JSON edge variant.
     const { render } = createRender(
       () =>
         new Response('<html>live</html>', {
@@ -1005,12 +888,10 @@ describe('handleIsr', () => {
     );
     const { ctx, flush } = createCtx();
 
-    // 1) HTML navigation MISS → warms the JSON edge variant in the background.
     await handleIsr(htmlRequest(), env, ctx, OPTS, render);
     await flush();
     expect(edge.store.has(jsonEdgeKey(HOST, '/blog/post', DPL))).toBe(true);
 
-    // 2) A subsequent Pages (X-VoidPages) navigation hits the warmed JSON variant.
     const { render: render2, spy: spy2 } = createRender(() => new Response('SHOULD-NOT-RENDER'));
     const { ctx: ctx2 } = createCtx();
     const res = await handleIsr(
@@ -1021,27 +902,28 @@ describe('handleIsr', () => {
       render2,
     );
 
-    // Served from the cached JSON variant (no live render).
     expect(spy2).not.toHaveBeenCalled();
-    // The header the client gates on — missing it means a hard reload.
+    // The client parses JSON only with this header; without it the page hard-reloads.
     expect(res!.headers.get('X-VoidPages')).toBe('true');
     expect(res!.headers.get('Vary')).toBe('X-VoidPages');
     expect(res!.headers.get('content-type')).toBe('application/json');
+    expect(res!.headers.get('Cache-Control')).toBe('public, max-age=0, must-revalidate');
     expect(res!.headers.get('x-isr-cache')).toBe('HIT');
     expect(await res!.text()).toBe('{"component":"Blog","props":{}}');
   });
 
-  it('fails open to a LIVE render (not a 500) when getWithMetadata throws', async () => {
-    const { kv } = createKvMock({ throwOnGet: true });
+  it.each([
+    ['getWithMetadata throws', true],
+    ['the KV entry is from an older cache policy', false],
+  ])('fails open to a LIVE render (not a 500) when %s', async (_, throwOnGet) => {
+    const { store, kv } = createKvMock({ throwOnGet });
+    store.set(isrKey(DPL, HOST, '/blog/post'), corruptCases[0]!.seed());
     const env = makeEnv(kv);
     const { render, spy } = createRender(
       () => new Response('<html>live</html>', { headers: { 'content-type': 'text/html' } }),
     );
     const { ctx } = createCtx();
 
-    // readIsrCache degrades to null on the throw...
-    await expect(readIsrCache(env, HOST, '/blog/post')).resolves.toBeNull();
-    // ...and handleIsr degrades to the live render rather than throwing.
     const res = await handleIsr(htmlRequest(), env, ctx, OPTS, render);
     expect(res!.status).toBe(200);
     expect(res!.headers.get('x-isr-cache')).toBe('MISS');
@@ -1049,73 +931,6 @@ describe('handleIsr', () => {
     expect(spy).toHaveBeenCalledTimes(1);
   });
 
-  // A corrupt KV entry on the hit path must degrade to a live render, never 500
-  // and never throw — proven through the PUBLIC `handleIsr` API for EVERY corrupt
-  // shape (the full module-scoped `corruptCases` table, including createdAt
-  // NaN/Infinity/negative and ttl zero/negative), not just a hand-picked subset.
-  for (const c of corruptCases) {
-    it(`degrades to a live render on a corrupt KV hit (never 500): ${c.name}`, async () => {
-      const { store, kv } = createKvMock();
-      const env = makeEnv(kv);
-      store.set(isrKey(DPL, HOST, '/blog/post'), c.seed());
-
-      // Choke point: the corrupt entry is rejected at `readIsrCache` (→ null),
-      // so `isrCacheResponse` never sees an un-constructible entry.
-      await expect(readIsrCache(env, HOST, '/blog/post')).resolves.toBeNull();
-
-      const { render, spy } = createRender(
-        () => new Response('<html>live</html>', { headers: { 'content-type': 'text/html' } }),
-      );
-      const { ctx, flush } = createCtx();
-
-      // handleIsr returns the LIVE render (MISS), never a 500 and never a throw.
-      const res = await handleIsr(htmlRequest(), env, ctx, OPTS, render);
-      expect(res!.status).toBe(200);
-      expect(res!.headers.get('x-isr-cache')).toBe('MISS');
-      expect(await res!.text()).toBe('<html>live</html>');
-      expect(spy).toHaveBeenCalledTimes(1);
-
-      await flush();
-      // The MISS path overwrote the corrupt entry with a valid, readable one.
-      const entry = await readIsrCache(env, HOST, '/blog/post');
-      expect(entry).not.toBeNull();
-      expect(await new Response(entry!.body).text()).toBe('<html>live</html>');
-    });
-  }
-
-  it('background revalidation with x-revalidate: 0 purges the KV entry and both edge variants', async () => {
-    const { store, kv, delete: kvDelete } = createKvMock();
-    const env = makeEnv(kv);
-    seedEntry(store, '/blog/post', { createdAt: BASE, ttl: 60 });
-    vi.setSystemTime(BASE + 200_000); // stale
-
-    // Pre-warm the JSON edge variant so we can watch it get purged. The HTML
-    // edge key is left empty on purpose — pre-warming it would hit L1 and
-    // short-circuit before the KV stale path (which triggers the purge) runs.
-    edge.store.set(jsonEdgeKey(HOST, '/blog/post', DPL), new Response('{"edge":true}'));
-
-    const { render } = createRender(
-      () =>
-        new Response('<html>opt-out</html>', {
-          headers: { 'content-type': 'text/html', 'x-revalidate': '0' },
-        }),
-    );
-    const { ctx, flush } = createCtx();
-
-    await handleIsr(htmlRequest(), env, ctx, OPTS, render);
-    await flush();
-
-    // KV entry is only ever deleted here (never re-put) — deterministic real removal.
-    expect(store.has(isrKey(DPL, HOST, '/blog/post'))).toBe(false);
-    expect(kvDelete).toHaveBeenCalledWith(isrKey(DPL, HOST, '/blog/post'));
-    // JSON edge variant is only touched by the purge → deterministically removed.
-    expect(edge.store.has(jsonEdgeKey(HOST, '/blog/post', DPL))).toBe(false);
-    expect(edge.delete).toHaveBeenCalledWith(jsonEdgeKey(HOST, '/blog/post', DPL));
-    // No stale edge warm races the purge, so the HTML variant stays absent.
-    expect(edge.store.has(htmlEdgeKey(HOST, '/blog/post', DPL))).toBe(false);
-    expect(edge.delete).toHaveBeenCalledWith(htmlEdgeKey(HOST, '/blog/post', DPL));
-  });
-
   describe.each([handleIsr, handleFrameworkIsr])('%s removal convergence', (handle) => {
     describe.each(['text/plain', 'text/event-stream'])('with %s', (contentType) => {
       it.each([
@@ -1164,6 +979,7 @@ describe('handleIsr', () => {
     ['no-cache', { 'Cache-Control': 'no-cache' }],
     ['Set-Cookie', { 'Set-Cookie': 'sid=private; Path=/; HttpOnly' }],
     ['Vary', { Vary: 'Accept-Language' }],
+    ['x-revalidate: 0', { 'x-revalidate': '0' }],
   ])(
     'authoritative %s background response evicts previously public HTML, JSON, and KV',
     async (_policy, headers) => {
@@ -1175,6 +991,8 @@ describe('handleIsr', () => {
         ttl: 60,
       });
       vi.setSystemTime(BASE + 200_000);
+      // Only the JSON variant is pre-warmed: an HTML edge hit would return
+      // before the stale KV path runs.
       edge.store.set(jsonEdgeKey(HOST, '/blog/post', DPL), new Response('{"user":null}'));
 
       const { render, spy } = createRender(
@@ -1204,6 +1022,7 @@ describe('handleIsr', () => {
       const second = createCtx();
       const live = await handleIsr(htmlRequest(), env, second.ctx, OPTS, render);
       expect(await live!.text()).toBe('<html>private</html>');
+      expect(live!.headers.get('Cache-Control')).toBe(new Headers(headers).get('Cache-Control'));
       expect(live!.headers.get('x-isr-cache')).toBeNull();
       await second.flush();
       expect(spy).toHaveBeenCalledTimes(2);
@@ -1278,7 +1097,6 @@ describe('handleIsr', () => {
     const { render } = createRender(() => new Response('x'));
     const { ctx } = createCtx();
 
-    // Non-GET.
     expect(
       await handleIsr(
         new Request(`https://${HOST}/blog/post`, { method: 'POST' }),
@@ -1288,7 +1106,6 @@ describe('handleIsr', () => {
         render,
       ),
     ).toBeNull();
-    // Credentialed requests bypass ISR.
     expect(
       await handleIsr(htmlRequest('/blog/post', { Cookie: 'sid=1' }), env, ctx, OPTS, render),
     ).toBeNull();
@@ -1301,7 +1118,6 @@ describe('handleIsr', () => {
         render,
       ),
     ).toBeNull();
-    // Path with no configured TTL.
     expect(
       await handleIsr(
         htmlRequest('/blog/post'),
@@ -1313,11 +1129,8 @@ describe('handleIsr', () => {
     ).toBeNull();
   });
 
-  // FIX A: the Cache API can be absent/degraded — `edgeCache()` must swallow the
-  // `caches.default` deref (returning undefined) so `handleIsr` never rejects
-  // before its fail-open guards run. A degraded cache renders live, never 500.
   it('fails open (never throws) when the Cache API is absent — a MISS renders live', async () => {
-    // Degrade the Cache API entirely: reading `caches.default` throws.
+    // Reading `caches.default` now throws.
     vi.stubGlobal('caches', undefined);
 
     const { store, kv } = createKvMock();
@@ -1327,7 +1140,6 @@ describe('handleIsr', () => {
     );
     const { ctx, flush } = createCtx();
 
-    // L1 edge is unreachable → treated as a miss → L2 KV miss → live MISS render.
     const res = await handleIsr(htmlRequest(), env, ctx, OPTS, render);
     expect(res).not.toBeNull();
     expect(res!.status).toBe(200);
@@ -1335,18 +1147,14 @@ describe('handleIsr', () => {
     expect(await res!.text()).toBe('<html>live</html>');
     expect(spy).toHaveBeenCalledTimes(1);
 
-    // Background writes (guarded on an undefined edge cache) drain without throwing;
-    // the KV write still lands.
     await expect(flush()).resolves.toBeUndefined();
     const entry = await readIsrCache(env, HOST, '/blog/post');
     expect(entry).not.toBeNull();
     expect(await new Response(entry!.body).text()).toBe('<html>live</html>');
-    // Exactly one page-cache entry; the registry key is separate.
     expect([...store.keys()].filter((k) => k.startsWith(isrPrefix(DPL))).length).toBe(1);
   });
 
   it('serves the L2 KV HIT with no per-colo edge cache (KV ladder independent of caches.default)', async () => {
-    // `caches.default` throws on access — the KV ladder must still serve.
     vi.stubGlobal('caches', {
       get default(): Cache {
         throw new Error('Cache API degraded');
@@ -1363,22 +1171,12 @@ describe('handleIsr', () => {
     expect(res).not.toBeNull();
     expect(res!.headers.get('x-isr-cache')).toBe('HIT');
     expect(await res!.text()).toBe('<html>kv</html>');
-    // Served from KV without a live render, despite no reachable edge cache.
     expect(spy).not.toHaveBeenCalled();
-    // The edge-warm background task (guarded on undefined cache) drains cleanly.
     await expect(flush()).resolves.toBeUndefined();
   });
 
-  // =========================================================================
-  // Range bypass + full-200-only cache gate
-  // A Range GET on an ISR path (e.g. a byte-range media route under a global
-  // `revalidate: "*"`) must render LIVE so the origin emits a correct `206
-  // Partial Content`. It must never read the shared (host,path) entry (a full
-  // body for a partial request) nor write it (a truncated 206 that a later full
-  // request would then be served). Defense-in-depth: the write gate is tightened
-  // from `response.ok` (200–299, INCLUDING 206) to `status === 200`, so even a
-  // non-range render that returns 206/204/etc. never lands in the shared cache.
-  // =========================================================================
+  // A partial 206 body must never be read from or written to the shared
+  // full-response entry.
   describe('Range bypass + full-200-only cache gate', () => {
     it('bypasses ISR for a Range request → null before any cache read, render, or write', async () => {
       const { store, kv, getWithMetadata, put } = createKvMock();
@@ -1396,12 +1194,9 @@ describe('handleIsr', () => {
         render,
       );
 
-      // Range requests render live (the caller handles them) — handleIsr bails.
       expect(res).toBeNull();
-      // No cache READ: neither the L1 edge nor the L2 KV was consulted.
       expect(edge.match).not.toHaveBeenCalled();
       expect(getWithMetadata).not.toHaveBeenCalled();
-      // No render kicked off inside handleIsr, and no cache WRITE scheduled.
       expect(spy).not.toHaveBeenCalled();
       expect(edge.put).not.toHaveBeenCalled();
       expect(put).not.toHaveBeenCalled();
@@ -1413,8 +1208,6 @@ describe('handleIsr', () => {
     it('does NOT cache a forced 206 render (non-range) — only full 200 responses are written', async () => {
       const { store, kv, put } = createKvMock();
       const env = makeEnv(kv);
-      // No Range header on the request, yet the render returns 206 — the tightened
-      // write gate (status === 200, not response.ok) must still refuse to persist it.
       const { render, spy } = createRender(
         () =>
           new Response('<html>partial</html>', {
@@ -1426,15 +1219,12 @@ describe('handleIsr', () => {
 
       const res = await handleIsr(htmlRequest(), env, ctx, OPTS, render);
 
-      // The live 206 is returned to the client verbatim (never rewritten to 200).
       expect(res).not.toBeNull();
       expect(res!.status).toBe(206);
       expect(await res!.text()).toBe('<html>partial</html>');
       expect(spy).toHaveBeenCalledTimes(1);
 
       await flush();
-      // Nothing persisted: a 206 partial body must never enter a shared full-
-      // response cache (KV or edge), and no write was even scheduled.
       expect(tasks).toHaveLength(0);
       expect(put).not.toHaveBeenCalled();
       expect(edge.put).not.toHaveBeenCalled();
@@ -1442,40 +1232,11 @@ describe('handleIsr', () => {
       expect(edge.store.size).toBe(0);
       expect(await readIsrCache(env, HOST, '/blog/post')).toBeNull();
     });
-
-    it('still writes + serves a full 200 render (the tightened gate does not block 200)', async () => {
-      const { store, kv, put } = createKvMock();
-      const env = makeEnv(kv);
-      const { render, spy } = createRender(
-        () =>
-          new Response('<html>ok-200</html>', {
-            status: 200,
-            headers: { 'content-type': 'text/html' },
-          }),
-      );
-      const { ctx, flush } = createCtx();
-
-      const res = await handleIsr(htmlRequest(), env, ctx, OPTS, render);
-      expect(res!.status).toBe(200);
-      expect(res!.headers.get('x-isr-cache')).toBe('MISS');
-      expect(await res!.text()).toBe('<html>ok-200</html>');
-      expect(spy).toHaveBeenCalledTimes(1);
-
-      await flush();
-      // The 200 render lands in KV + the HTML edge variant, exactly as before.
-      expect(put).toHaveBeenCalled();
-      const entry = await readIsrCache(env, HOST, '/blog/post');
-      expect(entry).not.toBeNull();
-      expect(entry!.status).toBe(200);
-      expect(await new Response(entry!.body).text()).toBe('<html>ok-200</html>');
-      expect(edge.store.has(htmlEdgeKey(HOST, '/blog/post', DPL))).toBe(true);
-      expect([...store.keys()].filter((k) => k.startsWith(isrPrefix(DPL))).length).toBe(1);
-    });
   });
 });
 
 // ===========================================================================
-// Host-scoped KV cache + host registry (FIX 4)
+// Host-scoped KV cache + host registry
 // ===========================================================================
 
 describe('host-scoped KV cache + host registry', () => {
@@ -1497,9 +1258,7 @@ describe('host-scoped KV cache + host registry', () => {
       new Response('<html>foo</html>', { headers: { 'content-type': 'text/html' } }),
       60,
     );
-    // Same path, different host → miss (keys are host-scoped).
     expect(await readIsrCache(env, 'bar.example', '/x')).toBeNull();
-    // Same host → hit.
     expect(await readIsrCache(env, 'foo.example', '/x')).not.toBeNull();
   });
 
@@ -1547,11 +1306,9 @@ describe('host-scoped KV cache + host registry', () => {
     const env = makeEnv(kv);
     const res = () => new Response('<html>x</html>', { headers: { 'content-type': 'text/html' } });
 
-    // First write: content put succeeds, registry put throws → guard cleared, host unregistered.
     await writeIsrCache(env, host, '/p', res(), 60);
     expect(store.has(hostRegistryKey(DPL, host))).toBe(false);
 
-    // Second write: the guard was cleared, so the registry put is retried and succeeds.
     await writeIsrCache(env, host, '/p', res(), 60);
     expect(registryPuts).toBe(2);
     expect(store.has(hostRegistryKey(DPL, host))).toBe(true);
@@ -1562,7 +1319,6 @@ describe('host-scoped KV cache + host registry', () => {
     const { store, kv } = createKvMock();
     store.set(hostRegistryKey(DPL, 'a.example'), { value: new ArrayBuffer(0), metadata: null });
     store.set(hostRegistryKey(DPL, 'b.example'), { value: new ArrayBuffer(0), metadata: null });
-    // A different deployment's registration must NOT leak into this list.
     store.set(hostRegistryKey('other_dpl', 'c.example'), {
       value: new ArrayBuffer(0),
       metadata: null,
diff --git a/packages/void/test/unit/isr-config.test.ts b/packages/void/test/unit/isr-config.test.ts
index f70daae82..d749460ec 100644
--- a/packages/void/test/unit/isr-config.test.ts
+++ b/packages/void/test/unit/isr-config.test.ts
@@ -2,7 +2,7 @@ import { resolvePathTtl } from '@void/isr/runtime';
 import { describe, expect, it } from 'vite-plus/test';
 import type { VoidConfig } from '../../src/config.ts';
 import { collectPages, collectRevalidate, hasRevalidate } from '../../src/isr-config.ts';
-import type { PageDefinition, PageScanResult } from '../../src/pages/types.ts';
+import { makePage, makeScan } from '../helpers/page-scan.ts';
 
 describe('hasRevalidate', () => {
   it('treats null / undefined / 0 / negative / {} as no ISR', () => {
@@ -24,27 +24,6 @@ describe('hasRevalidate', () => {
   });
 });
 
-function makePage(pattern: string, revalidate?: number): PageDefinition {
-  return {
-    pattern,
-    params: [],
-    catchAll: false,
-    componentPath: `${pattern}.vue`,
-    serverPath: `${pattern}.server.ts`,
-    methods: ['GET'],
-    componentId: pattern.replace(/^\//, ''),
-    revalidate,
-    ssrMode: 'auto',
-    prerenderMode: 'auto',
-    renderMode: 'server',
-    shouldPrerender: false,
-  };
-}
-
-function makeScan(pages: Array<PageDefinition>): PageScanResult {
-  return { pages, layouts: [], namedLayouts: [] };
-}
-
 function configWith(revalidate: number | Record<string, number> | undefined): VoidConfig {
   return (revalidate === undefined ? {} : { routing: { revalidate } }) as VoidConfig;
 }
@@ -83,7 +62,6 @@ describe('collectRevalidate', () => {
     const scan = makeScan([makePage('/blog/:slug', 120)]);
     const result = collectRevalidate(configWith(60), scan);
     expect(result).toEqual({ '/blog/:slug': 120, '*': 60 });
-    // Per-page entry must precede the fallback (first-match-wins ordering).
     expect(Object.keys(result as Record<string, number>)).toEqual(['/blog/:slug', '*']);
   });
 
@@ -95,8 +73,6 @@ describe('collectRevalidate', () => {
   it('merges per-page rules ahead of an object config (per-page first in match order)', () => {
     const scan = makeScan([makePage('/blog/:slug', 120)]);
     const result = collectRevalidate(configWith({ '/docs/*': 30, '*': 10 }), scan);
-    // Per-page entries are emitted before the config entries, so first-match
-    // resolution consults the per-page pattern ahead of the config's catch-alls.
     expect(Object.entries(result as Record<string, number>)).toEqual([
       ['/blog/:slug', 120],
       ['/docs/*', 30],
@@ -115,15 +91,7 @@ describe('collectRevalidate', () => {
     expect(collectRevalidate(configWith(60), scan)).toBe(60);
   });
 
-  // FIX 3: single-segment params (`:slug`) stay as `:slug` so the matcher can
-  // anchor them to ONE path segment (`[^/]+`); only named catch-alls (`:slug{.+}`)
-  // and anonymous catch-alls (`*`) collapse to `*` (a splat that crosses `/`).
   describe('route-param → key conversion (generated page keys)', () => {
-    it('keeps a single dynamic param `[slug]` (`/blog/:slug`) as `/blog/:slug`', () => {
-      const scan = makeScan([makePage('/blog/:slug', 120)]);
-      expect(collectRevalidate(configWith(undefined), scan)).toEqual({ '/blog/:slug': 120 });
-    });
-
     it('converts a catch-all param `[...slug]` (`/blog/:slug{.+}`) to `/blog/*`', () => {
       const scan = makeScan([makePage('/blog/:slug{.+}', 90)]);
       expect(collectRevalidate(configWith(undefined), scan)).toEqual({ '/blog/*': 90 });
@@ -134,19 +102,7 @@ describe('collectRevalidate', () => {
       expect(collectRevalidate(configWith(undefined), scan)).toEqual({ '/*': 15 });
     });
 
-    it('keeps every single-segment param in a multi-param pattern (`/shop/:cat/:id`)', () => {
-      const scan = makeScan([makePage('/shop/:cat/:id', 45)]);
-      expect(collectRevalidate(configWith(undefined), scan)).toEqual({ '/shop/:cat/:id': 45 });
-    });
-
-    it('leaves static page patterns untouched', () => {
-      const scan = makeScan([makePage('/about', 300)]);
-      expect(collectRevalidate(configWith(undefined), scan)).toEqual({ '/about': 300 });
-    });
-
     it('does NOT convert user `routing.revalidate` literal keys (only generated page keys)', () => {
-      // A user-authored key that happens to contain a `:` must pass through
-      // verbatim — only the scanned page patterns are converted.
       const scan = makeScan([makePage('/blog/:slug', 120)]);
       const result = collectRevalidate(configWith({ '/legacy/:kept': 30 }), scan);
       expect(Object.entries(result as Record<string, number>)).toEqual([
@@ -156,17 +112,11 @@ describe('collectRevalidate', () => {
     });
   });
 
-  // FIX 3 end-to-end: the emitted `:slug` key must anchor to ONE segment through
-  // the same resolver the runtime uses (mirrors isr-cache resolvePathTtl).
   it('produces keys that resolvePathTtl anchors to a single dynamic path segment', () => {
     const scan = makeScan([makePage('/blog/:slug', 120)]);
     const revalidate = collectRevalidate(configWith(undefined), scan);
-    // Single dynamic segment matches.
     expect(resolvePathTtl(revalidate, '/blog/hello')).toBe(120);
-    // A DEEPER path must NOT match the single-segment `:slug` key (would have
-    // matched the old `/blog/*` wildcard) — proves the segment anchoring.
     expect(resolvePathTtl(revalidate, '/blog/a/b')).toBe(0);
-    // An unrelated path still resolves to 0 (no ISR).
     expect(resolvePathTtl(revalidate, '/about')).toBe(0);
   });
 });
@@ -181,11 +131,10 @@ describe('collectPages', () => {
   });
 
   it('emits every page in scan order with raw patterns; revalidate only when set', () => {
-    // makeScan preserves array order; a real scan is pre-sorted static→dynamic→catch-all.
     const scan = makeScan([
-      makePage('/docs/setup/install'), // specific, no revalidate (opt-out)
-      makePage('/blog/:slug', 120), // single-segment dynamic
-      makePage('/docs/:path{.+}', 3600), // named catch-all — RAW pattern, not `*`
+      makePage('/docs/setup/install'),
+      makePage('/blog/:slug', 120),
+      makePage('/docs/:path{.+}', 3600),
     ]);
     expect(collectPages(scan)).toEqual([
       { pattern: '/docs/setup/install' },
@@ -194,28 +143,20 @@ describe('collectPages', () => {
     ]);
   });
 
-  // A per-page `export const revalidate` wins over any routing.revalidate config.
   it('per-page export wins over config', () => {
     const scan = makeScan([makePage('/p', 120)]);
     expect(collectPages(scan, 3600)).toEqual([{ pattern: '/p', revalidate: 120 }]);
     expect(collectPages(scan, { '/p': 9999 })).toEqual([{ pattern: '/p', revalidate: 120 }]);
   });
 
-  // An explicit `export const revalidate = 0` is an opt-OUT: it bakes the
-  // DISTINGUISHED marker `revalidate: 0` (NOT absent) so dispatch treats it as a
-  // deliberate opt-out — never overridden by an app-wide config, never a per-path
-  // inherit. The `0`-vs-absent distinction is load-bearing (see the 3-state test).
   it('explicit per-page revalidate=0 bakes the distinguished opt-out marker (revalidate:0)', () => {
     const scan = makeScan([makePage('/p', 0)]);
     expect(collectPages(scan, 3600)).toEqual([{ pattern: '/p', revalidate: 0 }]);
-    // Even with an object rule for the same path, the explicit opt-out marker wins.
     expect(collectPages(scan, { '/p': 9999 })).toEqual([{ pattern: '/p', revalidate: 0 }]);
   });
 
-  // The 3-STATE encoding in one table: a baked number `N` (ISR on), an explicit
-  // `0` (opt-out marker), and an ABSENT revalidate (inherit — dispatch resolves
-  // the per-path config against the real request path). Dispatch relies on the
-  // `0`-vs-absent distinction to tell a deliberate opt-out from "ask the config".
+  // Dispatch relies on 0 (explicit opt-out) vs absent (resolve the per-path
+  // config against the request path).
   it('emits all three states: baked N, explicit 0 opt-out, and absent (inherit)', () => {
     const scan = makeScan([
       makePage('/on', 120), // per-page export > 0 → baked N
@@ -239,32 +180,21 @@ describe('collectPages', () => {
     ]);
   });
 
-  // An object (per-path) config bakes no per-page TTL. A page can straddle
-  // several entries, so the raw config ships as `manifest.pathRevalidate` and
-  // dispatch resolves it against the actual request path.
+  // A page can straddle several entries, including a per-path 0, so the raw
+  // config ships as `manifest.pathRevalidate` and dispatch resolves it per request.
   it('an object config bakes no per-page TTL (pages are inherit-eligible)', () => {
     const scan = makeScan([makePage('/blog/:slug'), makePage('/about')]);
-    expect(collectPages(scan, { '/blog/*': 3600 })).toEqual([
-      { pattern: '/blog/:slug' }, // inherit-eligible → dispatch resolves per-path
-      { pattern: '/about' },
-    ]);
-  });
-
-  // A per-path `0` inside an object config is why baking is unsafe: a build-time
-  // collapse would over-cache `/blog/private`.
-  it('leaves an object-config page inherit-eligible so a per-path 0 opt-out is honored at the edge', () => {
-    const scan = makeScan([makePage('/blog/:slug')]);
     expect(collectPages(scan, { '/blog/private': 0, '/blog/*': 3600 })).toEqual([
-      { pattern: '/blog/:slug' }, // no baked TTL; edge honors /blog/private:0 per-path
+      { pattern: '/blog/:slug' },
+      { pattern: '/about' },
     ]);
   });
 
-  // A no-export page never inherits a sibling catch-all's per-page export.
   it('a no-export page does not inherit a sibling catch-all export', () => {
     const scan = makeScan([makePage('/docs/:path{.+}', 300), makePage('/docs/setup/install')]);
     expect(collectPages(scan)).toEqual([
       { pattern: '/docs/:path{.+}', revalidate: 300 },
-      { pattern: '/docs/setup/install' }, // stays 0 — no sibling inheritance
+      { pattern: '/docs/setup/install' },
     ]);
   });
 });
diff --git a/packages/void/test/unit/isr.test.ts b/packages/void/test/unit/isr.test.ts
index 08e73ccae..07b831b28 100644
--- a/packages/void/test/unit/isr.test.ts
+++ b/packages/void/test/unit/isr.test.ts
@@ -46,7 +46,7 @@ function createEdgeMock() {
 }
 
 describe('revalidate — managed (platform proxy)', () => {
-  it('forwards { paths } to the proxy /revalidate endpoint (no self-host regression)', async () => {
+  it('forwards { paths } to the proxy /revalidate endpoint', async () => {
     const fetchMock = vi.fn(
       async (_url: string, _init: RequestInit) => new Response('ok', { status: 200 }),
     );
@@ -119,19 +119,15 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
     vi.unstubAllGlobals();
   });
 
-  it('{ paths } (request host) deletes EXACTLY the requested (host, path) entries from KV and both edge variants — no over-purge', async () => {
+  it('{ paths } with a request host deletes only the requested entries from KV and both edge variants', async () => {
     const { store, kv, delete: kvDelete } = createKvMock();
     store.set(isrKey(DPL, HOST, '/'), new ArrayBuffer(4));
     store.set(isrKey(DPL, HOST, '/blog/x'), new ArrayBuffer(4));
     store.set(isrKey(DPL, HOST, '/keepme'), new ArrayBuffer(4));
-    // Target edge variants (both should be purged).
     edge.store.set(htmlEdgeKey(HOST, '/', DPL), new Response('x'));
     edge.store.set(jsonEdgeKey(HOST, '/', DPL), new Response('x'));
     edge.store.set(htmlEdgeKey(HOST, '/blog/x', DPL), new Response('x'));
     edge.store.set(jsonEdgeKey(HOST, '/blog/x', DPL), new Response('x'));
-    // UNRELATED edge variants for a path NOT being revalidated — an over-purging
-    // implementation (e.g. deleting sibling variants, or purging by prefix) would
-    // wrongly remove these. They MUST survive.
     edge.store.set(htmlEdgeKey(HOST, '/keepme', DPL), new Response('x'));
     edge.store.set(jsonEdgeKey(HOST, '/keepme', DPL), new Response('x'));
 
@@ -142,12 +138,10 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
       },
     );
 
-    // Exactly the requested (host, path) KV keys are gone; the untouched one survives.
     expect(store.has(isrKey(DPL, HOST, '/'))).toBe(false);
     expect(store.has(isrKey(DPL, HOST, '/blog/x'))).toBe(false);
     expect(store.has(isrKey(DPL, HOST, '/keepme'))).toBe(true);
 
-    // Both edge variants purged for each requested path; unrelated ones survive.
     expect(edge.store.has(htmlEdgeKey(HOST, '/', DPL))).toBe(false);
     expect(edge.store.has(jsonEdgeKey(HOST, '/', DPL))).toBe(false);
     expect(edge.store.has(htmlEdgeKey(HOST, '/blog/x', DPL))).toBe(false);
@@ -155,16 +149,12 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
     expect(edge.store.has(htmlEdgeKey(HOST, '/keepme', DPL))).toBe(true);
     expect(edge.store.has(jsonEdgeKey(HOST, '/keepme', DPL))).toBe(true);
 
-    // EXACT KV delete calls: precisely the two requested (host, path) keys, no
-    // extras. An over-purge (e.g. also deleting `/keepme`) would fail here.
     expect(kvDelete).toHaveBeenCalledTimes(2);
     expect(kvDelete.mock.calls.map((c) => c[0])).toEqual([
       isrKey(DPL, HOST, '/'),
       isrKey(DPL, HOST, '/blog/x'),
     ]);
 
-    // EXACT edge delete calls: html + json for each requested path (correct
-    // host/id), in purge order, with no unrelated deletes.
     expect(edge.delete).toHaveBeenCalledTimes(4);
     expect(edge.delete.mock.calls.map((c) => c[0])).toEqual([
       htmlEdgeKey(HOST, '/', DPL),
@@ -198,14 +188,10 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
     expect(edge.store.has(jsonEdgeKey(HOST, '/search', DPL, variantB))).toBe(false);
   });
 
-  // Cron/queue handlers stamp the deployment id WITHOUT a request host (the F1
-  // fix), so a host-less `revalidate({ paths })` must enumerate EVERY registered
-  // host from the registry and purge each host's (host, path) entry.
-  it('{ paths } with NO request host purges every REGISTERED host (cron/queue purge via registry)', async () => {
+  it('{ paths } without a request host (cron/queue) purges every registered host', async () => {
     const { store, kv, delete: kvDelete } = createKvMock();
     const HOST_A = 'a.example';
     const HOST_B = 'b.example';
-    // Two hosts have cached the same path; both are registered.
     store.set(isrKey(DPL, HOST_A, '/p'), new ArrayBuffer(4));
     store.set(isrKey(DPL, HOST_B, '/p'), new ArrayBuffer(4));
     store.set(hostRegistryKey(DPL, HOST_A), new ArrayBuffer(0));
@@ -213,23 +199,20 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
     edge.store.set(htmlEdgeKey(HOST_A, '/p', DPL), new Response('x'));
     edge.store.set(htmlEdgeKey(HOST_B, '/p', DPL), new Response('x'));
 
-    // NO __VOID_ISR_HOST — the cron/queue path relies entirely on the registry.
     await envContext.run({ ISR_CACHE: kv, __VOID_ISR_DEPLOYMENT_ID: DPL }, async () => {
       await revalidate({ paths: ['/p'] });
     });
 
-    // Both registered hosts' KV + edge entries purged.
     expect(store.has(isrKey(DPL, HOST_A, '/p'))).toBe(false);
     expect(store.has(isrKey(DPL, HOST_B, '/p'))).toBe(false);
     expect(edge.store.has(htmlEdgeKey(HOST_A, '/p', DPL))).toBe(false);
     expect(edge.store.has(htmlEdgeKey(HOST_B, '/p', DPL))).toBe(false);
-    // One KV delete per registered host (order-independent).
     expect(kvDelete.mock.calls.map((c) => c[0]).sort()).toEqual(
       [isrKey(DPL, HOST_A, '/p'), isrKey(DPL, HOST_B, '/p')].sort(),
     );
   });
 
-  it('{ paths } with no request host and an EMPTY registry is a silent no-op (nothing purged)', async () => {
+  it('{ paths } without a request host and with an empty registry purges nothing', async () => {
     const { store, kv, delete: kvDelete } = createKvMock();
     store.set(isrKey(DPL, HOST, '/'), new ArrayBuffer(4));
 
@@ -237,17 +220,13 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
       await revalidate({ paths: ['/'] });
     });
 
-    // No registered host and no request host → no host to purge → key survives.
     expect(store.has(isrKey(DPL, HOST, '/'))).toBe(true);
     expect(kvDelete).not.toHaveBeenCalled();
     expect(edge.delete).not.toHaveBeenCalled();
   });
 
-  // The authoritative KV purge must never depend on the Cache API: the edge purge
-  // is guarded, so a degraded `caches.default` (scheduled/queue handlers, or no
-  // Cache API) fails open without blocking the KV delete.
-  it('purges KV via the registry even when the Cache API is degraded (edge fails open, KV still purged)', async () => {
-    // Degraded Cache API: reading `caches.default` throws.
+  // The edge purge fails open, so the KV purge never depends on the Cache API.
+  it('purges KV via the registry when the Cache API is unavailable', async () => {
     vi.stubGlobal('caches', {
       get default(): Cache {
         throw new Error('Cache API unavailable');
@@ -258,31 +237,24 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
     store.set(isrKey(DPL, HOST, '/'), new ArrayBuffer(4));
     store.set(hostRegistryKey(DPL, HOST), new ArrayBuffer(0));
 
-    // No __VOID_ISR_HOST → host comes from the registry; the degraded edge must
-    // not throw and must not block the KV purge.
     await expect(
       envContext.run({ ISR_CACHE: kv, __VOID_ISR_DEPLOYMENT_ID: DPL }, async () => {
         await revalidate({ paths: ['/'] });
       }),
     ).resolves.toBeUndefined();
 
-    // KV delete completed despite the swallowed edge throw.
     expect(store.has(isrKey(DPL, HOST, '/'))).toBe(false);
     expect(kvDelete).toHaveBeenCalledWith(isrKey(DPL, HOST, '/'));
   });
 
   it('{ all: true } lists the shared deployment prefix, splits each host, and purges every entry across pages', async () => {
-    // pageSize 2 forces the cursor loop to iterate across multiple pages.
     const { store, kv, list } = createKvMock(2);
     const HOST2 = 'other.example';
     store.set(isrKey(DPL, HOST, '/'), new ArrayBuffer(4));
     store.set(isrKey(DPL, HOST, '/a'), new ArrayBuffer(4));
     store.set(isrKey(DPL, HOST, '/b/c'), new ArrayBuffer(4));
-    // A SECOND host under the same deployment — its key must be purged too, and
-    // its host must be split back out of the scanned key correctly.
     store.set(isrKey(DPL, HOST2, '/d'), new ArrayBuffer(4));
     store.set(isrKey(DPL, HOST, '/e'), new ArrayBuffer(4));
-    // A different deployment's entry must never be touched.
     store.set(isrKey('other_dpl', HOST, '/x'), new ArrayBuffer(4));
 
     await envContext.run(
@@ -292,7 +264,6 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
       },
     );
 
-    // Every (host, path) under THIS deployment is gone; the other deployment survives.
     for (const [h, p] of [
       [HOST, '/'],
       [HOST, '/a'],
@@ -303,19 +274,12 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
       expect(store.has(isrKey(DPL, h, p))).toBe(false);
     }
     expect(store.has(isrKey('other_dpl', HOST, '/x'))).toBe(true);
-    // Cursor loop ran more than once (5 keys / pageSize 2 → 3 list calls).
     expect(list.mock.calls.length).toBeGreaterThan(1);
-    // EVERY list call is scoped to THIS deployment's prefix. An unscoped
-    // `kv.list()` (or a wrong/missing prefix) would enumerate — and therefore
-    // purge — other deployments' keys; assert the prefix on every page.
     const listPrefix = isrPrefix(DPL);
     for (const [opts] of list.mock.calls) {
       expect((opts as { prefix?: string }).prefix).toBe(listPrefix);
     }
-    // The first page starts with no cursor.
     expect((list.mock.calls[0][0] as { cursor?: string }).cursor).toBeUndefined();
-    // Edge purge issued with the host SPLIT from the scanned key (path round-tripped
-    // through denormalizeIsrPath), including the second host.
     expect(edge.delete).toHaveBeenCalledWith(htmlEdgeKey(HOST, '/', DPL));
     expect(edge.delete).toHaveBeenCalledWith(htmlEdgeKey(HOST, '/b/c', DPL));
     expect(edge.delete).toHaveBeenCalledWith(htmlEdgeKey(HOST2, '/d', DPL));
@@ -324,7 +288,7 @@ describe('revalidate — self-host (own ISR_CACHE + edge)', () => {
 
 describe('revalidate — unconfigured (silent no-op)', () => {
   beforeEach(() => {
-    // No caches.default stub — an unconfigured worker must not even reach it.
+    // An unconfigured worker must not touch the Cache API.
     vi.stubGlobal('caches', undefined);
   });
   afterEach(() => {
@@ -345,7 +309,6 @@ describe('revalidate — unconfigured (silent no-op)', () => {
     await envContext.run({ ISR_CACHE: kv }, async () => {
       await revalidate({ paths: ['/'] });
     });
-    // Early return before any delete — the key survives.
     expect(store.has(isrKey(DPL, HOST, '/'))).toBe(true);
     expect(kvDelete).not.toHaveBeenCalled();
   });
diff --git a/packages/void/test/unit/kv.test.ts b/packages/void/test/unit/kv.test.ts
index b656b336b..d210fb54a 100644
--- a/packages/void/test/unit/kv.test.ts
+++ b/packages/void/test/unit/kv.test.ts
@@ -83,11 +83,6 @@ describe('createKV', () => {
       expect(mockNS.put).toHaveBeenCalledWith('user:1', '{"name":"Alice"}', {});
     });
 
-    it('stores strings as JSON so their type survives reads', async () => {
-      await kv.put('key', 'hello');
-      expect(mockNS.put).toHaveBeenCalledWith('key', '"hello"', {});
-    });
-
     it('passes ttl option as expirationTtl', async () => {
       await kv.put('key', 'val', { ttl: 3600 });
       expect(mockNS.put).toHaveBeenCalledWith('key', '"val"', { expirationTtl: 3600 });
@@ -97,11 +92,6 @@ describe('createKV', () => {
       await kv.put('key', 'val', { expiration: 1700000000 });
       expect(mockNS.put).toHaveBeenCalledWith('key', '"val"', { expiration: 1700000000 });
     });
-
-    it('passes metadata option', async () => {
-      await kv.put('key', 'val', { metadata: { role: 'admin' } });
-      expect(mockNS.put).toHaveBeenCalledWith('key', '"val"', { metadata: { role: 'admin' } });
-    });
   });
 
   describe('delete', () => {
diff --git a/packages/void/test/unit/lint-duplicate-sources.test.ts b/packages/void/test/unit/lint-duplicate-sources.test.ts
index e4bda16d3..284a9e665 100644
--- a/packages/void/test/unit/lint-duplicate-sources.test.ts
+++ b/packages/void/test/unit/lint-duplicate-sources.test.ts
@@ -68,20 +68,6 @@ describe('lintDuplicateSources', () => {
     expect(msg).not.toContain('/api/*');
   });
 
-  it('treats cross-phase collisions as safe — callers lint each phase list independently', () => {
-    const rewrites: Array<DevRedirectRule> = [
-      rule('/docs/*', 'void.json#routing.rewrites', { force: true }),
-    ];
-    const fallbacks: Array<DevRedirectRule> = [
-      rule('/docs/*', 'void.json#routing.fallbacks', { force: false }),
-    ];
-
-    lintDuplicateSources(rewrites, 'redirects/rewrites (pre-asset)');
-    lintDuplicateSources(fallbacks, 'fallbacks (post-asset)');
-
-    expect(warnMock).not.toHaveBeenCalled();
-  });
-
   it('aggregates multiple duplicate sources into one message', () => {
     const rules: Array<DevRedirectRule> = [
       rule('/docs/*', '_redirects:12'),
diff --git a/packages/void/test/unit/list-command.test.ts b/packages/void/test/unit/list-command.test.ts
index f28b81d8d..8eaa141f2 100644
--- a/packages/void/test/unit/list-command.test.ts
+++ b/packages/void/test/unit/list-command.test.ts
@@ -2,7 +2,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { Buffer } from '../../src/cli/node-buffer.ts';
+import { captureOutput } from '../helpers/cli-command.ts';
 
 const tempHomes: Array<string> = [];
 const mockGetToken = vi.fn<() => string | null>();
@@ -26,31 +26,6 @@ async function importRunListCommand() {
   return mod.runListCommand;
 }
 
-function captureOutput(): { output: () => string; restore: () => void } {
-  const chunks: Array<string> = [];
-  const writeMock = vi
-    .spyOn(process.stdout, 'write')
-    .mockImplementation((...args: Array<unknown>) => {
-      const chunk = args[0];
-      if (typeof chunk === 'string') {
-        chunks.push(chunk);
-      } else if (Buffer.isBuffer(chunk)) {
-        chunks.push(chunk.toString());
-      }
-      return true;
-    });
-  const logMock = vi.spyOn(console, 'log').mockImplementation((...args: Array<unknown>) => {
-    chunks.push(args.map(String).join(' ') + '\n');
-  });
-  return {
-    output: () => chunks.join(''),
-    restore: () => {
-      writeMock.mockRestore();
-      logMock.mockRestore();
-    },
-  };
-}
-
 describe('runListCommand', () => {
   beforeEach(() => {
     mockGetToken.mockReset().mockReturnValue(null);
@@ -73,7 +48,7 @@ describe('runListCommand', () => {
     setIsolatedHome();
 
     const capture = captureOutput();
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
       throw new Error(`process.exit:${code ?? 0}`);
     }) as never);
 
@@ -85,7 +60,6 @@ describe('runListCommand', () => {
     capture.restore();
 
     expect(out).toContain('Not logged in');
-    expect(exitSpy).toHaveBeenCalled();
   });
 
   it('exits with error when no linked project and no slug', async () => {
@@ -93,7 +67,7 @@ describe('runListCommand', () => {
     mockGetToken.mockReturnValue('test-token');
 
     const capture = captureOutput();
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
       throw new Error(`process.exit:${code ?? 0}`);
     }) as never);
 
@@ -105,7 +79,6 @@ describe('runListCommand', () => {
     capture.restore();
 
     expect(out).toContain('No linked project found');
-    expect(exitSpy).toHaveBeenCalled();
   });
 
   it('summarizes per-path revalidation rules in the isr column', async () => {
diff --git a/packages/void/test/unit/live-client.test.ts b/packages/void/test/unit/live-client.test.ts
index 14d50f286..7faf5673a 100644
--- a/packages/void/test/unit/live-client.test.ts
+++ b/packages/void/test/unit/live-client.test.ts
@@ -1,39 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { connectLiveStream } from '../../src/runtime/live-client.ts';
-
-class MockEventSource {
-  static instances: Array<MockEventSource> = [];
-
-  readonly listeners = new Map<string, Set<(event: Event) => void>>();
-  closed = false;
-
-  constructor(
-    readonly url: string,
-    readonly options?: { withCredentials?: boolean },
-  ) {
-    MockEventSource.instances.push(this);
-  }
-
-  addEventListener(type: string, listener: (event: Event) => void): void {
-    const listeners = this.listeners.get(type) ?? new Set();
-    listeners.add(listener);
-    this.listeners.set(type, listeners);
-  }
-
-  removeEventListener(type: string, listener: (event: Event) => void): void {
-    this.listeners.get(type)?.delete(listener);
-  }
-
-  emit(type: string, event: Event): void {
-    for (const listener of this.listeners.get(type) ?? []) {
-      listener(event);
-    }
-  }
-
-  close(): void {
-    this.closed = true;
-  }
-}
+import { connectLiveStream, type ConnectLiveStreamOptions } from '../../src/runtime/live-client.ts';
+import { MockEventSource } from '../helpers/mock-event-source.ts';
 
 const originalLocation = (globalThis as { location?: unknown }).location;
 
@@ -57,11 +24,7 @@ describe('connectLiveStream', () => {
         results: [{ ok: true, kind: 'subscribe', id: 'post-card', topic: 'post:12' }],
       }),
     );
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-      withCredentials: true,
-    });
+    const live = openLive(fetchMock, { withCredentials: true });
 
     const pending = live.subscribe({ id: 'post-card', topic: 'post:12' });
     await Promise.resolve();
@@ -82,17 +45,8 @@ describe('connectLiveStream', () => {
   });
 
   it('rejects a subscribe waiting for the initial open when closed', async () => {
-    const fetchMock = vi.fn(async () =>
-      Response.json({
-        accepted: true,
-        connectionId: 'connection',
-        results: [{ ok: true, kind: 'subscribe', id: 'post-card', topic: 'post:12' }],
-      }),
-    );
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-    });
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => ackAll(init));
+    const live = openLive(fetchMock);
 
     const pending = live.subscribe({ id: 'post-card', topic: 'post:12' });
     await Promise.resolve();
@@ -106,37 +60,17 @@ describe('connectLiveStream', () => {
   });
 
   it('routes message envelopes by subscription id and unsubscribes individually', async () => {
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: body.operations.map((op: { kind: string; id: string; topic?: string }) => ({
-          ok: true,
-          kind: op.kind,
-          id: op.id,
-          topic: op.topic,
-        })),
-      });
-    });
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => ackAll(init));
     const handler = vi.fn();
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-    });
+    const live = openLive(fetchMock);
     const unsubscribe = live.subscribe({ id: 'comments', topic: 'comment:2323', onEvent: handler });
-    await Promise.resolve();
-    const source = MockEventSource.instances[0]!;
-    source.emit('open', new Event('open'));
+    const source = await emitOpen();
     await unsubscribe;
 
-    source.emit('message', {
-      data: JSON.stringify({
-        subscriptionId: 'comments',
-        topic: 'comment:2323',
-        data: { ok: true },
-      }),
-    } as MessageEvent);
+    source.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'comments', topic: 'comment:2323', data: { ok: true } }),
+    );
     expect(handler).toHaveBeenCalledWith({
       subscriptionId: 'comments',
       topic: 'comment:2323',
@@ -156,29 +90,21 @@ describe('connectLiveStream', () => {
 
   it('routes events that arrive before the subscribe control ack resolves', async () => {
     const handler = vi.fn();
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      MockEventSource.instances[0]!.emit('message', {
-        data: JSON.stringify({
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
+      MockEventSource.instances[0]!.emit(
+        'message',
+        JSON.stringify({
           subscriptionId: 'comments',
           topic: 'comment:2323',
           data: { early: true },
         }),
-      } as MessageEvent);
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: [{ ok: true, kind: 'subscribe', id: 'comments', topic: 'comment:2323' }],
-      });
-    });
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
+      );
+      return ackAll(init);
     });
+    const live = openLive(fetchMock);
 
     const unsubscribe = live.subscribe({ id: 'comments', topic: 'comment:2323', onEvent: handler });
-    await Promise.resolve();
-    MockEventSource.instances[0]!.emit('open', new Event('open'));
+    await emitOpen();
     await unsubscribe;
 
     expect(handler).toHaveBeenCalledWith({
@@ -191,36 +117,19 @@ describe('connectLiveStream', () => {
   it('routes replacement events to the replacement handler before the control ack resolves', async () => {
     const oldHandler = vi.fn();
     const newHandler = vi.fn();
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      if (body.operations[0]?.topic === 'post:13') {
-        MockEventSource.instances[0]!.emit('message', {
-          data: JSON.stringify({
-            subscriptionId: 'card',
-            topic: 'post:13',
-            data: { early: true },
-          }),
-        } as MessageEvent);
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
+      if (controlBody(init).operations[0]?.topic === 'post:13') {
+        MockEventSource.instances[0]!.emit(
+          'message',
+          JSON.stringify({ subscriptionId: 'card', topic: 'post:13', data: { early: true } }),
+        );
       }
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: body.operations.map((op: { kind: string; id: string; topic?: string }) => ({
-          ok: true,
-          kind: op.kind,
-          id: op.id,
-          topic: op.topic,
-        })),
-      });
-    });
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
+      return ackAll(init);
     });
+    const live = openLive(fetchMock);
 
     const first = live.subscribe({ id: 'card', topic: 'post:12', onEvent: oldHandler });
-    await Promise.resolve();
-    MockEventSource.instances[0]!.emit('open', new Event('open'));
+    await emitOpen();
     await first;
 
     const second = live.subscribe({ id: 'card', topic: 'post:13', onEvent: newHandler });
@@ -235,11 +144,10 @@ describe('connectLiveStream', () => {
   });
 
   it('keeps per-operation subscribe failures isolated in one control batch', async () => {
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      return Response.json({
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) =>
+      Response.json({
         accepted: true,
-        connectionId: body.connectionId,
+        connectionId: controlBody(init).connectionId,
         results: [
           { ok: true, kind: 'subscribe', id: 'post-card', topic: 'post:12' },
           {
@@ -249,14 +157,11 @@ describe('connectLiveStream', () => {
             error: { code: 'FORBIDDEN', message: 'Forbidden' },
           },
         ],
-      });
-    });
+      }),
+    );
     const postHandler = vi.fn();
     const privateHandler = vi.fn();
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-    });
+    const live = openLive(fetchMock);
 
     const post = live.subscribe({ id: 'post-card', topic: 'post:12', onEvent: postHandler });
     const privatePost = live.subscribe({
@@ -264,95 +169,77 @@ describe('connectLiveStream', () => {
       topic: 'post:private',
       onEvent: privateHandler,
     });
-    await Promise.resolve();
-    MockEventSource.instances[0]!.emit('open', new Event('open'));
+    const source = await emitOpen();
 
     await expect(post).resolves.toEqual(expect.any(Function));
     await expect(privatePost).rejects.toThrow('Forbidden');
 
-    MockEventSource.instances[0]!.emit('message', {
-      data: JSON.stringify({ subscriptionId: 'post-card', topic: 'post:12', data: { ok: true } }),
-    } as MessageEvent);
-    MockEventSource.instances[0]!.emit('message', {
-      data: JSON.stringify({ subscriptionId: 'private-card', topic: 'post:private', data: {} }),
-    } as MessageEvent);
+    source.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'post-card', topic: 'post:12', data: { ok: true } }),
+    );
+    source.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'private-card', topic: 'post:private', data: {} }),
+    );
 
     expect(postHandler).toHaveBeenCalledTimes(1);
     expect(privateHandler).not.toHaveBeenCalled();
   });
 
   it('keeps the previous subscription handler when replacement fails', async () => {
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      const operation = body.operations[0];
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
+      const body = controlBody(init);
+      const operation = body.operations[0]!;
+      if (operation.topic !== 'post:blocked') {
+        return ackAll(init);
+      }
       return Response.json({
         accepted: true,
         connectionId: body.connectionId,
-        results:
-          operation.topic === 'post:blocked'
-            ? [
-                {
-                  ok: false,
-                  kind: 'subscribe',
-                  id: operation.id,
-                  error: { code: 'FORBIDDEN', message: 'Forbidden' },
-                },
-              ]
-            : [{ ok: true, kind: operation.kind, id: operation.id, topic: operation.topic }],
+        results: [
+          {
+            ok: false,
+            kind: 'subscribe',
+            id: operation.id,
+            error: { code: 'FORBIDDEN', message: 'Forbidden' },
+          },
+        ],
       });
     });
     const oldHandler = vi.fn();
     const newHandler = vi.fn();
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-    });
+    const live = openLive(fetchMock);
 
     const first = live.subscribe({ id: 'card', topic: 'post:12', onEvent: oldHandler });
-    await Promise.resolve();
-    MockEventSource.instances[0]!.emit('open', new Event('open'));
+    const source = await emitOpen();
     await first;
 
     await expect(
       live.subscribe({ id: 'card', topic: 'post:blocked', onEvent: newHandler }),
     ).rejects.toThrow('Forbidden');
 
-    MockEventSource.instances[0]!.emit('message', {
-      data: JSON.stringify({ subscriptionId: 'card', topic: 'post:12', data: { ok: true } }),
-    } as MessageEvent);
+    source.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'card', topic: 'post:12', data: { ok: true } }),
+    );
 
     expect(oldHandler).toHaveBeenCalledTimes(1);
     expect(newHandler).not.toHaveBeenCalled();
   });
 
   it('does not let stale unsubscribe functions remove replacement subscriptions', async () => {
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: body.operations.map((op: { kind: string; id: string; topic?: string }) => ({
-          ok: true,
-          kind: op.kind,
-          id: op.id,
-          topic: op.topic,
-        })),
-      });
-    });
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => ackAll(init));
     const oldHandler = vi.fn();
     const newHandler = vi.fn();
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-    });
+    const live = openLive(fetchMock);
 
     const firstUnsubscribe = live.subscribe({
       id: 'card',
       topic: 'post:12',
       onEvent: oldHandler,
     });
-    await Promise.resolve();
-    MockEventSource.instances[0]!.emit('open', new Event('open'));
+    const source = await emitOpen();
     const unsubscribeOld = await firstUnsubscribe;
     await flushMicrotasks();
 
@@ -367,9 +254,10 @@ describe('connectLiveStream', () => {
     await unsubscribeOld();
     expect(fetchMock).toHaveBeenCalledTimes(2);
 
-    MockEventSource.instances[0]!.emit('message', {
-      data: JSON.stringify({ subscriptionId: 'card', topic: 'post:13', data: { ok: true } }),
-    } as MessageEvent);
+    source.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'card', topic: 'post:13', data: { ok: true } }),
+    );
     expect(oldHandler).not.toHaveBeenCalled();
     expect(newHandler).toHaveBeenCalledTimes(1);
 
@@ -379,38 +267,24 @@ describe('connectLiveStream', () => {
 
   it('does not let stale unsubscribe functions race in-flight replacements', async () => {
     let resolveReplacement: ((value: Response | PromiseLike<Response>) => void) | undefined;
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      if (body.operations[0]?.topic === 'post:13') {
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
+      if (controlBody(init).operations[0]?.topic === 'post:13') {
         return await new Promise<Response>((resolve) => {
           resolveReplacement = resolve;
         });
       }
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: body.operations.map((op: { kind: string; id: string; topic?: string }) => ({
-          ok: true,
-          kind: op.kind,
-          id: op.id,
-          topic: op.topic,
-        })),
-      });
+      return ackAll(init);
     });
     const oldHandler = vi.fn();
     const newHandler = vi.fn();
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-    });
+    const live = openLive(fetchMock);
 
     const firstUnsubscribe = live.subscribe({
       id: 'card',
       topic: 'post:12',
       onEvent: oldHandler,
     });
-    await Promise.resolve();
-    MockEventSource.instances[0]!.emit('open', new Event('open'));
+    const source = await emitOpen();
     const unsubscribeOld = await firstUnsubscribe;
 
     const secondUnsubscribe = live.subscribe({
@@ -433,9 +307,10 @@ describe('connectLiveStream', () => {
     );
     const unsubscribeNew = await secondUnsubscribe;
 
-    MockEventSource.instances[0]!.emit('message', {
-      data: JSON.stringify({ subscriptionId: 'card', topic: 'post:13', data: { ok: true } }),
-    } as MessageEvent);
+    source.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'card', topic: 'post:13', data: { ok: true } }),
+    );
     expect(oldHandler).not.toHaveBeenCalled();
     expect(newHandler).toHaveBeenCalledTimes(1);
 
@@ -445,32 +320,18 @@ describe('connectLiveStream', () => {
 
   it('serializes control requests while a previous flush is in flight', async () => {
     let resolveReplacement: ((value: Response | PromiseLike<Response>) => void) | undefined;
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      if (body.operations[0]?.topic === 'post:13') {
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
+      if (controlBody(init).operations[0]?.topic === 'post:13') {
         return await new Promise<Response>((resolve) => {
           resolveReplacement = resolve;
         });
       }
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: body.operations.map((op: { kind: string; id: string; topic?: string }) => ({
-          ok: true,
-          kind: op.kind,
-          id: op.id,
-          topic: op.topic,
-        })),
-      });
-    });
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
+      return ackAll(init);
     });
+    const live = openLive(fetchMock);
 
     const first = live.subscribe({ id: 'card', topic: 'post:12' });
-    await Promise.resolve();
-    MockEventSource.instances[0]!.emit('open', new Event('open'));
+    await emitOpen();
     await first;
     await flushMicrotasks();
 
@@ -501,38 +362,16 @@ describe('connectLiveStream', () => {
 
   it('reconnects and resubscribes active subscriptions with lastEventId', async () => {
     vi.useFakeTimers();
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: body.operations.map((op: { kind: string; id: string; topic?: string }) => ({
-          ok: true,
-          kind: op.kind,
-          id: op.id,
-          topic: op.topic,
-        })),
-      });
-    });
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-      retryDelay: 25,
-    });
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => ackAll(init));
+    const live = openLive(fetchMock, { retryDelay: 25 });
     const unsubscribe = live.subscribe({ id: 'post-card', topic: 'post:12', lastEventId: 'v1' });
-    await Promise.resolve();
-    const firstSource = MockEventSource.instances[0]!;
-    firstSource.emit('open', new Event('open'));
+    const firstSource = await emitOpen();
     await unsubscribe;
 
-    firstSource.emit('message', {
-      data: JSON.stringify({
-        subscriptionId: 'post-card',
-        topic: 'post:12',
-        eventId: 'v2',
-        data: {},
-      }),
-    } as MessageEvent);
+    firstSource.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'post-card', topic: 'post:12', eventId: 'v2', data: {} }),
+    );
     firstSource.emit('error', new Event('error'));
     expect(firstSource.closed).toBe(true);
 
@@ -552,39 +391,17 @@ describe('connectLiveStream', () => {
 
   it('preserves resubscribe when a control operation interrupts a reconnect timer', async () => {
     vi.useFakeTimers();
-    const fetchMock = vi.fn(async (_url, init) => {
-      const body = JSON.parse(String((init as RequestInit).body));
-      return Response.json({
-        accepted: true,
-        connectionId: body.connectionId,
-        results: body.operations.map((op: { kind: string; id: string; topic?: string }) => ({
-          ok: true,
-          kind: op.kind,
-          id: op.id,
-          topic: op.topic,
-        })),
-      });
-    });
-    const live = connectLiveStream('/live', {
-      eventSource: MockEventSource,
-      fetch: fetchMock as unknown as typeof fetch,
-      retryDelay: 25,
-    });
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => ackAll(init));
+    const live = openLive(fetchMock, { retryDelay: 25 });
     const first = live.subscribe({ id: 'post-card', topic: 'post:12', lastEventId: 'v1' });
-    await Promise.resolve();
-    const firstSource = MockEventSource.instances[0]!;
-    firstSource.emit('open', new Event('open'));
+    const firstSource = await emitOpen();
     await first;
     await flushMicrotasks();
 
-    firstSource.emit('message', {
-      data: JSON.stringify({
-        subscriptionId: 'post-card',
-        topic: 'post:12',
-        eventId: 'v2',
-        data: {},
-      }),
-    } as MessageEvent);
+    firstSource.emit(
+      'message',
+      JSON.stringify({ subscriptionId: 'post-card', topic: 'post:12', eventId: 'v2', data: {} }),
+    );
     firstSource.emit('error', new Event('error'));
 
     const second = live.subscribe({ id: 'comments', topic: 'comment:2323' });
@@ -607,6 +424,46 @@ describe('connectLiveStream', () => {
   });
 });
 
+type ControlBody = {
+  connectionId: string;
+  operations: Array<{ kind: string; id: string; topic?: string }>;
+};
+
+function controlBody(init: RequestInit | undefined): ControlBody {
+  return JSON.parse(String(init?.body)) as ControlBody;
+}
+
+/** Answers a control request by accepting every operation in it. */
+function ackAll(init: RequestInit | undefined): Response {
+  const body = controlBody(init);
+  return Response.json({
+    accepted: true,
+    connectionId: body.connectionId,
+    results: body.operations.map((op) => ({
+      ok: true,
+      kind: op.kind,
+      id: op.id,
+      topic: op.topic,
+    })),
+  });
+}
+
+function openLive(fetchMock: unknown, options: ConnectLiveStreamOptions = {}) {
+  return connectLiveStream('/live', {
+    eventSource: MockEventSource,
+    fetch: fetchMock as typeof fetch,
+    ...options,
+  });
+}
+
+/** Lets the client create its EventSource, then opens it. */
+async function emitOpen(): Promise<MockEventSource> {
+  await Promise.resolve();
+  const source = MockEventSource.instances[0]!;
+  source.emit('open', new Event('open'));
+  return source;
+}
+
 async function flushMicrotasks(count = 5): Promise<void> {
   for (let i = 0; i < count; i++) {
     await Promise.resolve();
diff --git a/packages/void/test/unit/live-server.test.ts b/packages/void/test/unit/live-server.test.ts
index 41e146617..0ccdf3ed0 100644
--- a/packages/void/test/unit/live-server.test.ts
+++ b/packages/void/test/unit/live-server.test.ts
@@ -83,34 +83,18 @@ describe('live Durable Object runtime', () => {
     const topic = harness.stub('live:app:topic:topic-key');
     const limits = { ...LIMITS, maxSubscriptionsPerTopic: 1 };
 
-    const stale = await topic.fetch(
-      jsonRequest('/register', {
-        streamId: 'app',
-        topic: 'post:12',
-        topicKey: 'topic-key',
-        connectionId: 'stale-connection-0001',
-        subscriptionId: 'comments',
-        generation: 1,
-        revision: 1,
-        lastSeenAt: Date.now(),
-        limits,
-      }),
-    );
+    const stale = await register(topic, {
+      connectionId: 'stale-connection-0001',
+      subscriptionId: 'comments',
+      limits,
+    });
     expect(stale.ok).toBe(true);
 
-    const current = await topic.fetch(
-      jsonRequest('/register', {
-        streamId: 'app',
-        topic: 'post:12',
-        topicKey: 'topic-key',
-        connectionId: 'current-connection-001',
-        subscriptionId: 'comments',
-        generation: 1,
-        revision: 1,
-        lastSeenAt: Date.now(),
-        limits,
-      }),
-    );
+    const current = await register(topic, {
+      connectionId: 'current-connection-001',
+      subscriptionId: 'comments',
+      limits,
+    });
     expect(current.ok).toBe(true);
   });
 
@@ -134,19 +118,11 @@ describe('live Durable Object runtime', () => {
     const topic = new LiveDurableObject(state, env);
     const limits = { ...LIMITS, deliveryAttemptTimeoutMs: 10 };
 
-    await topic.fetch(
-      jsonRequest('/register', {
-        streamId: 'app',
-        topic: 'post:12',
-        topicKey: 'topic-key',
-        connectionId: 'slow-connection-0001',
-        subscriptionId: 'comments',
-        generation: 1,
-        revision: 1,
-        lastSeenAt: Date.now(),
-        limits,
-      }),
-    );
+    await register(topic, {
+      connectionId: 'slow-connection-0001',
+      subscriptionId: 'comments',
+      limits,
+    });
 
     const startedAt = Date.now();
     const response = await topic.fetch(
@@ -185,19 +161,10 @@ describe('live Durable Object runtime', () => {
         }
       },
     });
-    const connectionId = 'connection-transient-0001';
-    const connection = harness.stub(`live:app:connection:${connectionId}`);
-    const message = { streamId: 'app', connectionId, owner: 'user:1', limits: LIMITS };
-    const response = await connection.fetch(jsonRequest('/connect', message));
-    const reader = response.body!.getReader();
-    await readFrame(reader);
+    const { reader } = await connectAndSubscribe(harness, 'connection-transient-0001', [
+      { kind: 'subscribe', id: 'card', topic: 'post:12' },
+    ]);
     try {
-      await connection.fetch(
-        jsonRequest('/control', {
-          ...message,
-          operations: [{ kind: 'subscribe', id: 'card', topic: 'post:12' }],
-        }),
-      );
       const topicName = `live:app:topic:${await topicDigest('app', 'post:12')}`;
       failing = true;
       vi.useFakeTimers();
@@ -348,41 +315,15 @@ describe('live Durable Object runtime', () => {
     });
     const topicKey = await topicDigest('app', 'post:12');
     const topic = harness.stub(`live:app:topic:${topicKey}`);
-    await topic.fetch(
-      jsonRequest('/register', {
-        streamId: 'app',
-        topic: 'post:12',
-        topicKey,
-        connectionId: 'slow-connection-0001',
-        subscriptionId: 'slow-card',
-        generation: 1,
-        revision: 1,
-        lastSeenAt: Date.now(),
-        limits: LIMITS,
-      }),
-    );
+    await register(topic, {
+      topicKey,
+      connectionId: 'slow-connection-0001',
+      subscriptionId: 'slow-card',
+    });
 
-    const connectionId = 'connection-order-001';
-    const connection = harness.stub(`live:app:connection:${connectionId}`);
-    const response = await connection.fetch(
-      jsonRequest('/connect', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-      }),
-    );
-    const reader = response.body!.getReader();
-    await readFrame(reader);
-    await connection.fetch(
-      jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-        operations: [{ kind: 'subscribe', id: 'post-card', topic: 'post:12' }],
-      }),
-    );
+    const { reader } = await connectAndSubscribe(harness, 'connection-order-001', [
+      { kind: 'subscribe', id: 'post-card', topic: 'post:12' },
+    ]);
 
     const firstPublish = harness.publish('app', 'post:12', { seq: 1 });
     await slowFirstStarted;
@@ -399,27 +340,9 @@ describe('live Durable Object runtime', () => {
 
   it('rejects oversized live events instead of reporting successful publish', async () => {
     const harness = createHarness();
-    const connectionId = 'connection-large-001';
-    const connection = harness.stub(`live:app:connection:${connectionId}`);
-    const response = await connection.fetch(
-      jsonRequest('/connect', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-      }),
-    );
-    const reader = response.body!.getReader();
-    await readFrame(reader);
-    await connection.fetch(
-      jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-        operations: [{ kind: 'subscribe', id: 'post-card', topic: 'post:12' }],
-      }),
-    );
+    const { reader } = await connectAndSubscribe(harness, 'connection-large-001', [
+      { kind: 'subscribe', id: 'post-card', topic: 'post:12' },
+    ]);
 
     const publishResponse = await harness.publish(
       'app',
@@ -449,34 +372,15 @@ describe('live Durable Object runtime', () => {
         }
       },
     });
-    const connectionId = 'connection-replace-1';
-    const connection = harness.stub(`live:app:connection:${connectionId}`);
-    const response = await connection.fetch(
-      jsonRequest('/connect', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-      }),
-    );
-    const reader = response.body!.getReader();
-    await readFrame(reader);
-    await connection.fetch(
-      jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-        operations: [{ kind: 'subscribe', id: 'post-card', topic: 'post:12' }],
-      }),
+    const { connection, message, reader } = await connectAndSubscribe(
+      harness,
+      'connection-replace-1',
+      [{ kind: 'subscribe', id: 'post-card', topic: 'post:12' }],
     );
 
     const replaceResponse = await connection.fetch(
       jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
+        ...message,
         operations: [{ kind: 'subscribe', id: 'post-card', topic: 'post:13' }],
       }),
     );
@@ -496,30 +400,13 @@ describe('live Durable Object runtime', () => {
 
   it('delivers multiple topics over one connection and unsubscribes individually', async () => {
     const harness = createHarness();
-    const connectionId = 'connection-0000000001';
-    const connection = harness.stub(`live:app:connection:${connectionId}`);
-    const response = await connection.fetch(
-      jsonRequest('/connect', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-      }),
-    );
-    const reader = response.body!.getReader();
-    await readFrame(reader);
-
-    await connection.fetch(
-      jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
-        operations: [
-          { kind: 'subscribe', id: 'post-card', topic: 'post:12' },
-          { kind: 'subscribe', id: 'comments', topic: 'comment:2323' },
-        ],
-      }),
+    const { connection, message, reader } = await connectAndSubscribe(
+      harness,
+      'connection-0000000001',
+      [
+        { kind: 'subscribe', id: 'post-card', topic: 'post:12' },
+        { kind: 'subscribe', id: 'comments', topic: 'comment:2323' },
+      ],
     );
 
     const postPublish = harness.publish('app', 'post:12', { title: 'Updated' });
@@ -541,10 +428,7 @@ describe('live Durable Object runtime', () => {
 
     await connection.fetch(
       jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits: LIMITS,
+        ...message,
         operations: [{ kind: 'unsubscribe', id: 'post-card' }],
       }),
     );
@@ -565,46 +449,24 @@ describe('live Durable Object runtime', () => {
   it('removes previous generation topic rows when a connection reconnects', async () => {
     const harness = createHarness();
     const limits = { ...LIMITS, maxSubscriptionsPerTopic: 1 };
-    const connectionId = 'connection-0000000002';
-    const connection = harness.stub(`live:app:connection:${connectionId}`);
-    const first = await connection.fetch(
-      jsonRequest('/connect', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits,
-      }),
+    const {
+      connection,
+      message,
+      reader: firstReader,
+    } = await connectAndSubscribe(
+      harness,
+      'connection-0000000002',
+      [{ kind: 'subscribe', id: 'old-card', topic: 'post:12' }],
+      limits,
     );
-    const firstReader = first.body!.getReader();
-    await readFrame(firstReader);
 
-    await connection.fetch(
-      jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits,
-        operations: [{ kind: 'subscribe', id: 'old-card', topic: 'post:12' }],
-      }),
-    );
-
-    const second = await connection.fetch(
-      jsonRequest('/connect', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits,
-      }),
-    );
+    const second = await connection.fetch(jsonRequest('/connect', message));
     const secondReader = second.body!.getReader();
     await readFrame(secondReader);
 
     const controlResponse = await connection.fetch(
       jsonRequest('/control', {
-        streamId: 'app',
-        connectionId,
-        owner: 'user:1',
-        limits,
+        ...message,
         operations: [{ kind: 'subscribe', id: 'new-card', topic: 'post:12' }],
       }),
     );
@@ -847,25 +709,47 @@ function createHarness(options?: {
   };
 }
 
+function register(
+  topic: { fetch(request: Request): Promise<Response> },
+  overrides: Record<string, unknown>,
+): Promise<Response> {
+  return topic.fetch(
+    jsonRequest('/register', {
+      streamId: 'app',
+      topic: 'post:12',
+      topicKey: 'topic-key',
+      subscriptionId: 'card',
+      generation: 1,
+      revision: 1,
+      lastSeenAt: Date.now(),
+      limits: LIMITS,
+      ...overrides,
+    }),
+  );
+}
+
 async function registerSubscribers(topic: DurableObjectStub, count: number): Promise<void> {
   for (let index = 0; index < count; index++) {
-    const response = await topic.fetch(
-      jsonRequest('/register', {
-        streamId: 'app',
-        topic: 'post:12',
-        topicKey: 'topic-key',
-        connectionId: `connection-${index}`,
-        subscriptionId: 'card',
-        generation: 1,
-        revision: 1,
-        lastSeenAt: Date.now(),
-        limits: LIMITS,
-      }),
-    );
+    const response = await register(topic, { connectionId: `connection-${index}` });
     expect(response.ok).toBe(true);
   }
 }
 
+async function connectAndSubscribe(
+  harness: ReturnType<typeof createHarness>,
+  connectionId: string,
+  operations: Array<Record<string, unknown>>,
+  limits: LiveLimits = LIMITS,
+) {
+  const connection = harness.stub(`live:app:connection:${connectionId}`);
+  const message = { streamId: 'app', connectionId, owner: 'user:1', limits };
+  const response = await connection.fetch(jsonRequest('/connect', message));
+  const reader = response.body!.getReader();
+  await readFrame(reader);
+  await connection.fetch(jsonRequest('/control', { ...message, operations }));
+  return { connection, message, reader };
+}
+
 function liveContext(env: unknown, url: string, body?: unknown): CloudContext {
   return {
     env,
diff --git a/packages/void/test/unit/login-command.test.ts b/packages/void/test/unit/login-command.test.ts
index 50bfadb13..ae23da531 100644
--- a/packages/void/test/unit/login-command.test.ts
+++ b/packages/void/test/unit/login-command.test.ts
@@ -17,10 +17,8 @@ const mockGetToken = vi.fn();
 const mockGetApiUrl = vi.fn();
 const mockGetTokenSource = vi.fn();
 const mockRemoveToken = vi.fn();
-const mockRunLogin = vi.fn();
 const mockRunPlatformLogin = vi.fn();
 const mockSavePlatformToken = vi.fn();
-const mockSaveToken = vi.fn();
 const mockWhoami = vi.fn();
 const mockIsExpiredTokenError = vi.fn();
 const mockDiscoverPlatform = vi.fn();
@@ -52,11 +50,8 @@ vi.mock('../../src/cli/auth', () => ({
   getApiUrl: (...args: Array<unknown>) => mockGetApiUrl(...args),
   getTokenSource: (...args: Array<unknown>) => mockGetTokenSource(...args),
   removeToken: (...args: Array<unknown>) => mockRemoveToken(...args),
-  runLogin: (...args: Array<unknown>) => mockRunLogin(...args),
   runPlatformLogin: (...args: Array<unknown>) => mockRunPlatformLogin(...args),
   savePlatformToken: (...args: Array<unknown>) => mockSavePlatformToken(...args),
-  saveToken: (...args: Array<unknown>) => mockSaveToken(...args),
-  isStagingMode: () => false,
 }));
 
 vi.mock('../../src/cli/platform-cmd', () => ({
@@ -88,10 +83,8 @@ beforeEach(() => {
   mockGetApiUrl.mockReset().mockReturnValue('https://api.example.test');
   mockGetTokenSource.mockReset();
   mockRemoveToken.mockReset();
-  mockRunLogin.mockReset();
   mockRunPlatformLogin.mockReset().mockResolvedValue('platform-token');
   mockSavePlatformToken.mockReset();
-  mockSaveToken.mockReset();
   mockWhoami.mockReset();
   mockIsExpiredTokenError.mockReset();
   mockDiscoverPlatform.mockReset().mockResolvedValue({
@@ -100,22 +93,20 @@ beforeEach(() => {
   });
 
   mockGetTokenSource.mockReturnValue('manual');
-  mockRunLogin.mockResolvedValue('fresh-token');
   mockSelect.mockResolvedValue('github');
   mockRemoveToken.mockReturnValue(true);
   mockIsExpiredTokenError.mockReturnValue(false);
 });
 
-describe('runLoginCommand', () => {
-  const root = '/project';
+const root = '/project';
 
+describe('promptForLoginToken', () => {
   it('logs into the explicit platform with its sole provider and scopes token storage', async () => {
     await promptForLoginToken(root, {
       apiUrl: 'https://company.example.com',
       authenticationProviders: ['github'],
     });
     expect(mockSelect).not.toHaveBeenCalled();
-    expect(mockRunLogin).not.toHaveBeenCalled();
     expect(mockRunPlatformLogin).toHaveBeenCalledWith(
       'https://company.example.com',
       'github',
@@ -125,9 +116,10 @@ describe('runLoginCommand', () => {
       'platform-token',
       'https://company.example.com',
     );
-    expect(mockSaveToken).not.toHaveBeenCalled();
   });
+});
 
+describe('runLoginCommand', () => {
   it('keeps the logout-first flow when the stored token is still valid', async () => {
     mockGetToken.mockReturnValue('existing-token');
     mockWhoami.mockResolvedValue({ login: 'cpojer', plan: 'pro' });
@@ -137,7 +129,7 @@ describe('runLoginCommand', () => {
     expect(mockWhoami).toHaveBeenCalledTimes(1);
     expect(mockWarn).toHaveBeenCalledWith('Already logged in.');
     expect(mockOutro).toHaveBeenCalledWith('To re-login, run `void account logout` first.');
-    expect(mockRunLogin).not.toHaveBeenCalled();
+    expect(mockRunPlatformLogin).not.toHaveBeenCalled();
     expect(mockRemoveToken).not.toHaveBeenCalled();
   });
 
@@ -151,8 +143,15 @@ describe('runLoginCommand', () => {
     expect(mockRemoveToken).toHaveBeenCalledTimes(1);
     expect(mockWarn).toHaveBeenCalledWith('Stored auth token expired. Starting a new login.');
     expect(mockDiscoverPlatform).toHaveBeenCalledWith('https://api.example.test');
-    expect(mockRunLogin).toHaveBeenCalledWith(root, 'github', expect.any(Function));
-    expect(mockSaveToken).toHaveBeenCalledWith('fresh-token', root);
+    expect(mockRunPlatformLogin).toHaveBeenCalledWith(
+      'https://api.example.test',
+      'github',
+      expect.any(Function),
+    );
+    expect(mockSavePlatformToken).toHaveBeenCalledWith(
+      'platform-token',
+      'https://api.example.test',
+    );
     expect(mockInfo).toHaveBeenCalledWith('Logged in!');
   });
 
@@ -169,8 +168,15 @@ describe('runLoginCommand', () => {
       '`VOID_TOKEN` is invalid or expired. Continuing with a new login.',
     );
     expect(mockDiscoverPlatform).toHaveBeenCalledWith('https://api.example.test');
-    expect(mockRunLogin).toHaveBeenCalledWith(root, 'github', expect.any(Function));
-    expect(mockSaveToken).toHaveBeenCalledWith('fresh-token', root);
+    expect(mockRunPlatformLogin).toHaveBeenCalledWith(
+      'https://api.example.test',
+      'github',
+      expect.any(Function),
+    );
+    expect(mockSavePlatformToken).toHaveBeenCalledWith(
+      'platform-token',
+      'https://api.example.test',
+    );
     expect(mockOutro).toHaveBeenCalledWith(
       `\n${pc.green('✓ Token saved. Unset `VOID_TOKEN` to use it.')}`,
       { withGuide: false },
diff --git a/packages/void/test/unit/logs-filter.test.ts b/packages/void/test/unit/logs-filter.test.ts
index d8a4b047c..3fc5587be 100644
--- a/packages/void/test/unit/logs-filter.test.ts
+++ b/packages/void/test/unit/logs-filter.test.ts
@@ -107,8 +107,6 @@ describe('filterLogEntries', () => {
   });
 
   it("--level log matches entries whose log line has no level (printEntry renders those as '[log]')", () => {
-    // `printEntry` falls back to 'log' for nullish levels; the filter must
-    // do the same so that `--level log` matches what the renderer shows.
     const E_NULLISH_LEVEL = entry({
       // Cast covers the user-DTO case where `level` is missing or undefined.
       logs: [
@@ -129,10 +127,7 @@ describe('filterLogEntries', () => {
     expect(filterLogEntries([E_OK, E_EXCEPTION], undefined, 'TypeError')).toEqual([E_EXCEPTION]);
   });
 
-  it('substring filter "error" no longer conflates levels — only matches messages containing the literal word', () => {
-    // Older behavior: --filter error would match every error-level line because
-    // "[error]" appeared in renderings. The new --filter is a clean substring
-    // search over the raw message text and exception name/message.
+  it('substring filter "error" matches message text, not the log level', () => {
     const errorWordEntry = entry({
       logs: [{ level: 'info', message: ['this is an error in the message'], timestamp: 0 }],
     });
@@ -141,18 +136,30 @@ describe('filterLogEntries', () => {
       undefined,
       'error',
     );
-    // E_ERROR_LOG message is "boom" — no literal "error" substring, so it's filtered out.
-    // Only entries whose text literally contains "error" come through.
     expect(result).toEqual([errorWordEntry]);
   });
 
   it('--level error AND --filter websocket: ANDs both conditions', () => {
     const result = filterLogEntries([E_OK, E_ERROR_LOG, E_MIXED, E_INFO_LOG], 'error', 'websocket');
-    // Only E_MIXED has both an error-level log AND a "websocket" substring.
     expect(result).toEqual([E_MIXED]);
   });
 });
 
+function setFetchMock() {
+  const fetchMock: ReturnType<typeof vi.fn> = vi.fn(async () => Response.json({ data: [] }));
+  globalThis.fetch = withPlatformDiscovery(fetchMock);
+  return fetchMock;
+}
+
+/** The API request URL; the platform discovery request never reaches the mock. */
+function requestUrl(fetchMock: ReturnType<typeof vi.fn>): string {
+  const call = fetchMock.mock.calls[0];
+  if (!call) {
+    throw new Error('fetch was not called');
+  }
+  return String(call[0]);
+}
+
 describe('PlatformClient.getLogs URL', () => {
   const originalFetch = globalThis.fetch;
 
@@ -161,27 +168,12 @@ describe('PlatformClient.getLogs URL', () => {
     vi.restoreAllMocks();
   });
 
-  function setFetchMock() {
-    const fetchMock: ReturnType<typeof vi.fn> = vi.fn(async () => Response.json({ data: [] }));
-    globalThis.fetch = withPlatformDiscovery(fetchMock);
-    return fetchMock;
-  }
-
-  function lastUrl(fetchMock: ReturnType<typeof vi.fn>): string {
-    const calls = fetchMock.mock.calls as Array<Array<unknown>>;
-    if (calls.length === 0) {
-      throw new Error('fetch was not called');
-    }
-    const first = calls[0]?.[0];
-    return String(first);
-  }
-
   it('omits level when not provided', async () => {
     const fetchMock = setFetchMock();
     const client = new PlatformClient('tok', { apiUrl: 'http://localhost:1234' });
     await client.getLogs('proj_1', '1h');
 
-    const url = lastUrl(fetchMock);
+    const url = requestUrl(fetchMock);
     expect(url).toContain('since=1h');
     expect(url).not.toContain('level=');
   });
@@ -191,7 +183,7 @@ describe('PlatformClient.getLogs URL', () => {
     const client = new PlatformClient('tok', { apiUrl: 'http://localhost:1234' });
     await client.getLogs('proj_1', '1h', 200, undefined, 'all');
 
-    expect(lastUrl(fetchMock)).not.toContain('level=');
+    expect(requestUrl(fetchMock)).not.toContain('level=');
   });
 
   it("appends level=error when level === 'error'", async () => {
@@ -199,7 +191,7 @@ describe('PlatformClient.getLogs URL', () => {
     const client = new PlatformClient('tok', { apiUrl: 'http://localhost:1234' });
     await client.getLogs('proj_1', '1h', 200, undefined, 'error');
 
-    expect(lastUrl(fetchMock)).toContain('level=error');
+    expect(requestUrl(fetchMock)).toContain('level=error');
   });
 
   it('serializes deploymentId and level together', async () => {
@@ -207,7 +199,7 @@ describe('PlatformClient.getLogs URL', () => {
     const client = new PlatformClient('tok', { apiUrl: 'http://localhost:1234' });
     await client.getLogs('proj_1', '1h', 200, 'dpl_abc', 'warn');
 
-    const url = lastUrl(fetchMock);
+    const url = requestUrl(fetchMock);
     expect(url).toContain('deploymentId=dpl_abc');
     expect(url).toContain('level=warn');
   });
@@ -221,26 +213,12 @@ describe('PlatformClient.getRequests URL', () => {
     vi.restoreAllMocks();
   });
 
-  function setFetchMock() {
-    const fetchMock: ReturnType<typeof vi.fn> = vi.fn(async () => Response.json({ data: [] }));
-    globalThis.fetch = withPlatformDiscovery(fetchMock);
-    return fetchMock;
-  }
-
-  function lastUrl(fetchMock: ReturnType<typeof vi.fn>): string {
-    const calls = fetchMock.mock.calls as Array<Array<unknown>>;
-    if (calls.length === 0) {
-      throw new Error('fetch was not called');
-    }
-    return String(calls[0]?.[0]);
-  }
-
   it('hits the /requests endpoint with since and limit, omitting status by default', async () => {
     const fetchMock = setFetchMock();
     const client = new PlatformClient('tok', { apiUrl: 'http://localhost:1234' });
     await client.getRequests('proj_1', '12h');
 
-    const url = lastUrl(fetchMock);
+    const url = requestUrl(fetchMock);
     expect(url).toContain('/projects/proj_1/requests?');
     expect(url).toContain('since=12h');
     expect(url).toContain('limit=200');
@@ -252,7 +230,7 @@ describe('PlatformClient.getRequests URL', () => {
     const client = new PlatformClient('tok', { apiUrl: 'http://localhost:1234' });
     await client.getRequests('proj_1', '1h', 200, 'all');
 
-    expect(lastUrl(fetchMock)).not.toContain('status=');
+    expect(requestUrl(fetchMock)).not.toContain('status=');
   });
 
   it('appends a status class filter', async () => {
@@ -260,6 +238,6 @@ describe('PlatformClient.getRequests URL', () => {
     const client = new PlatformClient('tok', { apiUrl: 'http://localhost:1234' });
     await client.getRequests('proj_1', '1h', 200, '5xx');
 
-    expect(lastUrl(fetchMock)).toContain('status=5xx');
+    expect(requestUrl(fetchMock)).toContain('status=5xx');
   });
 });
diff --git a/packages/void/test/unit/logs-rendering.test.ts b/packages/void/test/unit/logs-rendering.test.ts
index 629474ccf..da95e9ec1 100644
--- a/packages/void/test/unit/logs-rendering.test.ts
+++ b/packages/void/test/unit/logs-rendering.test.ts
@@ -63,7 +63,8 @@ afterEach(() => {
   vi.restoreAllMocks();
 });
 
-it.each([40, 80])('aligns wrapped log messages and exceptions at %i columns', async (columns) => {
+/** Runs `void logs` with a stdout of the given width and returns the printed lines. */
+async function printLogs(columns: number): Promise<Array<string>> {
   const output = Object.assign(
     new Writable({
       write(_chunk, _encoding, callback) {
@@ -75,9 +76,15 @@ it.each([40, 80])('aligns wrapped log messages and exceptions at %i columns', as
   vi.spyOn(process, 'stdout', 'get').mockReturnValue(output as typeof process.stdout);
   const print = vi.spyOn(console, 'log').mockImplementation(() => {});
   await runLogsCommand('/fixture', '', '1h');
+  return print.mock.calls.map((args) => String(args[0] ?? ''));
+}
+
+const UNSAFE_SEQUENCES = ['\x1b]', '\x1b[2J', '\r', '\x07', '\u009b'];
+
+it.each([40, 80])('aligns wrapped log messages and exceptions at %i columns', async (columns) => {
+  const messages = await printLogs(columns);
   expect(intro).not.toHaveBeenCalled();
   expect(stripVTControlCharacters(vi.mocked(outro).mock.calls.at(-1)![0]!)).toBe('1 log entry');
-  const messages = print.mock.calls.map((args) => String(args[0] ?? ''));
   const warn = messages.find((line) => line.includes('[warn]'))!;
   const error = messages.find((line) => line.includes('[error]'))!;
   const exception = messages.find((line) => line.includes('[exception]'))!;
@@ -118,28 +125,16 @@ it('drops terminal control sequences from app log text but keeps colors and line
       ],
     },
   ];
-  const output = Object.assign(
-    new Writable({
-      write(_chunk, _encoding, callback) {
-        callback();
-      },
-    }),
-    { columns: 120 },
-  );
-  vi.spyOn(process, 'stdout', 'get').mockReturnValue(output as typeof process.stdout);
-  const print = vi.spyOn(console, 'log').mockImplementation(() => {});
-  await runLogsCommand('/fixture', '', '1h');
+  const messages = await printLogs(120);
 
-  const printed = print.mock.calls.map((args) => String(args[0] ?? '')).join('\n');
-  for (const unsafe of ['\x1b]', '\x1b[2J', '\r', '\x07', '\u009b']) {
+  const printed = messages.join('\n');
+  for (const unsafe of UNSAFE_SEQUENCES) {
     expect(printed).not.toContain(unsafe);
   }
   expect(printed).toContain('\x1b[31mred');
   expect(printed).not.toContain('evil.example');
   expect(printed).toContain('Error: see click then 2J');
-  const error = print.mock.calls
-    .map((args) => String(args[0] ?? ''))
-    .find((line) => line.includes('[error]'))!;
+  const error = messages.find((line) => line.includes('[error]'))!;
   expect(stripVTControlCharacters(error).split('\n')).toEqual(['  [error] abc', '          red']);
 });
 
@@ -155,21 +150,9 @@ it('ends app log text with a reset so its styles cannot hide the next printed li
       exceptions: [{ name: 'Error', message: 'x\x1b[7;30;40m' }],
     },
   ];
-  const output = Object.assign(
-    new Writable({
-      write(_chunk, _encoding, callback) {
-        callback();
-      },
-    }),
-    { columns: 120 },
+  const styled = (await printLogs(120)).filter(
+    (line) => line.includes('\x1b[8m') || line.includes('\x1b[7;30;40m'),
   );
-  vi.spyOn(process, 'stdout', 'get').mockReturnValue(output as typeof process.stdout);
-  const print = vi.spyOn(console, 'log').mockImplementation(() => {});
-  await runLogsCommand('/fixture', '', '1h');
-
-  const styled = print.mock.calls
-    .map((args) => String(args[0] ?? ''))
-    .filter((line) => line.includes('\x1b[8m') || line.includes('\x1b[7;30;40m'));
   expect(styled).toHaveLength(3);
   for (const line of styled) {
     expect(line.lastIndexOf('\x1b[0m')).toBeGreaterThan(
@@ -253,18 +236,7 @@ it('prints stack frames under the error that logged them', async () => {
       ],
     },
   ];
-  const output = Object.assign(
-    new Writable({
-      write(_chunk, _encoding, callback) {
-        callback();
-      },
-    }),
-    { columns: 120 },
-  );
-  vi.spyOn(process, 'stdout', 'get').mockReturnValue(output as typeof process.stdout);
-  const print = vi.spyOn(console, 'log').mockImplementation(() => {});
-  await runLogsCommand('/fixture', '', '1h');
-  const messages = print.mock.calls.map((args) => String(args[0] ?? ''));
+  const messages = await printLogs(120);
   const header = messages.findIndex((line) => line.includes('/sponsors.svg'));
   expect(header).toBeGreaterThanOrEqual(0);
   expect(
@@ -318,20 +290,8 @@ it('drops terminal control sequences from stack frames', async () => {
       ],
     },
   ];
-  const output = Object.assign(
-    new Writable({
-      write(_chunk, _encoding, callback) {
-        callback();
-      },
-    }),
-    { columns: 120 },
-  );
-  vi.spyOn(process, 'stdout', 'get').mockReturnValue(output as typeof process.stdout);
-  const print = vi.spyOn(console, 'log').mockImplementation(() => {});
-  await runLogsCommand('/fixture', '', '1h');
-
-  const printed = print.mock.calls.map((args) => String(args[0] ?? '')).join('\n');
-  for (const unsafe of ['\x1b]', '\x1b[2J', '\r', '\x07', '\u009b']) {
+  const printed = (await printLogs(120)).join('\n');
+  for (const unsafe of UNSAFE_SEQUENCES) {
     expect(printed).not.toContain(unsafe);
   }
   expect(printed).not.toContain('evil.example');
diff --git a/packages/void/test/unit/migration-binding-consistency.test.ts b/packages/void/test/unit/migration-binding-consistency.test.ts
index 83d322f02..8337d9dd7 100644
--- a/packages/void/test/unit/migration-binding-consistency.test.ts
+++ b/packages/void/test/unit/migration-binding-consistency.test.ts
@@ -1,20 +1,13 @@
-import { mkdirSync, writeFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { describe, it, expect, beforeEach, afterEach } from 'vite-plus/test';
+import { describe, it, expect } from 'vite-plus/test';
 import { buildVoidManifest, buildFrameworkManifest } from '../../src/cli/package.ts';
-import { inferBindingsFromSource, mergeBindings } from '../../src/inference/walk.ts';
 import type { InferredBindings } from '../../src/inference/walk.ts';
-import { collectMigrations } from '../../src/migrations/collect.ts';
 import { buildMigrationPlanBundle } from '../../src/migrations/plan.ts';
-import { validateMigrations } from '../../src/migrations/validate.ts';
 import type { MigrationFile } from '../../src/migrations/validate.ts';
 import {
   createMigrationHandler,
   type MigrationResponse,
 } from '../../src/runtime/migration-handler.ts';
 
-const TMP = join(import.meta.dirname, '.tmp-migration-binding-test');
-
 const noBindings: InferredBindings = {
   needsD1: false,
   needsKV: false,
@@ -33,18 +26,6 @@ const sampleMigrations: Array<MigrationFile> = [
   },
 ];
 
-beforeEach(() => {
-  mkdirSync(TMP, { recursive: true });
-});
-
-afterEach(() => {
-  rmSync(TMP, { recursive: true, force: true });
-});
-
-// ---------------------------------------------------------------------------
-// buildVoidManifest: migration ↔ binding consistency
-// ---------------------------------------------------------------------------
-
 describe('buildVoidManifest migration-binding consistency', () => {
   it('includes both d1 binding and migrations when needsD1 is true', () => {
     const manifest = buildVoidManifest({
@@ -122,41 +103,6 @@ describe('buildVoidManifest migration-binding consistency', () => {
     expect(manifest.migrations).toBeUndefined();
   });
 
-  it('includes d1 binding when auth forces needsD1 even without explicit D1 usage', () => {
-    const manifest = buildVoidManifest({
-      bindings: { ...noBindings, needsAuth: true },
-      migrations: sampleMigrations,
-    });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 1 }));
-  });
-
-  it('forces d1 binding when multiple migrations exist without D1 usage', () => {
-    const migrations: Array<MigrationFile> = [
-      {
-        name: '0001_create_users.sql',
-        sql: 'CREATE TABLE users (id INTEGER PRIMARY KEY);',
-        destructive: false,
-      },
-      {
-        name: '0002_create_posts.sql',
-        sql: 'CREATE TABLE posts (id INTEGER PRIMARY KEY);',
-        destructive: false,
-      },
-      {
-        name: '0003_add_email.sql',
-        sql: 'ALTER TABLE users ADD COLUMN email TEXT;',
-        destructive: false,
-      },
-    ];
-
-    const manifest = buildVoidManifest({ bindings: noBindings, migrations });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 3 }));
-  });
-
   it('uses custom d1 binding name when provided', () => {
     const manifest = buildVoidManifest({
       bindings: { ...noBindings, needsD1: true },
@@ -168,10 +114,6 @@ describe('buildVoidManifest migration-binding consistency', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// buildVoidManifest: postgresql / hyperdrive variant
-// ---------------------------------------------------------------------------
-
 describe('buildVoidManifest postgresql migration-binding consistency', () => {
   it('forces hyperdrive binding when migrations exist with postgresql dialect and needsD1 is false', () => {
     const manifest = buildVoidManifest({
@@ -185,24 +127,8 @@ describe('buildVoidManifest postgresql migration-binding consistency', () => {
     expect(manifest.bindings.d1).toBeUndefined();
     expect(manifest.migrations).toEqual({ dialect: 'postgresql', pending: 1 });
   });
-
-  it('includes both hyperdrive binding and migrations when needsD1 is true with postgresql dialect', () => {
-    const manifest = buildVoidManifest({
-      bindings: { ...noBindings, needsD1: true },
-      migrations: sampleMigrations,
-      dialect: 'postgresql',
-    });
-
-    expect(manifest.bindings.hyperdrive).toEqual(['HYPERDRIVE']);
-    expect(manifest.bindings.d1).toBeUndefined();
-    expect(manifest.migrations).toEqual({ dialect: 'postgresql', pending: 1 });
-  });
 });
 
-// ---------------------------------------------------------------------------
-// buildFrameworkManifest: same consistency requirement
-// ---------------------------------------------------------------------------
-
 describe('buildFrameworkManifest migration-binding consistency', () => {
   it('forces d1 binding when migrations exist even if needsD1 is false', () => {
     const manifest = buildFrameworkManifest({
@@ -216,30 +142,6 @@ describe('buildFrameworkManifest migration-binding consistency', () => {
     expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 1 }));
   });
 
-  it('includes both d1 binding and migrations when needsD1 is true', () => {
-    const manifest = buildFrameworkManifest({
-      frameworkName: 'nuxt',
-      workerMain: 'index.js',
-      bindings: { ...noBindings, needsD1: true },
-      migrations: sampleMigrations,
-    });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 1 }));
-  });
-
-  it('includes d1 binding via auth even without explicit D1 usage', () => {
-    const manifest = buildFrameworkManifest({
-      frameworkName: 'nuxt',
-      workerMain: 'index.js',
-      bindings: { ...noBindings, needsAuth: true },
-      migrations: sampleMigrations,
-    });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 1 }));
-  });
-
   it('forces hyperdrive binding when postgresql migrations exist with needsD1 false', () => {
     const manifest = buildFrameworkManifest({
       frameworkName: 'nuxt',
@@ -253,22 +155,8 @@ describe('buildFrameworkManifest migration-binding consistency', () => {
     expect(manifest.bindings.d1).toBeUndefined();
     expect(manifest.migrations).toEqual({ dialect: 'postgresql', pending: 1 });
   });
-
-  it('rejects live bindings because framework workers do not export the live durable object', () => {
-    expect(() =>
-      buildFrameworkManifest({
-        frameworkName: 'nuxt',
-        workerMain: 'index.js',
-        bindings: { ...noBindings, needsLive: true },
-      }),
-    ).toThrow('void/live is currently supported in Void apps only');
-  });
 });
 
-// ---------------------------------------------------------------------------
-// createMigrationHandler: behavior when D1 binding is missing
-// ---------------------------------------------------------------------------
-
 describe('createMigrationHandler with missing D1 binding', () => {
   const proxyToken = 'test-token-123';
 
@@ -280,11 +168,7 @@ describe('createMigrationHandler with missing D1 binding', () => {
   }
 
   it('returns error when env.DB is undefined', async () => {
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken },
-      sampleMigrations,
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken }, sampleMigrations);
 
     const response = await handler(makeRequest());
     const body = (await response.json()) as MigrationResponse;
@@ -299,7 +183,6 @@ describe('createMigrationHandler with missing D1 binding', () => {
     const handler = createMigrationHandler(
       { __VOID_PROXY_TOKEN: proxyToken, DB: null },
       sampleMigrations,
-      'sqlite',
     );
 
     const response = await handler(makeRequest());
@@ -311,11 +194,7 @@ describe('createMigrationHandler with missing D1 binding', () => {
   });
 
   it('rejects requests with wrong proxy token', async () => {
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken },
-      sampleMigrations,
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken }, sampleMigrations);
 
     const badRequest = new Request('https://example.com/__void/migrate', {
       method: 'POST',
@@ -330,11 +209,7 @@ describe('createMigrationHandler with missing D1 binding', () => {
   });
 
   it('rejects requests with no proxy token', async () => {
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken },
-      sampleMigrations,
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken }, sampleMigrations);
 
     const noAuthRequest = new Request('https://example.com/__void/migrate', {
       method: 'POST',
@@ -348,7 +223,6 @@ describe('createMigrationHandler D1 execution', () => {
   const proxyToken = 'test-token-123';
 
   function createMockD1(options?: {
-    attempts?: Map<string, Record<string, unknown>>;
     failExec?: (sql: string) => Error | undefined;
     lockAttemptId?: string;
   }) {
@@ -359,7 +233,7 @@ describe('createMigrationHandler D1 execution', () => {
       run: [] as Array<string>,
     };
     const applied = new Set<string>();
-    const attempts = new Map(options?.attempts ?? []);
+    const attempts = new Map<string, Record<string, unknown>>();
     let lockAttemptId = options?.lockAttemptId;
 
     const db = {
@@ -459,7 +333,6 @@ describe('createMigrationHandler D1 execution', () => {
     };
 
     return {
-      attempts,
       calls,
       db: db as unknown as D1Database,
       getLockAttemptId: () => lockAttemptId,
@@ -475,11 +348,9 @@ describe('createMigrationHandler D1 execution', () => {
           ? new Error('D1_EXEC_ERROR: Error in line 1: CREATE TABLE notes (: incomplete input')
           : undefined,
     });
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken, DB: db },
-      [{ name: '0001_semicolon.sql', sql }],
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken, DB: db }, [
+      { name: '0001_semicolon.sql', sql },
+    ]);
 
     const response = await handler(
       new Request('https://example.com/__void/migrate', {
@@ -512,11 +383,9 @@ describe('createMigrationHandler D1 execution', () => {
       'END;',
     ].join('\n');
     const { calls, db } = createMockD1();
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken, DB: db },
-      [{ name: '0001_trigger.sql', sql }],
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken, DB: db }, [
+      { name: '0001_trigger.sql', sql },
+    ]);
 
     const response = await handler(
       new Request('https://example.com/__void/migrate', {
@@ -545,7 +414,6 @@ describe('createMigrationHandler D1 execution', () => {
     const handler = createMigrationHandler(
       { __VOID_PROXY_TOKEN: proxyToken, DB: db },
       migrations,
-      'sqlite',
       undefined,
       buildMigrationPlanBundle(migrations),
     );
@@ -583,11 +451,9 @@ describe('createMigrationHandler D1 execution', () => {
           ? new Error('D1_EXEC_ERROR: Error in line 1: CREATE TABLE `posts` (: incomplete input')
           : undefined,
     });
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken, DB: db },
-      [{ name: '0000_generated.sql', sql }],
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken, DB: db }, [
+      { name: '0000_generated.sql', sql },
+    ]);
 
     const response = await handler(
       new Request('https://example.com/__void/migrate', {
@@ -626,11 +492,9 @@ describe('createMigrationHandler D1 execution', () => {
       ');',
     ].join('\n');
     const { calls, db } = createMockD1();
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken, DB: db },
-      [{ name: '0001_drizzle.sql', sql }],
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken, DB: db }, [
+      { name: '0001_drizzle.sql', sql },
+    ]);
 
     const response = await handler(
       new Request('https://example.com/__void/migrate', {
@@ -668,11 +532,9 @@ describe('createMigrationHandler D1 execution', () => {
       '/* --> statement-breakpoint */',
     ].join('\n');
     const { calls, db } = createMockD1();
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken, DB: db },
-      [{ name: '0001_literal_marker.sql', sql }],
-      'sqlite',
-    );
+    const handler = createMigrationHandler({ __VOID_PROXY_TOKEN: proxyToken, DB: db }, [
+      { name: '0001_literal_marker.sql', sql },
+    ]);
 
     const response = await handler(
       new Request('https://example.com/__void/migrate', {
@@ -705,7 +567,6 @@ describe('createMigrationHandler D1 execution', () => {
     const handler = createMigrationHandler(
       { __VOID_PROXY_TOKEN: proxyToken, DB: db },
       migrations,
-      'sqlite',
       undefined,
       buildMigrationPlanBundle(migrations),
     );
@@ -732,74 +593,12 @@ describe('createMigrationHandler D1 execution', () => {
     ]);
   });
 
-  it('retains an incomplete lock owned by an older executor without fencing', async () => {
-    const attempts = new Map<string, Record<string, unknown>>([
-      [
-        'attempt_old',
-        {
-          attempt_id: 'attempt_old',
-          completed_at: null,
-          deployment_id: 'dpl_old',
-          error: null,
-          migration_list_hash: 'sha256:old',
-          plan_hashes_json: '[]',
-          planned_names_json: JSON.stringify(['0001_users.sql']),
-          started_at: new Date().toISOString(),
-          status: 'running',
-        },
-      ],
-    ]);
-    const {
-      attempts: storedAttempts,
-      db,
-      getLockAttemptId,
-    } = createMockD1({
-      attempts,
-      lockAttemptId: 'attempt_old',
-    });
-    const migrations: Array<MigrationFile> = [];
-    const handler = createMigrationHandler(
-      { __VOID_PROXY_TOKEN: proxyToken, DB: db },
-      migrations,
-      'sqlite',
-      undefined,
-      buildMigrationPlanBundle(migrations),
-    );
-
-    const reconcile = await handler(
-      new Request('https://example.com/__void/migrate/app/attempt/attempt_old', {
-        headers: { 'x-void-internal': proxyToken },
-      }),
-    );
-    const reconcileBody = (await reconcile.json()) as MigrationResponse;
-
-    expect(reconcile.status).toBe(409);
-    expect(reconcileBody.ok).toBe(false);
-    expect(reconcileBody.error).toContain(
-      'wait for this migration to finish before retrying recovery',
-    );
-    expect(storedAttempts.get('attempt_old')?.status).toBe('running');
-    expect(getLockAttemptId()).toBe('attempt_old');
-
-    const retry = await handler(
-      new Request('https://example.com/__void/migrate/app', {
-        body: JSON.stringify({ attemptId: 'attempt_new', deploymentId: 'dpl_new' }),
-        headers: { 'content-type': 'application/json', 'x-void-internal': proxyToken },
-        method: 'POST',
-      }),
-    );
-    const retryBody = (await retry.json()) as MigrationResponse;
-    expect(retry.status).toBe(409);
-    expect(retryBody.ok).toBe(false);
-  });
-
   it('does not steal a lock when an older executor has not published its attempt', async () => {
     const migrations: Array<MigrationFile> = [];
     const { db, getLockAttemptId } = createMockD1({ lockAttemptId: 'attempt_orphan' });
     const handler = createMigrationHandler(
       { __VOID_PROXY_TOKEN: proxyToken, DB: db },
       migrations,
-      'sqlite',
       undefined,
       buildMigrationPlanBundle(migrations),
     );
@@ -818,150 +617,3 @@ describe('createMigrationHandler D1 execution', () => {
     expect(getLockAttemptId()).toBe('attempt_orphan');
   });
 });
-
-// ---------------------------------------------------------------------------
-// End-to-end: collectMigrations + inference + buildVoidManifest
-// ---------------------------------------------------------------------------
-
-describe('end-to-end: D1 removed but migrations remain on disk', () => {
-  it('forces d1 binding when user removes D1 usage but keeps migration files', () => {
-    // Source code has no void/db imports or env.DB usage
-    const sourceCode = `export const GET = defineHandler(() => ({ message: "hello" }));`;
-    const bindings = inferBindingsFromSource(sourceCode, 'hello.ts');
-    expect(bindings.needsD1).toBe(false);
-
-    // But old migration files still exist on disk
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(migrationsDir, { recursive: true });
-    writeFileSync(
-      join(migrationsDir, '0001_create_users.sql'),
-      'CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT);',
-    );
-    const rawMigrations = collectMigrations(migrationsDir);
-    expect(rawMigrations).toHaveLength(1);
-    const validatedMigrations = validateMigrations(rawMigrations);
-
-    const manifest = buildVoidManifest({ bindings, migrations: validatedMigrations });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 1 }));
-  });
-
-  it('works correctly when D1 usage is still present', () => {
-    const sourceCode = `
-      import { db } from "void/db";
-      export const GET = defineHandler(async () => {
-        return db.select().from("users");
-      });
-    `;
-    const bindings = inferBindingsFromSource(sourceCode, 'users.ts');
-    expect(bindings.needsD1).toBe(true);
-
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(migrationsDir, { recursive: true });
-    writeFileSync(
-      join(migrationsDir, '0001_create_users.sql'),
-      'CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT);',
-    );
-    const validatedMigrations = validateMigrations(collectMigrations(migrationsDir));
-
-    const manifest = buildVoidManifest({ bindings, migrations: validatedMigrations });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 1 }));
-  });
-
-  it('produces clean manifest when both D1 and migrations are removed', () => {
-    const sourceCode = `export const GET = defineHandler(() => ({ ok: true }));`;
-    const bindings = inferBindingsFromSource(sourceCode, 'health.ts');
-
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    const rawMigrations = collectMigrations(migrationsDir);
-    expect(rawMigrations).toHaveLength(0);
-
-    const manifest = buildVoidManifest({ bindings });
-
-    expect(manifest.migrations).toBeUndefined();
-    expect(manifest.bindings.d1).toBeUndefined();
-  });
-
-  it('forces d1 binding when multiple old migrations remain after removing env.DB', () => {
-    const sourceCode = `
-      export const GET = defineHandler(async (c) => {
-        const data = await fetch("https://api.example.com/users");
-        return c.json(await data.json());
-      });
-    `;
-    const bindings = inferBindingsFromSource(sourceCode, 'users.ts');
-    expect(bindings.needsD1).toBe(false);
-
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(migrationsDir, { recursive: true });
-    writeFileSync(
-      join(migrationsDir, '0001_create_users.sql'),
-      'CREATE TABLE users (id INTEGER PRIMARY KEY);',
-    );
-    writeFileSync(
-      join(migrationsDir, '0002_add_email.sql'),
-      'ALTER TABLE users ADD COLUMN email TEXT;',
-    );
-    const validatedMigrations = validateMigrations(collectMigrations(migrationsDir));
-
-    const manifest = buildVoidManifest({ bindings, migrations: validatedMigrations });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations).toEqual(expect.objectContaining({ dialect: 'sqlite', pending: 2 }));
-  });
-
-  it('auth-enabled project with leftover migrations stays consistent', () => {
-    const authSource = `import { auth } from "void/client"; await auth.signOut();`;
-    const routeSource = `export const GET = defineHandler(() => ({ ok: true }));`;
-    const merged = mergeBindings([
-      inferBindingsFromSource(authSource, 'auth.ts'),
-      inferBindingsFromSource(routeSource, 'health.ts'),
-    ]);
-    expect(merged.needsAuth).toBe(true);
-    expect(merged.needsD1).toBe(false);
-
-    // Simulate deploy.ts behavior: auth forces needsD1
-    const effectiveBindings =
-      merged.needsAuth && !merged.needsD1 ? { ...merged, needsD1: true } : merged;
-
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(migrationsDir, { recursive: true });
-    writeFileSync(
-      join(migrationsDir, '0001_auth_tables.sql'),
-      'CREATE TABLE auth_users (id TEXT PRIMARY KEY);',
-    );
-    const validatedMigrations = validateMigrations(collectMigrations(migrationsDir));
-
-    const manifest = buildVoidManifest({
-      bindings: effectiveBindings,
-      migrations: validatedMigrations,
-    });
-
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations!.pending).toBe(1);
-  });
-
-  it('forces d1 binding for non-auth project with leftover migrations', () => {
-    const routeSource = `export const GET = defineHandler(() => ({ ok: true }));`;
-    const bindings = inferBindingsFromSource(routeSource, 'health.ts');
-    expect(bindings.needsD1).toBe(false);
-    expect(bindings.needsAuth).toBe(false);
-
-    const migrationsDir = join(TMP, 'db', 'migrations');
-    mkdirSync(migrationsDir, { recursive: true });
-    writeFileSync(
-      join(migrationsDir, '0001_create_users.sql'),
-      'CREATE TABLE users (id INTEGER PRIMARY KEY);',
-    );
-    const validatedMigrations = validateMigrations(collectMigrations(migrationsDir));
-
-    const manifest = buildVoidManifest({ bindings, migrations: validatedMigrations });
-
-    // Migrations should force the d1 binding even without auth or D1 imports
-    expect(manifest.bindings.d1).toEqual(['DB']);
-    expect(manifest.migrations!.pending).toBe(1);
-  });
-});
diff --git a/packages/void/test/unit/migration-concurrency.test.ts b/packages/void/test/unit/migration-concurrency.test.ts
index bf774fc07..2936807d2 100644
--- a/packages/void/test/unit/migration-concurrency.test.ts
+++ b/packages/void/test/unit/migration-concurrency.test.ts
@@ -88,7 +88,6 @@ function createDatabase(
     createMigrationHandler(
       { DB: db, __VOID_PROXY_TOKEN: 'test-token' },
       migrations,
-      'sqlite',
       undefined,
       buildMigrationPlanBundle(migrations),
     );
@@ -170,6 +169,11 @@ describe('D1 migration ownership', () => {
       expect(recovered.error).toContain(
         'wait for this migration to finish before retrying recovery',
       );
+      expect(
+        sqlite
+          .prepare("SELECT status FROM _void_migration_attempts WHERE attempt_id = 'legacy'")
+          .get()?.status,
+      ).toBe('running');
       expect((await handler([])(apply('contender'))).status).toBe(409);
     } finally {
       resume.resolve();
diff --git a/packages/void/test/unit/operator-cli.test.ts b/packages/void/test/unit/operator-cli.test.ts
index 42797cf57..0fd36cc8b 100644
--- a/packages/void/test/unit/operator-cli.test.ts
+++ b/packages/void/test/unit/operator-cli.test.ts
@@ -367,7 +367,6 @@ describe('operator argument and help coverage', () => {
       body: { cursor: 'opaque-cursor' },
       plan: true,
     });
-    expect(hasHelpPage(['platform', 'deployment', 'migrate-assets'])).toBe(true);
     expect(() =>
       parseOperatorArgs(['deployment', 'migrate-assets', 'id', '--plan', '--yes']),
     ).toThrow('--plan and --yes cannot be combined');
@@ -397,9 +396,8 @@ describe('operator argument and help coverage', () => {
     expect(() => parseOperatorArgs(['system', 'sandbox-drain', '--all'])).toThrow(
       "Unknown flag '--all'",
     );
-    expect(hasHelpPage(['platform', 'system', 'rotate-proxy-tokens'])).toBe(true);
   });
-  it('routes asset migration inventory with bounded pagination and nested help', () => {
+  it('routes asset migration inventory with bounded pagination', () => {
     expect(
       parsePlatformArgs(['system', 'asset-migrations', '--page', '2', '--limit', '100']),
     ).toMatchObject({
@@ -408,7 +406,6 @@ describe('operator argument and help coverage', () => {
       query: { page: '2', limit: '100' },
       body: {},
     });
-    expect(hasHelpPage(['platform', 'system', 'asset-migrations'])).toBe(true);
     expect(() => parseOperatorArgs(['system', 'asset-migrations', '--limit', '101'])).toThrow(
       '--limit must be an integer from 1 to 100',
     );
@@ -465,7 +462,7 @@ describe('operator argument and help coverage', () => {
       },
     });
   });
-  it('routes the email domain verbs', () => {
+  it('pages shared recipient inspection', () => {
     expect(
       parseOperatorArgs([
         'email',
@@ -482,6 +479,8 @@ describe('operator argument and help coverage', () => {
       path: '/email/shared-recipients',
       query: { project: 'app', page: '2', limit: '10' },
     });
+  });
+  it('routes the email domain verbs', () => {
     expect(
       parseOperatorArgs([
         'email',
@@ -546,9 +545,15 @@ describe('operator argument and help coverage', () => {
       tokenStdin: true,
       yes: true,
     });
-    expect(() => parseOperatorArgs(['email', 'domain-remove', 'x', '--force'])).toThrow();
-    expect(() => parseOperatorArgs(['email', 'domain-sync', 'x', '--force'])).toThrow();
-    expect(() => parseOperatorArgs(['email', 'domain-add', 'x', '--force'])).toThrow();
+    expect(() => parseOperatorArgs(['email', 'domain-remove', 'x', '--force'])).toThrow(
+      "Unknown flag '--force'",
+    );
+    expect(() => parseOperatorArgs(['email', 'domain-sync', 'x', '--force'])).toThrow(
+      "Unknown flag '--force'",
+    );
+    expect(() => parseOperatorArgs(['email', 'domain-add', 'x', '--force'])).toThrow(
+      "Unknown flag '--force'",
+    );
   });
   it.each([
     ['user', 'list', '--limit', '101'],
diff --git a/packages/void/test/unit/package.test.ts b/packages/void/test/unit/package.test.ts
index 21d95f754..6d8158aff 100644
--- a/packages/void/test/unit/package.test.ts
+++ b/packages/void/test/unit/package.test.ts
@@ -10,13 +10,23 @@ import {
   collectWorkerFiles,
   resolveSpaFallbackChain,
 } from '../../src/cli/package.ts';
-import type { VoidConfig } from '../../src/config.ts';
 import type { InferredBindings } from '../../src/inference/walk.ts';
-import { collectRevalidate } from '../../src/isr-config.ts';
-import type { PageDefinition, PageScanResult } from '../../src/pages/types.ts';
 
 const TMP = join(import.meta.dirname, '.tmp-package-test');
 
+function makeBindings(overrides: Partial<InferredBindings> = {}): InferredBindings {
+  return {
+    needsD1: false,
+    needsKV: false,
+    needsR2: false,
+    needsAuth: false,
+    needsQueues: false,
+    needsAI: false,
+    needsSandbox: false,
+    ...overrides,
+  };
+}
+
 beforeEach(() => {
   mkdirSync(TMP, { recursive: true });
 });
@@ -28,17 +38,8 @@ afterEach(() => {
 
 describe('worker packaging', () => {
   it('marks Sandbox bundles as controller-capable and omits metadata for apps without Sandbox', () => {
-    const bindings = {
-      needsD1: false,
-      needsKV: false,
-      needsR2: false,
-      needsAuth: false,
-      needsQueues: false,
-      needsAI: false,
-      needsSandbox: true,
-    };
     const manifest = buildVoidManifest({
-      bindings,
+      bindings: makeBindings({ needsSandbox: true }),
       options: {
         sandbox: {
           binding: 'SANDBOX',
@@ -52,9 +53,7 @@ describe('worker packaging', () => {
       },
     });
     expect(manifest.sandbox).toMatchObject({ controllerProtocol: 2, bindingName: 'SANDBOX' });
-    expect(
-      buildVoidManifest({ bindings: { ...bindings, needsSandbox: false } }).sandbox,
-    ).toBeUndefined();
+    expect(buildVoidManifest({ bindings: makeBindings() }).sandbox).toBeUndefined();
   });
 
   it('keeps the manifest workerMain aligned with uploaded worker modules', () => {
@@ -63,15 +62,7 @@ describe('worker packaging', () => {
     writeFileSync(join(TMP, 'wrangler.json'), JSON.stringify({ main: 'index.mjs' }));
 
     const manifest = buildVoidManifest({
-      bindings: {
-        needsD1: false,
-        needsKV: false,
-        needsR2: false,
-        needsAuth: false,
-        needsQueues: false,
-        needsAI: false,
-        needsSandbox: false,
-      },
+      bindings: makeBindings(),
       ssr: true,
       options: {
         workerMain: 'index.mjs',
@@ -85,49 +76,7 @@ describe('worker packaging', () => {
   });
 });
 
-// Non-regression: the managed `void deploy` manifest must stay byte-identical
-// after the self-host AI + ISR refactors (Tasks 2 & 5). These assert the manifest
-// builder still sets `bindings.ai` from `needsAI` and still carries the exact
-// `collectRevalidate` output the deploy path feeds it.
-describe('buildVoidManifest — self-host non-regression', () => {
-  function makeBindings(overrides: Partial<InferredBindings> = {}): InferredBindings {
-    return {
-      needsD1: false,
-      needsKV: false,
-      needsR2: false,
-      needsAuth: false,
-      needsQueues: false,
-      needsAI: false,
-      needsSandbox: false,
-      ...overrides,
-    };
-  }
-
-  function makePage(pattern: string, revalidate?: number): PageDefinition {
-    return {
-      pattern,
-      params: [],
-      catchAll: false,
-      componentPath: `${pattern}.vue`,
-      serverPath: `${pattern}.server.ts`,
-      methods: ['GET'],
-      componentId: pattern.replace(/^\//, ''),
-      revalidate,
-      ssrMode: 'auto',
-      prerenderMode: 'auto',
-      renderMode: 'server',
-      shouldPrerender: false,
-    };
-  }
-
-  function makeScan(pages: Array<PageDefinition>): PageScanResult {
-    return { pages, layouts: [], namedLayouts: [] };
-  }
-
-  function configWith(revalidate: number | Record<string, number> | undefined): VoidConfig {
-    return (revalidate === undefined ? {} : { routing: { revalidate } }) as VoidConfig;
-  }
-
+describe('buildVoidManifest', () => {
   it('advertises authenticated email protocol only for a managed inbound handler', () => {
     expect(
       buildVoidManifest({ bindings: makeBindings(), hasEmailHandlers: true }).emailProtocolVersion,
@@ -145,54 +94,15 @@ describe('buildVoidManifest — self-host non-regression', () => {
     expect(manifest.bindings.ai).toBe(true);
   });
 
-  it('omits bindings.ai when the app does not use Workers AI', () => {
-    const manifest = buildVoidManifest({ bindings: makeBindings({ needsAI: false }) });
-    expect(manifest.bindings.ai).toBeUndefined();
-  });
-
-  it('carries collectRevalidate output verbatim into manifest.revalidate (numeric config + per-page)', () => {
-    // Same inputs the deploy path feeds: void.json config + page-scan per-page rules.
-    const config = configWith(60);
-    const scan = makeScan([makePage('/blog/:slug', 120)]);
-    const revalidate = collectRevalidate(config, scan);
-
-    const manifest = buildVoidManifest({ bindings: makeBindings(), revalidate });
-
-    // Merge must be non-trivial (numeric config → path map with "*" fallback).
-    // The single-segment page pattern `/blog/:slug` stays as `/blog/:slug` so the
-    // matcher anchors it to ONE path segment (`[^/]+`) at runtime.
-    expect(revalidate).toEqual({ '/blog/:slug': 120, '*': 60 });
-    // …and it must land in the manifest byte-for-byte.
-    expect(manifest.revalidate).toEqual(revalidate);
-    expect(Object.keys(manifest.revalidate as Record<string, number>)).toEqual([
-      '/blog/:slug',
-      '*',
-    ]);
-  });
-
-  it('carries collectRevalidate output verbatim into manifest.revalidate (object config + per-page order)', () => {
-    const config = configWith({ '/docs/*': 30, '*': 10 });
-    const scan = makeScan([makePage('/blog/:slug', 120)]);
-    const revalidate = collectRevalidate(config, scan);
-
-    const manifest = buildVoidManifest({ bindings: makeBindings(), revalidate });
-
-    expect(manifest.revalidate).toEqual(revalidate);
-    // Per-page entries precede config entries (first-match-wins ordering preserved).
-    // The per-page `/blog/:slug` pattern stays `/blog/:slug` (single-segment); the
-    // user's own `routing.revalidate` literal keys (`/docs/*`, `*`) pass untouched.
-    expect(Object.entries(manifest.revalidate as Record<string, number>)).toEqual([
-      ['/blog/:slug', 120],
-      ['/docs/*', 30],
-      ['*', 10],
-    ]);
-  });
-
-  it('leaves manifest.revalidate unset when collectRevalidate yields nothing', () => {
-    const revalidate = collectRevalidate(configWith(undefined), makeScan([]));
-    const manifest = buildVoidManifest({ bindings: makeBindings(), revalidate });
-    expect(revalidate).toBeUndefined();
-    expect(manifest.revalidate).toBeUndefined();
+  it('carries revalidate into manifest.revalidate and omits it when unset or 0', () => {
+    const revalidate = { '/blog/:slug': 120, '*': 60 };
+    expect(
+      Object.entries(buildVoidManifest({ bindings: makeBindings(), revalidate }).revalidate ?? {}),
+    ).toEqual(Object.entries(revalidate));
+    expect(buildVoidManifest({ bindings: makeBindings() }).revalidate).toBeUndefined();
+    expect(
+      buildVoidManifest({ bindings: makeBindings(), revalidate: 0 }).revalidate,
+    ).toBeUndefined();
   });
 
   it('carries a pages array verbatim into manifest.pages', () => {
@@ -211,19 +121,6 @@ describe('buildVoidManifest — self-host non-regression', () => {
 });
 
 describe('manifest limits (worker.limits.cpu_ms)', () => {
-  function makeBindings(overrides: Partial<InferredBindings> = {}): InferredBindings {
-    return {
-      needsD1: false,
-      needsKV: false,
-      needsR2: false,
-      needsAuth: false,
-      needsQueues: false,
-      needsAI: false,
-      needsSandbox: false,
-      ...overrides,
-    };
-  }
-
   it('emits manifest.limits when options.cpuMs is set (void manifest)', () => {
     const manifest = buildVoidManifest({ bindings: makeBindings(), options: { cpuMs: 50 } });
     expect(manifest.limits).toEqual({ cpuMs: 50 });
@@ -253,13 +150,6 @@ describe('manifest limits (worker.limits.cpu_ms)', () => {
     });
     expect('limits' in manifest).toBe(false);
   });
-
-  it('static manifests never carry limits', () => {
-    for (const appType of ['static', 'spa'] as const) {
-      const manifest = buildStaticManifest({ appType });
-      expect('limits' in manifest).toBe(false);
-    }
-  });
 });
 
 describe('resolveSpaFallbackChain', () => {
@@ -386,15 +276,6 @@ describe('resolveSpaFallbackChain', () => {
       },
     ]);
   });
-
-  it('falls back to the appType-inferred handling when notFound is undefined', () => {
-    expect(resolveSpaFallbackChain('static', undefined, undefined).assetConfig).toEqual({
-      not_found_handling: '404-page',
-    });
-    expect(resolveSpaFallbackChain('spa', undefined, undefined).assetConfig).toEqual({
-      not_found_handling: 'single-page-application',
-    });
-  });
 });
 
 describe('buildStaticManifest', () => {
@@ -407,18 +288,13 @@ describe('buildStaticManifest', () => {
     });
   });
 
-  it('threads routing.notFound into manifest.assetConfig', () => {
-    const manifest = buildStaticManifest({ appType: 'spa', notFound: '404-page' });
-    expect(manifest.type).toBe('spa');
-    expect(manifest.assetConfig).toEqual({ not_found_handling: '404-page' });
-  });
-
   it('ships only the user fallbacks when notFound overrides the SPA default', () => {
     const manifest = buildStaticManifest({
       appType: 'spa',
       notFound: '404-page',
       fallbackRules: [{ source: '/docs/*', destination: '/docs.html', status: 200, force: false }],
     });
+    expect(manifest.type).toBe('spa');
     expect(manifest.assetConfig).toEqual({ not_found_handling: '404-page' });
     expect(manifest.fallbackRules).toEqual([
       { source: '/docs/*', destination: '/docs.html', status: 200 },
@@ -426,36 +302,6 @@ describe('buildStaticManifest', () => {
   });
 });
 
-describe('computeAssetHash', () => {
-  it('returns a 32-char hex string', () => {
-    const hash = computeAssetHash(Buffer.from('hello world'), 'test.html');
-    expect(hash).toHaveLength(32);
-    expect(hash).toMatch(/^[0-9a-f]{32}$/);
-  });
-
-  it('returns consistent hashes for same content and path', () => {
-    const a = computeAssetHash(Buffer.from('test content'), 'file.js');
-    const b = computeAssetHash(Buffer.from('test content'), 'file.js');
-    expect(a).toBe(b);
-  });
-
-  it('returns different hashes for different content', () => {
-    const a = computeAssetHash(Buffer.from('content a'), 'file.js');
-    const b = computeAssetHash(Buffer.from('content b'), 'file.js');
-    expect(a).not.toBe(b);
-  });
-
-  it('returns different hashes for same content with different extensions', () => {
-    const content = Buffer.from('identical bytes');
-    const hashHtml = computeAssetHash(content, 'file.html');
-    const hashJs = computeAssetHash(content, 'file.js');
-    const hashNoExt = computeAssetHash(content, 'file');
-    expect(hashHtml).not.toBe(hashJs);
-    expect(hashHtml).not.toBe(hashNoExt);
-    expect(hashJs).not.toBe(hashNoExt);
-  });
-});
-
 describe('collectAndHashAssets', () => {
   it('collects files with hashes and sizes', async () => {
     mkdirSync(join(TMP, 'assets'), { recursive: true });
@@ -470,6 +316,25 @@ describe('collectAndHashAssets', () => {
     expect(assetFiles.size).toBe(2);
   });
 
+  it('emits { blake3, md5, size, hash } per entry', async () => {
+    writeFileSync(join(TMP, 'a.js'), 'hello\n');
+
+    const { assetManifest } = await collectAndHashAssets(TMP);
+
+    expect(assetManifest['/a.js']).toEqual({
+      blake3: 'dc6c72af24e164d6188743458a7da473',
+      md5: 'b1946ac92492d2347c6235b4d2611184',
+      size: Buffer.from('hello\n').length,
+      hash: 'dc6c72af24e164d6188743458a7da473',
+    });
+  });
+
+  it("matches Wrangler's hashFile BLAKE3 recipe", () => {
+    expect(computeAssetHash(Buffer.from('const x = 1;\n'), 'foo.js')).toBe(
+      '3725f96aa779d1959d5942b1b4e04567',
+    );
+  });
+
   it('returns empty manifest for missing directory', async () => {
     const { assetManifest, assetFiles } = await collectAndHashAssets(join(TMP, 'nonexistent'));
 
diff --git a/packages/void/test/unit/pages-client.test.ts b/packages/void/test/unit/pages-client.test.ts
index ef735fa9f..72fa4d85a 100644
--- a/packages/void/test/unit/pages-client.test.ts
+++ b/packages/void/test/unit/pages-client.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
-import { createVoidRouter, ssrProxy } from '../../src/pages/client.ts';
+import { createVoidRouter, ssrProxy, type VoidRouterConfig } from '../../src/pages/client.ts';
 import { createPageNavigationEngine } from '../../src/pages/navigation-engine.ts';
 import { parseCacheFor } from '../../src/pages/prefetch.ts';
 
@@ -7,6 +7,10 @@ type DeferredTestWindow = Window & {
   __resolveDeferred(group: string, data: unknown): void;
 };
 
+type TestRouterConfig = Partial<Omit<VoidRouterConfig, 'adapter'>> & {
+  adapter?: Partial<VoidRouterConfig['adapter']>;
+};
+
 function stubClientGlobals() {
   const documentStub = {
     createElement: vi.fn(() => ({})),
@@ -60,7 +64,38 @@ function stubClientGlobals() {
   return documentStub;
 }
 
-describe('createVoidRouter prefetch', () => {
+function pageJson(body: unknown): Response {
+  return Response.json(body, { headers: { 'X-VoidPages': 'true' } });
+}
+
+const loadComponent = async () => ({ default: {} });
+
+function createTestRouter({ adapter, ...config }: TestRouterConfig = {}) {
+  return createVoidRouter({
+    components: { home: loadComponent },
+    layoutTree: {},
+    routeMeta: {},
+    matchRoute: () => 'home',
+    viewTransitions: false,
+    prefetchHoverDelay: 75,
+    prefetchDefaultCacheFor: parseCacheFor('30s'),
+    ...config,
+    adapter: {
+      applyUpdate: vi.fn(),
+      createDeferred: () => ({}),
+      isLoading: () => false,
+      resolveDeferred: (_ref, value) => value,
+      rejectDeferred: (_ref, error) => error,
+      ...adapter,
+    },
+  });
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('createVoidRouter', () => {
   it('requires the page-data script even when a legacy data-page attribute is present', async () => {
     const documentStub = stubClientGlobals();
     documentStub.getElementById.mockImplementation((id: string) =>
@@ -68,24 +103,7 @@ describe('createVoidRouter prefetch', () => {
         ? { getAttribute: vi.fn(() => JSON.stringify({ component: 'home', props: {} })) }
         : null,
     );
-    await expect(
-      createVoidRouter({
-        adapter: {
-          applyUpdate: vi.fn(),
-          createDeferred: () => ({}),
-          isLoading: () => false,
-          resolveDeferred: (_ref, value) => value,
-          rejectDeferred: (_ref, error) => error,
-        },
-        components: { home: async () => ({ default: {} }) },
-        layoutTree: {},
-        routeMeta: {},
-        matchRoute: () => 'home',
-        viewTransitions: false,
-        prefetchHoverDelay: 75,
-        prefetchDefaultCacheFor: parseCacheFor('30s'),
-      }),
-    ).rejects.toThrow('pages: Missing initial page payload.');
+    await expect(createTestRouter()).rejects.toThrow('pages: Missing initial page payload.');
   });
 
   it.each([
@@ -97,35 +115,14 @@ describe('createVoidRouter prefetch', () => {
     stubClientGlobals();
     vi.stubGlobal(
       'fetch',
-      vi.fn(async () =>
-        Response.json({ component: 'home', props: {} }, { headers: { 'X-VoidPages': 'true' } }),
-      ),
+      vi.fn(async () => pageJson({ component: 'home', props: {} })),
     );
     const applyUpdate = vi.fn();
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: () => ({}),
-        isLoading: () => false,
-        resolveDeferred: (_ref, value) => value,
-        rejectDeferred: (_ref, error) => error,
-      },
-      components: { home: async () => ({ default: {} }) },
-      layoutTree: {},
-      routeMeta: {},
-      matchRoute: () => 'home',
-      viewTransitions: false,
-      prefetchHoverDelay: 75,
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-    });
+    const { router } = await createTestRouter({ adapter: { applyUpdate } });
     await router.visit('/next', options);
     expect(applyUpdate.mock.calls[0][3]).toEqual({ preserveState });
   });
 
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
   it('returns stable route values from the SSR proxy', () => {
     expect(ssrProxy.path).toBe('/');
     expect(ssrProxy.url.pathname).toBe('/');
@@ -142,14 +139,7 @@ describe('createVoidRouter prefetch', () => {
     const layoutLoader = vi.fn(async () => ({ default: {} }));
     const matchRoute = vi.fn(() => 'users');
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate: vi.fn(),
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
+    const { router } = await createTestRouter({
       components: {
         home: homeLoader,
         layout: layoutLoader,
@@ -159,12 +149,9 @@ describe('createVoidRouter prefetch', () => {
         users: ['layout'],
       },
       matchRoute,
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
       routeMeta: {
         users: {},
       },
-      viewTransitions: false,
     });
 
     expect(() => router.prefetch('/users', { method: 'POST' })).toThrow(
@@ -183,31 +170,15 @@ describe('createVoidRouter prefetch', () => {
       component: 'users',
       props: { users: [] },
     };
-    const fetchMock = vi.fn(() =>
-      Promise.resolve(Response.json(pageData, { headers: { 'X-VoidPages': 'true' } })),
-    );
+    const fetchMock = vi.fn(() => Promise.resolve(pageJson(pageData)));
     vi.stubGlobal('fetch', fetchMock);
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate: vi.fn(),
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-        users: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => (url === '/users' ? 'users' : 'home')),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
+    const { router } = await createTestRouter({
+      components: { home: loadComponent, users: loadComponent },
+      matchRoute: (url) => (url === '/users' ? 'users' : 'home'),
       routeMeta: {
         users: {},
       },
-      viewTransitions: false,
     });
 
     await expect(router.prefetch('/users')).resolves.toEqual(pageData);
@@ -226,12 +197,10 @@ describe('createVoidRouter prefetch', () => {
         props: { stats: { count: 42 } },
         deferredKeys: { stats: 'stats' },
       };
-      const fetchMock = vi.fn(async () =>
-        Response.json(pageData, { headers: { 'X-VoidPages': 'true' } }),
-      );
+      const fetchMock = vi.fn(async () => pageJson(pageData));
       vi.stubGlobal('fetch', fetchMock);
       const applyUpdate = vi.fn();
-      const { router } = await createVoidRouter({
+      const { router } = await createTestRouter({
         adapter: {
           applyUpdate,
           createDeferred: () => ({ loading: true, value: null, error: null }),
@@ -242,13 +211,8 @@ describe('createVoidRouter prefetch', () => {
               : { loading: false, value, error: null },
           rejectDeferred: (_ref, error) => ({ loading: false, value: null, error }),
         },
-        components: { home: async () => ({ default: {} }), users: async () => ({ default: {} }) },
-        layoutTree: {},
-        routeMeta: {},
+        components: { home: loadComponent, users: loadComponent },
         matchRoute: () => 'users',
-        viewTransitions: false,
-        prefetchHoverDelay: 75,
-        prefetchDefaultCacheFor: parseCacheFor('30s'),
       });
       try {
         await router.prefetch('/users');
@@ -278,33 +242,15 @@ describe('createVoidRouter prefetch', () => {
       'fetch',
       vi.fn(() => {
         n += 1;
-        return Promise.resolve(
-          Response.json(
-            { component: 'users', props: { v: n } },
-            { headers: { 'X-VoidPages': 'true' } },
-          ),
-        );
+        return Promise.resolve(pageJson({ component: 'users', props: { v: n } }));
       }),
     );
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate: vi.fn(),
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-        users: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => (url === '/users' ? 'users' : 'home')),
+    const { router } = await createTestRouter({
+      components: { home: loadComponent, users: loadComponent },
+      matchRoute: (url) => (url === '/users' ? 'users' : 'home'),
       prefetchDefaultCacheFor: parseCacheFor(['5ms', '10s']),
-      prefetchHoverDelay: 75,
       routeMeta: { users: {} },
-      viewTransitions: false,
     });
 
     await expect(router.prefetch('/users')).resolves.toMatchObject({ props: { v: 1 } });
@@ -328,32 +274,15 @@ describe('createVoidRouter prefetch', () => {
         });
       }
       return Promise.resolve(
-        Response.json(
-          { component: requests === 2 ? 'other' : 'users', props: { version: requests } },
-          { headers: { 'X-VoidPages': 'true' } },
-        ),
+        pageJson({ component: requests === 2 ? 'other' : 'users', props: { version: requests } }),
       );
     });
     vi.stubGlobal('fetch', fetchMock);
     const applyUpdate = vi.fn();
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: () => ({}),
-        isLoading: () => false,
-        resolveDeferred: (_ref, value) => value,
-        rejectDeferred: (_ref, error) => error,
-      },
-      components: {
-        home: async () => ({ default: {} }),
-        users: async () => ({ default: {} }),
-        other: async () => ({ default: {} }),
-      },
-      layoutTree: {},
-      routeMeta: {},
+    const { router } = await createTestRouter({
+      adapter: { applyUpdate },
+      components: { home: loadComponent, users: loadComponent, other: loadComponent },
       matchRoute: (url) => (url === '/users' ? 'users' : 'other'),
-      viewTransitions: false,
-      prefetchHoverDelay: 75,
       prefetchDefaultCacheFor: { stale: 0, expires: 5 * 60_000 },
       cacheVisitedPageData: true,
     });
@@ -366,12 +295,7 @@ describe('createVoidRouter prefetch', () => {
     expect(applyUpdate.mock.lastCall?.[0]).toMatchObject({ props: { version: 1 } });
 
     expect(finishRefresh).toBeTypeOf('function');
-    finishRefresh!(
-      Response.json(
-        { component: 'users', props: { version: 3 } },
-        { headers: { 'X-VoidPages': 'true' } },
-      ),
-    );
+    finishRefresh!(pageJson({ component: 'users', props: { version: 3 } }));
     await expect(router.prefetch('/users')).resolves.toMatchObject({ props: { version: 3 } });
   });
 
@@ -395,34 +319,17 @@ describe('createVoidRouter prefetch', () => {
     });
     const fetchMock = vi.fn((url: string) =>
       Promise.resolve(
-        Response.json(
-          {
-            component: url === '/users' ? 'users' : 'dashboard',
-            props: { version: url === '/users' ? 2 : 3 },
-          },
-          { headers: { 'X-VoidPages': 'true' } },
-        ),
+        pageJson({
+          component: url === '/users' ? 'users' : 'dashboard',
+          props: { version: url === '/users' ? 2 : 3 },
+        }),
       ),
     );
     vi.stubGlobal('fetch', fetchMock);
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate: vi.fn(),
-        createDeferred: () => ({}),
-        isLoading: () => false,
-        resolveDeferred: (_ref, value) => value,
-        rejectDeferred: (_ref, error) => error,
-      },
-      components: {
-        dashboard: async () => ({ default: {} }),
-        users: async () => ({ default: {} }),
-      },
-      layoutTree: {},
-      routeMeta: {},
+    const { router } = await createTestRouter({
+      components: { dashboard: loadComponent, users: loadComponent },
       matchRoute: (url) => (url === '/dashboard' ? 'dashboard' : 'users'),
-      viewTransitions: false,
-      prefetchHoverDelay: 75,
       prefetchDefaultCacheFor: { stale: 0, expires: 5 * 60_000 },
       cacheVisitedPageData: true,
     });
@@ -459,20 +366,10 @@ describe('createVoidRouter prefetch', () => {
     const applyUpdate = vi.fn();
     vi.stubGlobal(
       'fetch',
-      vi.fn(() =>
-        Promise.resolve(
-          Response.json(
-            {
-              component: 'next',
-              props: { title: 'Next' },
-            },
-            { headers: { 'X-VoidPages': 'true' } },
-          ),
-        ),
-      ),
+      vi.fn(() => Promise.resolve(pageJson({ component: 'next', props: { title: 'Next' } }))),
     );
 
-    const { router, start } = await createVoidRouter({
+    const { router, start } = await createTestRouter({
       adapter: {
         applyUpdate,
         createDeferred: vi.fn(() => ({ loading: true, value: null, error: null })),
@@ -480,16 +377,8 @@ describe('createVoidRouter prefetch', () => {
         rejectDeferred,
         resolveDeferred,
       },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-        next: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn(() => 'next'),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+      components: { home: loadComponent, next: loadComponent },
+      matchRoute: () => 'next',
     });
 
     start();
@@ -517,23 +406,9 @@ describe('createVoidRouter prefetch', () => {
     vi.stubGlobal('fetch', vi.fn());
 
     const events: Array<string> = [];
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
+    const { router } = await createTestRouter({
+      adapter: { applyUpdate },
       matchRoute,
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
       onNavigationChange(navigation) {
         events.push(navigation.state);
       },
@@ -579,21 +454,10 @@ describe('createVoidRouter prefetch', () => {
       }),
     );
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        fast: vi.fn(async () => ({ default: {} })),
-        home: vi.fn(async () => ({ default: {} })),
-        slow: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => {
+    const { router } = await createTestRouter({
+      adapter: { applyUpdate },
+      components: { fast: loadComponent, home: loadComponent, slow: loadComponent },
+      matchRoute: (url) => {
         if (url === '/slow') {
           return 'slow';
         }
@@ -601,11 +465,7 @@ describe('createVoidRouter prefetch', () => {
           return 'fast';
         }
         return 'home';
-      }),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+      },
       onNavigationChange(navigation) {
         events.push(navigation.state);
       },
@@ -619,15 +479,7 @@ describe('createVoidRouter prefetch', () => {
 
     expect(events).toEqual(['loading', 'loading']);
 
-    resolveFast(
-      Response.json(
-        {
-          component: 'fast',
-          props: { title: 'Fast' },
-        },
-        { headers: { 'X-VoidPages': 'true' } },
-      ),
-    );
+    resolveFast(pageJson({ component: 'fast', props: { title: 'Fast' } }));
     await fastVisit;
 
     expect(events).toEqual(['loading', 'loading', 'idle']);
@@ -653,35 +505,15 @@ describe('createVoidRouter prefetch', () => {
           });
         }
         if (url === '/fast') {
-          return Promise.resolve(
-            Response.json(
-              {
-                component: 'fast',
-                props: { title: 'Fast' },
-              },
-              { headers: { 'X-VoidPages': 'true' } },
-            ),
-          );
+          return Promise.resolve(pageJson({ component: 'fast', props: { title: 'Fast' } }));
         }
         throw new Error(`Unexpected fetch: ${url}`);
       }),
     );
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate: vi.fn(),
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        fast: vi.fn(async () => ({ default: {} })),
-        home: vi.fn(async () => ({ default: {} })),
-        slow: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => {
+    const { router } = await createTestRouter({
+      components: { fast: loadComponent, home: loadComponent, slow: loadComponent },
+      matchRoute: (url) => {
         if (url === '/slow') {
           return 'slow';
         }
@@ -689,11 +521,7 @@ describe('createVoidRouter prefetch', () => {
           return 'fast';
         }
         return 'home';
-      }),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+      },
     });
 
     const slowVisit = router.visit('/slow');
@@ -710,24 +538,7 @@ describe('createVoidRouter prefetch', () => {
     const applyUpdate = vi.fn();
     vi.stubGlobal('fetch', vi.fn());
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn(() => 'home'),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
-    });
+    const { router } = await createTestRouter({ adapter: { applyUpdate } });
 
     await router.visit('/docs?tab=api#section', {
       preserveState: true,
@@ -750,24 +561,7 @@ describe('createVoidRouter prefetch', () => {
     const matchRoute = vi.fn(() => 'home');
     vi.stubGlobal('fetch', vi.fn());
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute,
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
-    });
+    const { router } = await createTestRouter({ adapter: { applyUpdate }, matchRoute });
 
     await router.visit('/docs?tab=api', {
       preserveState: true,
@@ -790,24 +584,7 @@ describe('createVoidRouter prefetch', () => {
     const applyUpdate = vi.fn();
     vi.stubGlobal('fetch', vi.fn());
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn(() => 'home'),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
-    });
+    const { router } = await createTestRouter({ adapter: { applyUpdate } });
 
     await router.visit('#section', { preserveState: true });
 
@@ -826,36 +603,14 @@ describe('createVoidRouter prefetch', () => {
       if (url !== '/next') {
         throw new Error(`Unexpected fetch: ${url}`);
       }
-      return Promise.resolve(
-        Response.json(
-          {
-            component: 'next',
-            props: { title: 'Next' },
-          },
-          { headers: { 'X-VoidPages': 'true' } },
-        ),
-      );
+      return Promise.resolve(pageJson({ component: 'next', props: { title: 'Next' } }));
     });
     vi.stubGlobal('fetch', fetchMock);
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-        next: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => (url === '/next' ? 'next' : 'home')),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+    const { router } = await createTestRouter({
+      adapter: { applyUpdate },
+      components: { home: loadComponent, next: loadComponent },
+      matchRoute: (url) => (url === '/next' ? 'next' : 'home'),
     });
 
     await router.visit('/next', { preserveState: true });
@@ -907,24 +662,10 @@ describe('createVoidRouter prefetch', () => {
     });
     vi.stubGlobal('fetch', fetchMock);
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-        slow: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => (url === '/slow' ? 'slow' : 'home')),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+    const { router } = await createTestRouter({
+      adapter: { applyUpdate },
+      components: { home: loadComponent, slow: loadComponent },
+      matchRoute: (url) => (url === '/slow' ? 'slow' : 'home'),
     });
 
     const slowVisit = router.visit('/slow').catch(() => undefined);
@@ -940,15 +681,7 @@ describe('createVoidRouter prefetch', () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
     expect(window.scrollTo).toHaveBeenCalledWith(0, 42);
 
-    resolveSlow(
-      Response.json(
-        {
-          component: 'slow',
-          props: { title: 'Slow' },
-        },
-        { headers: { 'X-VoidPages': 'true' } },
-      ),
-    );
+    resolveSlow(pageJson({ component: 'slow', props: { title: 'Slow' } }));
     await slowVisit;
 
     expect(applyUpdate).not.toHaveBeenCalled();
@@ -959,36 +692,14 @@ describe('createVoidRouter prefetch', () => {
     window.location.pathname = '/users';
     const applyUpdate = vi.fn();
     const fetchMock = vi.fn(() =>
-      Promise.resolve(
-        Response.json(
-          {
-            component: 'docs',
-            props: { title: 'Docs' },
-          },
-          { headers: { 'X-VoidPages': 'true' } },
-        ),
-      ),
+      Promise.resolve(pageJson({ component: 'docs', props: { title: 'Docs' } })),
     );
     vi.stubGlobal('fetch', fetchMock);
 
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        docs: vi.fn(async () => ({ default: {} })),
-        home: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn(() => 'docs'),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+    const { router } = await createTestRouter({
+      adapter: { applyUpdate },
+      components: { docs: loadComponent, home: loadComponent },
+      matchRoute: () => 'docs',
     });
 
     window.location.pathname = '/docs';
@@ -1042,19 +753,11 @@ describe('createVoidRouter prefetch', () => {
     vi.stubGlobal(
       'fetch',
       vi.fn(() =>
-        Promise.resolve(
-          Response.json(
-            {
-              component: 'home',
-              props: { stats: null, title: 'Updated' },
-            },
-            { headers: { 'X-VoidPages': 'true' } },
-          ),
-        ),
+        Promise.resolve(pageJson({ component: 'home', props: { stats: null, title: 'Updated' } })),
       ),
     );
 
-    const { router, start } = await createVoidRouter({
+    const { router, start } = await createTestRouter({
       adapter: {
         applyUpdate,
         createDeferred: vi.fn(() => initialRef),
@@ -1062,15 +765,6 @@ describe('createVoidRouter prefetch', () => {
         rejectDeferred,
         resolveDeferred,
       },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn(() => 'home'),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
     });
 
     start();
@@ -1130,36 +824,19 @@ describe('createVoidRouter prefetch', () => {
             });
           });
         }
-        return Promise.resolve(
-          Response.json(
-            {
-              component: 'fast',
-              props: { title: 'Fast' },
-            },
-            { headers: { 'X-VoidPages': 'true' } },
-          ),
-        );
+        return Promise.resolve(pageJson({ component: 'fast', props: { title: 'Fast' } }));
       }),
     );
 
-    const { router, start } = await createVoidRouter({
+    const { router, start } = await createTestRouter({
       adapter: {
-        applyUpdate: vi.fn(),
         createDeferred: vi.fn(() => ({ loading: true, value: null, error: null })),
         isLoading: vi.fn((ref) => Boolean(ref?.loading)),
         rejectDeferred,
         resolveDeferred,
       },
-      components: {
-        fast: vi.fn(async () => ({ default: {} })),
-        home: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => (url === '/slow' ? 'slow' : 'fast')),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+      components: { fast: loadComponent, home: loadComponent },
+      matchRoute: (url) => (url === '/slow' ? 'slow' : 'fast'),
     });
 
     start();
@@ -1209,21 +886,12 @@ describe('createVoidRouter prefetch', () => {
             }),
           );
         }
-        return Promise.resolve(
-          Response.json(
-            {
-              component: 'fast',
-              props: { title: 'Fast' },
-            },
-            { headers: { 'X-VoidPages': 'true' } },
-          ),
-        );
+        return Promise.resolve(pageJson({ component: 'fast', props: { title: 'Fast' } }));
       }),
     );
 
-    const { router } = await createVoidRouter({
+    const { router } = await createTestRouter({
       adapter: {
-        applyUpdate: vi.fn(),
         createDeferred: vi.fn(() => ({ loading: true, value: null, error: null })),
         isLoading: vi.fn((ref) => Boolean(ref?.loading)),
         rejectDeferred: vi.fn((_ref, error) => ({
@@ -1234,16 +902,11 @@ describe('createVoidRouter prefetch', () => {
         resolveDeferred,
       },
       components: {
-        fast: vi.fn(async () => ({ default: {} })),
-        home: vi.fn(async () => ({ default: {} })),
+        fast: loadComponent,
+        home: loadComponent,
         slow: vi.fn(() => slowComponent),
       },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => (url === '/slow' ? 'slow' : 'fast')),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+      matchRoute: (url) => (url === '/slow' ? 'slow' : 'fast'),
     });
 
     const slowVisit = router.visit('/slow').catch(() => undefined);
@@ -1261,38 +924,15 @@ describe('createVoidRouter prefetch', () => {
 });
 
 describe('createVoidRouter other-origin visits', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
   async function createRouter() {
     stubClientGlobals();
-    const fetchMock = vi.fn(async () =>
-      Response.json(
-        { component: 'users', props: { users: [] } },
-        { headers: { 'X-VoidPages': 'true' } },
-      ),
-    );
+    const fetchMock = vi.fn(async () => pageJson({ component: 'users', props: { users: [] } }));
     vi.stubGlobal('fetch', fetchMock);
     const applyUpdate = vi.fn();
-    const { router } = await createVoidRouter({
-      adapter: {
-        applyUpdate,
-        createDeferred: vi.fn(() => ({})),
-        isLoading: vi.fn(() => false),
-        rejectDeferred: vi.fn((_ref, error) => error),
-        resolveDeferred: vi.fn((_ref, value) => value),
-      },
-      components: {
-        home: vi.fn(async () => ({ default: {} })),
-        users: vi.fn(async () => ({ default: {} })),
-      },
-      layoutTree: {},
-      matchRoute: vi.fn((url) => (url === '/users' ? 'users' : 'home')),
-      prefetchDefaultCacheFor: parseCacheFor('30s'),
-      prefetchHoverDelay: 75,
-      routeMeta: {},
-      viewTransitions: false,
+    const { router } = await createTestRouter({
+      adapter: { applyUpdate },
+      components: { home: loadComponent, users: loadComponent },
+      matchRoute: (url) => (url === '/users' ? 'users' : 'home'),
     });
     return { router, fetchMock, applyUpdate };
   }
@@ -1322,7 +962,7 @@ describe('createVoidRouter other-origin visits', () => {
         rejectDeferred: (_ref, error) => error,
         isLoading: () => false,
       },
-      components: { home: async () => ({ default: {} }) },
+      components: { home: loadComponent },
       layoutTree: {},
       routeMeta: {},
       matchRoute: () => 'home',
diff --git a/packages/void/test/unit/pages-compile.test.ts b/packages/void/test/unit/pages-compile.test.ts
index 0ffc6091d..a8568fda0 100644
--- a/packages/void/test/unit/pages-compile.test.ts
+++ b/packages/void/test/unit/pages-compile.test.ts
@@ -21,41 +21,12 @@ const pagesOptions: PagesCompileOptions = {
   clientEntryId: 'virtual:void-pages-client',
 };
 
-type TestPageDefinition = Omit<
-  PageDefinition,
-  'ssrMode' | 'prerenderMode' | 'renderMode' | 'shouldPrerender'
-> &
-  Partial<Pick<PageDefinition, 'ssrMode' | 'prerenderMode' | 'renderMode' | 'shouldPrerender'>>;
-
-function withRenderingDefaults(page: TestPageDefinition): PageDefinition {
-  const renderMode =
-    page.renderMode ?? (page.island ? 'island' : page.ssr === false ? 'client' : 'server');
-  return {
-    ...page,
-    ssrMode:
-      page.ssrMode ?? (page.ssr === true ? 'server' : page.ssr === false ? 'client' : 'auto'),
-    prerenderMode:
-      page.prerenderMode ??
-      (page.prerender === true ? 'force' : page.prerender === false ? 'disabled' : 'auto'),
-    renderMode,
-    shouldPrerender: page.shouldPrerender ?? page.prerender === true,
-  };
-}
-
-function makeScan(
-  pages: Omit<PageScanResult, 'pages'> & { pages: Array<TestPageDefinition> },
-): ScanResult {
-  return {
-    routes: [],
-    middleware: [],
-    jobs: [],
-    queues: [],
-    pages: { ...pages, pages: pages.pages.map(withRenderingDefaults) },
-  };
+function makeScan(pages: PageScanResult): ScanResult {
+  return { routes: [], middleware: [], jobs: [], queues: [], pages };
 }
 
 describe('Pages metadata wiring', () => {
-  const page: TestPageDefinition = {
+  const page: PageDefinition = {
     pattern: '/',
     params: [],
     catchAll: false,
@@ -63,6 +34,10 @@ describe('Pages metadata wiring', () => {
     componentId: 'index',
     serverPath: 'index.server.ts',
     methods: ['loader', 'actions'],
+    ssrMode: 'auto',
+    prerenderMode: 'auto',
+    renderMode: 'server',
+    shouldPrerender: false,
   };
   const compile = (options = testOptions) =>
     compileRouteTable(
@@ -112,7 +87,7 @@ describe('Pages metadata wiring', () => {
   });
   it('keeps layout CSS roots in cascade order and includes island markdown metadata', () => {
     const scan = makeScan({
-      pages: [{ ...page, island: true }],
+      pages: [{ ...page, island: true, renderMode: 'island' }],
       layouts: [{ directory: '', filePath: 'layout.vue', island: true }],
       namedLayouts: [],
     });
diff --git a/packages/void/test/unit/pages-defer.test.ts b/packages/void/test/unit/pages-defer.test.ts
index b7991171a..de7ec1e97 100644
--- a/packages/void/test/unit/pages-defer.test.ts
+++ b/packages/void/test/unit/pages-defer.test.ts
@@ -1,31 +1,5 @@
 import { describe, expect, it, vi } from 'vite-plus/test';
-import { defer, separateDeferred, DEFERRED } from '../../src/pages/defer.ts';
-
-describe('defer', () => {
-  it('single prop — returns sentinel with null group', () => {
-    const resolver = vi.fn();
-    const result = defer(resolver) as unknown as {
-      [DEFERRED]: true;
-      group: null;
-      resolver: typeof resolver;
-    };
-    expect(result[DEFERRED]).toBe(true);
-    expect(result.group).toBeNull();
-    expect(result.resolver).toBe(resolver);
-  });
-
-  it('named group — returns sentinel with group name', () => {
-    const resolver = vi.fn();
-    const result = defer('analytics', resolver) as unknown as {
-      [DEFERRED]: true;
-      group: string;
-      resolver: typeof resolver;
-    };
-    expect(result[DEFERRED]).toBe(true);
-    expect(result.group).toBe('analytics');
-    expect(result.resolver).toBe(resolver);
-  });
-});
+import { separateDeferred, DEFERRED } from '../../src/pages/defer.ts';
 
 describe('separateDeferred', () => {
   it('returns all immediate props when no deferred', () => {
@@ -67,33 +41,4 @@ describe('separateDeferred', () => {
     expect(deferredMap['analytics'].keys).toEqual(['metrics', 'chart']);
     expect(deferredMap['analytics'].resolver).toBe(resolver);
   });
-
-  it('handles mix of immediate, single deferred, and grouped deferred', () => {
-    const usageResolver = vi.fn();
-    const analyticsResolver = vi.fn();
-    const input = {
-      projects: [1],
-      usage: { [DEFERRED]: true, group: null, resolver: usageResolver },
-      metrics: {
-        [DEFERRED]: true,
-        group: 'analytics',
-        resolver: analyticsResolver,
-      },
-      chart: {
-        [DEFERRED]: true,
-        group: 'analytics',
-        resolver: analyticsResolver,
-      },
-    };
-    const { immediateProps, deferredMap } = separateDeferred(input);
-    expect(immediateProps).toEqual({
-      projects: [1],
-      usage: LOADING,
-      metrics: LOADING,
-      chart: LOADING,
-    });
-    expect(Object.keys(deferredMap).sort()).toEqual(['analytics', 'usage']);
-    expect(deferredMap['usage'].keys).toEqual(['usage']);
-    expect(deferredMap['analytics'].keys).toEqual(['metrics', 'chart']);
-  });
 });
diff --git a/packages/void/test/unit/pages-dev-css-assets.test.ts b/packages/void/test/unit/pages-dev-css-assets.test.ts
index e156813aa..04a74cecd 100644
--- a/packages/void/test/unit/pages-dev-css-assets.test.ts
+++ b/packages/void/test/unit/pages-dev-css-assets.test.ts
@@ -122,6 +122,55 @@ async function postCollector(
   return response;
 }
 
+function createCollector({
+  nodes,
+  transforms,
+  resolve,
+}: {
+  nodes: Map<string, { id: string; url: string }>;
+  transforms: Record<string, string>;
+  resolve: (specifier: string) => Promise<{ id: string } | undefined>;
+}) {
+  let middleware: Middleware | undefined;
+  const transformCalls: Array<string> = [];
+  const [assetPlugin, edgePlugin] = pagesDevCssAssetsPlugin('/root', 'secret');
+  const configureServer = assetPlugin.configureServer as (server: unknown) => void;
+  configureServer({
+    config: { logger: { warn() {}, warnOnce() {} }, server: {} },
+    environments: {
+      client: {
+        moduleGraph: {
+          getModuleByUrl: async (url: string) => nodes.get(url),
+        },
+        transformRequest: async (url: string) => {
+          transformCalls.push(url);
+          return { code: transforms[url] ?? '' };
+        },
+      },
+    },
+    middlewares: {
+      use(fn: Middleware) {
+        middleware = fn;
+      },
+    },
+    watcher: { on() {} },
+  });
+  const transform = edgePlugin.transform as (
+    this: unknown,
+    code: string,
+    id: string,
+  ) => Promise<void>;
+  return {
+    transformCalls,
+    transform: (code: string, id: string) =>
+      transform.call({ environment: { name: 'client' }, resolve }, code, id),
+    async collect(rootPhases: Array<Array<string>>): Promise<{ assets: unknown }> {
+      const response = await postCollector(middleware!, { rootPhases });
+      return JSON.parse(response.body);
+    },
+  };
+}
+
 describe('pages dev CSS assets', () => {
   it('resolves transformed component imports and re-exports in source order', async () => {
     const [, plugin] = pagesDevCssAssetsPlugin('/root', 'secret');
@@ -264,16 +313,6 @@ export default __vite__css;`;
     expect(response.body).toBe('Unauthorized');
   });
 
-  it('generates the worker bridge with the internal Vite origin, not request.url', () => {
-    const plugin = createConfiguredPlugin();
-    const code = loadDevAssetModule(plugin);
-
-    expect(code).toContain('const INTERNAL_ORIGIN = "http://127.0.0.1:6199"');
-    expect(code).toContain('new URL(ENDPOINT, INTERNAL_ORIGIN)');
-    expect(code).toContain('env?.ASSETS');
-    expect(code).toContain('new URL(ENDPOINT, request.url)');
-  });
-
   it('uses the internal Vite origin before the ASSETS binding in dev', async () => {
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
     const originalFetch = globalThis.fetch;
@@ -327,6 +366,7 @@ export default __vite__css;`;
         }),
     );
     const assetsFetch = vi.fn(async (request: Request) => {
+      expect(request.url).toBe('https://app.local/__void/dev/pages-css');
       expect(request.signal.aborted).toBe(false);
       return Response.json({ assets: expectedAssets });
     });
@@ -352,14 +392,6 @@ export default __vite__css;`;
     }
   });
 
-  it('brackets IPv6 internal Vite origins', () => {
-    const plugin = createConfiguredPlugin('::1');
-    const code = loadDevAssetModule(plugin);
-
-    expect(code).toContain('const INTERNAL_ORIGIN = "http://[::1]:6199"');
-    expect(() => new URL('/__void/dev/pages-css', 'http://[::1]:6199')).not.toThrow();
-  });
-
   it('prefers concrete bound IPv6 loopback over ambiguous localhost display URLs', () => {
     const plugin = createConfiguredPlugin('::1', 'http://localhost:6199/');
     const code = loadDevAssetModule(plugin);
@@ -369,63 +401,24 @@ export default __vite__css;`;
   });
 
   it('collects CSS through ordered static edges and ignores dynamic imports', async () => {
-    let middleware: Middleware | undefined;
-    const nodes = new Map([
-      ['/src/page.ts', { id: '/root/src/page.ts', url: '/src/page.ts' }],
-      ['/src/component.ts', { id: '/root/src/component.ts', url: '/src/component.ts' }],
-      ['/src/static.css', { id: '/root/wrong.css', url: '/src/static.css' }],
-      ['/src/dynamic.css', { id: '/root/src/dynamic.css', url: '/src/dynamic.css' }],
-    ]);
-    const transformCalls: Array<string> = [];
-    const [assetPlugin, edgePlugin] = pagesDevCssAssetsPlugin('/root', 'secret');
-    const configureServer = assetPlugin.configureServer as (server: unknown) => void;
-    configureServer({
-      config: { logger: { warn() {}, warnOnce() {} }, server: {} },
-      environments: {
-        client: {
-          moduleGraph: {
-            getModuleByUrl: async (url: string) => nodes.get(url),
-          },
-          transformRequest: async (url: string) => {
-            transformCalls.push(url);
-            if (url === '/src/static.css') {
-              return {
-                code:
-                  '// const __vite__id = "/root/comment.css"\n' +
-                  `const note = '__vite__id = "/root/string.css"';\n` +
-                  'const __vite__id = "/root/src/static.css"\nconst __vite__css = ".static{}"',
-              };
-            }
-            if (url === '/src/static.css?inline=') {
-              return { code: 'export default ".static{}"' };
-            }
-            if (url === '/src/dynamic.css') {
-              return {
-                code: 'const __vite__id = "/root/src/dynamic.css"\nconst __vite__css = ".dynamic{}"',
-              };
-            }
-            if (url === '/src/dynamic.css?inline=') {
-              return { code: 'export default ".dynamic{}"' };
-            }
-            return { code: '' };
-          },
-        },
-      },
-      middlewares: {
-        use(fn: Middleware) {
-          middleware = fn;
-        },
+    const collector = createCollector({
+      nodes: new Map([
+        ['/src/page.ts', { id: '/root/src/page.ts', url: '/src/page.ts' }],
+        ['/src/component.ts', { id: '/root/src/component.ts', url: '/src/component.ts' }],
+        ['/src/static.css', { id: '/root/wrong.css', url: '/src/static.css' }],
+        ['/src/dynamic.css', { id: '/root/src/dynamic.css', url: '/src/dynamic.css' }],
+      ]),
+      transforms: {
+        '/src/static.css':
+          '// const __vite__id = "/root/comment.css"\n' +
+          `const note = '__vite__id = "/root/string.css"';\n` +
+          'const __vite__id = "/root/src/static.css"\nconst __vite__css = ".static{}"',
+        '/src/static.css?inline=': 'export default ".static{}"',
+        '/src/dynamic.css':
+          'const __vite__id = "/root/src/dynamic.css"\nconst __vite__css = ".dynamic{}"',
+        '/src/dynamic.css?inline=': 'export default ".dynamic{}"',
       },
-      watcher: { on() {} },
-    });
-    const transform = edgePlugin.transform as (
-      this: unknown,
-      code: string,
-      id: string,
-    ) => Promise<void>;
-    const context = {
-      environment: { name: 'client' },
-      resolve: async (specifier: string) => {
+      resolve: async (specifier) => {
         if (specifier === './component.ts') {
           return { id: '/root/src/component.ts' };
         }
@@ -436,80 +429,44 @@ export default __vite__css;`;
           return { id: '/root/src/dynamic.css' };
         }
       },
-    };
+    });
 
-    await transform.call(
-      context,
+    await collector.transform(
       'import "./component.ts"; import("./dynamic.css");',
       '/root/src/page.ts',
     );
-    await transform.call(context, 'import "./static.css";', '/root/src/component.ts');
+    await collector.transform('import "./static.css";', '/root/src/component.ts');
 
-    const response = await postCollector(middleware!, { rootPhases: [['/src/page.ts']] });
-    const body = JSON.parse(response.body);
+    const body = await collector.collect([['/src/page.ts']]);
 
     expect(body.assets).toEqual([
       { url: '/src/static.css', id: '/root/src/static.css', css: '.static{}' },
     ]);
-    expect(transformCalls).not.toContain('/src/dynamic.css');
+    expect(collector.transformCalls).not.toContain('/src/dynamic.css');
   });
 
   it('uses Svelte style transform CSS without appending inline', async () => {
-    let middleware: Middleware | undefined;
     const styleUrl = '/src/page.svelte?svelte&type=style&lang.css';
-    const nodes = new Map([
-      ['/src/page.ts', { id: '/root/src/page.ts', url: '/src/page.ts' }],
-      [styleUrl, { id: `/root${styleUrl}`, url: styleUrl }],
-    ]);
-    const transformCalls: Array<string> = [];
-    const [assetPlugin, edgePlugin] = pagesDevCssAssetsPlugin('/root', 'secret');
-    const configureServer = assetPlugin.configureServer as (server: unknown) => void;
-    configureServer({
-      config: { logger: { warn() {}, warnOnce() {} }, server: {} },
-      environments: {
-        client: {
-          moduleGraph: {
-            getModuleByUrl: async (url: string) => nodes.get(url),
-          },
-          transformRequest: async (url: string) => {
-            transformCalls.push(url);
-            if (url === styleUrl) {
-              return {
-                code:
-                  'const __vite__id = "/root/src/page.svelte?svelte&type=style&lang.css"\n' +
-                  'const __vite__css = ".svelte-page{color:red}"',
-              };
-            }
-            if (url === `${styleUrl}&inline=`) {
-              return { code: 'export default function Component() {}' };
-            }
-            return { code: '' };
-          },
-        },
+    const collector = createCollector({
+      nodes: new Map([
+        ['/src/page.ts', { id: '/root/src/page.ts', url: '/src/page.ts' }],
+        [styleUrl, { id: `/root${styleUrl}`, url: styleUrl }],
+      ]),
+      transforms: {
+        [styleUrl]:
+          'const __vite__id = "/root/src/page.svelte?svelte&type=style&lang.css"\n' +
+          'const __vite__css = ".svelte-page{color:red}"',
+        [`${styleUrl}&inline=`]: 'export default function Component() {}',
       },
-      middlewares: {
-        use(fn: Middleware) {
-          middleware = fn;
-        },
-      },
-      watcher: { on() {} },
+      resolve: async () => ({ id: `/root${styleUrl}` }),
     });
-    const transform = edgePlugin.transform as (
-      this: unknown,
-      code: string,
-      id: string,
-    ) => Promise<void>;
-    await transform.call(
-      {
-        environment: { name: 'client' },
-        resolve: async () => ({ id: `/root${styleUrl}` }),
-      },
+
+    await collector.transform(
       'import "./page.svelte?svelte&type=style&lang.css";',
       '/root/src/page.ts',
     );
 
-    const response = await postCollector(middleware!, { rootPhases: [['/src/page.ts']] });
-    const body = JSON.parse(response.body);
+    const body = await collector.collect([['/src/page.ts']]);
 
     expect(body.assets).toEqual([
       {
@@ -518,124 +475,52 @@ export default __vite__css;`;
         css: '.svelte-page{color:red}',
       },
     ]);
-    expect(transformCalls).not.toContain(`${styleUrl}&inline=`);
+    expect(collector.transformCalls).not.toContain(`${styleUrl}&inline=`);
   });
 
   it('unwraps virtual /@id roots before transforming them', async () => {
-    let middleware: Middleware | undefined;
-    const nodes = new Map([
-      [
-        '/@id/__x00__virtual:void-pages-client',
-        { id: '\0virtual:void-pages-client', url: '/@id/__x00__virtual:void-pages-client' },
-      ],
-      ['/src/page.css', { id: '/root/src/page.css', url: '/src/page.css' }],
-    ]);
-    const transformCalls: Array<string> = [];
-    const [assetPlugin, edgePlugin] = pagesDevCssAssetsPlugin('/root', 'secret');
-    const configureServer = assetPlugin.configureServer as (server: unknown) => void;
-    configureServer({
-      config: { logger: { warn() {}, warnOnce() {} }, server: {} },
-      environments: {
-        client: {
-          moduleGraph: {
-            getModuleByUrl: async (url: string) => nodes.get(url),
-          },
-          transformRequest: async (url: string) => {
-            transformCalls.push(url);
-            if (url === '/src/page.css?inline=') {
-              return { code: 'export default ".page{}"' };
-            }
-            return { code: '' };
-          },
-        },
-      },
-      middlewares: {
-        use(fn: Middleware) {
-          middleware = fn;
-        },
-      },
-      watcher: { on() {} },
+    const collector = createCollector({
+      nodes: new Map([
+        [
+          '/@id/__x00__virtual:void-pages-client',
+          { id: '\0virtual:void-pages-client', url: '/@id/__x00__virtual:void-pages-client' },
+        ],
+        ['/src/page.css', { id: '/root/src/page.css', url: '/src/page.css' }],
+      ]),
+      transforms: { '/src/page.css?inline=': 'export default ".page{}"' },
+      resolve: async () => ({ id: '/root/src/page.css' }),
     });
-    const transform = edgePlugin.transform as (
-      this: unknown,
-      code: string,
-      id: string,
-    ) => Promise<void>;
-    await transform.call(
-      {
-        environment: { name: 'client' },
-        resolve: async () => ({ id: '/root/src/page.css' }),
-      },
-      'import "./page.css";',
-      '\0virtual:void-pages-client',
-    );
 
-    const response = await postCollector(middleware!, {
-      rootPhases: [['/@id/__x00__virtual:void-pages-client']],
-    });
-    const body = JSON.parse(response.body);
+    await collector.transform('import "./page.css";', '\0virtual:void-pages-client');
 
-    expect(transformCalls[0]).toBe('\0virtual:void-pages-client');
+    const body = await collector.collect([['/@id/__x00__virtual:void-pages-client']]);
+
+    expect(collector.transformCalls[0]).toBe('\0virtual:void-pages-client');
     expect(body.assets).toEqual([
       { url: '/src/page.css', id: '/root/src/page.css', css: '.page{}' },
     ]);
   });
 
   it('skips optimized deps and continues collecting route CSS', async () => {
-    let middleware: Middleware | undefined;
-    const nodes = new Map([
-      ['/src/page.ts', { id: '/root/src/page.ts', url: '/src/page.ts' }],
-      ['/src/page.css', { id: '/root/src/page.css', url: '/src/page.css' }],
-    ]);
-    const transformCalls: Array<string> = [];
-    const [assetPlugin, edgePlugin] = pagesDevCssAssetsPlugin('/root', 'secret');
-    const configureServer = assetPlugin.configureServer as (server: unknown) => void;
-    configureServer({
-      config: { logger: { warn() {}, warnOnce() {} }, server: {} },
-      environments: {
-        client: {
-          moduleGraph: {
-            getModuleByUrl: async (url: string) => nodes.get(url),
-          },
-          transformRequest: async (url: string) => {
-            transformCalls.push(url);
-            if (url === '/src/page.css?inline=') {
-              return { code: 'export default ".page{}"' };
-            }
-            return { code: '' };
-          },
-        },
-      },
-      middlewares: {
-        use(fn: Middleware) {
-          middleware = fn;
-        },
+    const collector = createCollector({
+      nodes: new Map([
+        ['/src/page.ts', { id: '/root/src/page.ts', url: '/src/page.ts' }],
+        ['/src/page.css', { id: '/root/src/page.css', url: '/src/page.css' }],
+      ]),
+      transforms: { '/src/page.css?inline=': 'export default ".page{}"' },
+      resolve: async (specifier) => {
+        if (specifier === './page.css') {
+          return { id: '/root/src/page.css' };
+        }
+        return { id: '/node_modules/.vite/deps/react.js?v=123' };
       },
-      watcher: { on() {} },
     });
-    const transform = edgePlugin.transform as (
-      this: unknown,
-      code: string,
-      id: string,
-    ) => Promise<void>;
-    await transform.call(
-      {
-        environment: { name: 'client' },
-        resolve: async (specifier: string) => {
-          if (specifier === './page.css') {
-            return { id: '/root/src/page.css' };
-          }
-          return { id: '/node_modules/.vite/deps/react.js?v=123' };
-        },
-      },
-      'import "react"; import "./page.css";',
-      '/root/src/page.ts',
-    );
 
-    const response = await postCollector(middleware!, { rootPhases: [['/src/page.ts']] });
-    const body = JSON.parse(response.body);
+    await collector.transform('import "react"; import "./page.css";', '/root/src/page.ts');
+
+    const body = await collector.collect([['/src/page.ts']]);
 
-    expect(transformCalls).not.toContain('/node_modules/.vite/deps/react.js?v=123');
+    expect(collector.transformCalls).not.toContain('/node_modules/.vite/deps/react.js?v=123');
     expect(body.assets).toEqual([
       { url: '/src/page.css', id: '/root/src/page.css', css: '.page{}' },
     ]);
diff --git a/packages/void/test/unit/pages-protocol.test.ts b/packages/void/test/unit/pages-protocol.test.ts
index 2129e378c..7295581dc 100644
--- a/packages/void/test/unit/pages-protocol.test.ts
+++ b/packages/void/test/unit/pages-protocol.test.ts
@@ -80,6 +80,7 @@ describe('handlePageGet', () => {
         mockRenderFn,
         mockGetAssetTags,
       );
+      expect(response.headers.get('X-VoidPages')).toBe('true');
       expect(response.headers.get('Vary')).toBe('Accept-Language, X-VoidPages');
       await response.text();
     },
@@ -107,6 +108,7 @@ describe('handlePageGet', () => {
     expect(body.props).toEqual({ users: [1, 2, 3] });
     expect(body.url).toBe('/users');
     expect(body.errors).toBeNull();
+    expect(body.deferred).toBeUndefined();
   });
 
   it('preserves headers set by loaders on X-VoidPages JSON responses', async () => {
@@ -131,24 +133,6 @@ describe('handlePageGet', () => {
     expect(response.headers.get('X-VoidPages')).toBe('true');
   });
 
-  it('includes the request query string in page object URLs', async () => {
-    const c = await createTestContext('GET', '/users?page=2', {
-      headers: { 'x-voidpages': 'true' },
-    });
-
-    const response = await handlePageGet(
-      () => ({ users: [] }),
-      undefined,
-      c,
-      'users',
-      mockRenderFn,
-      mockGetAssetTags,
-    );
-
-    const body = await json<PageResponse>(response);
-    expect(body.url).toBe('/users?page=2');
-  });
-
   it('includes route params in page objects without requiring loader props', async () => {
     const c = await createTestContext('GET', '/posts/abc-123?preview=true', {
       headers: { 'x-voidpages': 'true' },
@@ -227,25 +211,6 @@ describe('handlePageGet', () => {
     expect(response.headers.get('content-type')).toBe('text/html; charset=utf-8');
   });
 
-  it('handles undefined handler (empty props)', async () => {
-    const c = await createTestContext('GET', '/', {
-      headers: { 'x-voidpages': 'true' },
-    });
-
-    const response = await handlePageGet(
-      undefined,
-      undefined,
-      c,
-      'index',
-      mockRenderFn,
-      mockGetAssetTags,
-    );
-
-    const body = await json<PageResponse>(response);
-    expect(body.props).toEqual({});
-    expect(body.component).toBe('index');
-  });
-
   it('passes through redirect Response from loader', async () => {
     const c = await createTestContext('GET', '/auth/callback');
 
@@ -290,27 +255,6 @@ describe('handlePageGet', () => {
     expect(renderFn).toHaveBeenCalled();
   });
 
-  it('island=false returns JSON for X-VoidPages requests (unchanged)', async () => {
-    const c = await createTestContext('GET', '/', {
-      headers: { 'x-voidpages': 'true' },
-    });
-
-    const renderFn = vi.fn(async () => '<html></html>');
-    const response = await handlePageGet(
-      undefined,
-      undefined,
-      c,
-      'index',
-      renderFn,
-      mockGetAssetTags,
-      undefined,
-      { renderMode: 'server' },
-    );
-
-    expect(response.headers.get('X-VoidPages')).toBe('true');
-    expect(renderFn).not.toHaveBeenCalled();
-  });
-
   it('serializes dev CSS records with a nonce before rendering HTML', async () => {
     const c = await createTestContext('GET', '/styled');
     const renderFn = vi.fn(
@@ -876,26 +820,6 @@ describe('handlePageMutation', () => {
 });
 
 describe('handlePageGet with deferred props', () => {
-  it('SPA — marks deferred NDJSON responses as Void Pages responses', async () => {
-    const c = await createTestContext('GET', '/dashboard', {
-      headers: { 'x-voidpages': 'true' },
-    });
-
-    const response = await handlePageGet(
-      () => ({
-        usage: defer(() => Promise.resolve({ requests: 100 })),
-      }),
-      undefined,
-      c,
-      'dashboard',
-      mockRenderFn,
-      mockGetAssetTags,
-    );
-
-    expect(response.headers.get('X-VoidPages')).toBe('true');
-    expect(response.headers.get('Vary')).toBe('X-VoidPages');
-  });
-
   it('SPA — streams NDJSON with immediate props first, then deferred', async () => {
     const c = await createTestContext('GET', '/dashboard', {
       headers: { 'x-voidpages': 'true' },
@@ -1014,7 +938,8 @@ describe('handlePageGet with deferred props', () => {
 
       const text = await response.text();
       expect(text).not.toContain('10.0.0.5');
-      expect(text).toContain('window.__rejectDeferred("usage","Internal Server Error")');
+      expect(text).toContain('window.__rejectDeferred("usage",');
+      expect(text).toContain('"Internal Server Error"');
       expect(consoleError).toHaveBeenCalledWith(error);
     } finally {
       consoleError.mockRestore();
@@ -1052,26 +977,6 @@ describe('handlePageGet with deferred props', () => {
     }
   });
 
-  it('SPA — no deferred props returns normal JSON (not streaming)', async () => {
-    const c = await createTestContext('GET', '/users', {
-      headers: { 'x-voidpages': 'true' },
-    });
-
-    const handler = vi.fn(() => ({ users: [1] }));
-    const response = await handlePageGet(
-      handler,
-      undefined,
-      c,
-      'users',
-      mockRenderFn,
-      mockGetAssetTags,
-    );
-
-    const body = await json<PageResponse>(response);
-    expect(body.props).toEqual({ users: [1] });
-    expect(body.deferred).toBeUndefined();
-  });
-
   it('SSR — streams HTML then deferred script tags', async () => {
     const c = await createTestContext('GET', '/dashboard');
 
@@ -1101,22 +1006,6 @@ describe('handlePageGet with deferred props', () => {
     expect(text).toContain('"requests":100');
   });
 
-  it('SSR — no deferred props returns normal HTML', async () => {
-    const c = await createTestContext('GET', '/users');
-
-    const handler = vi.fn(() => ({ users: [1] }));
-    const response = await handlePageGet(
-      handler,
-      undefined,
-      c,
-      'users',
-      mockRenderFn,
-      mockGetAssetTags,
-    );
-
-    expect(response.headers.get('content-type')).toBe('text/html; charset=utf-8');
-  });
-
   it('client-only page — returns an empty app shell with initial page data', async () => {
     const c = await createTestContext('GET', '/analytics');
 
@@ -1210,26 +1099,6 @@ describe('handlePageGet with deferred props', () => {
     expect(deferredLine.data).toHaveProperty('metrics');
     expect(deferredLine.data).toHaveProperty('chart');
   });
-
-  it('redirect from loader with deferred props — passes through', async () => {
-    const c = await createTestContext('GET', '/dashboard');
-
-    const redirect = new Response(null, {
-      status: 302,
-      headers: { Location: '/login' },
-    });
-    const handler = vi.fn(() => redirect);
-    const response = await handlePageGet(
-      handler,
-      undefined,
-      c,
-      'dashboard',
-      mockRenderFn,
-      mockGetAssetTags,
-    );
-
-    expect(response.status).toBe(302);
-  });
 });
 
 describe('flattenValidationErrors', () => {
diff --git a/packages/void/test/unit/pages-scan.test.ts b/packages/void/test/unit/pages-scan.test.ts
index a3a31df98..2a5f13bb0 100644
--- a/packages/void/test/unit/pages-scan.test.ts
+++ b/packages/void/test/unit/pages-scan.test.ts
@@ -276,21 +276,6 @@ export { handler as action, type actions };`,
     expect(page!.revalidate).toBeUndefined();
   });
 
-  it('detects prerender = true from .server.ts', async () => {
-    writeFile('products/index.vue', '<template><div>Products</div></template>');
-    writeFile(
-      'products/index.server.ts',
-      'export const prerender = true;\nexport const loader = () => [];',
-    );
-
-    const result = await scanPages(TMP);
-    const page = result.pages.find((p) => p.componentId === 'products');
-    expect(page).toBeDefined();
-    expect(page!.prerender).toBe(true);
-    expect(page!.prerenderMode).toBe('force');
-    expect(page!.shouldPrerender).toBe(true);
-  });
-
   it('detects ssr = false from .server.ts and resolves client render mode', async () => {
     writeFile('analytics.vue', '<template><div>Analytics</div></template>');
     writeFile('analytics.server.ts', 'export const ssr = false;\nexport const loader = () => [];');
@@ -639,14 +624,6 @@ export { handler as action, type actions };`,
       expect(result.namedLayouts[0].island).toBe(true);
     });
 
-    it('named layout files are not treated as pages', async () => {
-      writeFile('_layouts/home.vue', '<template><slot /></template>');
-      writeFile('index.vue', '<template><div /></template>');
-      const result = await scanPages(TMP);
-      expect(result.pages).toHaveLength(1);
-      expect(result.pages[0].componentId).toBe('index');
-    });
-
     it('extracts layout from Vue SFC export const', async () => {
       writeFile('_layouts/home.vue', '<template><slot /></template>');
       writeFile(
@@ -749,15 +726,6 @@ const example = 'export const layout = "home"';
       );
       await expect(scanPages(TMP)).rejects.toThrow('_layouts/missing.vue');
     });
-
-    it('does not throw for layout: false', async () => {
-      writeFile('layout.vue', '<template><slot /></template>');
-      writeFile(
-        'index.vue',
-        '<script>export const layout = false;</script>\n<template><div /></template>',
-      );
-      await expect(scanPages(TMP)).resolves.toBeDefined();
-    });
   });
 });
 
@@ -867,17 +835,6 @@ describe('resolveEffectiveLayoutChain', () => {
     { name: 'api', directory: 'guide', filePath: 'guide/_layouts/api.vue' },
   ];
 
-  it('returns default chain when no layout field', () => {
-    const chain = resolveEffectiveLayoutChain(
-      { componentId: 'guide/intro' },
-      layouts,
-      namedLayouts,
-    );
-    expect(chain).toHaveLength(2);
-    expect(chain[0].directory).toBe('');
-    expect(chain[1].directory).toBe('guide');
-  });
-
   it('returns empty chain for layout: false', () => {
     const chain = resolveEffectiveLayoutChain(
       { componentId: 'guide/intro', layout: false },
@@ -887,27 +844,6 @@ describe('resolveEffectiveLayoutChain', () => {
     expect(chain).toHaveLength(0);
   });
 
-  it('replaces innermost layout for named layout', () => {
-    const chain = resolveEffectiveLayoutChain(
-      { componentId: 'guide/intro', layout: 'api' },
-      layouts,
-      namedLayouts,
-    );
-    expect(chain).toHaveLength(2);
-    expect(chain[0].directory).toBe('');
-    expect((chain[1] as { name: string }).name).toBe('api');
-  });
-
-  it('replaces entire chain for exclusive layout', () => {
-    const chain = resolveEffectiveLayoutChain(
-      { componentId: 'guide/intro', layout: '!home' },
-      layouts,
-      namedLayouts,
-    );
-    expect(chain).toHaveLength(1);
-    expect((chain[0] as { name: string }).name).toBe('home');
-  });
-
   it('returns named layout as sole entry when no default chain', () => {
     const chain = resolveEffectiveLayoutChain(
       { componentId: 'about', layout: 'home' },
diff --git a/packages/void/test/unit/parse-filename.test.ts b/packages/void/test/unit/parse-filename.test.ts
index 057abae05..1946ddd2f 100644
--- a/packages/void/test/unit/parse-filename.test.ts
+++ b/packages/void/test/unit/parse-filename.test.ts
@@ -165,11 +165,6 @@ describe('parseRouteFilename', () => {
       const r = parseRouteFilename('api/hello.ts');
       expect(r.filePath).toBe('api/hello.ts');
     });
-
-    it('methods starts empty (populated by scanner)', () => {
-      const r = parseRouteFilename('api/hello.ts');
-      expect(r.methods).toEqual([]);
-    });
   });
 });
 
diff --git a/packages/void/test/unit/platform-access-preflight.test.ts b/packages/void/test/unit/platform-access-preflight.test.ts
index d4251702f..b3a747408 100644
--- a/packages/void/test/unit/platform-access-preflight.test.ts
+++ b/packages/void/test/unit/platform-access-preflight.test.ts
@@ -2,7 +2,6 @@ import { createHash } from 'node:crypto';
 import {
   createPlatformDeploymentManifest,
   createPlatformInstallationManifest,
-  type PlatformAccessProtection,
 } from '@void/platform';
 import { describe, expect, it, vi } from 'vite-plus/test';
 import { verifyInstalledPlatformAccessProtection } from '../../src/cli/platform-access-preflight.ts';
@@ -27,7 +26,7 @@ const manifest = createPlatformInstallationManifest({
   ownershipNonce: '0123456789abcdef0123456789abcdef',
   platformVersion: '1.0.0',
 });
-async function fixture() {
+async function fixture(options: { loseFirstCreate?: boolean } = {}) {
   const env = platformAccessFixture();
   let state: PlatformAccessCheckpoint = {
     version: 1,
@@ -39,22 +38,25 @@ async function fixture() {
       .slice(0, 32),
     resources: {},
   };
-  const result = await provisionPlatformAccess(
-    env.client,
-    {
-      accountId: 'account',
-      installationId: manifest.id,
-      apiUrl,
-      proxyUrl,
-      identityProviderIds: ['company-idp'],
-      policyIds: ['employees'],
-      protection: {},
-    },
-    state,
-    (value) => {
-      state = structuredClone(value);
-    },
-  );
+  const provisionInput = {
+    accountId: 'account',
+    installationId: manifest.id,
+    apiUrl,
+    proxyUrl,
+    identityProviderIds: ['company-idp'],
+    policyIds: ['employees'],
+    protection: {},
+  };
+  const save = (value: PlatformAccessCheckpoint) => {
+    state = structuredClone(value);
+  };
+  if (options.loseFirstCreate) {
+    env.loseNextApplicationResponse();
+    await expect(provisionPlatformAccess(env.client, provisionInput, state, save)).rejects.toThrow(
+      'response lost',
+    );
+  }
+  const result = await provisionPlatformAccess(env.client, provisionInput, state, save);
   env.calls.length = 0;
   const input = {
     client: {
@@ -194,24 +196,12 @@ describe('installed Access protection preflight', () => {
       if (change === 'checkpoint') {
         input.checkpoint.accessProvisioningJson = '';
       }
-      await expect(verifyInstalledPlatformAccessProtection(input)).rejects.toThrow('platform:');
+      await expect(verifyInstalledPlatformAccessProtection(input)).rejects.toThrow(
+        change === 'audience' ? 'active platform protection' : 'platform:',
+      );
       expect(env.calls.every((call) => call.method === 'GET')).toBe(true);
     },
   );
-  it('uses active database audiences instead of restoring a stale workstation configuration', async () => {
-    const { env, input } = await fixture();
-    const changed: PlatformAccessProtection = {
-      ...input.protection,
-      applications: input.protection.applications.map((entry) => ({
-        ...entry,
-        audience: 'new-live-gate',
-      })),
-    };
-    await expect(
-      verifyInstalledPlatformAccessProtection({ ...input, protection: changed }),
-    ).rejects.toThrow('active platform protection');
-    expect(env.calls.every((call) => call.method === 'GET')).toBe(true);
-  });
   it('reads a separately managed identity account without using the deployment account for Access', async () => {
     const { env, state, input } = await fixture();
     const requested: Array<string> = [];
@@ -244,53 +234,8 @@ describe('installed Access protection preflight', () => {
     expect(env.calls.every((call) => call.method === 'GET')).toBe(true);
   });
   it('accepts a protection application reconciled after its create response was lost', async () => {
-    const env = platformAccessFixture();
-    let state: PlatformAccessCheckpoint = {
-      version: 1,
-      accountId: 'account',
-      installationId: manifest.id,
-      nonce: createHash('sha256')
-        .update(`void-access:${manifest.ownershipNonce}`)
-        .digest('hex')
-        .slice(0, 32),
-      resources: {},
-    };
-    const provisionInput = {
-      accountId: 'account',
-      installationId: manifest.id,
-      apiUrl,
-      proxyUrl,
-      identityProviderIds: ['company-idp'],
-      policyIds: ['employees'],
-      protection: {},
-    };
-    const save = (value: PlatformAccessCheckpoint) => {
-      state = structuredClone(value);
-    };
-    env.loseNextApplicationResponse();
-    await expect(provisionPlatformAccess(env.client, provisionInput, state, save)).rejects.toThrow(
-      'response lost',
-    );
-    const result = await provisionPlatformAccess(env.client, provisionInput, state, save);
+    const { state, input } = await fixture({ loseFirstCreate: true });
     expect(state.resources.protection).toMatchObject({ pending: false });
-    await verifyInstalledPlatformAccessProtection({
-      client: {
-        ...env.transport,
-        listWorkerDomains: vi.fn(async () => []),
-        listWorkerServiceRoutes: vi.fn(async () => []),
-      },
-      manifest,
-      plan: { apiUrl, proxyUrl, actions: [] },
-      protection: result.protection!,
-      checkpoint: {
-        accessProvisioningJson: JSON.stringify(state),
-        accessSetupSpecJson: JSON.stringify({
-          mode: 'create',
-          identityProviderIds: ['company-idp'],
-          policyIds: ['employees'],
-        }),
-        accessCredentialsJson: JSON.stringify(result.credentials),
-      },
-    });
+    await verifyInstalledPlatformAccessProtection(input);
   });
 });
diff --git a/packages/void/test/unit/platform-access-provision.test.ts b/packages/void/test/unit/platform-access-provision.test.ts
index 420de47b4..f6b300080 100644
--- a/packages/void/test/unit/platform-access-provision.test.ts
+++ b/packages/void/test/unit/platform-access-provision.test.ts
@@ -15,6 +15,13 @@ const base: PlatformAccessProvisionInput = {
   identityProviderIds: ['company-idp'],
   policyIds: ['employees'],
 };
+const fresh = (): PlatformAccessCheckpoint => ({
+  version: 1,
+  accountId: base.accountId,
+  installationId: base.installationId,
+  nonce: '0123456789abcdef0123456789abcdef',
+  resources: {},
+});
 
 describe('Cloudflare Access provisioning', () => {
   it.each(['', '  ', undefined, null])(
@@ -40,7 +47,7 @@ describe('Cloudflare Access provisioning', () => {
       provisionPlatformAccess(
         env.client,
         { ...base, login: { id: 'access', label: 'Company Access' } },
-        undefined,
+        fresh(),
         () => {},
       ),
     ).rejects.toThrow('Cloudflare Access did not return identity provider');
@@ -71,7 +78,7 @@ describe('Cloudflare Access provisioning', () => {
         protection: { applicationId: 'external-gate' },
         serviceToken: { id: 'ci-token', clientId: 'external-ci', clientSecret: 'external-secret' },
       },
-      undefined,
+      fresh(),
       () => {},
     );
     expect(output.resources).toEqual(
@@ -82,18 +89,9 @@ describe('Cloudflare Access provisioning', () => {
     );
     expect(env.calls.every((call) => call.method === 'GET')).toBe(true);
   });
-  it('performs no Access probes or writes when neither capability is selected', async () => {
-    const env = fixture();
-    expect(
-      await provisionPlatformAccess(env.client, base, undefined, () => {
-        throw new Error('No checkpoint expected');
-      }),
-    ).toEqual({ resources: [] });
-    expect(env.calls).toHaveLength(0);
-  });
   it('creates OIDC login without a perimeter application or service token', async () => {
     const env = fixture();
-    let state: PlatformAccessCheckpoint | undefined;
+    let state = fresh();
     const input = { ...base, login: { id: 'access', label: 'Company Access' } };
     const result = await provisionPlatformAccess(env.client, input, state, (value) => {
       state = structuredClone(value);
@@ -118,7 +116,7 @@ describe('Cloudflare Access provisioning', () => {
     const result = await provisionPlatformAccess(
       env.client,
       { ...base, protection: {} },
-      undefined,
+      fresh(),
       (state) => {
         saved = structuredClone(state);
       },
@@ -154,7 +152,7 @@ describe('Cloudflare Access provisioning', () => {
       const env = fixture();
       Object.assign(env.policy, replacement);
       await expect(
-        provisionPlatformAccess(env.client, { ...base, protection: {} }, undefined, () => {}),
+        provisionPlatformAccess(env.client, { ...base, protection: {} }, fresh(), () => {}),
       ).rejects.toThrow();
       expect(env.calls.some((call) => call.method === 'POST')).toBe(false);
     }
@@ -172,7 +170,7 @@ describe('Cloudflare Access provisioning', () => {
       provisionPlatformAccess(
         env.client,
         { ...base, login: { id: 'access', label: 'Access' }, protection: {} },
-        undefined,
+        fresh(),
         () => {},
       ),
     ).rejects.toThrow('overlaps');
@@ -181,7 +179,7 @@ describe('Cloudflare Access provisioning', () => {
 
   it('reconciles an ambiguous create without duplicating the app or inventing its secret', async () => {
     const env = fixture();
-    let state: PlatformAccessCheckpoint | undefined;
+    let state = fresh();
     const save = (value: PlatformAccessCheckpoint) => {
       state = structuredClone(value);
     };
@@ -232,7 +230,7 @@ describe('Cloudflare Access provisioning', () => {
           clientSecret: 'external-secret',
         },
       },
-      undefined,
+      fresh(),
       () => {},
     );
     expect(result.resources).toMatchObject([{ id: 'external', adopted: true }]);
diff --git a/packages/void/test/unit/platform-access-setup.test.ts b/packages/void/test/unit/platform-access-setup.test.ts
index 5aa94019d..b2a0ffe75 100644
--- a/packages/void/test/unit/platform-access-setup.test.ts
+++ b/packages/void/test/unit/platform-access-setup.test.ts
@@ -38,36 +38,6 @@ afterEach(() => {
 });
 
 describe('Access installer setup', () => {
-  it('creates and resumes login with the unnamed built-in Cloudflare provider', async () => {
-    vi.spyOn(console, 'log').mockImplementation(() => {});
-    const env = platformAccessFixture();
-    env.identityProviders[0] = { id: 'company-idp', type: 'cloudflare', name: '' };
-    const checkpoint: Record<string, string> = {};
-    const input = {
-      plan,
-      ownershipNonce: 'owned-installation',
-      login: { id: 'access', label: 'Cloudflare Access' },
-      protection: false,
-      yes: true,
-      spec: {
-        mode: 'create' as const,
-        identityProviderIds: ['company-idp'],
-        policyIds: ['employees'],
-      },
-      client: env.transport as PlatformCloudflareClient,
-      checkpoint,
-      save: (values: Record<string, string>) => Object.assign(checkpoint, values),
-    };
-    const result = await preparePlatformAccessSetup(input);
-    expect(result?.login?.configuration.kind).toBe('cloudflare-access');
-    expect([...env.apps.values()][0]).toMatchObject({
-      allowed_idps: ['company-idp'],
-      policies: [{ id: 'employees', precedence: 1 }],
-    });
-    expect(await preparePlatformAccessSetup({ ...input, spec: undefined })).toEqual(result);
-    expect(env.calls.filter((call) => call.method === 'POST')).toHaveLength(1);
-    expect(env.tokens.size).toBe(0);
-  });
   it('publishes recovered ambiguous resource IDs without replacing deployment configuration', () => {
     const deployment = createPlatformDeploymentManifest({
       application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
diff --git a/packages/void/test/unit/platform-args.test.ts b/packages/void/test/unit/platform-args.test.ts
index 84330b149..da40dbabf 100644
--- a/packages/void/test/unit/platform-args.test.ts
+++ b/packages/void/test/unit/platform-args.test.ts
@@ -195,39 +195,6 @@ describe('platform args', () => {
     });
   });
 
-  it('parses explicit lifecycle acknowledgement', () => {
-    expect(parsePlatformArgs(['upgrade', '--yes'])).toMatchObject({
-      subcommand: 'upgrade',
-      yes: true,
-    });
-    expect(parsePlatformArgs(['install', '--yes'])).toMatchObject({
-      subcommand: 'install',
-      yes: true,
-    });
-    expect(parsePlatformArgs(['uninstall', '--purge-data', '--yes'])).toMatchObject({
-      subcommand: 'uninstall',
-      purgeData: true,
-      yes: true,
-    });
-  });
-
-  it('parses a non-interactive installation', () => {
-    expect(
-      parsePlatformArgs([
-        'install',
-        '--name',
-        'company',
-        '--application-domain',
-        'apps.example.com',
-        '--zone',
-        'example.com',
-        '--account',
-        'abc',
-        '--plan',
-      ]),
-    ).toMatchObject({ subcommand: 'install', name: 'company', plan: true });
-  });
-
   it('fails closed for every unacknowledged non-interactive mutation', () => {
     for (const command of [
       'install',
diff --git a/packages/void/test/unit/platform-auth.test.ts b/packages/void/test/unit/platform-auth.test.ts
index df3f47fff..6275bc0da 100644
--- a/packages/void/test/unit/platform-auth.test.ts
+++ b/packages/void/test/unit/platform-auth.test.ts
@@ -1,6 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import type { CloudflareAuthRunResult } from '../../src/cli/cloudflare-auth.ts';
-import { cloudflareAuthEnvironment } from '../../src/cli/cloudflare-auth.ts';
 import {
   assertPlatformOperatorCredentialCanApplyPlan,
   readWranglerOAuthCredential,
@@ -196,16 +195,6 @@ describe('platform Cloudflare authentication', () => {
     ).not.toThrow();
   });
 
-  it('uses explicit environment credentials without invoking Wrangler', async () => {
-    process.env.CLOUDFLARE_API_TOKEN = 'ci-token';
-    const runWrangler = vi.fn();
-
-    await expect(
-      resolvePlatformCloudflareCredential({ interactive: false, runWrangler }),
-    ).resolves.toEqual({ source: 'environment', token: 'ci-token' });
-    expect(runWrangler).not.toHaveBeenCalled();
-  });
-
   it.each([false, true])(
     'uses saved management authority before browser login (interactive: %s)',
     async (interactive) => {
@@ -304,18 +293,6 @@ describe('platform Cloudflare authentication', () => {
       })),
     ).resolves.toBeNull();
   });
-
-  it('does not expose platform recovery or service secrets to Wrangler auth commands', () => {
-    expect(
-      cloudflareAuthEnvironment({
-        CF_ACCESS_CLIENT_SECRET: 'access-secret',
-        DATABASE_URL: 'postgres://secret',
-        PATH: '/bin',
-        VOID_PLATFORM_GITHUB_CLIENT_SECRET: 'github-secret',
-        VOID_PLATFORM_RECOVERY_KEY: 'recovery-secret',
-      }),
-    ).toEqual({ CLOUDFLARE_AUTH_USE_KEYRING: 'true', PATH: '/bin' });
-  });
 });
 
 describe('platform authentication during input', () => {
diff --git a/packages/void/test/unit/platform-cloudflare.test.ts b/packages/void/test/unit/platform-cloudflare.test.ts
index 0f9d6cbd1..254de6b9b 100644
--- a/packages/void/test/unit/platform-cloudflare.test.ts
+++ b/packages/void/test/unit/platform-cloudflare.test.ts
@@ -196,7 +196,7 @@ describe('platform Cloudflare client', () => {
     ).resolves.toBe(false);
   });
 
-  it('pins every Wrangler Cloudflare transport selector exactly once', () => {
+  it('pins the Cloudflare API base from the environment at construction', () => {
     const keys = [
       'CLOUDFLARE_API_BASE_URL',
       'CF_API_BASE_URL',
@@ -206,11 +206,6 @@ describe('platform Cloudflare client', () => {
     const original = Object.fromEntries(keys.map((key) => [key, process.env[key]]));
     const cases: Array<[Record<string, string>, string]> = [
       [{ CF_API_BASE_URL: 'https://legacy.example/client/v4' }, 'https://legacy.example/client/v4'],
-      [{ WRANGLER_API_ENVIRONMENT: 'staging' }, 'https://api.staging.cloudflare.com/client/v4'],
-      [
-        { CLOUDFLARE_COMPLIANCE_REGION: 'fedramp_high' },
-        'https://api.fed.cloudflare.com/client/v4',
-      ],
       [
         {
           CLOUDFLARE_COMPLIANCE_REGION: 'fedramp_high',
@@ -218,7 +213,6 @@ describe('platform Cloudflare client', () => {
         },
         'https://api.fed.staging.cloudflare.com/client/v4',
       ],
-      [{ CLOUDFLARE_API_BASE_URL: '' }, ''],
     ];
     try {
       for (const [environment, expected] of cases) {
@@ -510,34 +504,6 @@ describe('platform Cloudflare client', () => {
     expect(paths.at(-1)).toBe('/client/v4/zones/zone/custom_hostnames');
   });
 
-  it('names missing runtime permissions without exposing the token', async () => {
-    const token = 'runtime-token-that-must-stay-secret';
-    const client = new PlatformCloudflareClient(token, {
-      fetcher: async () => {
-        return Response.json(
-          { errors: [{ message: 'permission denied' }], success: false },
-          { status: 403 },
-        );
-      },
-    });
-
-    let message = '';
-    try {
-      await verifyPlatformRuntimeTokenPermissions(client, {
-        accountId: 'account',
-        applicationDomain: 'example.com',
-        customDomains: false,
-        zoneId: 'zone',
-      });
-    } catch (error) {
-      message = String(error);
-    }
-    expect(message).toContain('Hyperdrive → Write');
-    expect(message).toContain('HTTP 403');
-    expect(message).toContain('token is valid, scoped to this account');
-    expect(message).not.toContain(token);
-  });
-
   it.each([401, 403, 404, 429, 500, 503])(
     'distinguishes HTTP %s during token preflight without leaking upstream text',
     async (status) => {
@@ -562,6 +528,8 @@ describe('platform Cloudflare client', () => {
       expect(message).not.toContain('upstream echoed');
       if (status === 401 || status === 403) {
         expect(message).toContain('Cloudflare denied');
+        expect(message).toContain('token is valid, scoped to this account');
+        expect(message).toContain('Hyperdrive → Write');
       } else if (status === 429) {
         expect(message).toContain('rate-limited');
       } else {
@@ -589,70 +557,6 @@ describe('platform Cloudflare client', () => {
     await expect(failure).rejects.not.toThrow('Required permission or scope');
   });
 
-  it('refuses unattended custom-domain deletion without a generation precondition', async () => {
-    const requests: Array<string> = [];
-    const client = new PlatformCloudflareClient('token', {
-      fetcher: async (input) => {
-        requests.push(String(input));
-        return Response.json({ result: [], success: true });
-      },
-    });
-
-    await expect(
-      client.removeRoutes('account', null, {
-        customDomains: [{ hostname: 'api.example.com', id: 'domain-id', service: 'void-api' }],
-        routes: [],
-      }),
-    ).rejects.toThrow('does not support conditional Worker traffic deletion');
-    expect(requests).toEqual([]);
-  });
-
-  it('refuses unattended route deletion before reading mutable zone state', async () => {
-    const requests: Array<string> = [];
-    const client = new PlatformCloudflareClient('token', {
-      fetcher: async (input) => {
-        const url = String(input);
-        requests.push(url);
-        if (url.includes('/zones/')) {
-          return Response.json(
-            { errors: [{ message: 'missing' }], result: null, success: false },
-            { status: 404 },
-          );
-        }
-        return Response.json({ result: [], success: true });
-      },
-    });
-
-    await expect(
-      client.removeRoutes('account', 'removed-zone', {
-        customDomains: [{ hostname: 'api.example.com', id: 'domain-id', service: 'void-api' }],
-        routes: [{ id: 'route-id', pattern: 'apps.example.com/*', script: 'void-api' }],
-      }),
-    ).rejects.toThrow('does not support conditional Worker traffic deletion');
-    expect(requests).toEqual([]);
-  });
-
-  it('paginates namespace discovery without a title filter', async () => {
-    const pages: Array<string> = [];
-    const client = new PlatformCloudflareClient('token', {
-      fetcher: async (input) => {
-        const url = new URL(String(input));
-        pages.push(url.searchParams.get('page') ?? '');
-        const page = url.searchParams.get('page');
-        const result =
-          page === '1'
-            ? Array.from({ length: 100 }, (_, index) => ({
-                id: `id-${index}`,
-                title: `namespace-${index}`,
-              }))
-            : [{ id: 'id-100', title: 'namespace-100' }];
-        return Response.json({ success: true, result });
-      },
-    });
-    await expect(client.listKvNamespaces('account')).resolves.toHaveLength(101);
-    expect(pages).toEqual(['1', '2']);
-  });
-
   it('filters KV namespaces by exact title instead of trusting an unsupported API filter', async () => {
     const entries = [
       { id: 'routing-id', title: 'void-example-routing' },
@@ -1161,14 +1065,15 @@ describe('platform Cloudflare client', () => {
     );
   });
 
-  it('reads an AI Gateway creation time without a zone as UTC, whatever the local zone', async () => {
+  it('reads AI Gateway creation times as UTC, with or without a zone', async () => {
     const client = new PlatformCloudflareClient('token', {
       fetcher: async () =>
         Response.json({
           success: true,
-          // The live API answers in this form.
           result: [
+            // The live API answers in this form.
             { id: 'void-team', created_at: '2026-10-05 18:29:14' },
+            { id: 'zoned', created_at: '2026-09-14T00:00:01.400Z' },
             { id: 'odd', created_at: 'not a time' },
           ],
         }),
@@ -1176,6 +1081,7 @@ describe('platform Cloudflare client', () => {
 
     await expect(client.listAiGateways('account')).resolves.toEqual([
       { createdAt: '2026-10-05T18:29:14.000Z', id: 'void-team', name: 'void-team' },
+      { createdAt: '2026-09-14T00:00:01.400Z', id: 'zoned', name: 'zoned' },
       { id: 'odd', name: 'odd' },
     ]);
   });
@@ -1282,21 +1188,6 @@ describe('platform Cloudflare client', () => {
     ]);
   });
 
-  it('reports when Cloudflare created each AI Gateway', async () => {
-    const client = new PlatformCloudflareClient('token', {
-      fetcher: async () =>
-        Response.json({
-          success: true,
-          result: [{ id: 'void-team', created_at: '2026-09-14T00:00:01.400Z' }, { id: 'other' }],
-        }),
-    });
-
-    await expect(client.listAiGateways('account')).resolves.toEqual([
-      { createdAt: '2026-09-14T00:00:01.400Z', id: 'void-team', name: 'void-team' },
-      { id: 'other', name: 'other' },
-    ]);
-  });
-
   it('creates and deletes the proxied wildcard application DNS record in its zone', async () => {
     const requests: Array<{ body: unknown; method: string; pathname: string }> = [];
     const dns = {
@@ -1351,24 +1242,6 @@ describe('platform Cloudflare client', () => {
     ]);
   });
 
-  it('never calls Cloudflare for non-empty unattended traffic cleanup', async () => {
-    let requests = 0;
-    const client = new PlatformCloudflareClient('token', {
-      fetcher: async () => {
-        requests++;
-        return Response.json({ success: true, result: null });
-      },
-    });
-
-    await expect(
-      client.removeRoutes('account', 'zone', {
-        customDomains: [],
-        routes: [{ id: 'route', pattern: 'apps.example.com/*', script: 'worker' }],
-      }),
-    ).rejects.toThrow('does not support conditional Worker traffic deletion');
-    expect(requests).toBe(0);
-  });
-
   it('inventories Worker custom domains before installer deployment', async () => {
     const pages: Array<string | null> = [];
     const client = new PlatformCloudflareClient('token', {
diff --git a/packages/void/test/unit/platform-command-output.test.ts b/packages/void/test/unit/platform-command-output.test.ts
index 7f89d17c1..ad07b7874 100644
--- a/packages/void/test/unit/platform-command-output.test.ts
+++ b/packages/void/test/unit/platform-command-output.test.ts
@@ -1,6 +1,5 @@
 import { afterEach, expect, it, vi } from 'vite-plus/test';
-import { runPlatformWranglerAtApiBase } from '../../src/cli/platform-installer-process.ts';
-import { runPlatformWrangler } from '../../src/cli/platform-installer.ts';
+import { runPlatformWrangler } from '../../src/cli/platform-installer-process.ts';
 
 const mocks = vi.hoisted(() => ({ run: vi.fn() }));
 vi.mock('../../src/cli/provision.ts', async (importOriginal) => ({
@@ -15,25 +14,6 @@ afterEach(() => {
   vi.restoreAllMocks();
 });
 
-it('pins the selected operator token for serial and parallel platform operations', async () => {
-  mocks.run.mockResolvedValue({ status: 0, stdout: '', stderr: '' });
-  for (const parallel of [false, true]) {
-    await runPlatformWranglerAtApiBase(
-      { type: 'versions.upload', configPath: '/test/wrangler.json' },
-      'account',
-      '/test',
-      true,
-      'https://api.example.com/client/v4',
-      parallel,
-      'selected-manager',
-    );
-    expect(mocks.run).toHaveBeenLastCalledWith(
-      expect.anything(),
-      expect.objectContaining({ apiToken: 'selected-manager', accountId: 'account' }),
-    );
-  }
-});
-
 it.each([true, false])(
   'keeps successful platform command output quiet (capture: %s)',
   async (capture) => {
diff --git a/packages/void/test/unit/platform-connect.test.ts b/packages/void/test/unit/platform-connect.test.ts
index acac53e21..3bf5618e5 100644
--- a/packages/void/test/unit/platform-connect.test.ts
+++ b/packages/void/test/unit/platform-connect.test.ts
@@ -6,7 +6,7 @@ import {
   createPlatformDeploymentManifest,
   createPlatformInstallationManifest,
 } from '@void/platform';
-import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
+import { describe, expect, it, vi } from 'vite-plus/test';
 import { discoverPlatform, runPlatformCommand } from '../../src/cli/platform-cmd.ts';
 import {
   savePlatformConnection,
@@ -34,13 +34,6 @@ const document = {
   schemaVersion: 1,
 };
 
-afterEach(() => {
-  delete process.env.CF_ACCESS_CLIENT_ID;
-  delete process.env.CF_ACCESS_CLIENT_SECRET;
-  delete process.env.CF_ACCESS_TOKEN;
-  delete process.env.VOID_ACCESS_ORIGIN;
-});
-
 describe('platform discovery', () => {
   it('groups the current platform first and explains how to select another platform', async () => {
     const directory = mkdtempSync(join(tmpdir(), 'void-list-'));
@@ -278,22 +271,6 @@ describe('platform discovery', () => {
     expect(request).not.toHaveBeenCalled();
   });
 
-  it('requires a proxy origin even for former hosted discovery documents', async () => {
-    const legacyHosted = { ...document, apiUrl: 'https://api.void.cloud' } as Record<
-      string,
-      unknown
-    >;
-    delete legacyHosted.proxyUrl;
-    const response = new Response(JSON.stringify(legacyHosted));
-    Object.defineProperty(response, 'url', {
-      value: 'https://api.void.cloud/.well-known/void-platform',
-    });
-
-    await expect(discoverPlatform('https://api.void.cloud', async () => response)).rejects.toThrow(
-      'proxyUrl',
-    );
-  });
-
   it('rejects custom discovery documents without a proxy origin', async () => {
     const incomplete = { ...document } as Record<string, unknown>;
     delete incomplete.proxyUrl;
@@ -316,49 +293,4 @@ describe('platform discovery', () => {
       'origin mismatch',
     );
   });
-
-  it('authenticates discovery for Access-gated Void Cloud staging', async () => {
-    process.env.CF_ACCESS_CLIENT_ID = 'client-id';
-    process.env.CF_ACCESS_CLIENT_SECRET = 'client-secret';
-    process.env.VOID_ACCESS_ORIGIN = 'https://api.staging.void.cloud';
-    const stagingDocument = {
-      ...document,
-      apiUrl: 'https://api.staging.void.cloud',
-      proxyUrl: 'https://proxy.staging.void.cloud',
-    };
-    const response = new Response(JSON.stringify(stagingDocument));
-    Object.defineProperty(response, 'url', {
-      value: 'https://api.staging.void.cloud/.well-known/void-platform',
-    });
-    let request: RequestInit | undefined;
-
-    await discoverPlatform('https://api.staging.void.cloud', async (_input, init) => {
-      request = init;
-      return response;
-    });
-
-    expect(request?.headers).toMatchObject({
-      'CF-Access-Client-Id': 'client-id',
-      'CF-Access-Client-Secret': 'client-secret',
-    });
-    expect(request?.redirect).toBe('manual');
-  });
-
-  it('does not forward hosted Access credentials to a user platform origin', async () => {
-    process.env.CF_ACCESS_CLIENT_ID = 'client-id';
-    process.env.CF_ACCESS_CLIENT_SECRET = 'client-secret';
-    const response = new Response(JSON.stringify(document));
-    Object.defineProperty(response, 'url', {
-      value: 'https://api.example.com/.well-known/void-platform',
-    });
-    let request: RequestInit | undefined;
-
-    await discoverPlatform('https://api.example.com', async (_input, init) => {
-      request = init;
-      return response;
-    });
-
-    expect(request?.headers).toEqual({ Accept: 'application/json' });
-    expect(request?.redirect).toBe('manual');
-  });
 });
diff --git a/packages/void/test/unit/platform-database-lock.test.ts b/packages/void/test/unit/platform-database-lock.test.ts
index d8075e346..ba2733ff9 100644
--- a/packages/void/test/unit/platform-database-lock.test.ts
+++ b/packages/void/test/unit/platform-database-lock.test.ts
@@ -1,9 +1,9 @@
 import { PGlite } from '@electric-sql/pglite';
 import { getPlatformRuntimeDirectory, readPlatformRuntimeManifest } from '@void/platform/installer';
 import { afterEach, beforeEach, expect, it, vi } from 'vite-plus/test';
+import { claimPlatformDatabase } from '../../src/cli/platform-installer-database.ts';
 import {
   acquirePlatformDatabaseLifecycleLock,
-  claimPlatformDatabase,
   type PlatformDatabaseLifecycleLock,
 } from '../../src/cli/platform-installer.ts';
 
diff --git a/packages/void/test/unit/platform-database-migrations.test.ts b/packages/void/test/unit/platform-database-migrations.test.ts
index 36109ba32..3ae8c25b9 100644
--- a/packages/void/test/unit/platform-database-migrations.test.ts
+++ b/packages/void/test/unit/platform-database-migrations.test.ts
@@ -9,7 +9,7 @@ import { afterEach, describe, expect, it } from 'vite-plus/test';
 import {
   inspectPlatformDatabaseStateConnection,
   preparePlatformDatabaseConnection,
-} from '../../src/cli/platform-installer.ts';
+} from '../../src/cli/platform-installer-database.ts';
 
 let database: PGlite | undefined;
 
diff --git a/packages/void/test/unit/platform-database-ssl.test.ts b/packages/void/test/unit/platform-database-ssl.test.ts
index 7e4111f7b..93db55c54 100644
--- a/packages/void/test/unit/platform-database-ssl.test.ts
+++ b/packages/void/test/unit/platform-database-ssl.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
+import { claimPlatformDatabase } from '../../src/cli/platform-installer-database.ts';
 import {
   acquirePlatformDatabaseLifecycleLock,
-  claimPlatformDatabase,
   platformDatabaseClientUrl,
   readPlatformDatabaseLifecycleManifest,
 } from '../../src/cli/platform-installer.ts';
@@ -109,19 +109,6 @@ describe('platform PostgreSQL SSL mode', () => {
     expect(platformDatabaseClientUrl(url)).toBe(url);
   });
 
-  it('connects to a provider URL with sslrootcert=system using Node default CAs', async () => {
-    const warning = vi.spyOn(process, 'emitWarning').mockImplementation(() => {});
-    const { Client } = await vi.importActual<typeof import('pg')>('pg');
-    // Constructing a real pg client parses SSL options, but does not open a connection.
-    const client = new Client({
-      connectionString: platformDatabaseClientUrl(
-        'postgresql://owner:pw@db.example.com:5432/postgres?sslmode=verify-full&sslrootcert=system',
-      ),
-    });
-    expect(client.ssl).toEqual({}); // Node TLS verification defaults remain enabled.
-    expect(warning).not.toHaveBeenCalled();
-  });
-
   it.each([
     ['database claim', claimPlatformDatabase],
     ['lifecycle lock', acquirePlatformDatabaseLifecycleLock],
@@ -143,18 +130,4 @@ describe('platform PostgreSQL SSL mode', () => {
     expect(process.env.DATABASE_URL).toBe(original);
     expect(resolvePlatformInstallDatabaseUrl(checkpoint)).toBe(original);
   });
-
-  it('keeps sslrootcert=system in the saved URL while the claim client uses Node default CAs', async () => {
-    const original =
-      'postgresql://owner:pw@db.example.com/postgres?sslmode=verify-full&sslrootcert=system';
-    const checkpoint = { databaseUrl: original, databaseClaimState: 'claimed' };
-    await expect(
-      claimPlatformDatabase(checkpoint.databaseUrl, 'installation', 'nonce'),
-    ).rejects.toThrow('Stopped before network access.');
-    expect(mocks.pool).toHaveBeenCalledWith({
-      connectionString: 'postgresql://owner:pw@db.example.com/postgres?sslmode=verify-full',
-      max: 1,
-    });
-    expect(checkpoint.databaseUrl).toBe(original);
-  });
 });
diff --git a/packages/void/test/unit/platform-deployment-execution.test.ts b/packages/void/test/unit/platform-deployment-execution.test.ts
index 9611d9812..0338410b7 100644
--- a/packages/void/test/unit/platform-deployment-execution.test.ts
+++ b/packages/void/test/unit/platform-deployment-execution.test.ts
@@ -7,10 +7,10 @@ import {
 } from '@void/platform';
 import { resolvePlatformRuntime } from '@void/platform/installer';
 import { afterEach, expect, it, vi } from 'vite-plus/test';
+import { verifyPlatformDeploymentExecutionDrain } from '../../src/cli/platform-installer-health.ts';
 import {
   installPlatform,
   createPlatformInstallationSecrets,
-  verifyPlatformDeploymentExecutionDrain,
 } from '../../src/cli/platform-installer.ts';
 import { createPlatformInstallPlan } from '../../src/cli/platform-plan.ts';
 import { writeInstallationManifest } from '../../src/cli/platform-registry.ts';
@@ -174,6 +174,7 @@ it.each([1, 0])(
         verifyDeploymentExecutionDrain: checkDrain,
         revalidateBeforeWorkerDeploy: async () => {},
         client: {
+          apiBaseUrl: 'https://api.cloudflare.com/client/v4',
           createZone: provision,
           createAiGateway: provision,
           createDnsRecord: provision,
@@ -184,8 +185,17 @@ it.each([1, 0])(
           createQueue: provision,
           createR2Bucket: provision,
           createDispatchNamespace: provision,
+          deleteKvValue: provision,
+          getWorkerPlainTextBindings: provision,
+          listWorkerDomains: provision,
+          listWorkerNames: provision,
+          listWorkerRoutes: provision,
+          listWorkerServiceRoutes: provision,
+          publishWorkerCustomDomainsSafely: provision,
+          publishWorkerRoutesSafely: provision,
           putKvValue: async () => {},
           putR2Object: async () => {},
+          request: provision,
         },
       }),
     ).rejects.toThrow(pendingDeployments ? 'unfinished' : 'provisioning reached');
diff --git a/packages/void/test/unit/platform-domain.test.ts b/packages/void/test/unit/platform-domain.test.ts
index 7ac841220..5b01cb7a8 100644
--- a/packages/void/test/unit/platform-domain.test.ts
+++ b/packages/void/test/unit/platform-domain.test.ts
@@ -4,10 +4,6 @@ import {
   parsePlatformInstallationManifest,
   recordInstallationResource,
   PLATFORM_APPLICATION_KEY,
-  PLATFORM_PROJECT_INGRESS_SOURCE,
-  platformProjectHostname,
-  platformWorkersDevAliasKey,
-  resolvePlatformApplicationEnvironment,
   type PlatformInstallationManifest,
 } from '@void/platform';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
@@ -119,62 +115,6 @@ describe('platform domain activation', () => {
   it('resumes after DNS and TLS waits without changing the original application before verification', async () => {
     const f = fixture();
     const client = f.client as unknown as PlatformCloudflareClient;
-    const { default: dispatch } = await import(
-      new URL('../../../platform/dist/runtime/dispatch/index.js', import.meta.url).href
-    );
-    const project = { id: 'proj_123456abcdef', slug: 'my-app' };
-    const originalHostname = platformProjectHostname(project, f.manifest.deployment.application);
-    const route = JSON.stringify({ projectId: project.id, workerName: 'user-my-app-dpl_original' });
-    f.values.set(project.slug, route);
-    f.values.set(platformWorkersDevAliasKey(originalHostname), JSON.stringify(project));
-    let count = 0;
-    const userWorker = {
-      fetch: async (request: Request) => {
-        if (request.method === 'POST') {
-          count++;
-        }
-        return Response.json({
-          deployment: 'original',
-          count,
-          origin: new URL(request.url).origin,
-        });
-      },
-    };
-    const dispatchEnv = {
-      PLATFORM_APPLICATION: JSON.stringify(f.manifest.deployment.application),
-      BASE_HOSTNAME: 'test.workers.dev',
-      ROUTING: { get: async (key: string) => f.values.get(key) ?? null },
-      DISPATCH: {
-        get: (name: string) => {
-          expect(name).toBe('user-my-app-dpl_original');
-          return userWorker;
-        },
-      },
-      ANALYTICS: { writeDataPoint: () => {} },
-    };
-    const ingress = (
-      await import(`data:text/javascript,${encodeURIComponent(PLATFORM_PROJECT_INGRESS_SOURCE)}`)
-    ).default;
-    const fetchApp = async (host: string) => {
-      const request = new Request(`https://${host}/api/state`, {
-        method: 'POST',
-        body: 'preserved',
-      });
-      const platformFetch = (request: Request) =>
-        dispatch.fetch(request, dispatchEnv, {
-          waitUntil: () => {},
-        } as unknown as ExecutionContext);
-      const response =
-        host === originalHostname
-          ? await ingress.fetch(request, {
-              VOID_APP_HOSTNAME: host,
-              PLATFORM_DISPATCH: { fetch: platformFetch },
-            })
-          : await platformFetch(request);
-      expect(response.status).toBe(200);
-      return response.json();
-    };
-    expect(await fetchApp(originalHostname)).toMatchObject({ deployment: 'original', count: 1 });
     const pending = await applyPlatformDomain(client, f.manifest, f.target, f.plan, f.dependencies);
     expect(pending.waitingForDns).toBe(true);
     expect(f.current().deployment).toEqual(f.manifest.deployment);
@@ -220,24 +160,11 @@ describe('platform domain activation', () => {
     expect(result.manifest.pendingDomain).toBeUndefined();
     expect(result.manifest.endpoints).toEqual(f.manifest.endpoints);
     expect(result.manifest.deployment.application.baseDomain).toBe('example.com');
+    expect(result.manifest.deployment.application.workersDev).toEqual(
+      f.manifest.deployment.application.workersDev,
+    );
     expect(f.client.createZone).toHaveBeenCalledTimes(1);
     expect(f.client.createDnsRecord).toHaveBeenCalledTimes(1);
-    const originalEnv = {
-      PLATFORM_APPLICATION: JSON.stringify(f.manifest.deployment.application),
-      ROUTING: { get: async (key: string) => f.values.get(key) ?? null },
-    };
-    const activeEnv = await resolvePlatformApplicationEnvironment(originalEnv);
-    expect(platformProjectHostname(project, JSON.parse(activeEnv.PLATFORM_APPLICATION))).toBe(
-      'my-app.example.com',
-    );
-    expect(JSON.parse(originalEnv.PLATFORM_APPLICATION).zoneName).toBe('');
-    expect(await fetchApp('my-app.example.com')).toEqual({
-      deployment: 'original',
-      count: 2,
-      origin: 'https://my-app.example.com',
-    });
-    expect(await fetchApp(originalHostname)).toMatchObject({ deployment: 'original', count: 3 });
-    expect(f.values.get(project.slug)).toBe(route);
     expect(f.client.putKvValue).not.toHaveBeenCalled();
   });
   it('retains the pending domain until the platform finishes protection', async () => {
diff --git a/packages/void/test/unit/platform-install-auth.test.ts b/packages/void/test/unit/platform-install-auth.test.ts
index fd452907a..6441eb502 100644
--- a/packages/void/test/unit/platform-install-auth.test.ts
+++ b/packages/void/test/unit/platform-install-auth.test.ts
@@ -3,7 +3,6 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { parsePlatformArgs } from '../../src/cli/platform-args.ts';
 import type { PlatformCloudflareClient } from '../../src/cli/platform-cloudflare.ts';
 import {
   collectInstallationAuthentication,
@@ -163,10 +162,6 @@ describe('installer login selection', () => {
     await writeFile(file, JSON.stringify(input));
     const selection = await selectInstallationAuthentication(file);
     expect(selection.authentication).toEqual({ providers: ['google'], configurable: true });
-    expect(parsePlatformArgs(['install', '--auth-config', file, '--plan'])).toMatchObject({
-      authConfig: file,
-      plan: true,
-    });
   });
   it('keeps recorded GitHub-only installation selection unchanged', async () => {
     expect(await selectInstallationAuthentication(undefined, { providers: ['github'] })).toEqual({
diff --git a/packages/void/test/unit/platform-install-cutover.test.ts b/packages/void/test/unit/platform-install-cutover.test.ts
index 924bb4df7..264f935b4 100644
--- a/packages/void/test/unit/platform-install-cutover.test.ts
+++ b/packages/void/test/unit/platform-install-cutover.test.ts
@@ -8,11 +8,11 @@ import type { CloudflareOperation } from '@void/deploy-cloudflare';
 import { PLATFORM_DISABLED_KEY, type PlatformInstallationManifest } from '@void/platform';
 import { afterEach, beforeEach, expect, it, vi } from 'vite-plus/test';
 import { hyperdriveOriginFromConnectionString } from '../../src/cli/platform-cloudflare.ts';
+import { verifyPlatformWorkerCutoverVersions } from '../../src/cli/platform-installer-cutover.ts';
+import { type PlatformInstallerDependencies } from '../../src/cli/platform-installer-types.ts';
 import {
   createPlatformInstallationSecrets,
   installPlatform,
-  verifyPlatformWorkerCutoverVersions,
-  type PlatformInstallerDependencies,
 } from '../../src/cli/platform-installer.ts';
 import { createPlatformInstallPlan } from '../../src/cli/platform-plan.ts';
 import { listInstallationManifests } from '../../src/cli/platform-registry.ts';
@@ -258,7 +258,10 @@ async function createFakeCloudflare() {
     putR2Object: async (_account: string, bucket: string, key: string, value: string) => {
       r2.set(`${bucket}/${key}`, value);
     },
-    removeRoutes: async () => {},
+    // Worker reads fall back to the provider process, which this fake models.
+    request: async (path: string): Promise<never> => {
+      throw new Error(`No Cloudflare API read expected: ${path}`);
+    },
   };
   const planningClient = {
     findZone: async (): Promise<never> => {
@@ -367,7 +370,11 @@ async function runInstall(
       }),
     claimDatabase: async () => {},
     client: cloud.client,
-    migrateDatabase: async () => {},
+    prepareDatabase: async () => ({
+      appliedMigrations: 0,
+      previousSchemaDigest: '',
+      schemaDigest: '',
+    }),
     revalidateBeforeWorkerDeploy: async () => {},
     verifyHealth: async () => {},
     ...(options.bootstrapEmail ? { bootstrapEmail: options.bootstrapEmail } : {}),
diff --git a/packages/void/test/unit/platform-installer.test.ts b/packages/void/test/unit/platform-installer.test.ts
index ef5401afc..893c324a6 100644
--- a/packages/void/test/unit/platform-installer.test.ts
+++ b/packages/void/test/unit/platform-installer.test.ts
@@ -35,48 +35,61 @@ import {
   hyperdriveOriginFromConnectionString,
   PlatformCloudflareClient,
 } from '../../src/cli/platform-cloudflare.ts';
+import {
+  resolvePlatformPreviousTriggerConfig,
+  stablePublicEndpointState,
+  withoutCompletedPlatformWorkerMigrations,
+} from '../../src/cli/platform-installer-cutover.ts';
 import {
   acquirePlatformDatabaseLifecycleLockConnection,
-  apiWorkerSecrets,
+  inspectPlatformDatabaseStateConnection,
+  preparePlatformDatabaseConnection,
+  preparePlatformSandboxDrainConnection,
+  readPlatformDatabaseLifecycleManifestConnection,
+} from '../../src/cli/platform-installer-database.ts';
+import {
   bootstrapPlatformSharedEmail,
-  platformWorkerSecretPayload,
-  platformWorkerUploadFingerprint,
-  assertRequiredPlatformSecrets,
+  verifyPlatformHealth,
+  verifyPlatformSandboxDrain,
+} from '../../src/cli/platform-installer-health.ts';
+import {
   classifyPlatformWorkerDeploymentLineage,
-  installPlatform as installPlatformImplementation,
-  claimPlatformDatabaseConnection,
-  createPlatformHealthProbeToken,
-  createPlatformInstallationSecrets,
   inspectNewPlatformWorker,
-  inspectPlatformDatabaseStateConnection,
+  readActivePlatformWorkerSnapshot,
+  readPlatformWorkerDeployments,
+} from '../../src/cli/platform-installer-inspection.ts';
+import { withConditionalPlatformWorkerCreate } from '../../src/cli/platform-installer-process.ts';
+import {
   inventoryUnmanagedPlatformWorkerTraffic,
   isolatePlatformWorkerCustomDomains,
   mergePlatformWorkerTrafficConfig,
-  mergePlatformLiveAuthenticationDeployment,
   mergePreservedTriggerRoutes,
-  preparePlatformDatabaseConnection,
-  preparePlatformSandboxDrainConnection,
-  PlatformWorkerRecoveryIncompleteError,
-  r2BucketConfigHash,
-  readPlatformWorkerDeployments,
-  readPlatformDatabaseLifecycleManifestConnection,
-  readActivePlatformWorkerSnapshot,
-  recoverFailedPlatformWorkerDeployment,
   retainReplacedInstallationResource,
-  resolvePlatformPreviousTriggerConfig,
+  withoutPlatformWorkerTrafficAttachments,
+} from '../../src/cli/platform-installer-resources.ts';
+import {
+  apiWorkerSecrets,
+  assertRequiredPlatformSecrets,
+  createPlatformHealthProbeToken,
+  createPlatformInstallationSecrets,
+  platformWorkerSecretPayload,
   resolveBootstrapGitHubId,
+} from '../../src/cli/platform-installer-secrets.ts';
+import {
+  mergePlatformLiveAuthenticationDeployment,
+  PlatformWorkerRecoveryIncompleteError,
+} from '../../src/cli/platform-installer-types.ts';
+import {
+  platformWorkerUploadFingerprint,
+  recoverFailedPlatformWorkerDeployment,
   restorePlatformWorkerDeployment,
-  stablePublicEndpointState,
-  verifyPlatformHealth,
-  verifyPlatformSandboxDrain,
-  withConditionalPlatformWorkerCreate,
-  withoutCompletedPlatformWorkerMigrations,
-  withoutPlatformWorkerTrafficAttachments,
-} from '../../src/cli/platform-installer.ts';
+} from '../../src/cli/platform-installer-workers.ts';
+import { installPlatform as installPlatformImplementation } from '../../src/cli/platform-installer.ts';
 import { resolvePlatformInstallDatabaseUrl } from '../../src/cli/platform-lifecycle.ts';
 import {
   createPlatformInstallPlan,
   platformProvisionIntentHash,
+  r2BucketConfigHash,
 } from '../../src/cli/platform-plan.ts';
 import {
   listInstallationManifests,
@@ -90,15 +103,35 @@ import {
   completePlatformSetupDraft,
   savePlatformSetupDraft,
 } from '../../src/cli/platform-setup-draft.ts';
+import { resolvePinnedApiBaseUrl } from '../../src/cli/provision.ts';
 
 const directories: Array<string> = [];
 type InstallArguments = Parameters<typeof installPlatformImplementation>;
 type InstallClient = InstallArguments[3]['client'];
+type DefaultedClientMethods =
+  | 'apiBaseUrl'
+  | 'deleteKvValue'
+  | 'disableHyperdriveCaching'
+  | 'getHyperdriveConfig'
+  | 'getWorkerPlainTextBindings'
+  | 'listWorkerDomains'
+  | 'listWorkerNames'
+  | 'listWorkerRoutes'
+  | 'listWorkerServiceRoutes'
+  | 'publishWorkerCustomDomainsSafely'
+  | 'publishWorkerRoutesSafely'
+  | 'request';
 type TestInstallerDependencies = Omit<InstallArguments[3], 'client'> & {
-  client: Omit<InstallClient, 'getHyperdriveConfig' | 'disableHyperdriveCaching'> &
-    Partial<Pick<InstallClient, 'getHyperdriveConfig' | 'disableHyperdriveCaching'>>;
+  client: Omit<InstallClient, DefaultedClientMethods> &
+    Partial<Pick<InstallClient, DefaultedClientMethods>>;
 };
 
+function unexpectedCloudflareCall(name: string) {
+  return async (): Promise<never> => {
+    throw new Error(`Unexpected Cloudflare call: ${name}`);
+  };
+}
+
 // These lifecycle fixtures model an already uncached dedicated database. Cache
 // drift, adoption, and verification failures are exercised by platform-auth-database.test.ts.
 function installPlatform(
@@ -110,6 +143,18 @@ function installPlatform(
   return installPlatformImplementation(plan, secrets, existing, {
     ...dependencies,
     client: {
+      apiBaseUrl: resolvePinnedApiBaseUrl(),
+      deleteKvValue: async () => {},
+      getWorkerPlainTextBindings: unexpectedCloudflareCall('getWorkerPlainTextBindings'),
+      listWorkerDomains: unexpectedCloudflareCall('listWorkerDomains'),
+      listWorkerNames: unexpectedCloudflareCall('listWorkerNames'),
+      listWorkerRoutes: unexpectedCloudflareCall('listWorkerRoutes'),
+      listWorkerServiceRoutes: unexpectedCloudflareCall('listWorkerServiceRoutes'),
+      publishWorkerCustomDomainsSafely: unexpectedCloudflareCall(
+        'publishWorkerCustomDomainsSafely',
+      ),
+      publishWorkerRoutesSafely: unexpectedCloudflareCall('publishWorkerRoutesSafely'),
+      request: unexpectedCloudflareCall('request'),
       ...dependencies.client,
       getHyperdriveConfig:
         dependencies.client.getHyperdriveConfig ??
@@ -127,6 +172,10 @@ const TEST_PLATFORM_JWT_SECRET = 'test-only-platform-jwt-secret-material';
 const TEST_PLATFORM_EMAIL_SIGNING_SECRET = 'test-only-email-signing-secret-material';
 const TEST_PLATFORM_PROJECT_SECRET_KEY = Buffer.alloc(32, 5).toString('base64');
 
+async function prepareDatabase() {
+  return { appliedMigrations: 0, previousSchemaDigest: '', schemaDigest: '' };
+}
+
 function sandboxDrainPreparation(state: 'complete' | 'pending') {
   return {
     admissionProtocol: 3 as const,
@@ -178,6 +227,102 @@ function planningClient() {
   };
 }
 
+const FRESH_SECRETS_INPUT = {
+  bootstrapGitHubId: '583231',
+  bootstrapGitHubLogin: 'octocat',
+  cloudflareApiToken: 'cf-token',
+  databaseUrl: 'postgres://user:password@db.example.com/void',
+  githubClientId: 'github-id',
+  githubClientSecret: 'github-secret',
+  jwtSecret: TEST_PLATFORM_JWT_SECRET,
+  projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
+  r2AccessKeyId: 'r2-id',
+  r2SecretAccessKey: 'r2-secret',
+};
+
+function freshSecrets(
+  overrides: Partial<Parameters<typeof createPlatformInstallationSecrets>[0]> = {},
+) {
+  return createPlatformInstallationSecrets({ ...FRESH_SECRETS_INPUT, ...overrides });
+}
+
+const EXAMPLE_PLAN_INPUT = {
+  accountId: 'account',
+  applicationDomain: 'apps.example.com',
+  controlPlaneDomain: '',
+  dedicatedZone: false,
+  displayName: 'Example',
+  installationSlug: 'example',
+  zoneName: 'example.com',
+};
+
+function examplePlan(
+  existing: Parameters<typeof createPlatformInstallPlan>[2] = null,
+  overrides: Partial<Parameters<typeof createPlatformInstallPlan>[1]> = {},
+) {
+  return createPlatformInstallPlan(
+    planningClient(),
+    { ...EXAMPLE_PLAN_INPUT, ...overrides },
+    existing,
+  );
+}
+
+function useRegistryDirectory(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'void-platform-installer-test-'));
+  directories.push(directory);
+  process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+  return directory;
+}
+
+/** A client for runs that stop before any resource is created. */
+function unusedClient(): TestInstallerDependencies['client'] {
+  const unused = async () => ({ id: 'unused', name: 'unused' });
+  return {
+    createAiGateway: unused,
+    createDispatchNamespace: unused,
+    createDnsRecord: async () => ({
+      content: '100::',
+      id: 'unused',
+      name: 'unused',
+      proxied: true,
+      type: 'AAAA',
+    }),
+    createHyperdrive: unused,
+    createKvNamespace: unused,
+    createQueue: unused,
+    createR2Bucket: unused,
+    createZone: async () => ({ id: 'unused', name: 'unused', nameServers: [], status: 'active' }),
+    putKvValue: async () => {},
+    putR2Object: async () => {},
+  };
+}
+
+/** A client that creates every planned resource in the existing example.com zone. */
+function creatingClient(): TestInstallerDependencies['client'] {
+  let index = 0;
+  const create = async (_account: string, name: string) => ({ id: `id-${index++}`, name });
+  return {
+    createAiGateway: create,
+    createDispatchNamespace: create,
+    createDnsRecord: async (_zone, name) => ({
+      content: '100::',
+      id: `id-${index++}`,
+      name,
+      proxied: true,
+      type: 'AAAA',
+    }),
+    createHyperdrive: async (account, name) => create(account, name),
+    createKvNamespace: create,
+    createQueue: create,
+    createR2Bucket: create,
+    createZone: async () => {
+      throw new Error('existing zone must not be created');
+    },
+    putKvValue: async () => {},
+    putR2Object: async () => {},
+  };
+}
+
 async function listen(server: Server): Promise<string> {
   await new Promise<void>((resolvePromise, rejectPromise) => {
     server.once('error', rejectPromise);
@@ -250,9 +395,7 @@ describe('platform installer', () => {
   ])(
     'installs $kind with Access protection=$protection and initializes auth after deploying the API',
     async ({ kind, protection }) => {
-      const directory = mkdtempSync(join(tmpdir(), 'void-platform-google-install-'));
-      directories.push(directory);
-      process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+      useRegistryDirectory();
       const plan = await createPlatformInstallPlan(
         planningClient(),
         {
@@ -431,7 +574,7 @@ describe('platform installer', () => {
           }
           deployed.push({ config, secrets: payload });
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {},
         initializeAuthentication: async (url, id, token, json) => {
@@ -490,9 +633,7 @@ describe('platform installer', () => {
   ])(
     'installs core Workers without a zone and probes the dispatch hostname (draft: $fromDraft, dashboard: $dashboardUrl)',
     async ({ fromDraft, dashboardUrl }) => {
-      const directory = mkdtempSync(join(tmpdir(), 'void-platform-workers-dev-test-'));
-      directories.push(directory);
-      process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+      useRegistryDirectory();
       const forbidden = async (): Promise<never> => {
         throw new Error('no zone or DNS access allowed');
       };
@@ -523,18 +664,7 @@ describe('platform installer', () => {
         name,
       });
       const configs: Array<Record<string, unknown>> = [];
-      const secrets = createPlatformInstallationSecrets({
-        bootstrapGitHubId: '583231',
-        bootstrapGitHubLogin: 'octocat',
-        cloudflareApiToken: 'test-token',
-        databaseUrl: 'postgres://user:password@db.example.com/testing',
-        githubClientId: 'id',
-        githubClientSecret: 'secret',
-        jwtSecret: TEST_PLATFORM_JWT_SECRET,
-        projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-        r2AccessKeyId: 'id',
-        r2SecretAccessKey: 'secret',
-      });
+      const secrets = freshSecrets();
       const draft = fromDraft
         ? completePlatformSetupDraft(
             savePlatformSetupDraft(plan, resolvePlatformRuntime().manifest.platformVersion),
@@ -578,8 +708,9 @@ describe('platform installer', () => {
           }
           configs.push(config);
         },
-        migrateDatabase: async () => {
+        prepareDatabase: async () => {
           expect(progress.at(-1)).toBe('Applying platform database migrations');
+          return prepareDatabase();
         },
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async (
@@ -632,9 +763,7 @@ describe('platform installer', () => {
   );
 
   it('lifts a left-over uninstall fence before traffic opens', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-uninstall-fence-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDirectory();
     const plan = await createPlatformInstallPlan(
       planningClient(),
       {
@@ -655,65 +784,47 @@ describe('platform installer', () => {
       name,
     });
     const events: Array<string> = [];
-    const result = await installPlatform(
-      plan,
-      createPlatformInstallationSecrets({
-        bootstrapGitHubId: '583231',
-        bootstrapGitHubLogin: 'octocat',
-        cloudflareApiToken: 'test-token',
-        databaseUrl: 'postgres://user:password@db.example.com/fenced',
-        githubClientId: 'id',
-        githubClientSecret: 'secret',
-        jwtSecret: TEST_PLATFORM_JWT_SECRET,
-        projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-        r2AccessKeyId: 'id',
-        r2SecretAccessKey: 'secret',
-      }),
-      null,
-      {
-        claimDatabase,
-        acquireDatabaseLifecycleLock: async () =>
-          Object.assign(async () => {}, {
-            prepareSandboxDrain: async () => sandboxDrainPreparation('complete'),
-            liftProjectZeroTrustFence: async () => {
-              events.push('lift fence');
-            },
-          }),
-        client: {
-          createAiGateway: create,
-          createDnsRecord: async () => {
-            throw new Error('no DNS expected');
-          },
-          createZone: async () => {
-            throw new Error('no zone expected');
-          },
-          createKvNamespace: create,
-          createR2Bucket: create,
-          createQueue: create,
-          createDispatchNamespace: create,
-          createHyperdrive: create,
-          putKvValue: async () => {},
-          deleteKvValue: async (_account, _namespace, key) => {
-            if (key === PLATFORM_DISABLED_KEY) {
-              events.push('enable traffic');
-            }
+    const result = await installPlatform(plan, freshSecrets(), null, {
+      claimDatabase,
+      acquireDatabaseLifecycleLock: async () =>
+        Object.assign(async () => {}, {
+          prepareSandboxDrain: async () => sandboxDrainPreparation('complete'),
+          liftProjectZeroTrustFence: async () => {
+            events.push('lift fence');
           },
-          putR2Object: async () => {},
+        }),
+      client: {
+        createAiGateway: create,
+        createDnsRecord: async () => {
+          throw new Error('no DNS expected');
         },
-        deployWorker: async () => {},
-        migrateDatabase: async () => {},
-        revalidateBeforeWorkerDeploy: async () => {},
-        verifyHealth: async () => {},
+        createZone: async () => {
+          throw new Error('no zone expected');
+        },
+        createKvNamespace: create,
+        createR2Bucket: create,
+        createQueue: create,
+        createDispatchNamespace: create,
+        createHyperdrive: create,
+        putKvValue: async () => {},
+        deleteKvValue: async (_account, _namespace, key) => {
+          if (key === PLATFORM_DISABLED_KEY) {
+            events.push('enable traffic');
+          }
+        },
+        putR2Object: async () => {},
       },
-    );
+      deployWorker: async () => {},
+      prepareDatabase,
+      revalidateBeforeWorkerDeploy: async () => {},
+      verifyHealth: async () => {},
+    });
     expect(result.manifest.status).toBe('installed');
     expect(events).toEqual(['lift fence', 'enable traffic']);
   });
 
   it('keeps traffic disabled and the verified Worker set when shared email bootstrap blocks', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-email-bootstrap-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDirectory();
     const plan = await createPlatformInstallPlan(
       planningClient(),
       {
@@ -730,19 +841,7 @@ describe('platform installer', () => {
       },
       null,
     );
-    const secrets = createPlatformInstallationSecrets({
-      bootstrapGitHubId: '583231',
-      bootstrapGitHubLogin: 'octocat',
-      cloudflareApiToken: 'test-token',
-      databaseUrl: 'postgres://user:password@db.example.com/email',
-      emailEnabled: true,
-      githubClientId: 'id',
-      githubClientSecret: 'secret',
-      jwtSecret: TEST_PLATFORM_JWT_SECRET,
-      projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-      r2AccessKeyId: 'id',
-      r2SecretAccessKey: 'secret',
-    });
+    const secrets = freshSecrets({ emailEnabled: true });
     let index = 0;
     const create = async (_account: string, name: string) => ({
       id: `resource-${index++}`,
@@ -784,7 +883,7 @@ describe('platform installer', () => {
         deployWorker: async (config) => async () => {
           rollbacks.push(String(config.name));
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {},
       }),
@@ -809,16 +908,11 @@ describe('platform installer', () => {
   });
 
   it('requires externally custodied identity keys for a fresh installation', () => {
-    const input = {
-      bootstrapGitHubId: '583231',
-      bootstrapGitHubLogin: 'octocat',
-      cloudflareApiToken: 'cf-token',
-      databaseUrl: 'postgres://user:password@db.example.com/void',
-      githubClientId: 'github-id',
-      githubClientSecret: 'github-secret',
-      r2AccessKeyId: 'r2-id',
-      r2SecretAccessKey: 'r2-secret',
-    };
+    const {
+      jwtSecret: _jwtSecret,
+      projectSecretKey: _projectSecretKey,
+      ...input
+    } = FRESH_SECRETS_INPUT;
 
     expect(() => createPlatformInstallationSecrets(input)).toThrow(
       'VOID_PLATFORM_JWT_SECRET is required',
@@ -863,20 +957,7 @@ describe('platform installer', () => {
   });
 
   it('generates and preserves a dedicated email signing key only for email installations', () => {
-    const freshInput = {
-      bootstrapGitHubId: '583231',
-      bootstrapGitHubLogin: 'octocat',
-      cloudflareApiToken: 'cf-token',
-      databaseUrl: 'postgres://user:password@db.example.com/void',
-      githubClientId: 'github-id',
-      githubClientSecret: 'github-secret',
-      jwtSecret: TEST_PLATFORM_JWT_SECRET,
-      projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-      r2AccessKeyId: 'r2-id',
-      r2SecretAccessKey: 'r2-secret',
-    };
-    const emailDisabled = createPlatformInstallationSecrets({
-      ...freshInput,
+    const emailDisabled = freshSecrets({
       emailSigningSecret: TEST_PLATFORM_EMAIL_SIGNING_SECRET,
     });
     expect(emailDisabled.emailSigningSecret).toBe('');
@@ -886,8 +967,7 @@ describe('platform installer', () => {
     expect(
       platformWorkerSecretPayload('emailGateway', emailDisabled, 'account', 'zone', false),
     ).toBeNull();
-    const existingEmailDisabled = createPlatformInstallationSecrets({
-      ...freshInput,
+    const existingEmailDisabled = freshSecrets({
       emailSigningSecret: TEST_PLATFORM_EMAIL_SIGNING_SECRET,
       existingInstallation: true,
       updateExistingWorkers: true,
@@ -895,8 +975,7 @@ describe('platform installer', () => {
     expect(existingEmailDisabled.emailSigningSecret).toBe('');
     expect(existingEmailDisabled.workerSecretUpdates).not.toHaveProperty('EMAIL_SIGNING_SECRET');
 
-    const freshEmail = createPlatformInstallationSecrets({
-      ...freshInput,
+    const freshEmail = freshSecrets({
       emailEnabled: true,
     });
     expect(Buffer.byteLength(freshEmail.emailSigningSecret, 'utf8')).toBeGreaterThanOrEqual(32);
@@ -916,15 +995,14 @@ describe('platform installer', () => {
     ).toEqual({ EMAIL_SIGNING_SECRET: freshEmail.emailSigningSecret });
 
     expect(() =>
-      createPlatformInstallationSecrets({
-        ...freshInput,
+      freshSecrets({
         emailEnabled: true,
         emailSigningSecret: TEST_PLATFORM_JWT_SECRET,
       }),
     ).toThrow('must be different from VOID_PLATFORM_JWT_SECRET');
 
     const existingInput = {
-      ...freshInput,
+      ...FRESH_SECRETS_INPUT,
       existingInstallation: true,
       emailEnabled: true,
       existingEmailEnabled: true,
@@ -974,8 +1052,7 @@ describe('platform installer', () => {
       EMAIL_SIGNING_SECRET: TEST_PLATFORM_EMAIL_SIGNING_SECRET,
     });
 
-    const disabling = createPlatformInstallationSecrets({
-      ...freshInput,
+    const disabling = freshSecrets({
       checkpoint: { emailSigningSecret: TEST_PLATFORM_EMAIL_SIGNING_SECRET },
       emailSigningSecret: 'replacement-signal-that-must-not-override-recovery',
       existingInstallation: true,
@@ -988,16 +1065,14 @@ describe('platform installer', () => {
       TEST_PLATFORM_EMAIL_SIGNING_SECRET,
     );
     expect(() =>
-      createPlatformInstallationSecrets({
-        ...freshInput,
+      freshSecrets({
         checkpoint: { emailSigningSecret: 'short' },
         existingInstallation: true,
         existingEmailEnabled: true,
       }),
     ).toThrow('at least 32 bytes');
     expect(
-      createPlatformInstallationSecrets({
-        ...freshInput,
+      freshSecrets({
         existingInstallation: true,
         existingEmailEnabled: true,
       }).emailSigningSecret,
@@ -1032,9 +1107,7 @@ describe('platform installer', () => {
   });
 
   it('does not let an email-disable plan bypass an unresolved email secret update', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-email-secret-authority-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDirectory();
     const currentDeployment = createPlatformDeploymentManifest({
       application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
       capabilities: { email: true },
@@ -1070,19 +1143,7 @@ describe('platform installer', () => {
       '2026-09-20T00:00:02.000Z',
     );
     writeInstallationManifest(manifest);
-    const currentPlan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      manifest,
-    );
+    const currentPlan = await examplePlan(manifest);
     const plan = {
       ...currentPlan,
       deployment: createPlatformDeploymentManifest({
@@ -1090,20 +1151,10 @@ describe('platform installer', () => {
         capabilities: { ...currentPlan.deployment.capabilities, email: false },
       }),
     };
-    const secrets = createPlatformInstallationSecrets({
-      bootstrapGitHubId: '583231',
-      bootstrapGitHubLogin: 'octocat',
+    const secrets = freshSecrets({
       checkpoint: { emailSigningSecret: TEST_PLATFORM_EMAIL_SIGNING_SECRET },
-      cloudflareApiToken: 'cf-token',
-      databaseUrl: 'postgres://user:password@db.example.com/void',
       existingEmailEnabled: true,
       existingInstallation: true,
-      githubClientId: 'github-id',
-      githubClientSecret: 'github-secret',
-      jwtSecret: TEST_PLATFORM_JWT_SECRET,
-      projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-      r2AccessKeyId: 'r2-id',
-      r2SecretAccessKey: 'r2-secret',
       updateExistingWorkers: true,
     });
     expect(secrets.workerSecretUpdates).not.toHaveProperty('EMAIL_SIGNING_SECRET');
@@ -1122,17 +1173,12 @@ describe('platform installer', () => {
   });
 
   it('validates complete project-secret keyring restoration inputs', () => {
-    const input = {
-      bootstrapGitHubId: '583231',
-      bootstrapGitHubLogin: 'octocat',
-      cloudflareApiToken: 'cf-token',
-      databaseUrl: 'postgres://user:password@db.example.com/void',
-      existingInstallation: true,
-      githubClientId: 'github-id',
-      githubClientSecret: 'github-secret',
-      r2AccessKeyId: 'r2-id',
-      r2SecretAccessKey: 'r2-secret',
-    };
+    const {
+      jwtSecret: _jwtSecret,
+      projectSecretKey: _projectSecretKey,
+      ...fresh
+    } = FRESH_SECRETS_INPUT;
+    const input = { ...fresh, existingInstallation: true };
     expect(() =>
       createPlatformInstallationSecrets({
         ...input,
@@ -1598,46 +1644,6 @@ describe('platform installer', () => {
     }
   });
 
-  it('reports a concurrent create after assets were uploaded', async () => {
-    const requests: Array<string> = [];
-    const upstream = createServer((request, response) => {
-      request.resume();
-      requests.push(`${request.method} ${request.url}`);
-      response.writeHead(request.method === 'PUT' ? 412 : 200, {
-        'Content-Type': 'application/json',
-      });
-      response.end(
-        request.method === 'PUT'
-          ? '{"success":false,"errors":[{"message":"already exists"}]}'
-          : '{"success":true,"result":{"jwt":"token"}}',
-      );
-    });
-    const origin = await listen(upstream);
-    try {
-      const failure = withConditionalPlatformWorkerCreate(
-        'account',
-        'void-api',
-        async (base) => {
-          for (const path of [
-            '/accounts/account/workers/scripts/void-api/assets-upload-session',
-            '/accounts/account/workers/assets/upload?base64=true',
-          ]) {
-            await fetch(`${base}${path}`, { body: 'payload', method: 'POST' });
-          }
-          await fetch(
-            `${base}/accounts/account/workers/scripts/void-api?excludeScript=true&bindings_inherit=strict`,
-            { body: 'worker bundle', method: 'PUT' },
-          );
-        },
-        `${origin}/client/v4`,
-      );
-      await expect(failure).rejects.toThrow('created concurrently (HTTP 412)');
-      expect(requests.filter((request) => request.startsWith('PUT '))).toHaveLength(1);
-    } finally {
-      await close(upstream);
-    }
-  });
-
   it('accepts only an installer deployment with the expected predecessor', () => {
     const ours = {
       id: 'deployment-ours',
@@ -2034,19 +2040,7 @@ describe('platform installer', () => {
   });
 
   it('preserves unmanaged Worker routes and custom domains across deploy and rollback', async () => {
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: 'api.example.com',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
+    const plan = await examplePlan(null, { controlPlaneDomain: 'api.example.com' });
     const managedDispatchPattern = createApplicationRoutes(plan.deployment.application)[0]!.pattern;
     const client = {
       listWorkerDomains: async () => [
@@ -2402,9 +2396,13 @@ describe('platform installer', () => {
           ),
         );
 
-        await expect(
-          bootstrapPlatformSharedEmail('https://api.example.com', 'probe-token', fetcher),
-        ).rejects.toThrow(`Operation eop-terminal: ${operationStatus}`);
+        const failure = bootstrapPlatformSharedEmail(
+          'https://api.example.com',
+          'probe-token',
+          fetcher,
+        );
+        await expect(failure).rejects.toThrow(`Operation eop-terminal: ${operationStatus}`);
+        await expect(failure).rejects.toThrow('Traffic remains disabled');
         expect(fetcher).toHaveBeenCalledTimes(1);
       },
     );
@@ -2461,42 +2459,9 @@ describe('platform installer', () => {
     });
   });
 
-  it('requires the shared email bootstrap probe to report durable inbound readiness', async () => {
-    const requests: Array<{ headers: Headers; method?: string; redirect?: RequestRedirect }> = [];
-    const readyFetcher = (async (_input: string | URL | Request, init?: RequestInit) => {
-      requests.push({
-        headers: new Headers(init?.headers),
-        method: init?.method,
-        redirect: init?.redirect,
-      });
-      return Response.json({ version: 1, state: 'ready', operationId: 'eop-ready' });
-    }) as typeof fetch;
-
-    expect(
-      await bootstrapPlatformSharedEmail('https://api.example.com', 'probe-token', readyFetcher),
-    ).toBe('eop-ready');
-    expect(requests).toHaveLength(1);
-    expect(requests[0]?.method).toBe('POST');
-    expect(requests[0]?.redirect).toBe('manual');
-    expect(requests[0]?.headers.get('X-Void-Platform-Probe')).toBe('probe-token');
-
-    await expect(
-      bootstrapPlatformSharedEmail('https://api.example.com', 'probe-token', (async () =>
-        Response.json(
-          {
-            version: 1,
-            state: 'incomplete',
-            operationId: 'eop-blocked',
-            operationStatus: 'blocked',
-          },
-          { status: 503 },
-        )) as typeof fetch),
-    ).rejects.toThrow('Operation eop-blocked: blocked. Traffic remains disabled');
-  });
-
-  it('reports safe shared-email routing prerequisites without exposing provider details', async () => {
-    const fetcher = (failureDetail: string) =>
-      (async () =>
+  it('reports safe shared-email routing prerequisites without exposing provider details', async () => {
+    const fetcher = (failureDetail: string) =>
+      (async () =>
         Response.json(
           {
             version: 1,
@@ -2902,92 +2867,34 @@ describe('platform installer', () => {
     expect(connection.queries).not.toContain('ROLLBACK');
   });
 
-  it('migrates the exact canonical 0.22.0 predecessor to the recipient deletion fence and refuses unreviewed versions', async () => {
-    const database = readPlatformRuntimeManifest().database;
-    const baseline = database.migrations.filter((migration) => migration.index <= 55);
-    expect(baseline.at(-1)?.tag).toBe('0055_durable_deployment_execution');
-    expect(database.migrations.slice(baseline.length).map((migration) => migration.tag)).toEqual([
-      '0056_email_shared_recipients',
-      '0057_github_authority_constraints',
-      '0058_project_proxy_token_gen',
-    ]);
-    const rows = baseline.map((migration, index) => ({
-      id: index + 1,
-      hash: migration.sha256,
-      created_at: migration.timestampMillis,
-    }));
-    const rejected = migrationConnection(rows);
-    await expect(
-      preparePlatformDatabaseConnection(
-        rejected,
-        getPlatformRuntimeDirectory(),
-        database,
-        '0.21.9',
-        true,
-      ),
-    ).rejects.toThrow('cannot safely roll back');
-    expect(rejected.queries).not.toContain('BEGIN');
-    const accepted = migrationConnection(rows);
-    const result = await preparePlatformDatabaseConnection(
-      accepted,
-      getPlatformRuntimeDirectory(),
-      database,
-      '0.22.0',
-      true,
-    );
-    expect(result.appliedMigrations).toBe(3);
-    expect(
-      accepted.queries.some((query) =>
-        query.includes('CREATE TRIGGER "void_shared_email_recipient_teardown_guard"'),
-      ),
-    ).toBe(true);
-    expect(accepted.rows).toHaveLength(database.migrations.length);
-  });
-
-  it.each(['0.23.0', '0.24.0'])(
-    'upgrades a %s installation through the GitHub authority constraints',
-    async (sourceVersion) => {
-      const database = readPlatformRuntimeManifest().database;
-      const baseline = database.migrations.filter((migration) => migration.index <= 56);
-      expect(baseline.at(-1)?.tag).toBe('0056_email_shared_recipients');
-      const rows = baseline.map((migration, index) => ({
-        id: index + 1,
-        hash: migration.sha256,
-        created_at: migration.timestampMillis,
-      }));
-      const rejected = migrationConnection(rows);
-      await expect(
-        preparePlatformDatabaseConnection(
-          rejected,
-          getPlatformRuntimeDirectory(),
-          database,
-          '0.22.0',
-          true,
-        ),
-      ).rejects.toThrow('cannot safely roll back');
-      expect(rejected.queries).not.toContain('BEGIN');
-      const accepted = migrationConnection(rows);
-      const result = await preparePlatformDatabaseConnection(
-        accepted,
-        getPlatformRuntimeDirectory(),
-        database,
-        sourceVersion,
-        true,
-      );
-      expect(result.appliedMigrations).toBe(2);
-      expect(
-        accepted.queries.some((query) => query.includes('"authorized_by_user_id" SET NOT NULL')),
-      ).toBe(true);
-      expect(accepted.rows).toHaveLength(database.migrations.length);
+  it.each([
+    {
+      sourceVersion: '0.22.0',
+      rejectedVersion: '0.21.9',
+      lastTag: '0055_durable_deployment_execution',
+      sql: 'CREATE TRIGGER "void_shared_email_recipient_teardown_guard"',
     },
-  );
-
-  it.each(['0.25.0', '0.26.0'])(
-    'upgrades a %s installation through the project proxy token generation',
-    async (sourceVersion) => {
+    ...['0.23.0', '0.24.0'].map((sourceVersion) => ({
+      sourceVersion,
+      rejectedVersion: '0.22.0',
+      lastTag: '0056_email_shared_recipients',
+      sql: '"authorized_by_user_id" SET NOT NULL',
+    })),
+    ...['0.25.0', '0.26.0'].map((sourceVersion) => ({
+      sourceVersion,
+      rejectedVersion: '0.24.0',
+      lastTag: '0057_github_authority_constraints',
+      sql: 'ADD COLUMN "proxy_token_gen"',
+    })),
+  ])(
+    'upgrades a $sourceVersion installation and refuses an unreviewed $rejectedVersion one',
+    async ({ sourceVersion, rejectedVersion, lastTag, sql }) => {
       const database = readPlatformRuntimeManifest().database;
-      const baseline = database.migrations.filter((migration) => migration.index <= 57);
-      expect(baseline.at(-1)?.tag).toBe('0057_github_authority_constraints');
+      const baseline = database.migrations.slice(
+        0,
+        database.migrations.findIndex((migration) => migration.tag === lastTag) + 1,
+      );
+      expect(baseline.at(-1)?.tag).toBe(lastTag);
       const rows = baseline.map((migration, index) => ({
         id: index + 1,
         hash: migration.sha256,
@@ -2999,7 +2906,7 @@ describe('platform installer', () => {
           rejected,
           getPlatformRuntimeDirectory(),
           database,
-          '0.24.0',
+          rejectedVersion,
           true,
         ),
       ).rejects.toThrow('cannot safely roll back');
@@ -3012,46 +2919,12 @@ describe('platform installer', () => {
         sourceVersion,
         true,
       );
-      expect(result.appliedMigrations).toBe(1);
-      expect(accepted.queries.some((query) => query.includes('ADD COLUMN "proxy_token_gen"'))).toBe(
-        true,
-      );
+      expect(result.appliedMigrations).toBe(database.migrations.length - baseline.length);
+      expect(accepted.queries.some((query) => query.includes(sql))).toBe(true);
       expect(accepted.rows).toHaveLength(database.migrations.length);
     },
   );
 
-  it('rejects the isolated legacy email0054 fork without rewriting its history or applying canonical migrations', async () => {
-    const database = readPlatformRuntimeManifest().database;
-    const commonPrefix = database.migrations.filter((migration) => migration.index <= 53);
-    const email = database.migrations.find(
-      (migration) => migration.tag === '0056_email_shared_recipients',
-    )!;
-    expect(email).toBeDefined();
-    // The unreleased E2E runtime applied these same SQL bytes under its original
-    // 0054 timestamp. Equivalent SQL is not an exact canonical migration lineage.
-    const rows = [
-      ...commonPrefix.map((migration, index) => ({
-        id: index + 1,
-        hash: migration.sha256,
-        created_at: migration.timestampMillis,
-      })),
-      { id: commonPrefix.length + 1, hash: email.sha256, created_at: 1790860822162 },
-    ];
-    const connection = migrationConnection(rows);
-    await expect(
-      preparePlatformDatabaseConnection(
-        connection,
-        getPlatformRuntimeDirectory(),
-        database,
-        '0.21.9',
-        true,
-      ),
-    ).rejects.toThrow('not an exact prefix');
-    expect(connection.queries).not.toContain('BEGIN');
-    expect(connection.rows).toEqual(rows);
-    expect(connection.queries.some((query) => query.startsWith('INSERT INTO'))).toBe(false);
-  });
-
   it('requires an exact rollback compatibility edge before an existing install migrates', async () => {
     const base = migrationSubset(1);
     const sourceDigest = platformDatabaseSchemaDigest(base.lineage, []);
@@ -3550,39 +3423,6 @@ describe('platform installer', () => {
     await lock();
   });
 
-  it('claims only an empty database or an existing matching claim', async () => {
-    const queries: Array<string> = [];
-    const connection = (claim: ReadonlyArray<Record<string, string>>, hasContents: boolean) => ({
-      query: async <Row extends Record<string, unknown>>(sql: string) => {
-        queries.push(sql);
-        if (sql.includes('SELECT "installation_id"')) {
-          return { rows: claim as ReadonlyArray<Row> };
-        }
-        if (sql.includes('FROM "pg_catalog"."pg_tables"')) {
-          return {
-            rows: (hasContents
-              ? [{ schemaname: 'public', tablename: 'users' }]
-              : []) as unknown as ReadonlyArray<Row>,
-          };
-        }
-        return { rows: [] as ReadonlyArray<Row> };
-      },
-    });
-    await expect(
-      claimPlatformDatabaseConnection(connection([], false), 'install-one', 'nonce-one'),
-    ).resolves.toBeUndefined();
-    await expect(
-      claimPlatformDatabaseConnection(
-        connection([{ installation_id: 'install-one', ownership_nonce: 'nonce-one' }], true),
-        'install-one',
-        'nonce-one',
-      ),
-    ).resolves.toBeUndefined();
-    await expect(
-      claimPlatformDatabaseConnection(connection([], true), 'install-two', 'nonce-two'),
-    ).rejects.toThrow('non-empty PostgreSQL database');
-    expect(queries.some((sql) => sql === 'ROLLBACK')).toBe(true);
-  });
   it('resolves the initial administrator to an immutable GitHub account id', async () => {
     const requests: Array<string> = [];
     await expect(
@@ -3595,17 +3435,12 @@ describe('platform installer', () => {
   });
 
   it('preserves deployed secrets and never rotates restored runtime keys', () => {
-    const input = {
-      bootstrapGitHubId: '583231',
-      bootstrapGitHubLogin: 'octocat',
-      cloudflareApiToken: 'cf-token',
-      databaseUrl: 'postgres://user:password@db.example.com/void',
-      existingInstallation: true,
-      githubClientId: 'github-id',
-      githubClientSecret: 'github-secret',
-      r2AccessKeyId: 'r2-id',
-      r2SecretAccessKey: 'r2-secret',
-    };
+    const {
+      jwtSecret: _jwtSecret,
+      projectSecretKey: _projectSecretKey,
+      ...fresh
+    } = FRESH_SECRETS_INPUT;
+    const input = { ...fresh, existingInstallation: true };
     expect(createPlatformInstallationSecrets(input)).toMatchObject({
       jwtSecret: '',
       projectSecretKey: '',
@@ -3665,24 +3500,11 @@ describe('platform installer', () => {
   });
 
   it('stores a restored complete project-secret keyring in encrypted recovery state', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-keyring-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        emailSenderDomain: 'mail.example.com',
-        emailSharedZoneId: 'mail-zone',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
+    const directory = useRegistryDirectory();
+    const plan = await examplePlan(null, {
+      emailSenderDomain: 'mail.example.com',
+      emailSharedZoneId: 'mail-zone',
+    });
     const manifest = createPlatformInstallationManifest({
       account: plan.account,
       createdAt: '2026-09-16T00:00:00.000Z',
@@ -3800,9 +3622,7 @@ describe('platform installer', () => {
   });
 
   it('resumes encrypted per-Worker credential updates without replaying the baseline', () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-secret-update-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDirectory();
     const deployment = createPlatformDeploymentManifest({
       application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
       displayName: 'Example',
@@ -3992,19 +3812,7 @@ describe('platform installer', () => {
   });
 
   it('requires restored runtime secrets before recreating a missing platform Worker', async () => {
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
+    const plan = await examplePlan();
     let manifest = createPlatformInstallationManifest({
       account: plan.account,
       createdAt: '2026-01-01T00:00:00.000Z',
@@ -4040,19 +3848,7 @@ describe('platform installer', () => {
   });
 
   it('accepts a completed legacy authentication migration without setup authority on later upgrades', async () => {
-    const original = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
+    const original = await examplePlan();
     const plan = {
       ...original,
       actions: [],
@@ -4098,21 +3894,10 @@ describe('platform installer', () => {
   });
 
   it('recreates only the email gateway with its email key and no JWT or Cloudflare token', async () => {
-    const fullPlan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        emailSenderDomain: 'mail.example.com',
-        emailSharedZoneId: 'mail-zone',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
+    const fullPlan = await examplePlan(null, {
+      emailSenderDomain: 'mail.example.com',
+      emailSharedZoneId: 'mail-zone',
+    });
     const plan = {
       ...fullPlan,
       actions: fullPlan.actions.filter((action) => action.key === 'email-gateway-worker'),
@@ -4169,66 +3954,17 @@ describe('platform installer', () => {
   });
 
   it('does not checkpoint failure when another host owns the lifecycle lock', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-lock-contender-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
-    const client = {
-      createAiGateway: async () => ({ id: 'unused', name: 'unused' }),
-      createDispatchNamespace: async () => ({ id: 'unused', name: 'unused' }),
-      createDnsRecord: async () => ({
-        content: '100::',
-        id: 'unused',
-        name: 'unused',
-        proxied: true,
-        type: 'AAAA',
-      }),
-      createHyperdrive: async () => ({ id: 'unused', name: 'unused' }),
-      createKvNamespace: async () => ({ id: 'unused', name: 'unused' }),
-      createQueue: async () => ({ id: 'unused', name: 'unused' }),
-      createR2Bucket: async () => ({ id: 'unused', name: 'unused' }),
-      createZone: async () => ({ id: 'unused', name: 'unused', nameServers: [], status: 'active' }),
-      putKvValue: async () => {},
-      putR2Object: async () => {},
-    };
-
+    const directory = useRegistryDirectory();
+    const plan = await examplePlan();
     await expect(
-      installPlatform(
-        plan,
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
-          databaseUrl: 'postgres://user:password@db.example.com/void',
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
-        }),
-        null,
-        {
-          acquireDatabaseLifecycleLock: async () => {
-            throw new Error('another host owns the lock');
-          },
-          claimDatabase,
-          client,
-          revalidateBeforeWorkerDeploy: async () => {},
+      installPlatform(plan, freshSecrets(), null, {
+        acquireDatabaseLifecycleLock: async () => {
+          throw new Error('another host owns the lock');
         },
-      ),
+        claimDatabase,
+        client: unusedClient(),
+        revalidateBeforeWorkerDeploy: async () => {},
+      }),
     ).rejects.toThrow('another host owns the lock');
     expect(listInstallationManifests(directory)[0]).toMatchObject({
       resources: [],
@@ -4237,9 +3973,7 @@ describe('platform installer', () => {
   });
 
   it('validates a resume only after reading the authoritative database checkpoint', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-authoritative-resume-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDirectory();
     const deployment = createPlatformDeploymentManifest({
       application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
       displayName: 'Example',
@@ -4290,19 +4024,7 @@ describe('platform installer', () => {
       listKvNamespaces: async (_accountId: string, title?: string) =>
         title === routingName ? [{ id: 'routing-kv-id', name: routingName }] : [],
     };
-    const plan = await createPlatformInstallPlan(
-      planner,
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      manifest,
-    );
+    const plan = await createPlatformInstallPlan(planner, EXAMPLE_PLAN_INPUT, manifest);
     let released = false;
     const lock = Object.assign(
       async () => {
@@ -4312,244 +4034,190 @@ describe('platform installer', () => {
     );
 
     await expect(
-      installPlatform(
-        plan,
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
-          databaseUrl: 'postgres://user:password@db.example.com/void',
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
-        }),
-        manifest,
-        {
-          acquireDatabaseLifecycleLock: async () => lock,
-          claimDatabase,
-          client: {
-            createAiGateway: async () => ({ id: 'unused', name: 'unused' }),
-            createDispatchNamespace: async () => ({ id: 'unused', name: 'unused' }),
-            createDnsRecord: async () => ({
-              content: '100::',
-              id: 'unused',
-              name: 'unused',
-              proxied: true,
-              type: 'AAAA',
-            }),
-            createHyperdrive: async () => ({ id: 'unused', name: 'unused' }),
-            createKvNamespace: async () => ({ id: 'unused', name: 'unused' }),
-            createQueue: async () => ({ id: 'unused', name: 'unused' }),
-            createR2Bucket: async () => ({ id: 'unused', name: 'unused' }),
-            createZone: async () => ({
-              id: 'unused',
-              name: 'unused',
-              nameServers: [],
-              status: 'active',
-            }),
-            putKvValue: async () => {},
-            putR2Object: async () => {},
-          },
-          revalidateBeforeWorkerDeploy: async () => {},
-          verifyExistingOwnership: async (candidate, databaseCheckpointExists) => {
-            expect(candidate).toEqual(manifest);
-            expect(databaseCheckpointExists).toBe(true);
-            throw new Error('ownership-checked');
-          },
+      installPlatform(plan, freshSecrets(), manifest, {
+        acquireDatabaseLifecycleLock: async () => lock,
+        claimDatabase,
+        client: unusedClient(),
+        revalidateBeforeWorkerDeploy: async () => {},
+        verifyExistingOwnership: async (candidate, databaseCheckpointExists) => {
+          expect(candidate).toEqual(manifest);
+          expect(databaseCheckpointExists).toBe(true);
+          throw new Error('ownership-checked');
         },
-      ),
+      }),
     ).rejects.toThrow('ownership-checked');
     expect(released).toBe(true);
   });
 
-  it.each([
-    { legacyRuntime: false },
-    { legacyRuntime: true },
-    { legacyRuntime: false, appAccess: 'public' as const },
-    { legacyRuntime: false, appAccess: 'custom' as const },
-    { legacyRuntime: false, appAccess: 'custom' as const, failAppAccess: true },
-    { legacyRuntime: false, appAccess: 'custom' as const, failHealthToken: true },
-  ])(
-    'checkpoints app access and resource readiness before traffic opens: %j',
-    async ({ legacyRuntime, appAccess, failAppAccess, failHealthToken }) => {
-      const directory = mkdtempSync(join(tmpdir(), 'void-platform-installer-test-'));
-      directories.push(directory);
-      process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-      const plan = await createPlatformInstallPlan(
-        planningClient(),
-        {
-          appAccess,
-          accountId: 'account',
-          applicationDomain: 'apps.example.com',
-          controlPlaneDomain: '',
-          dedicatedZone: false,
-          displayName: 'Example',
-          installationSlug: 'example',
-          zoneName: 'example.com',
+  async function appAccessInstall({
+    legacyRuntime = false,
+    appAccess,
+    failAppAccess = false,
+    failHealthToken = false,
+  }: {
+    legacyRuntime?: boolean;
+    appAccess?: 'public' | 'custom';
+    failAppAccess?: boolean;
+    failHealthToken?: boolean;
+  }) {
+    const directory = useRegistryDirectory();
+    const plan = await createPlatformInstallPlan(
+      planningClient(),
+      { ...EXAMPLE_PLAN_INPUT, appAccess },
+      null,
+      { includeEmailGateway: !legacyRuntime },
+    );
+    const packagedRuntime = resolvePlatformRuntime(getPlatformRuntimeDirectory());
+    const { emailGateway: _legacyGateway, ...legacyArtifacts } = packagedRuntime.manifest.artifacts;
+    const { emailProtocolVersion: _legacyProtocol, ...legacyManifest } = packagedRuntime.manifest;
+    const selectedRuntime = legacyRuntime
+      ? {
+          ...packagedRuntime,
+          manifest: { ...legacyManifest, artifacts: legacyArtifacts },
+        }
+      : packagedRuntime;
+    let resourceIndex = 0;
+    const created = async (_account: string, name: string) => ({
+      id: `resource-${resourceIndex++}`,
+      name,
+    });
+    const captured = {
+      apiSecrets: null as Record<string, string> | null,
+      r2OwnershipMarker: '',
+      remoteManifest: '',
+    };
+    const deployed: Array<string> = [];
+    const deployedTrafficStates: Array<unknown> = [];
+    const routingValues = new Map<string, string>();
+    const lifecycleEvents: Array<string> = [];
+    const databaseClaims: Array<[string, string]> = [];
+    const install = () =>
+      installPlatform(plan, freshSecrets(), null, {
+        runtime: selectedRuntime,
+        prepareHealthAccess: async () => {
+          if (failHealthToken) {
+            throw new PlatformCloudflareApiError('rejected', 403);
+          }
         },
-        null,
-        { includeEmailGateway: !legacyRuntime },
-      );
-      const packagedRuntime = resolvePlatformRuntime(getPlatformRuntimeDirectory());
-      const { emailGateway: _legacyGateway, ...legacyArtifacts } =
-        packagedRuntime.manifest.artifacts;
-      const { emailProtocolVersion: _legacyProtocol, ...legacyManifest } = packagedRuntime.manifest;
-      const selectedRuntime = legacyRuntime
-        ? {
-            ...packagedRuntime,
-            manifest: { ...legacyManifest, artifacts: legacyArtifacts },
+        prepareAppAccess: async () =>
+          JSON.stringify({
+            version: 1,
+            accountId: 'account',
+            mode: appAccess === 'public' ? 'public' : 'protected',
+            managed: true,
+            apiToken: 'app-management-only',
+            identityProviderIds: appAccess === 'public' ? [] : ['idp'],
+            policyIds: appAccess === 'public' ? [] : ['policy'],
+          }),
+        initializeAppAccess: async ({ setupJson, setupToken }) => {
+          expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(PLATFORM_DISABLED_VALUE);
+          expect(JSON.parse(setupJson).apiToken).toBe('app-management-only');
+          expect(setupToken).toMatch(/^[a-f0-9]{64}$/);
+          expect(captured.apiSecrets?.PLATFORM_APP_ACCESS_SETUP_TOKEN).toBe(setupToken);
+          lifecycleEvents.push('app-access');
+          if (failAppAccess) {
+            throw new Error('app access not ready');
           }
-        : packagedRuntime;
-      if (legacyRuntime) {
-        expect(plan.actions.some((action) => action.key === 'email-gateway-worker')).toBe(false);
-      }
-      let resourceIndex = 0;
-      const created = async (_account: string, name: string) => ({
-        id: `resource-${resourceIndex++}`,
-        name,
-      });
-      const deployed: Array<string> = [];
-      const deployedTrafficStates: Array<unknown> = [];
-      let apiSecrets: Record<string, string> | null = null;
-      let r2OwnershipMarker = '';
-      const routingValues = new Map<string, string>();
-      const lifecycleEvents: Array<string> = [];
-      let remoteManifest = '';
-      const databaseClaims: Array<[string, string]> = [];
-      let result;
-      try {
-        result = await installPlatform(
-          plan,
-          createPlatformInstallationSecrets({
-            bootstrapGitHubId: '583231',
-            bootstrapGitHubLogin: 'octocat',
-            cloudflareApiToken: 'cf-token',
-            databaseUrl: 'postgres://user:password@db.example.com/void',
-            githubClientId: 'github-id',
-            githubClientSecret: 'github-secret',
-            jwtSecret: TEST_PLATFORM_JWT_SECRET,
-            projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-            r2AccessKeyId: 'r2-id',
-            r2SecretAccessKey: 'r2-secret',
+        },
+        acquireDatabaseLifecycleLock,
+        claimDatabase: async (_url, installationId, ownershipNonce) => {
+          databaseClaims.push([installationId, ownershipNonce]);
+        },
+        client: {
+          createAiGateway: created,
+          createDnsRecord: async (_zone, name) => ({
+            content: '100::',
+            id: `resource-${resourceIndex++}`,
+            name,
+            proxied: true,
+            type: 'AAAA',
           }),
-          null,
-          {
-            runtime: selectedRuntime,
-            prepareHealthAccess: async () => {
-              if (failHealthToken) {
-                throw new PlatformCloudflareApiError('rejected', 403);
-              }
-            },
-            prepareAppAccess: async () =>
-              JSON.stringify({
-                version: 1,
-                accountId: 'account',
-                mode: appAccess === 'public' ? 'public' : 'protected',
-                managed: true,
-                apiToken: 'app-management-only',
-                identityProviderIds: appAccess === 'public' ? [] : ['idp'],
-                policyIds: appAccess === 'public' ? [] : ['policy'],
-              }),
-            initializeAppAccess: async ({ setupJson, setupToken }) => {
-              expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(PLATFORM_DISABLED_VALUE);
-              expect(JSON.parse(setupJson).apiToken).toBe('app-management-only');
-              expect(setupToken).toMatch(/^[a-f0-9]{64}$/);
-              expect(apiSecrets?.PLATFORM_APP_ACCESS_SETUP_TOKEN).toBe(setupToken);
-              lifecycleEvents.push('app-access');
-              if (failAppAccess) {
-                throw new Error('app access not ready');
-              }
-            },
-            acquireDatabaseLifecycleLock,
-            claimDatabase: async (_url, installationId, ownershipNonce) => {
-              databaseClaims.push([installationId, ownershipNonce]);
-            },
-            client: {
-              createAiGateway: created,
-              createDnsRecord: async (_zone, name) => ({
-                content: '100::',
-                id: `resource-${resourceIndex++}`,
-                name,
-                proxied: true,
-                type: 'AAAA',
-              }),
-              createZone: async () => {
-                throw new Error('existing zone must not be created');
-              },
-              createKvNamespace: created,
-              createR2Bucket: created,
-              createQueue: created,
-              createDispatchNamespace: created,
-              createHyperdrive: async (account, name) => created(account, name),
-              deleteKvValue: async (_account, _namespace, key) => {
-                lifecycleEvents.push(`delete:${key}`);
-                routingValues.delete(key);
-              },
-              putKvValue: async (_account, _namespace, key, value) => {
-                routingValues.set(key, value);
-                if (key === PLATFORM_DISABLED_KEY) {
-                  lifecycleEvents.push(`put:${key}`);
-                }
-                if (key === '__void/platform/installation/v1') {
-                  remoteManifest = value;
-                }
-              },
-              putR2Object: async (_account, _bucket, _key, value) => {
-                r2OwnershipMarker = value;
-              },
-            },
-            deployWorker: async (config, secrets) => {
-              expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(PLATFORM_DISABLED_VALUE);
-              expect(routingValues.has(PLATFORM_SANDBOX_DRAIN_KEY)).toBe(false);
-              lifecycleEvents.push(`deploy:${String(config.name)}`);
-              deployed.push(String(config.name));
-              deployedTrafficStates.push(
-                (config.vars as Record<string, unknown>).PLATFORM_TRAFFIC_STATE,
-              );
-              if (String(config.name).endsWith('-api')) {
-                apiSecrets = secrets;
-              }
-            },
-            migrateDatabase: async () => {},
-            prepareSandboxDrain: async () => sandboxDrainPreparation('complete'),
-            revalidateBeforeWorkerDeploy: async () => {},
-            verifyHealth: async () => {
-              expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(
-                lifecycleEvents.includes('verify') ? undefined : PLATFORM_DISABLED_VALUE,
-              );
-              lifecycleEvents.push('verify');
-            },
-            verifySandboxDrain: async () => {
-              throw new Error('an empty fresh installation must not require a manual drain');
-            },
+          createZone: async () => {
+            throw new Error('existing zone must not be created');
           },
-        );
-      } catch (error) {
-        if (failHealthToken) {
-          expect(String(error)).toContain('App access token rejected');
-          expect(deployed).toEqual([]);
-          const failed = listInstallationManifests(directory)[0]!;
-          expect(readPendingInstallationSecrets(failed)?.appAccessTokenRejected).toBe('true');
-          return;
-        }
-        if (!failAppAccess) {
-          throw error;
-        }
-        expect(String(error)).toContain('app access not ready');
-        expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(PLATFORM_DISABLED_VALUE);
-        expect(lifecycleEvents).not.toContain(`delete:${PLATFORM_DISABLED_KEY}`);
-        expect(
-          listInstallationManifests(directory)[0]?.steps.some(
-            (step) => step.key === 'app-access-initialized:v1',
-          ),
-        ).toBe(false);
-        return;
+          createKvNamespace: created,
+          createR2Bucket: created,
+          createQueue: created,
+          createDispatchNamespace: created,
+          createHyperdrive: async (account, name) => created(account, name),
+          deleteKvValue: async (_account, _namespace, key) => {
+            lifecycleEvents.push(`delete:${key}`);
+            routingValues.delete(key);
+          },
+          putKvValue: async (_account, _namespace, key, value) => {
+            routingValues.set(key, value);
+            if (key === PLATFORM_DISABLED_KEY) {
+              lifecycleEvents.push(`put:${key}`);
+            }
+            if (key === '__void/platform/installation/v1') {
+              captured.remoteManifest = value;
+            }
+          },
+          putR2Object: async (_account, _bucket, _key, value) => {
+            captured.r2OwnershipMarker = value;
+          },
+        },
+        deployWorker: async (config, secrets) => {
+          expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(PLATFORM_DISABLED_VALUE);
+          expect(routingValues.has(PLATFORM_SANDBOX_DRAIN_KEY)).toBe(false);
+          lifecycleEvents.push(`deploy:${String(config.name)}`);
+          deployed.push(String(config.name));
+          deployedTrafficStates.push(
+            (config.vars as Record<string, unknown>).PLATFORM_TRAFFIC_STATE,
+          );
+          if (String(config.name).endsWith('-api')) {
+            captured.apiSecrets = secrets;
+          }
+        },
+        prepareDatabase,
+        prepareSandboxDrain: async () => sandboxDrainPreparation('complete'),
+        revalidateBeforeWorkerDeploy: async () => {},
+        verifyHealth: async () => {
+          expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(
+            lifecycleEvents.includes('verify') ? undefined : PLATFORM_DISABLED_VALUE,
+          );
+          lifecycleEvents.push('verify');
+        },
+        verifySandboxDrain: async () => {
+          throw new Error('an empty fresh installation must not require a manual drain');
+        },
+      });
+    return {
+      captured,
+      databaseClaims,
+      deployed,
+      deployedTrafficStates,
+      directory,
+      install,
+      lifecycleEvents,
+      plan,
+      routingValues,
+    };
+  }
+
+  it.each([
+    { legacyRuntime: false },
+    { legacyRuntime: true },
+    { legacyRuntime: false, appAccess: 'public' as const },
+    { legacyRuntime: false, appAccess: 'custom' as const },
+  ])(
+    'checkpoints app access and resource readiness before traffic opens: %j',
+    async ({ legacyRuntime, appAccess }) => {
+      const {
+        captured,
+        databaseClaims,
+        deployed,
+        deployedTrafficStates,
+        directory,
+        install,
+        lifecycleEvents,
+        plan,
+        routingValues,
+      } = await appAccessInstall({ legacyRuntime, appAccess });
+      if (legacyRuntime) {
+        expect(plan.actions.some((action) => action.key === 'email-gateway-worker')).toBe(false);
       }
-      expect(failAppAccess).not.toBe(true);
-      expect(failHealthToken).not.toBe(true);
+      const result = await install();
       if (appAccess) {
         expect(lifecycleEvents.indexOf('app-access')).toBeLessThan(
           lifecycleEvents.indexOf(`delete:${PLATFORM_DISABLED_KEY}`),
@@ -4557,7 +4225,7 @@ describe('platform installer', () => {
         expect(result.manifest.steps.some((step) => step.key === 'app-access-initialized:v1')).toBe(
           true,
         );
-        expect(JSON.stringify(apiSecrets)).not.toContain('app-management-only');
+        expect(JSON.stringify(captured.apiSecrets)).not.toContain('app-management-only');
         expect(readInstallationRecoverySecrets(result.manifest)?.appAccessSetupJson).toContain(
           'app-management-only',
         );
@@ -4589,14 +4257,14 @@ describe('platform installer', () => {
             'enabled',
           ];
       expect(deployedTrafficStates).toEqual(trafficStates);
-      expect(apiSecrets).toMatchObject({ PLATFORM_BOOTSTRAP_GITHUB_ID: '583231' });
-      expect(JSON.parse(r2OwnershipMarker)).toMatchObject({
+      expect(captured.apiSecrets).toMatchObject({ PLATFORM_BOOTSTRAP_GITHUB_ID: '583231' });
+      expect(JSON.parse(captured.r2OwnershipMarker)).toMatchObject({
         accountId: 'account',
         installationId: result.manifest.id,
         ownershipNonce: result.manifest.ownershipNonce,
         resourceKey: 'assets-bucket',
       });
-      expect(JSON.parse(remoteManifest)).toMatchObject({
+      expect(JSON.parse(captured.remoteManifest)).toMatchObject({
         id: result.manifest.id,
         status: 'installed',
       });
@@ -4620,79 +4288,57 @@ describe('platform installer', () => {
     },
   );
 
+  it('keeps traffic disabled when app access initialization fails', async () => {
+    const { directory, install, lifecycleEvents, routingValues } = await appAccessInstall({
+      appAccess: 'custom',
+      failAppAccess: true,
+    });
+    await expect(install()).rejects.toThrow('app access not ready');
+    expect(routingValues.get(PLATFORM_DISABLED_KEY)).toBe(PLATFORM_DISABLED_VALUE);
+    expect(lifecycleEvents).not.toContain(`delete:${PLATFORM_DISABLED_KEY}`);
+    expect(
+      listInstallationManifests(directory)[0]?.steps.some(
+        (step) => step.key === 'app-access-initialized:v1',
+      ),
+    ).toBe(false);
+  });
+
+  it('records a rejected app access token before deploying any Worker', async () => {
+    const { deployed, directory, install } = await appAccessInstall({
+      appAccess: 'custom',
+      failHealthToken: true,
+    });
+    await expect(install()).rejects.toThrow('App access token rejected');
+    expect(deployed).toEqual([]);
+    const failed = listInstallationManifests(directory)[0]!;
+    expect(readPendingInstallationSecrets(failed)?.appAccessTokenRejected).toBe('true');
+  });
+
   it('closes the routing gate before an ambiguous fresh Worker upload', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-worker-ambiguity-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
-    let index = 0;
+    const directory = useRegistryDirectory();
+    const plan = await examplePlan();
     let disabled = false;
-    const create = async (_account: string, name: string) => ({ id: `id-${index++}`, name });
 
     await expect(
-      installPlatform(
-        plan,
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
-          databaseUrl: 'postgres://user:password@db.example.com/void',
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
-        }),
-        null,
-        {
-          acquireDatabaseLifecycleLock,
-          claimDatabase,
-          client: {
-            createAiGateway: create,
-            createDispatchNamespace: create,
-            createDnsRecord: async (_zone, name) => ({
-              content: '100::',
-              id: `id-${index++}`,
-              name,
-              proxied: true,
-              type: 'AAAA',
-            }),
-            createHyperdrive: async (account, name) => create(account, name),
-            createKvNamespace: create,
-            createQueue: create,
-            createR2Bucket: create,
-            createZone: async () => {
-              throw new Error('existing zone must not be created');
-            },
-            putKvValue: async (_account, _namespace, key, value) => {
-              if (key === PLATFORM_DISABLED_KEY) {
-                expect(value).toBe(PLATFORM_DISABLED_VALUE);
-                disabled = true;
-              }
-            },
-            putR2Object: async () => {},
-          },
-          deployWorker: async () => {
-            expect(disabled).toBe(true);
-            throw new Error('Worker upload response was lost');
+      installPlatform(plan, freshSecrets(), null, {
+        acquireDatabaseLifecycleLock,
+        claimDatabase,
+        client: {
+          ...creatingClient(),
+          putKvValue: async (_account, _namespace, key, value) => {
+            if (key === PLATFORM_DISABLED_KEY) {
+              expect(value).toBe(PLATFORM_DISABLED_VALUE);
+              disabled = true;
+            }
           },
-          migrateDatabase: async () => {},
-          revalidateBeforeWorkerDeploy: async () => {},
         },
-      ),
+        deployWorker: async () => {
+          expect(disabled).toBe(true);
+          throw new Error('Worker upload response was lost');
+        },
+        prepareDatabase,
+        revalidateBeforeWorkerDeploy: async () => {},
+      }),
     ).rejects.toThrow('Worker upload response was lost');
 
     expect(disabled).toBe(true);
@@ -4700,41 +4346,17 @@ describe('platform installer', () => {
   });
 
   it('rejects a database URL Hyperdrive cannot use before claiming the database', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-preclaim-url-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
+    const directory = useRegistryDirectory();
+    const plan = await examplePlan();
     expect(plan.actions.find((action) => action.key === 'hyperdrive')?.action).toBe('create');
     let claims = 0;
     let locks = 0;
-    const unused = async () => ({ id: 'unused', name: 'unused' });
 
     await expect(
       installPlatform(
         plan,
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
+        freshSecrets({
           databaseUrl: 'postgres://user:password@db.example.com/void?sslmode=disable',
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
         }),
         null,
         {
@@ -4745,29 +4367,7 @@ describe('platform installer', () => {
           claimDatabase: async () => {
             claims++;
           },
-          client: {
-            createAiGateway: unused,
-            createDispatchNamespace: unused,
-            createDnsRecord: async () => ({
-              content: '100::',
-              id: 'unused',
-              name: 'unused',
-              proxied: true,
-              type: 'AAAA',
-            }),
-            createHyperdrive: unused,
-            createKvNamespace: unused,
-            createQueue: unused,
-            createR2Bucket: unused,
-            createZone: async () => ({
-              id: 'unused',
-              name: 'unused',
-              nameServers: [],
-              status: 'active',
-            }),
-            putKvValue: async () => {},
-            putR2Object: async () => {},
-          },
+          client: unusedClient(),
           revalidateBeforeWorkerDeploy: async () => {},
         },
       ),
@@ -4795,33 +4395,10 @@ describe('platform installer', () => {
   ])(
     'rejects a private certificate authority for a Void-created Hyperdrive before claiming the database: %s',
     async (databaseUrl) => {
-      const directory = mkdtempSync(join(tmpdir(), 'void-platform-private-ca-test-'));
-      directories.push(directory);
-      process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-      const input = {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      };
-      const plan = await createPlatformInstallPlan(planningClient(), input, null);
+      const directory = useRegistryDirectory();
+      const plan = await examplePlan();
       expect(plan.actions.find((action) => action.key === 'hyperdrive')?.action).toBe('create');
-      const secrets = (url: string) =>
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
-          databaseUrl: url,
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
-        });
+      const secrets = (url: string) => freshSecrets({ databaseUrl: url });
       const hyperdriveRequests: Array<Record<string, unknown>> = [];
       const cloudflare = new PlatformCloudflareClient('cf-token', {
         fetcher: async (_input, init) => {
@@ -4834,8 +4411,6 @@ describe('platform installer', () => {
       });
       const claimedUrls: Array<string> = [];
       const lockedUrls: Array<string> = [];
-      let index = 0;
-      const create = async (_account: string, name: string) => ({ id: `id-${index++}`, name });
       const dependencies: TestInstallerDependencies = {
         acquireDatabaseLifecycleLock: async (url) => {
           lockedUrls.push(url);
@@ -4845,30 +4420,14 @@ describe('platform installer', () => {
           claimedUrls.push(url);
         },
         client: {
-          createAiGateway: create,
-          createDispatchNamespace: create,
-          createDnsRecord: async (_zone, name) => ({
-            content: '100::',
-            id: `id-${index++}`,
-            name,
-            proxied: true,
-            type: 'AAAA',
-          }),
+          ...creatingClient(),
           createHyperdrive: (account, name, connectionString) =>
             cloudflare.createHyperdrive(account, name, connectionString),
-          createKvNamespace: create,
-          createQueue: create,
-          createR2Bucket: create,
-          createZone: async () => {
-            throw new Error('existing zone must not be created');
-          },
-          putKvValue: async () => {},
-          putR2Object: async () => {},
         },
         deployWorker: async () => {
           throw new Error('stop after resources');
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
       };
 
@@ -4898,7 +4457,7 @@ describe('platform installer', () => {
         delete process.env.VOID_PLATFORM_DATABASE_URL;
       }
       expect(resumedUrl).toBe(corrected);
-      const resumedPlan = await createPlatformInstallPlan(planningClient(), input, manifest);
+      const resumedPlan = await examplePlan(manifest);
       expect(resumedPlan.actions.find((action) => action.key === 'hyperdrive')?.action).toBe(
         'create',
       );
@@ -4914,9 +4473,7 @@ describe('platform installer', () => {
   );
 
   it('accepts a private certificate authority for an externally managed Hyperdrive', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-external-private-ca-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDirectory();
     const databaseUrl =
       'postgres://user:password@db.example.com/void?sslmode=verify-full&sslrootcert=/etc/ssl/private-ca.pem';
     const plan = await createPlatformInstallPlan(
@@ -4925,76 +4482,34 @@ describe('platform installer', () => {
         listHyperdriveConfigs: async () => [{ id: 'external-hyperdrive', name: 'managed-db' }],
       },
       {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
+        ...EXAMPLE_PLAN_INPUT,
         externalHyperdrive: {
           id: 'external-hyperdrive',
           name: 'managed-db',
           host: 'db.example.com',
           user: 'user',
         },
-        installationSlug: 'example',
-        zoneName: 'example.com',
       },
       null,
     );
     expect(plan.actions.find((action) => action.key === 'hyperdrive')?.action).toBe('adopt');
     const claimedUrls: Array<string> = [];
-    const unused = async () => ({ id: 'unused', name: 'unused' });
 
     await expect(
-      installPlatform(
-        plan,
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
-          databaseUrl,
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
-        }),
-        null,
-        {
-          acquireDatabaseLifecycleLock,
-          claimDatabase: async (url) => {
-            claimedUrls.push(url);
-            throw new Error('stop after claim');
-          },
-          client: {
-            createAiGateway: unused,
-            createDispatchNamespace: unused,
-            createDnsRecord: async () => ({
-              content: '100::',
-              id: 'unused',
-              name: 'unused',
-              proxied: true,
-              type: 'AAAA',
-            }),
-            createHyperdrive: async () => {
-              throw new Error('an externally managed Hyperdrive must not be created');
-            },
-            createKvNamespace: unused,
-            createQueue: unused,
-            createR2Bucket: unused,
-            createZone: async () => ({
-              id: 'unused',
-              name: 'unused',
-              nameServers: [],
-              status: 'active',
-            }),
-            putKvValue: async () => {},
-            putR2Object: async () => {},
+      installPlatform(plan, freshSecrets({ databaseUrl }), null, {
+        acquireDatabaseLifecycleLock,
+        claimDatabase: async (url) => {
+          claimedUrls.push(url);
+          throw new Error('stop after claim');
+        },
+        client: {
+          ...unusedClient(),
+          createHyperdrive: async () => {
+            throw new Error('an externally managed Hyperdrive must not be created');
           },
-          revalidateBeforeWorkerDeploy: async () => {},
         },
-      ),
+        revalidateBeforeWorkerDeploy: async () => {},
+      }),
     ).rejects.toThrow('stop after claim');
 
     expect(claimedUrls).toEqual([databaseUrl]);
@@ -5005,9 +4520,7 @@ describe('platform installer', () => {
   });
 
   it('resumes a claimed verify-full database URL by creating Hyperdrive with its TLS mode', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-verify-full-resume-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDirectory();
     const databaseUrl = 'postgresql://user:password@db.example.com:5432/void?sslmode=verify-full';
     const deployment = createPlatformDeploymentManifest({
       application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
@@ -5048,19 +4561,7 @@ describe('platform installer', () => {
       manifest,
     );
     expect(resumedUrl).toBe(databaseUrl);
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      manifest,
-    );
+    const plan = await examplePlan(manifest);
     expect(plan.actions.find((action) => action.key === 'hyperdrive')?.action).toBe('create');
     const hyperdriveRequests: Array<Record<string, unknown>> = [];
     const cloudflare = new PlatformCloudflareClient('cf-token', {
@@ -5074,61 +4575,27 @@ describe('platform installer', () => {
     });
     const claimedUrls: Array<string> = [];
     const lockedUrls: Array<string> = [];
-    let index = 0;
-    const create = async (_account: string, name: string) => ({ id: `id-${index++}`, name });
 
     await expect(
-      installPlatform(
-        plan,
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
-          databaseUrl: resumedUrl,
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
-        }),
-        manifest,
-        {
-          acquireDatabaseLifecycleLock: async (url) => {
-            lockedUrls.push(url);
-            return acquireDatabaseLifecycleLock();
-          },
-          claimDatabase: async (url) => {
-            claimedUrls.push(url);
-          },
-          client: {
-            createAiGateway: create,
-            createDispatchNamespace: create,
-            createDnsRecord: async (_zone, name) => ({
-              content: '100::',
-              id: `id-${index++}`,
-              name,
-              proxied: true,
-              type: 'AAAA',
-            }),
-            createHyperdrive: (account, name, connectionString) =>
-              cloudflare.createHyperdrive(account, name, connectionString),
-            createKvNamespace: create,
-            createQueue: create,
-            createR2Bucket: create,
-            createZone: async () => {
-              throw new Error('existing zone must not be created');
-            },
-            putKvValue: async () => {},
-            putR2Object: async () => {},
-          },
-          deployWorker: async () => {
-            throw new Error('stop after resources');
-          },
-          migrateDatabase: async () => {},
-          revalidateBeforeWorkerDeploy: async () => {},
+      installPlatform(plan, freshSecrets({ databaseUrl: resumedUrl }), manifest, {
+        acquireDatabaseLifecycleLock: async (url) => {
+          lockedUrls.push(url);
+          return acquireDatabaseLifecycleLock();
         },
-      ),
+        claimDatabase: async (url) => {
+          claimedUrls.push(url);
+        },
+        client: {
+          ...creatingClient(),
+          createHyperdrive: (account, name, connectionString) =>
+            cloudflare.createHyperdrive(account, name, connectionString),
+        },
+        deployWorker: async () => {
+          throw new Error('stop after resources');
+        },
+        prepareDatabase,
+        revalidateBeforeWorkerDeploy: async () => {},
+      }),
     ).rejects.toThrow('stop after resources');
 
     expect(claimedUrls).toEqual([databaseUrl]);
@@ -5147,81 +4614,30 @@ describe('platform installer', () => {
   });
 
   it('keeps a cutover unresolved when the current Worker rollback is incomplete', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-incomplete-rollback-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
-    let index = 0;
+    const directory = useRegistryDirectory();
+    const plan = await examplePlan();
     let deployments = 0;
     let previousRollbackRan = false;
-    const create = async (_account: string, name: string) => ({ id: `id-${index++}`, name });
 
     await expect(
-      installPlatform(
-        plan,
-        createPlatformInstallationSecrets({
-          bootstrapGitHubId: '583231',
-          bootstrapGitHubLogin: 'octocat',
-          cloudflareApiToken: 'cf-token',
-          databaseUrl: 'postgres://user:password@db.example.com/void',
-          githubClientId: 'github-id',
-          githubClientSecret: 'github-secret',
-          jwtSecret: TEST_PLATFORM_JWT_SECRET,
-          projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-          r2AccessKeyId: 'r2-id',
-          r2SecretAccessKey: 'r2-secret',
-        }),
-        null,
-        {
-          acquireDatabaseLifecycleLock,
-          claimDatabase,
-          client: {
-            createAiGateway: create,
-            createDispatchNamespace: create,
-            createDnsRecord: async (_zone, name) => ({
-              content: '100::',
-              id: `id-${index++}`,
-              name,
-              proxied: true,
-              type: 'AAAA',
-            }),
-            createHyperdrive: async (account, name) => create(account, name),
-            createKvNamespace: create,
-            createQueue: create,
-            createR2Bucket: create,
-            createZone: async () => {
-              throw new Error('existing zone must not be created');
-            },
-            putKvValue: async () => {},
-            putR2Object: async () => {},
-          },
-          deployWorker: async () => {
-            deployments++;
-            if (deployments === 1) {
-              return async () => {
-                previousRollbackRan = true;
-              };
-            }
-            throw new PlatformWorkerRecoveryIncompleteError(
-              'platform: Automatic recovery for proxy was incomplete.',
-            );
-          },
-          migrateDatabase: async () => {},
-          revalidateBeforeWorkerDeploy: async () => {},
+      installPlatform(plan, freshSecrets(), null, {
+        acquireDatabaseLifecycleLock,
+        claimDatabase,
+        client: creatingClient(),
+        deployWorker: async () => {
+          deployments++;
+          if (deployments === 1) {
+            return async () => {
+              previousRollbackRan = true;
+            };
+          }
+          throw new PlatformWorkerRecoveryIncompleteError(
+            'platform: Automatic recovery for proxy was incomplete.',
+          );
         },
-      ),
+        prepareDatabase,
+        revalidateBeforeWorkerDeploy: async () => {},
+      }),
     ).rejects.toThrow('cutover remains unresolved');
 
     const failed = listInstallationManifests(directory)[0]!;
@@ -5235,19 +4651,7 @@ describe('platform installer', () => {
   });
 
   it('retains an ambiguous resource before recording its replacement', async () => {
-    const plan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
+    const plan = await examplePlan();
     const fingerprint = '2026-09-14T00:00:00.000Z';
     let manifest = createPlatformInstallationManifest({
       account: plan.account,
@@ -5296,9 +4700,7 @@ describe('platform installer', () => {
   });
 
   it('stops after a newly-created zone until nameservers become active', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-installer-dns-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDirectory();
     const plan = await createPlatformInstallPlan(
       { ...planningClient(), findZone: async () => null },
       {
@@ -5312,62 +4714,46 @@ describe('platform installer', () => {
       },
       null,
     );
-    const result = await installPlatform(
-      plan,
-      createPlatformInstallationSecrets({
-        bootstrapGitHubId: '583231',
-        bootstrapGitHubLogin: 'octocat',
-        cloudflareApiToken: 'cf-token',
-        databaseUrl: 'postgres://user:password@db.example.com/void',
-        githubClientId: 'github-id',
-        githubClientSecret: 'github-secret',
-        jwtSecret: TEST_PLATFORM_JWT_SECRET,
-        projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-        r2AccessKeyId: 'r2-id',
-        r2SecretAccessKey: 'r2-secret',
-      }),
-      null,
-      {
-        acquireDatabaseLifecycleLock,
-        claimDatabase,
-        client: {
-          createAiGateway: async () => {
-            throw new Error('must wait for DNS');
-          },
-          createZone: async () => ({
-            id: 'new-zone',
-            name: 'example.net',
-            nameServers: ['a.ns.cloudflare.com', 'b.ns.cloudflare.com'],
-            status: 'pending',
-          }),
-          createDnsRecord: async () => {
-            throw new Error('must wait for DNS');
-          },
-          createKvNamespace: async () => {
-            return { id: 'routing-kv-id', name: plan.deployment.resources.routingKv };
-          },
-          createR2Bucket: async () => {
-            throw new Error('must wait for DNS');
-          },
-          createQueue: async () => {
-            throw new Error('must wait for DNS');
-          },
-          createDispatchNamespace: async () => {
-            throw new Error('must wait for DNS');
-          },
-          createHyperdrive: async () => {
-            throw new Error('must wait for DNS');
-          },
-          putKvValue: async () => {
-            // The remote recovery checkpoint is established before waiting.
-          },
-          putR2Object: async () => {
-            throw new Error('must wait for DNS');
-          },
+    const result = await installPlatform(plan, freshSecrets(), null, {
+      acquireDatabaseLifecycleLock,
+      claimDatabase,
+      client: {
+        createAiGateway: async () => {
+          throw new Error('must wait for DNS');
+        },
+        createZone: async () => ({
+          id: 'new-zone',
+          name: 'example.net',
+          nameServers: ['a.ns.cloudflare.com', 'b.ns.cloudflare.com'],
+          status: 'pending',
+        }),
+        createDnsRecord: async () => {
+          throw new Error('must wait for DNS');
+        },
+        createKvNamespace: async () => {
+          return { id: 'routing-kv-id', name: plan.deployment.resources.routingKv };
+        },
+        createR2Bucket: async () => {
+          throw new Error('must wait for DNS');
+        },
+        createQueue: async () => {
+          throw new Error('must wait for DNS');
+        },
+        createDispatchNamespace: async () => {
+          throw new Error('must wait for DNS');
+        },
+        createHyperdrive: async () => {
+          throw new Error('must wait for DNS');
+        },
+        putKvValue: async () => {
+          // The remote recovery checkpoint is established before waiting.
+        },
+        putR2Object: async () => {
+          throw new Error('must wait for DNS');
         },
-        revalidateBeforeWorkerDeploy: async () => {},
       },
-    );
+      revalidateBeforeWorkerDeploy: async () => {},
+    });
     expect(result.waitingForDns).toBe(true);
     expect(result.manifest.status).toBe('waiting-for-dns');
     expect(result.manifest.resources.map((resource) => resource.key).sort()).toEqual([
@@ -5376,78 +4762,33 @@ describe('platform installer', () => {
     ]);
   });
 
-  it('redeploys every Worker while reusing provisioned resources on upgrade', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-upgrade-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-    const initialPlan = await createPlatformInstallPlan(
-      planningClient(),
-      {
-        accountId: 'account',
-        applicationDomain: 'apps.example.com',
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: 'Example',
-        installationSlug: 'example',
-        zoneName: 'example.com',
-      },
-      null,
-    );
-    let index = 0;
-    const create = async (_account: string, name: string) => ({ id: `id-${index++}`, name });
-    const secrets = createPlatformInstallationSecrets({
-      bootstrapGitHubId: '583231',
-      bootstrapGitHubLogin: 'octocat',
-      cloudflareApiToken: 'cf-token',
-      databaseUrl: 'postgres://user:password@db.example.com/void',
-      githubClientId: 'github-id',
-      githubClientSecret: 'github-secret',
-      jwtSecret: TEST_PLATFORM_JWT_SECRET,
-      projectSecretKey: TEST_PLATFORM_PROJECT_SECRET_KEY,
-      r2AccessKeyId: 'r2-id',
-      r2SecretAccessKey: 'r2-secret',
-    });
-    const installed = await installPlatform(initialPlan, secrets, null, {
+  async function installedPlatform() {
+    const directory = useRegistryDirectory();
+    const secrets = freshSecrets();
+    const client = creatingClient();
+    const installed = await installPlatform(await examplePlan(), secrets, null, {
       acquireDatabaseLifecycleLock,
       claimDatabase,
       client: {
+        ...client,
         createAiGateway: async (_account, name) => ({ id: name, name }),
-        createDnsRecord: async (_zone, name) => ({
-          content: '100::',
-          id: `id-${index++}`,
-          name,
-          proxied: true,
-          type: 'AAAA',
-        }),
-        createZone: async () => {
-          throw new Error('existing zone must not be created');
-        },
-        createKvNamespace: create,
-        createR2Bucket: create,
-        createQueue: create,
-        createDispatchNamespace: create,
-        createHyperdrive: async (account, name) => create(account, name),
         deleteKvValue: async () => {},
-        putKvValue: async () => {},
-        putR2Object: async () => {},
       },
       deployWorker: async () => {},
       bootstrapEmail: async () => {
         throw new Error('email bootstrap must stay disabled');
       },
-      migrateDatabase: async () => {},
+      prepareDatabase,
       revalidateBeforeWorkerDeploy: async () => {},
       verifyHealth: async () => {},
     });
-    expect(installed.manifest.deployment.capabilities.email).toBe(false);
     const byKey = new Map(installed.manifest.resources.map((resource) => [resource.key, resource]));
-    expect(byKey.get('hyperdrive')?.configHash).toBe(
-      hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(secrets.databaseUrl)),
-    );
+    const named = (key: string) => {
+      const resource = byKey.get(key)!;
+      return { id: resource.id, name: resource.name };
+    };
     const deployment = installed.manifest.deployment;
-    const assetsBucket = installed.manifest.resources.find(
-      (resource) => resource.key === 'assets-bucket',
-    )!;
+    const assetsBucket = byKey.get('assets-bucket')!;
     const upgradedPlan = await createPlatformInstallPlan(
       {
         ...planningClient(),
@@ -5487,57 +4828,246 @@ describe('platform installer', () => {
           );
           return match ? [{ id: match.id, name: match.name }] : [];
         },
-        listDispatchNamespaces: async () => [named('dispatch-namespace')],
-        listHyperdriveConfigs: async () => [named('hyperdrive')],
-        listWorkerNames: async () => [
-          deployment.resources.apiWorker,
-          deployment.resources.proxyWorker,
-          deployment.resources.emailGatewayWorker,
-          deployment.resources.tailWorker,
-          deployment.resources.dispatchWorker,
-        ],
+        listDispatchNamespaces: async () => [named('dispatch-namespace')],
+        listHyperdriveConfigs: async () => [named('hyperdrive')],
+        listWorkerNames: async () => [
+          deployment.resources.apiWorker,
+          deployment.resources.proxyWorker,
+          deployment.resources.emailGatewayWorker,
+          deployment.resources.tailWorker,
+          deployment.resources.dispatchWorker,
+        ],
+      },
+      EXAMPLE_PLAN_INPUT,
+      installed.manifest,
+    );
+    const upgradeKvWrites: Array<string> = [];
+    const deletedKvValues: Array<string> = [];
+    const upgradeClient = {
+      ...client,
+      deleteKvValue: async (_account: string, _namespace: string, key: string) => {
+        deletedKvValues.push(key);
+      },
+      putKvValue: async (_account: string, _namespace: string, key: string) => {
+        upgradeKvWrites.push(key);
+      },
+    };
+    return {
+      byKey,
+      deletedKvValues,
+      deployment,
+      directory,
+      installed,
+      secrets,
+      sourceManifest: { ...installed.manifest, platformVersion: '0.10.13' },
+      upgradeClient,
+      upgradeKvWrites,
+      upgradedPlan,
+    };
+  }
+
+  async function upgradedPlatform() {
+    const platform = await installedPlatform();
+    const deployed: Array<string> = [];
+    let migrations = 0;
+    const upgraded = await installPlatform(
+      platform.upgradedPlan,
+      platform.secrets,
+      platform.sourceManifest,
+      {
+        acquireDatabaseLifecycleLock,
+        claimDatabase,
+        client: platform.upgradeClient,
+        deployWorker: async (config, secretPayload) => {
+          expect(secretPayload).toBeNull();
+          deployed.push(String(config.name));
+        },
+        prepareDatabase: async () => {
+          migrations++;
+          return prepareDatabase();
+        },
+        revalidateBeforeWorkerDeploy: async () => {},
+        runtime: resolvePlatformRuntime(getPlatformRuntimeDirectory()),
+        verifyHealth: async () => {},
+      },
+    );
+    return { ...platform, deployed, migrations, upgraded };
+  }
+
+  async function disabledPlatform() {
+    const platform = await upgradedPlatform();
+    const { directory, secrets, upgraded, upgradedPlan, upgradeClient } = platform;
+    const disabledConfigs: Array<Record<string, unknown>> = [];
+    let disabledHealthChecks = 0;
+    const disabledUpgrade = await installPlatform(
+      upgradedPlan,
+      secrets,
+      {
+        ...setInstallationDesiredState(upgraded.manifest, 'disabled', '2026-09-14T00:00:04.000Z'),
+        status: 'disabled',
+      },
+      {
+        acquireDatabaseLifecycleLock,
+        claimDatabase,
+        client: upgradeClient,
+        deployWorker: async (config) => {
+          disabledConfigs.push(config);
+        },
+        prepareDatabase,
+        revalidateBeforeWorkerDeploy: async () => {},
+        verifyHealth: async () => {
+          disabledHealthChecks++;
+        },
+      },
+    );
+    let interrupted = false;
+    await expect(
+      installPlatform(upgradedPlan, secrets, disabledUpgrade.manifest, {
+        acquireDatabaseLifecycleLock,
+        claimDatabase,
+        client: upgradeClient,
+        deployWorker: async () => {
+          interrupted = true;
+          throw new Error('interrupted deployment');
+        },
+        prepareDatabase,
+        revalidateBeforeWorkerDeploy: async () => {},
+      }),
+    ).rejects.toThrow('interrupted deployment');
+    const failedDisabledUpgrade = listInstallationManifests(directory)[0]!;
+    const resumedConfigs: Array<Record<string, unknown>> = [];
+    const resumedDisabledUpgrade = await installPlatform(
+      upgradedPlan,
+      secrets,
+      failedDisabledUpgrade,
+      {
+        acquireDatabaseLifecycleLock,
+        claimDatabase,
+        client: upgradeClient,
+        deployWorker: async (config) => {
+          resumedConfigs.push(config);
+        },
+        prepareDatabase,
+        revalidateBeforeWorkerDeploy: async () => {},
       },
+    );
+    return {
+      ...platform,
+      disabledConfigs,
+      disabledHealthChecks,
+      disabledUpgrade,
+      failedDisabledUpgrade,
+      interrupted,
+      resumedConfigs,
+      resumedDisabledUpgrade,
+    };
+  }
+
+  async function enabledPlatform() {
+    const platform = await disabledPlatform();
+    const { deletedKvValues, resumedDisabledUpgrade, secrets, upgradedPlan, upgradeClient } =
+      platform;
+    deletedKvValues.splice(0);
+    const enabledConfigs: Array<Record<string, unknown>> = [];
+    let enabledHealthChecks = 0;
+    const enabledUpgrade = await installPlatform(
+      upgradedPlan,
+      secrets,
+      setInstallationDesiredState(
+        resumedDisabledUpgrade.manifest,
+        'enabled',
+        '2026-09-14T00:00:05.000Z',
+      ),
       {
-        accountId: 'account',
-        applicationDomain: deployment.application.baseDomain,
-        controlPlaneDomain: '',
-        dedicatedZone: false,
-        displayName: deployment.displayName,
-        installationSlug: deployment.installationSlug,
-        zoneName: deployment.application.zoneName,
+        acquireDatabaseLifecycleLock,
+        claimDatabase,
+        client: upgradeClient,
+        deployWorker: async (config) => {
+          enabledConfigs.push(config);
+        },
+        prepareDatabase,
+        revalidateBeforeWorkerDeploy: async () => {},
+        verifyHealth: async () => {
+          enabledHealthChecks++;
+        },
       },
-      installed.manifest,
     );
-    const deployed: Array<string> = [];
-    let migrations = 0;
-    const upgradeKvWrites: Array<string> = [];
-    const deletedKvValues: Array<string> = [];
-    const upgradeClient = {
-      createAiGateway: create,
-      createDnsRecord: async (_zone: string, name: string) => ({
-        content: '100::',
-        id: name,
-        name,
-        proxied: true,
-        type: 'AAAA' as const,
+    return { ...platform, enabledConfigs, enabledHealthChecks, enabledUpgrade };
+  }
+
+  function cutoverSnapshot(
+    workerName: string,
+    previousVersionId: string | null,
+    stagedVersionId: string,
+  ) {
+    return Buffer.from(
+      JSON.stringify({
+        previousTriggers: {
+          crons: [],
+          preview_urls: true,
+          queueConsumers: [],
+          routes: [],
+          workers_dev: true,
+          workflows: [],
+        },
+        previousVersionId,
+        schema: 1,
+        stagedVersionId,
+        workerName,
       }),
-      createZone: async () => {
-        throw new Error('must reuse zone');
-      },
-      createKvNamespace: create,
-      createR2Bucket: create,
-      createQueue: create,
-      createDispatchNamespace: create,
-      createHyperdrive: async (account: string, name: string) => create(account, name),
-      deleteKvValue: async (_account: string, _namespace: string, key: string) => {
-        deletedKvValues.push(key);
-      },
-      putKvValue: async (_account: string, _namespace: string, key: string) => {
-        upgradeKvWrites.push(key);
-      },
-      putR2Object: async () => {},
-    };
-    const sourceManifest = { ...installed.manifest, platformVersion: '0.10.13' };
+    ).toString('base64url');
+  }
+
+  it('redeploys every Worker while reusing provisioned resources on upgrade', async () => {
+    const {
+      byKey,
+      deployed,
+      deployment,
+      installed,
+      migrations,
+      secrets,
+      upgraded,
+      upgradeKvWrites,
+    } = await upgradedPlatform();
+    expect(installed.manifest.deployment.capabilities.email).toBe(false);
+    expect(byKey.get('hyperdrive')?.configHash).toBe(
+      hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(secrets.databaseUrl)),
+    );
+    expect(deployed).toEqual([
+      deployment.resources.apiWorker,
+      deployment.resources.proxyWorker,
+      deployment.resources.emailGatewayWorker,
+      deployment.resources.tailWorker,
+      deployment.resources.dispatchWorker,
+      deployment.resources.apiWorker,
+      deployment.resources.proxyWorker,
+      deployment.resources.emailGatewayWorker,
+      deployment.resources.tailWorker,
+      deployment.resources.dispatchWorker,
+    ]);
+    expect(migrations).toBe(0);
+    expect(new Set(upgradeKvWrites)).toEqual(
+      new Set(['__void/platform/installation/v1', PLATFORM_DISABLED_KEY]),
+    );
+    expect(upgraded.manifest.status).toBe('installed');
+    expect(upgraded.manifest.platformVersion).toBe(readPlatformRuntimeManifest().platformVersion);
+    expect(upgraded.manifest.runtime).toMatchObject({
+      manifestSha256: expect.stringMatching(/^[0-9a-f]{64}$/),
+      source: 'custom',
+    });
+    expect(upgraded.manifest.resources).toHaveLength(16);
+  });
+
+  it('resumes an interrupted Worker secret rotation and commits the next one', async () => {
+    const {
+      directory,
+      secrets,
+      installed,
+      deployment,
+      upgradedPlan,
+      upgradeClient,
+      sourceManifest,
+    } = await installedPlatform();
     const interruptedProtocolEvents: Array<string> = [];
     const legacySourceManifest = {
       ...sourceManifest,
@@ -5599,7 +5129,7 @@ describe('platform installer', () => {
             interruptedProtocolEvents.push(`rollback:${name}`);
           };
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {
           throw new Error('health must not run before every Worker is staged');
@@ -5669,7 +5199,7 @@ describe('platform installer', () => {
           emptyCoreUpgradeConfigs.push(config);
           resumedSecretPayloads.push(secretPayload);
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         prepareSandboxDrain: async () => sandboxDrainPreparation('complete'),
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {},
@@ -5728,7 +5258,7 @@ describe('platform installer', () => {
         deployWorker: async (_config, secretPayload) => {
           nextRotationPayloads.push(secretPayload);
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {},
       },
@@ -5745,9 +5275,11 @@ describe('platform installer', () => {
         expect.objectContaining({ key: expect.stringMatching(/:committed$/) }),
       ]),
     );
-    upgradeKvWrites.splice(0);
-    deletedKvValues.splice(0);
+  });
 
+  it('waits for the sandbox drain before enabling traffic and resumes the same operation', async () => {
+    const { secrets, deployment, upgradedPlan, upgradeClient, sourceManifest } =
+      await installedPlatform();
     const sandboxDrainDeployments: Array<string> = [];
     const sandboxDrainTrafficStates: Array<unknown> = [];
     const sandboxDrainEvents: Array<string> = [];
@@ -5775,7 +5307,7 @@ describe('platform installer', () => {
             (config.vars as Record<string, unknown> | undefined)?.PLATFORM_TRAFFIC_STATE,
           );
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         prepareSandboxDrain: async () => sandboxDrainPreparation('pending'),
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {
@@ -5840,7 +5372,7 @@ describe('platform installer', () => {
             )}`,
           );
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         prepareSandboxDrain: async () =>
           sandboxDrainPreparation(resumedDrainPreparations++ === 0 ? 'pending' : 'complete'),
         revalidateBeforeWorkerDeploy: async () => {},
@@ -5885,9 +5417,11 @@ describe('platform installer', () => {
       'gate:open',
       'health',
     ]);
-    upgradeKvWrites.splice(0);
-    deletedKvValues.splice(0);
+  });
 
+  it('keeps the source version when upgrade health fails', async () => {
+    const { directory, secrets, upgradedPlan, upgradeClient, sourceManifest } =
+      await installedPlatform();
     let verifiedTargetVersion = '';
     await expect(
       installPlatform(upgradedPlan, secrets, sourceManifest, {
@@ -5895,7 +5429,7 @@ describe('platform installer', () => {
         claimDatabase,
         client: upgradeClient,
         deployWorker: async () => async () => {},
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async (_api, _id, _proxy, _domain, platformVersion) => {
           verifiedTargetVersion = platformVersion;
@@ -5909,47 +5443,10 @@ describe('platform installer', () => {
       action: 'upgrade',
       phase: 'failed',
     });
+  });
 
-    const upgraded = await installPlatform(upgradedPlan, secrets, sourceManifest, {
-      acquireDatabaseLifecycleLock,
-      claimDatabase,
-      client: upgradeClient,
-      deployWorker: async (config, secretPayload) => {
-        expect(secretPayload).toBeNull();
-        deployed.push(String(config.name));
-      },
-      migrateDatabase: async () => {
-        migrations++;
-      },
-      revalidateBeforeWorkerDeploy: async () => {},
-      runtime: resolvePlatformRuntime(getPlatformRuntimeDirectory()),
-      verifyHealth: async () => {},
-    });
-
-    expect(deployed).toEqual([
-      deployment.resources.apiWorker,
-      deployment.resources.proxyWorker,
-      deployment.resources.emailGatewayWorker,
-      deployment.resources.tailWorker,
-      deployment.resources.dispatchWorker,
-      deployment.resources.apiWorker,
-      deployment.resources.proxyWorker,
-      deployment.resources.emailGatewayWorker,
-      deployment.resources.tailWorker,
-      deployment.resources.dispatchWorker,
-    ]);
-    expect(migrations).toBe(0);
-    expect(new Set(upgradeKvWrites)).toEqual(
-      new Set(['__void/platform/installation/v1', PLATFORM_DISABLED_KEY]),
-    );
-    expect(upgraded.manifest.status).toBe('installed');
-    expect(upgraded.manifest.platformVersion).toBe(readPlatformRuntimeManifest().platformVersion);
-    expect(upgraded.manifest.runtime).toMatchObject({
-      manifestSha256: expect.stringMatching(/^[0-9a-f]{64}$/),
-      source: 'custom',
-    });
-    expect(upgraded.manifest.resources).toHaveLength(16);
-
+  it('rolls the database schema back and forward from recorded manifests', async () => {
+    const { secrets, upgradedPlan, upgradeClient, upgraded } = await upgradedPlatform();
     const currentRuntime = resolvePlatformRuntime(getPlatformRuntimeDirectory());
     const earlierDatabase = migrationSubset(currentRuntime.manifest.database.migrations.length - 1);
     const earlierRuntime = {
@@ -6048,7 +5545,11 @@ describe('platform installer', () => {
       platformVersion: rollbackSource.manifest.platformVersion,
       runtime: { manifestSha256: rollbackSource.manifestSha256 },
     });
+  });
 
+  it('downgrades the usage protocol behind the routing gate', async () => {
+    const { secrets, deployment, upgradedPlan, upgradeClient, upgraded } = await upgradedPlatform();
+    const currentRuntime = resolvePlatformRuntime(getPlatformRuntimeDirectory());
     const downgradeEvents: Array<string> = [];
     const downgraded = await installPlatform(upgradedPlan, secrets, upgraded.manifest, {
       acquireDatabaseLifecycleLock,
@@ -6069,7 +5570,7 @@ describe('platform installer', () => {
       deployWorker: async (config) => {
         downgradeEvents.push(`deploy:${String(config.name)}`);
       },
-      migrateDatabase: async () => {},
+      prepareDatabase,
       revalidateBeforeWorkerDeploy: async () => {},
       runtime: {
         ...currentRuntime,
@@ -6091,7 +5592,10 @@ describe('platform installer', () => {
       downgradeEvents.indexOf('cutover'),
     );
     expect(downgraded.manifest.usageProtocolVersion).toBe(0);
+  });
 
+  it('recreates a missing Worker behind the routing gate', async () => {
+    const { secrets, upgradedPlan, upgradeClient, upgraded } = await upgradedPlatform();
     const repairedWorkerConfigs: Array<Record<string, unknown>> = [];
     const repairEvents: Array<string> = [];
     const repairPlan = {
@@ -6127,7 +5631,7 @@ describe('platform installer', () => {
         repairedWorkerConfigs.push(config);
         repairEvents.push(`deploy:${String(config.name)}`);
       },
-      migrateDatabase: async () => {},
+      prepareDatabase,
       revalidateBeforeWorkerDeploy: async () => {},
       verifyHealth: async () => {
         repairEvents.push('health');
@@ -6156,7 +5660,10 @@ describe('platform installer', () => {
         (repairedWorkerConfigs[index + 5]!.vars as Record<string, unknown>).PLATFORM_TRAFFIC_STATE,
       ).toBe('enabled');
     }
+  });
 
+  it('defers sandbox drain verification of a disabled legacy upgrade until enablement', async () => {
+    const { secrets, upgradedPlan, upgradeClient, upgraded } = await upgradedPlatform();
     const legacyDisabled = {
       ...setInstallationDesiredState(upgraded.manifest, 'disabled', '2026-09-14T00:00:03.500Z'),
       safetyProtocols: { sandboxDrain: 0 as const },
@@ -6167,7 +5674,7 @@ describe('platform installer', () => {
       claimDatabase,
       client: upgradeClient,
       deployWorker: async () => {},
-      migrateDatabase: async () => {},
+      prepareDatabase,
       prepareSandboxDrain: async () => sandboxDrainPreparation('pending'),
       revalidateBeforeWorkerDeploy: async () => {},
       verifySandboxDrain: async () => {
@@ -6202,7 +5709,7 @@ describe('platform installer', () => {
         deployWorker: async (config) => {
           legacyEnableConfigs.push(config);
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         prepareSandboxDrain: async () => sandboxDrainPreparation('pending'),
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {},
@@ -6217,32 +5724,18 @@ describe('platform installer', () => {
         (legacyEnableConfigs[index]!.vars as Record<string, unknown>).PLATFORM_TRAFFIC_STATE,
       ).toBe('sandbox-drain');
     }
+  });
 
-    const disabledConfigs: Array<Record<string, unknown>> = [];
-    let disabledHealthChecks = 0;
-    const disabledUpgrade = await installPlatform(
-      upgradedPlan,
-      secrets,
-      {
-        ...setInstallationDesiredState(upgraded.manifest, 'disabled', '2026-09-14T00:00:04.000Z'),
-        status: 'disabled',
-      },
-      {
-        acquireDatabaseLifecycleLock,
-        claimDatabase,
-        client: upgradeClient,
-        deployWorker: async (config) => {
-          disabledConfigs.push(config);
-        },
-        migrateDatabase: async () => {
-          migrations++;
-        },
-        revalidateBeforeWorkerDeploy: async () => {},
-        verifyHealth: async () => {
-          disabledHealthChecks++;
-        },
-      },
-    );
+  it('keeps a disabled upgrade off public routes through an interrupted deployment', async () => {
+    const {
+      disabledConfigs,
+      disabledHealthChecks,
+      disabledUpgrade,
+      failedDisabledUpgrade,
+      interrupted,
+      resumedConfigs,
+      resumedDisabledUpgrade,
+    } = await disabledPlatform();
     expect(disabledUpgrade.manifest.status).toBe('disabled');
     expect(disabledHealthChecks).toBe(0);
     expect(disabledConfigs).toHaveLength(5);
@@ -6251,42 +5744,9 @@ describe('platform installer', () => {
       expect(config.preview_urls).toBe(false);
       expect(config).not.toHaveProperty('routes');
     }
-
-    let interrupted = false;
-    await expect(
-      installPlatform(upgradedPlan, secrets, disabledUpgrade.manifest, {
-        acquireDatabaseLifecycleLock,
-        claimDatabase,
-        client: upgradeClient,
-        deployWorker: async () => {
-          interrupted = true;
-          throw new Error('interrupted deployment');
-        },
-        migrateDatabase: async () => {},
-        revalidateBeforeWorkerDeploy: async () => {},
-      }),
-    ).rejects.toThrow('interrupted deployment');
     expect(interrupted).toBe(true);
-    const failedDisabledUpgrade = listInstallationManifests(directory)[0]!;
     expect(failedDisabledUpgrade.status).toBe('failed');
     expect(failedDisabledUpgrade.desiredState).toBe('disabled');
-
-    const resumedConfigs: Array<Record<string, unknown>> = [];
-    const resumedDisabledUpgrade = await installPlatform(
-      upgradedPlan,
-      secrets,
-      failedDisabledUpgrade,
-      {
-        acquireDatabaseLifecycleLock,
-        claimDatabase,
-        client: upgradeClient,
-        deployWorker: async (config) => {
-          resumedConfigs.push(config);
-        },
-        migrateDatabase: async () => {},
-        revalidateBeforeWorkerDeploy: async () => {},
-      },
-    );
     expect(resumedDisabledUpgrade.manifest.status).toBe('disabled');
     expect(resumedConfigs).toHaveLength(5);
     for (const config of resumedConfigs) {
@@ -6294,7 +5754,11 @@ describe('platform installer', () => {
       expect(config.preview_urls).toBe(false);
       expect(config).not.toHaveProperty('routes');
     }
+  });
 
+  it('closes the routing gate again when a Worker changes during enablement', async () => {
+    const { secrets, upgradedPlan, upgradeClient, resumedDisabledUpgrade } =
+      await disabledPlatform();
     const concurrentEnableEvents: Array<string> = [];
     let cutoverVerifications = 0;
     await expect(
@@ -6321,7 +5785,7 @@ describe('platform installer', () => {
             },
           },
           deployWorker: async () => async () => {},
-          migrateDatabase: async () => {},
+          prepareDatabase,
           revalidateBeforeWorkerDeploy: async () => {},
           verifyHealth: async () => {},
           verifyWorkerCutover: async () => {
@@ -6338,7 +5802,11 @@ describe('platform installer', () => {
       `delete:${PLATFORM_DISABLED_KEY}`,
       `put:${PLATFORM_DISABLED_KEY}`,
     ]);
+  });
 
+  it('retries a failed enablement from the recorded previous Worker configs', async () => {
+    const { directory, secrets, deployment, upgradedPlan, upgradeClient, resumedDisabledUpgrade } =
+      await disabledPlatform();
     const failedEnableEvents: Array<string> = [];
     let failedEnableDeploys = 0;
     await expect(
@@ -6367,7 +5835,7 @@ describe('platform installer', () => {
               }
             };
           },
-          migrateDatabase: async () => {},
+          prepareDatabase,
           revalidateBeforeWorkerDeploy: async () => {},
           verifyHealth: async () => {},
         },
@@ -6388,7 +5856,7 @@ describe('platform installer', () => {
       deployWorker: async (_config, _secrets, previousConfig) => {
         retryPreviousConfigs.push(previousConfig);
       },
-      migrateDatabase: async () => {},
+      prepareDatabase,
       revalidateBeforeWorkerDeploy: async () => {},
       verifyHealth: async () => {},
     });
@@ -6412,31 +5880,11 @@ describe('platform installer', () => {
           (config) => (config.vars as Record<string, unknown>).PLATFORM_TRAFFIC_STATE === 'staging',
         ),
     ).toBe(true);
+  });
 
-    const enabledConfigs: Array<Record<string, unknown>> = [];
-    let enabledHealthChecks = 0;
-    const enabledUpgrade = await installPlatform(
-      upgradedPlan,
-      secrets,
-      setInstallationDesiredState(
-        resumedDisabledUpgrade.manifest,
-        'enabled',
-        '2026-09-14T00:00:05.000Z',
-      ),
-      {
-        acquireDatabaseLifecycleLock,
-        claimDatabase,
-        client: upgradeClient,
-        deployWorker: async (config) => {
-          enabledConfigs.push(config);
-        },
-        migrateDatabase: async () => {},
-        revalidateBeforeWorkerDeploy: async () => {},
-        verifyHealth: async () => {
-          enabledHealthChecks++;
-        },
-      },
-    );
+  it('enables a disabled upgrade after staging every Worker', async () => {
+    const { deletedKvValues, deployment, enabledConfigs, enabledHealthChecks, enabledUpgrade } =
+      await enabledPlatform();
     expect(enabledUpgrade.manifest.status).toBe('installed');
     expect(enabledUpgrade.manifest.desiredState).toBe('enabled');
     expect(enabledUpgrade.manifest.deployment.authentication.configurable).toBe(true);
@@ -6459,7 +5907,10 @@ describe('platform installer', () => {
     expect(
       enabledConfigs.slice(5).find((config) => config.name === deployment.resources.dispatchWorker),
     ).toHaveProperty('routes');
+  });
 
+  it('rolls back a disabling upgrade without exposing workers.dev', async () => {
+    const { secrets, upgradedPlan, upgradeClient, enabledUpgrade } = await enabledPlatform();
     const disabledRollbackStates: Array<unknown> = [];
     let disabledRollbackDeploys = 0;
     await expect(
@@ -6486,13 +5937,16 @@ describe('platform installer', () => {
             }
             return async () => {};
           },
-          migrateDatabase: async () => {},
+          prepareDatabase,
           revalidateBeforeWorkerDeploy: async () => {},
         },
       ),
     ).rejects.toThrow('disabled upgrade failed');
     expect(disabledRollbackStates).toEqual([false, false]);
+  });
 
+  it('does not deploy when a Worker ownership marker changed after planning', async () => {
+    const { secrets, upgradedPlan, upgradeClient, enabledUpgrade } = await enabledPlatform();
     let replacedWorkerDeploys = 0;
     await expect(
       installPlatform(upgradedPlan, secrets, enabledUpgrade.manifest, {
@@ -6502,14 +5956,18 @@ describe('platform installer', () => {
         deployWorker: async () => {
           replacedWorkerDeploys++;
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {
           throw new Error('platform: Worker ownership marker changed after planning.');
         },
       }),
     ).rejects.toThrow('ownership marker changed after planning');
     expect(replacedWorkerDeploys).toBe(0);
+  });
 
+  it('rolls back deployed Workers in reverse order when one deploy fails', async () => {
+    const { secrets, deployment, upgradedPlan, upgradeClient, enabledUpgrade } =
+      await enabledPlatform();
     const partialEvents: Array<string> = [];
     let partialDeploys = 0;
     await expect(
@@ -6528,7 +5986,7 @@ describe('platform installer', () => {
             partialEvents.push(`rollback:${name}`);
           };
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
       }),
     ).rejects.toThrow('third Worker failed');
@@ -6539,7 +5997,11 @@ describe('platform installer', () => {
       `rollback:${deployment.resources.proxyWorker}`,
       `rollback:${deployment.resources.apiWorker}`,
     ]);
+  });
 
+  it('rolls back every Worker in reverse order when health fails', async () => {
+    const { secrets, deployment, upgradedPlan, upgradeClient, enabledUpgrade } =
+      await enabledPlatform();
     const healthEvents: Array<string> = [];
     await expect(
       installPlatform(upgradedPlan, secrets, enabledUpgrade.manifest, {
@@ -6553,7 +6015,7 @@ describe('platform installer', () => {
             healthEvents.push(`rollback:${name}`);
           };
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {
           throw new Error('health check failed');
@@ -6567,7 +6029,10 @@ describe('platform installer', () => {
       `rollback:${deployment.resources.proxyWorker}`,
       `rollback:${deployment.resources.apiWorker}`,
     ]);
+  });
 
+  it('attempts every rollback and reports an incomplete one', async () => {
+    const { secrets, upgradedPlan, upgradeClient, enabledUpgrade } = await enabledPlatform();
     let rollbackIndex = 0;
     await expect(
       installPlatform(upgradedPlan, secrets, enabledUpgrade.manifest, {
@@ -6580,7 +6045,7 @@ describe('platform installer', () => {
             throw new Error('rollback unavailable');
           }
         },
-        migrateDatabase: async () => {},
+        prepareDatabase,
         revalidateBeforeWorkerDeploy: async () => {},
         verifyHealth: async () => {
           throw new Error('health check failed');
@@ -6590,7 +6055,11 @@ describe('platform installer', () => {
       'health check failed Automatic Worker rollback was incomplete: rollback unavailable',
     );
     expect(rollbackIndex).toBe(5);
+  });
 
+  it('restores an interrupted cutover behind the routing gate before the next one', async () => {
+    const { secrets, deployment, upgradedPlan, upgradeClient, enabledUpgrade } =
+      await enabledPlatform();
     const interruptedCutover = {
       ...enabledUpgrade.manifest,
       status: 'failed' as const,
@@ -6649,7 +6118,7 @@ describe('platform installer', () => {
       deployWorker: async (config) => {
         recoveryEvents.push(`deploy:${String(config.name)}`);
       },
-      migrateDatabase: async () => {},
+      prepareDatabase,
       recoverWorkerCutover: async (snapshot) => {
         recoveryEvents.push(
           `recover:${snapshot.key}:${snapshot.previousVersionId}:${snapshot.stagedVersionId}:${snapshot.preserveCustomDomains}`,
@@ -6678,7 +6147,11 @@ describe('platform installer', () => {
         expect.objectContaining({ key: 'worker-cutover:1000:committed' }),
       ]),
     );
+  });
 
+  it('replans Workers after an interrupted initial cutover', async () => {
+    const { secrets, deployment, upgradedPlan, upgradeClient, enabledUpgrade } =
+      await enabledPlatform();
     const interruptedInitialCutover = {
       ...enabledUpgrade.manifest,
       status: 'failed' as const,
@@ -6706,7 +6179,7 @@ describe('platform installer', () => {
         },
       },
       deployWorker: async () => {},
-      migrateDatabase: async () => {},
+      prepareDatabase,
       recoverWorkerCutover: async () => {},
       replanWorkers: async (manifest) => {
         replannedResourceState = manifest.resources.find(
@@ -6726,34 +6199,6 @@ describe('platform installer', () => {
     expect(interruptedInitialGateWrites).toEqual([PLATFORM_DISABLED_KEY]);
     expect(replannedResourceState).toBe('ready');
     expect(replannedActions).toContain('api-worker:reuse');
-
-    function named(key: string) {
-      const resource = byKey.get(key)!;
-      return { id: resource.id, name: resource.name };
-    }
-
-    function cutoverSnapshot(
-      workerName: string,
-      previousVersionId: string | null,
-      stagedVersionId: string,
-    ) {
-      return Buffer.from(
-        JSON.stringify({
-          previousTriggers: {
-            crons: [],
-            preview_urls: true,
-            queueConsumers: [],
-            routes: [],
-            workers_dev: true,
-            workflows: [],
-          },
-          previousVersionId,
-          schema: 1,
-          stagedVersionId,
-          workerName,
-        }),
-      ).toString('base64url');
-    }
   });
 });
 
diff --git a/packages/void/test/unit/platform-management-upgrade.test.ts b/packages/void/test/unit/platform-management-upgrade.test.ts
index 994a863f8..f4b9c5308 100644
--- a/packages/void/test/unit/platform-management-upgrade.test.ts
+++ b/packages/void/test/unit/platform-management-upgrade.test.ts
@@ -220,6 +220,16 @@ import {
   writeInstallationManifest,
 } from '../../src/cli/platform-registry.ts';
 
+const upgrade = (overrides: { plan?: boolean; yes?: boolean } = {}) =>
+  runInstalledPlatformCommand({
+    subcommand: 'upgrade',
+    selector: state.manifest!.id,
+    plan: false,
+    runtime: '',
+    yes: true,
+    ...overrides,
+  });
+
 describe('installed platform upgrade', () => {
   it('prints an exact rollback resume command with quoted custom runtime paths', () => {
     expect(
@@ -333,13 +343,7 @@ describe('installed platform upgrade', () => {
         await args[0].listAiGateways(args[1].accountId);
         return original(...args);
       });
-      await runInstalledPlatformCommand({
-        plan: false,
-        runtime: '',
-        selector: state.manifest!.id,
-        subcommand: 'upgrade',
-        yes: true,
-      });
+      await upgrade();
       expect(state.clientTokens).toEqual([state.requiredGatewayToken]);
       expect(installPlatform).toHaveBeenCalledWith(
         expect.anything(),
@@ -379,15 +383,7 @@ describe('installed platform upgrade', () => {
             ? state.listWorkerNames
             : state.request;
       check.mockRejectedValueOnce(new PlatformCloudflareApiError('Authentication error', 403));
-      await expect(
-        runInstalledPlatformCommand({
-          plan: false,
-          runtime: '',
-          selector: state.manifest.id,
-          subcommand: 'upgrade',
-          yes: true,
-        }),
-      ).rejects.toThrow('HTTP 403');
+      await expect(upgrade()).rejects.toThrow('HTTP 403');
       expect(acquirePlatformLifecycleLock).not.toHaveBeenCalled();
       expect(acquirePlatformDatabaseLifecycleLock).not.toHaveBeenCalled();
       expect(writeInstallationManifest).not.toHaveBeenCalled();
@@ -401,13 +397,7 @@ describe('installed platform upgrade', () => {
   it('includes shared email configuration when planning an upgrade', async () => {
     vi.stubEnv('VOID_EMAIL_SHARED_ZONE_ID', 'mail-zone');
     vi.stubEnv('VOID_EMAIL_SENDER_DOMAIN', 'mail.example.com');
-    await runInstalledPlatformCommand({
-      plan: true,
-      runtime: '',
-      selector: state.manifest!.id,
-      subcommand: 'upgrade',
-      yes: true,
-    });
+    await upgrade({ plan: true });
     expect(createPlatformInstallPlan).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({
@@ -440,20 +430,8 @@ describe('installed platform upgrade', () => {
   );
 
   it('borrows database preparation from the held lifecycle lock', async () => {
-    await runInstalledPlatformCommand({
-      plan: false,
-      runtime: '',
-      selector: state.manifest!.id,
-      subcommand: 'upgrade',
-      yes: true,
-    });
+    await upgrade();
 
-    expect(state.prepareDatabase).toHaveBeenCalledWith(
-      state.runtime!.directory,
-      state.runtime!.manifest.database,
-      '1.0.0',
-      false,
-    );
     expect(state.events).toEqual([
       'installer-start',
       `prepare:${state.runtime!.manifest.database.schemaDigest}`,
@@ -532,15 +510,7 @@ describe('installed platform upgrade', () => {
       throw new Error('migration failed');
     });
 
-    await expect(
-      runInstalledPlatformCommand({
-        plan: false,
-        runtime: '',
-        selector: state.manifest!.id,
-        subcommand: 'upgrade',
-        yes: true,
-      }),
-    ).rejects.toThrow('migration failed');
+    await expect(upgrade()).rejects.toThrow('migration failed');
 
     expect(state.events).toEqual([
       'installer-start',
@@ -557,13 +527,7 @@ describe('installed platform upgrade', () => {
   });
 
   it('does not start deployment progress for a plan-only run', async () => {
-    await runInstalledPlatformCommand({
-      plan: true,
-      runtime: '',
-      selector: state.manifest!.id,
-      subcommand: 'upgrade',
-      yes: false,
-    });
+    await upgrade({ plan: true, yes: false });
     expect(state.spinner).not.toHaveBeenCalled();
     expect(installPlatform).not.toHaveBeenCalled();
     expect(state.events).toEqual([]);
@@ -573,15 +537,7 @@ describe('installed platform upgrade', () => {
     state.createSecrets.mockImplementationOnce(() => {
       throw new Error('invalid credentials');
     });
-    await expect(
-      runInstalledPlatformCommand({
-        plan: false,
-        runtime: '',
-        selector: state.manifest!.id,
-        subcommand: 'upgrade',
-        yes: true,
-      }),
-    ).rejects.toThrow('invalid credentials');
+    await expect(upgrade()).rejects.toThrow('invalid credentials');
     expect(installPlatform).not.toHaveBeenCalled();
     expect(state.progress.start).not.toHaveBeenCalled();
     expect(state.progress.error).not.toHaveBeenCalled();
@@ -595,27 +551,13 @@ describe('installed platform upgrade', () => {
       expect(state.progress.stop).not.toHaveBeenCalled();
       expect(printSuccess).not.toHaveBeenCalled();
     });
-    await runInstalledPlatformCommand({
-      plan: false,
-      runtime: '',
-      selector: state.manifest!.id,
-      subcommand: 'upgrade',
-      yes: true,
-    });
+    await upgrade();
     expect(state.progress.stop).toHaveBeenCalledExactlyOnceWith('Platform upgrade complete.');
   });
 
   it('reports a finalization failure without claiming success and still releases the local lock', async () => {
     state.releaseDatabase.mockRejectedValueOnce(new Error('database release failed'));
-    await expect(
-      runInstalledPlatformCommand({
-        plan: false,
-        runtime: '',
-        selector: state.manifest!.id,
-        subcommand: 'upgrade',
-        yes: true,
-      }),
-    ).rejects.toThrow('database release failed');
+    await expect(upgrade()).rejects.toThrow('database release failed');
     expect(state.progress.error).toHaveBeenCalledExactlyOnceWith('Platform upgrade failed.');
     expect(state.progress.stop).not.toHaveBeenCalled();
     expect(printSuccess).not.toHaveBeenCalled();
@@ -632,13 +574,7 @@ describe('installed platform upgrade', () => {
         zoneNameServers: [],
         [reason]: true,
       });
-      await runInstalledPlatformCommand({
-        plan: false,
-        runtime: '',
-        selector: state.manifest!.id,
-        subcommand: 'upgrade',
-        yes: true,
-      });
+      await upgrade();
       expect(state.progress.stop).toHaveBeenCalledExactlyOnceWith(
         'Platform operation paused; progress is saved.',
       );
@@ -652,13 +588,7 @@ describe('installed platform upgrade', () => {
   );
 
   it('forwards spinner cancellation to coordinated CLI shutdown', async () => {
-    await runInstalledPlatformCommand({
-      plan: false,
-      runtime: '',
-      selector: state.manifest!.id,
-      subcommand: 'upgrade',
-      yes: true,
-    });
+    await upgrade();
     const onCancel = state.spinner.mock.calls[0]![0].onCancel;
     const emit = vi.spyOn(process, 'emit').mockReturnValueOnce(true);
     onCancel();
@@ -678,13 +608,7 @@ describe('installed platform upgrade', () => {
       waitingForSandboxDrain: false,
       zoneNameServers: [],
     });
-    await runInstalledPlatformCommand({
-      subcommand: 'upgrade',
-      selector: state.manifest!.id,
-      plan: false,
-      runtime: '',
-      yes: true,
-    });
+    await upgrade();
     expect(log.info).toHaveBeenCalledWith(
       'Application traffic remains paused. Enable the installation when you are ready.',
     );
@@ -737,14 +661,6 @@ describe('installed platform upgrade', () => {
       expect(state.events).toEqual(['outer-release', 'local-release']);
     });
 
-    it('refuses when the held lock cannot read the state', async () => {
-      state.readProjectZeroTrust.mockRejectedValueOnce(new Error('relation is locked'));
-      await expect(uninstall(false)).rejects.toThrow(
-        'could not be read from the platform database: relation is locked',
-      );
-      expect(state.events).toEqual(['outer-release', 'local-release']);
-    });
-
     it('reads the state for a plan without taking the lifecycle lock', async () => {
       state.readPlanZeroTrust.mockResolvedValueOnce(enabled);
       await expect(uninstall(true)).rejects.toThrow(
diff --git a/packages/void/test/unit/platform-management.test.ts b/packages/void/test/unit/platform-management.test.ts
index 0695ebbac..e3823a4e1 100644
--- a/packages/void/test/unit/platform-management.test.ts
+++ b/packages/void/test/unit/platform-management.test.ts
@@ -6,11 +6,9 @@ import { createHash } from 'node:crypto';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { stripVTControlCharacters } from 'node:util';
 import {
   createPlatformDeploymentManifest,
   createPlatformInstallationManifest,
-  createPlatformResourceOwnershipMarker,
   PLATFORM_DISABLED_KEY,
   PLATFORM_DISABLED_VALUE,
   recordInstallationResource,
@@ -37,16 +35,20 @@ import {
 } from '../../src/cli/platform-plan.ts';
 import {
   listInstallationManifests,
-  promoteInstallationSecrets,
   readInstallationRecoverySecrets,
   writeInstallationManifest,
-  writePendingInstallationSecrets,
 } from '../../src/cli/platform-registry.ts';
 import { recordPlatformWorkerTraffic } from '../../src/cli/platform-traffic.ts';
 import {
   projectZeroTrustUninstallState,
   readPlatformProjectZeroTrustStateConnection,
 } from '../../src/cli/platform-zero-trust-uninstall.ts';
+import {
+  expectInOrder,
+  noteText,
+  ownershipMarker,
+  persistInstallation,
+} from '../helpers/platform-installation.ts';
 
 vi.mock('@voidzero-dev/vite-plus-prompts', async (original) => {
   const actual = await original<typeof import('@voidzero-dev/vite-plus-prompts')>();
@@ -149,35 +151,20 @@ function installedManifest(zoneOwnership: ResourceOwnership = 'created') {
   return manifest;
 }
 
-function persist(manifest: PlatformInstallationManifest): void {
-  const directory = mkdtempSync(join(tmpdir(), 'void-platform-management-test-'));
-  directories.push(directory);
-  process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-  writeInstallationManifest(manifest);
-  writePendingInstallationSecrets(manifest, { databaseUrl: 'postgres://recovery' });
-  promoteInstallationSecrets(manifest);
-}
-
 function client(manifest: PlatformInstallationManifest) {
   const deleted: Array<[string, string]> = [];
   const emptiedBuckets: Array<string> = [];
-  const preservedBucketKeys: Array<ReadonlyArray<string>> = [];
   const deletedBucketMarkers: Array<string> = [];
   const remoteWrites: Array<string> = [];
   const disabledWrites: Array<string> = [];
   const deletedKvValues: Array<string> = [];
-  let removedRoutes = 0;
   const fake = {
     deleted,
     emptiedBuckets,
-    preservedBucketKeys,
     deletedBucketMarkers,
     remoteWrites,
     disabledWrites,
     deletedKvValues,
-    get removedRoutes() {
-      return removedRoutes;
-    },
     deleteResource: async (
       _account: string,
       { id, kind }: Readonly<{ id: string; kind: string; name: string }>,
@@ -198,13 +185,8 @@ function client(manifest: PlatformInstallationManifest) {
     deleteR2Object: async (_account: string, bucket: string) => {
       deletedBucketMarkers.push(bucket);
     },
-    emptyR2Bucket: async (
-      _account: string,
-      bucket: string,
-      preservedKeys?: ReadonlySet<string>,
-    ) => {
+    emptyR2Bucket: async (_account: string, bucket: string) => {
       emptiedBuckets.push(bucket);
-      preservedBucketKeys.push([...(preservedKeys ?? [])]);
     },
     findZone: async (_account: string, name: string) => {
       const resource = manifest.resources.find(
@@ -283,52 +265,40 @@ function client(manifest: PlatformInstallationManifest) {
         remoteWrites.push(value);
       }
     },
-    removeRoutes: async (_account: string, _zone: string | null, _managed: unknown) => {
-      removedRoutes++;
-    },
+    // Only --purge-resources calls these; platform-teardown.test.ts covers it.
+    deleteAccessResource: unexpectedPurgeCall,
+    deleteDispatchNamespaceScript: unexpectedPurgeCall,
+    deleteEmailRoutingRule: unexpectedPurgeCall,
+    deleteQueueConsumer: unexpectedPurgeCall,
+    deleteWorkerDomain: unexpectedPurgeCall,
+    deleteWorkerRoute: unexpectedPurgeCall,
+    forceDeleteWorker: unexpectedPurgeCall,
+    getAccessResource: unexpectedPurgeCall,
+    getEmailRoutingCatchAll: unexpectedPurgeCall,
+    listDispatchNamespaceScripts: unexpectedPurgeCall,
+    listEmailRoutingRules: unexpectedPurgeCall,
+    listQueueConsumers: unexpectedPurgeCall,
+    listWorkerDependents: unexpectedPurgeCall,
+    listWorkerRoutes: unexpectedPurgeCall,
+    resetEmailRoutingCatchAll: unexpectedPurgeCall,
   };
   return fake;
 }
 
+async function unexpectedPurgeCall(): Promise<never> {
+  throw new Error('Unexpected --purge-resources Cloudflare call.');
+}
+
 function namedResources(manifest: PlatformInstallationManifest, kind: InstallationResourceKind) {
   return manifest.resources
     .filter((resource) => resource.kind === kind && resource.state === 'ready')
     .map((resource) => ({ id: resource.id, name: resource.name }));
 }
 
-function ownershipMarker(
-  manifest: PlatformInstallationManifest,
-  resource: PlatformInstallationManifest['resources'][number],
-): string {
-  return JSON.stringify(
-    createPlatformResourceOwnershipMarker({
-      accountId: manifest.account.id,
-      installationId: manifest.id,
-      ownershipNonce: manifest.ownershipNonce,
-      resourceId: resource.id,
-      resourceKey: resource.key,
-      resourceKind: resource.kind,
-      resourceName: resource.name,
-    }),
-  );
-}
-
-function noteText(title: string): string {
-  return String(
-    vi
-      .mocked(note)
-      .mock.calls.filter(([, noteTitle]) => stripVTControlCharacters(noteTitle ?? '') === title)
-      .at(-1)?.[0] ?? '',
-  );
-}
-
-function expectInOrder(text: string, lines: ReadonlyArray<string>): void {
-  const positions = lines.map((line) => text.indexOf(line));
-  expect(
-    positions.every((position) => position >= 0),
-    text,
-  ).toBe(true);
-  expect(positions, text).toEqual([...positions].sort((left, right) => left - right));
+function trafficRetentionSteps(): Array<string> {
+  return (listInstallationManifests()[0]?.steps ?? [])
+    .map((step) => step.key)
+    .filter((key) => /^disable:\d+:routes$|^uninstall:routes:/.test(key));
 }
 
 const uninstallArgs = {
@@ -409,13 +379,13 @@ describe('uninstall with project Zero Trust', () => {
     expect(fake.disabledWrites).toEqual([]);
     expect(fake.remoteWrites).toEqual([]);
     expect(fake.deleted).toEqual([]);
-    expect(fake.removedRoutes).toBe(0);
+    expect(trafficRetentionSteps()).toEqual([]);
     expect(listInstallationManifests()[0]?.status).toBe('installed');
   }
 
   it('refuses before any change while Zero Trust is enabled', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const error = await uninstallPlatform(fake, manifest, uninstallArgs, {
       interactive: false,
@@ -440,7 +410,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('shows the same refusal in the plan', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await expect(
       uninstallPlatform(
@@ -458,7 +428,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('refuses while an unfinished operation may still own applications', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const error = await uninstallPlatform(fake, manifest, uninstallArgs, {
       interactive: false,
@@ -480,7 +450,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('refuses while a finished disable left project applications behind', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const error = await uninstallPlatform(fake, manifest, uninstallArgs, {
       interactive: false,
@@ -501,7 +471,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('points to finishing the deletion of a project that stopped partway', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const read = (rows: Parameters<typeof projectZeroTrustUninstallState>[1]) => () =>
       uninstallPlatform(fake, manifest, uninstallArgs, {
@@ -539,7 +509,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('refuses when the Zero Trust state cannot be read', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const error = await uninstallPlatform(fake, manifest, uninstallArgs, {
       interactive: false,
@@ -561,7 +531,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('refuses when the saved configuration is malformed', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await expect(
       uninstallPlatform(fake, manifest, uninstallArgs, {
@@ -578,7 +548,7 @@ describe('uninstall with project Zero Trust', () => {
     ['is fully disabled', disabledZeroTrust],
   ])('proceeds when Zero Trust %s', async (_label, setting) => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await uninstallPlatform(fake, manifest, uninstallArgs, {
       interactive: false,
@@ -631,7 +601,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('refuses Zero Trust writers that were waiting on the lock once traffic is disabled', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const events: Array<string> = [];
     const putKvValue = fake.putKvValue;
@@ -672,7 +642,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('lifts the fence when uninstall stops before it disables traffic', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const events: Array<string> = [];
     fake.putKvValue = async () => {
@@ -702,7 +672,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('keeps the fence when uninstall fails after it started disabling traffic', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const events: Array<string> = [];
     const putKvValue = fake.putKvValue;
@@ -729,7 +699,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('checks again under the lock and refuses when Zero Trust changed after the first check', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const events: Array<string> = [];
     const gate = zeroTrustLock(events);
@@ -759,7 +729,7 @@ describe('uninstall with project Zero Trust', () => {
 
   it('refuses without a database session that can hold off Zero Trust changes', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await expect(
       uninstallPlatform(fake, manifest, uninstallArgs, {
@@ -861,18 +831,6 @@ describe('platform lifecycle management', () => {
     ).toBe('');
   });
 
-  it('requires explicit acknowledgement for a non-interactive uninstall', async () => {
-    const manifest = installedManifest();
-    persist(manifest);
-    const fake = client(manifest);
-
-    await expect(
-      uninstallPlatform(fake, manifest, { ...uninstallArgs, yes: false }, uninstallDependencies),
-    ).rejects.toThrow('requires --yes');
-    expect(fake.deleted).toEqual([]);
-    expect(fake.removedRoutes).toBe(0);
-  });
-
   it('prompts for an installation when a lifecycle selector is omitted', async () => {
     const directory = mkdtempSync(join(tmpdir(), 'void-platform-management-selection-test-'));
     directories.push(directory);
@@ -1157,7 +1115,7 @@ describe('platform lifecycle management', () => {
 
   it('disables routes without deleting resources', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const databaseCheckpoints: Array<PlatformInstallationManifest> = [];
     await disablePlatform(fake, manifest, false, {
@@ -1165,7 +1123,7 @@ describe('platform lifecycle management', () => {
         databaseCheckpoints.push(checkpoint);
       },
     });
-    expect(fake.removedRoutes).toBe(1);
+    expect(trafficRetentionSteps()).toEqual(['disable:0:routes']);
     expect(fake.disabledWrites).toEqual([PLATFORM_DISABLED_VALUE]);
     expect(fake.deleted).toEqual([]);
     expect(listInstallationManifests()[0]?.status).toBe('disabled');
@@ -1176,7 +1134,7 @@ describe('platform lifecycle management', () => {
 
   it('describes the disable plan in user terms', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
 
     await disablePlatform(fake, manifest, true);
@@ -1207,7 +1165,7 @@ describe('platform lifecycle management', () => {
       },
       '2026-09-14T00:00:03.000Z',
     );
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const first = client(manifest);
     await disablePlatform(first, manifest, false);
 
@@ -1226,25 +1184,25 @@ describe('platform lifecycle management', () => {
 
     const second = client(reenabled);
     await disablePlatform(second, reenabled, false);
-    expect(second.removedRoutes).toBe(1);
+    expect(trafficRetentionSteps()).toEqual(['disable:1:routes', 'disable:2:routes']);
     expect(second.disabledWrites).toHaveLength(1);
   });
 
   it('disables public Workers from an interrupted deployment', async () => {
     const manifest = { ...installedManifest(), status: 'deploying' as const };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
 
     await disablePlatform(fake, manifest, false);
 
-    expect(fake.removedRoutes).toBe(1);
+    expect(trafficRetentionSteps()).toEqual(['disable:0:routes']);
     expect(fake.disabledWrites).toHaveLength(1);
     expect(listInstallationManifests()[0]?.status).toBe('disabled');
   });
 
   it('uses routing storage when one recorded Worker is missing', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.listWorkerNames = async () => ['api-worker', 'proxy-worker', 'tail-worker'];
 
@@ -1256,17 +1214,12 @@ describe('platform lifecycle management', () => {
 
   it('disables workers.dev through routing storage when the recorded zone is missing', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.findZone = async () => null;
-    let routeZone: string | null | undefined;
-    fake.removeRoutes = async (_account, zone) => {
-      routeZone = zone;
-    };
 
     await disablePlatform(fake, manifest, false);
 
-    expect(routeZone).toBeNull();
     expect(fake.disabledWrites).toHaveLength(1);
     expect(listInstallationManifests()[0]?.status).toBe('disabled');
   });
@@ -1293,7 +1246,7 @@ describe('platform lifecycle management', () => {
       },
       '2026-09-14T00:00:03.000Z',
     );
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.listWorkerNames = async () => [
       api.name,
@@ -1323,16 +1276,16 @@ describe('platform lifecycle management', () => {
     });
   });
 
-  it('retains installer-owned data and the zone by default', async () => {
+  it('retains every resource and records the uninstall in routing storage by default', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies);
     expect(fake.deleted).toEqual([]);
-    expect(fake.deleted.some(([kind]) => kind === 'zone')).toBe(false);
+    expect(fake.remoteWrites.map((value) => JSON.parse(value).status)).toContain('uninstalled');
     const result = listInstallationManifests()[0]!;
     expect(result.status).toBe('uninstalled');
-    expect(result.resources.find((resource) => resource.key === 'zone')?.state).toBe('retained');
+    expect(result.resources.filter((resource) => resource.state === 'retained')).toHaveLength(15);
     expect(readInstallationRecoverySecrets(result)).toEqual({
       databaseUrl: 'postgres://recovery',
     });
@@ -1361,16 +1314,11 @@ describe('platform lifecycle management', () => {
       },
       '2026-09-14T00:00:03.000Z',
     );
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
-    let removed: unknown;
-    fake.removeRoutes = async (_account: string, _zone: string | null, traffic: unknown) => {
-      removed = traffic;
-    };
 
     await disablePlatform(fake, manifest, false);
 
-    expect(removed).toEqual({ customDomains: [], routes: [] });
     expect(
       listInstallationManifests()[0]
         ?.resources.filter((resource) => resource.kind === 'worker-route')
@@ -1380,7 +1328,7 @@ describe('platform lifecycle management', () => {
 
   it('retains Workers and their unmanaged traffic for manual cleanup', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.listWorkerServiceRoutes = async (_accountId: string, workerName: string) =>
       workerName === 'api-worker'
@@ -1398,13 +1346,18 @@ describe('platform lifecycle management', () => {
     await uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies);
 
     expect(fake.deleted.some(([kind]) => kind === 'worker')).toBe(false);
-    expect(fake.removedRoutes).toBe(4);
+    expect(trafficRetentionSteps()).toEqual([
+      'uninstall:routes:api-worker',
+      'uninstall:routes:dispatch-worker',
+      'uninstall:routes:proxy-worker',
+      'uninstall:routes:tail-worker',
+    ]);
     expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
   });
 
   it('retains an installer DNS record even when it was repurposed', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.listDnsRecords = async (_zone: string, name: string) =>
       namedResources(manifest, 'dns-record')
@@ -1427,19 +1380,6 @@ describe('platform lifecycle management', () => {
     ).toMatchObject({ state: 'retained' });
   });
 
-  it('records the completed uninstall in retained routing storage', async () => {
-    const manifest = installedManifest();
-    persist(manifest);
-    const fake = client(manifest);
-    await uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies);
-    expect(fake.deleted).toEqual([]);
-    expect(fake.remoteWrites.map((value) => JSON.parse(value).status)).toContain('uninstalled');
-    const retained = listInstallationManifests()[0]!.resources.filter(
-      (resource) => resource.state === 'retained',
-    );
-    expect(retained).toHaveLength(15);
-  });
-
   it('lists every kept resource in manual cleanup order after uninstall', async () => {
     const manifest = {
       ...installedManifest(),
@@ -1454,7 +1394,7 @@ describe('platform lifecycle management', () => {
         },
       ],
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
 
     await uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies);
@@ -1481,7 +1421,7 @@ describe('platform lifecycle management', () => {
 
   it('names the resources a purge plan keeps', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
 
     await uninstallPlatform(
@@ -1518,7 +1458,7 @@ describe('platform lifecycle management', () => {
         emailSharedZoneId: 'zone-id',
       },
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const emailLine = `Email Routing for mail.example.com (zone zone-id): its routing DNS records and any catch-all rule that sends mail to ${base.deployment.resources.emailGatewayWorker}.`;
 
@@ -1536,7 +1476,7 @@ describe('platform lifecycle management', () => {
 
   it('records an AI Gateway already removed in Cloudflare as deleted', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.listAiGateways = async () => [];
 
@@ -1552,7 +1492,7 @@ describe('platform lifecycle management', () => {
 
   it('refuses automatic deletion of an installer-created zone', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
 
     await expect(
@@ -1564,13 +1504,13 @@ describe('platform lifecycle management', () => {
       ),
     ).rejects.toThrow('Refusing to delete Cloudflare zone');
     expect(fake.deleted).toEqual([]);
-    expect(fake.removedRoutes).toBe(0);
+    expect(trafficRetentionSteps()).toEqual([]);
     expect(listInstallationManifests()[0]?.status).toBe('installed');
   });
 
   it('purges installer-owned data while never deleting an adopted zone', async () => {
     const manifest = installedManifest('adopted');
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await uninstallPlatform(
       fake,
@@ -1579,38 +1519,14 @@ describe('platform lifecycle management', () => {
       uninstallDependencies,
     );
     expect(fake.deleted).toHaveLength(5);
-    expect(fake.deleted.some(([kind]) => kind === 'queue')).toBe(false);
     expect(fake.deleted).not.toContainEqual(['ai-gateway', 'ai-gateway-id']);
-    expect(fake.emptiedBuckets).toEqual([]);
-    expect(fake.preservedBucketKeys).toEqual([]);
-    expect(fake.deletedBucketMarkers).toEqual([]);
-    expect(fake.deleted).not.toContainEqual(['r2-bucket', 'assets-bucket-id']);
     expect(fake.deleted.some(([kind]) => kind === 'zone')).toBe(false);
     expect(readInstallationRecoverySecrets(listInstallationManifests()[0]!)).toBeNull();
   });
 
-  it('retains R2 during purge because bucket generation cannot be pinned', async () => {
-    const manifest = installedManifest();
-    persist(manifest);
-    const fake = client(manifest);
-    await uninstallPlatform(
-      fake,
-      manifest,
-      { ...uninstallArgs, purgeData: true },
-      uninstallDependencies,
-    );
-    expect(fake.emptiedBuckets).toEqual([]);
-    expect(fake.deletedBucketMarkers).toEqual([]);
-    expect(fake.deleted).not.toContainEqual(['r2-bucket', 'assets-bucket-id']);
-    expect(
-      listInstallationManifests()[0]?.resources.find((resource) => resource.key === 'assets-bucket')
-        ?.state,
-    ).toBe('retained');
-  });
-
   it('refuses every mutation when the remote installation identity changed', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.getKvValue = async () =>
       JSON.stringify({ ...manifest, ownershipNonce: 'different-ownership-nonce-000000' });
@@ -1618,14 +1534,14 @@ describe('platform lifecycle management', () => {
     await expect(
       uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies),
     ).rejects.toThrow('remote installation identity does not match');
-    expect(fake.removedRoutes).toBe(0);
+    expect(trafficRetentionSteps()).toEqual([]);
     expect(fake.deleted).toEqual([]);
     expect(listInstallationManifests()[0]?.status).toBe('installed');
   });
 
   it('refuses to delete a replacement Worker with a reused name', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     const replacement = {
       ...manifest,
@@ -1641,14 +1557,14 @@ describe('platform lifecycle management', () => {
     await expect(
       uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies),
     ).rejects.toThrow('belongs to another installation');
-    expect(fake.removedRoutes).toBe(0);
+    expect(trafficRetentionSteps()).toEqual([]);
     expect(fake.deleted).toEqual([]);
     expect(listInstallationManifests()[0]?.status).toBe('installed');
   });
 
   it('does not inspect or mutate R2 during purge', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.getR2Object = async () => null;
 
@@ -1659,13 +1575,18 @@ describe('platform lifecycle management', () => {
       uninstallDependencies,
     );
     expect(fake.emptiedBuckets).toEqual([]);
+    expect(fake.deletedBucketMarkers).toEqual([]);
     expect(fake.deleted).not.toContainEqual(['r2-bucket', 'assets-bucket-id']);
-    expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
+    const result = listInstallationManifests()[0]!;
+    expect(result.status).toBe('uninstalled');
+    expect(result.resources.find((resource) => resource.key === 'assets-bucket')?.state).toBe(
+      'retained',
+    );
   });
 
   it('resumes safely after a deletion failure without retrying completed deletions', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const first = client(manifest);
     const originalDelete = first.deleteResource;
     first.deleteResource = async (account, resource) => {
@@ -1699,7 +1620,7 @@ describe('platform lifecycle management', () => {
 
   it('retains Queues that retained Workers still use', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
 
     await uninstallPlatform(
@@ -1732,7 +1653,7 @@ describe('platform lifecycle management', () => {
       'failed',
       '2026-09-14T00:00:04.000Z',
     );
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     fake.listWorkerNames = async () =>
       manifest.resources
@@ -1762,7 +1683,7 @@ describe('platform lifecycle management', () => {
       ...installed,
       resources: installed.resources.filter((resource) => resource.kind !== 'worker'),
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
 
     await uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies);
@@ -1776,7 +1697,7 @@ describe('platform lifecycle management', () => {
 
   it('resumes a purge after the final routing checkpoint was ambiguously deleted', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const first = client(manifest);
     const originalDelete = first.deleteResource;
     first.deleteResource = async (account, resource) => {
@@ -1825,10 +1746,10 @@ describe('platform lifecycle management', () => {
       ...installedManifest(),
       resources: installedManifest().resources.filter((resource) => resource.key !== 'zone'),
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies);
-    expect(fake.removedRoutes).toBe(0);
+    expect(trafficRetentionSteps()).toEqual([]);
     expect(fake.deleted.some(([kind]) => kind === 'worker')).toBe(false);
     expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
     expect(
@@ -1845,7 +1766,7 @@ describe('platform lifecycle management', () => {
       resources: installedManifest().resources.filter((resource) => resource.key === 'zone'),
       status: 'waiting-for-dns' as const,
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = client(manifest);
     await uninstallPlatform(fake, manifest, uninstallArgs, uninstallDependencies);
     expect(fake.deleted).toEqual([]);
@@ -1855,7 +1776,7 @@ describe('platform lifecycle management', () => {
 
   it('resumes after routes were removed but remote disable checkpointing failed', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const first = client(manifest);
     first.putKvValue = async () => {
       throw new Error('temporary KV failure');
@@ -1866,13 +1787,13 @@ describe('platform lifecycle management', () => {
     const failed = listInstallationManifests()[0]!;
     const second = client(failed);
     await disablePlatform(second, failed, false);
-    expect(second.removedRoutes).toBe(1);
+    expect(trafficRetentionSteps()).toEqual(['disable:0:routes']);
     expect(listInstallationManifests()[0]?.status).toBe('disabled');
   });
 
   it('reasserts every public endpoint when disabling an already-disabled installation', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const first = client(manifest);
     await disablePlatform(first, manifest, false);
 
@@ -1880,7 +1801,7 @@ describe('platform lifecycle management', () => {
     const second = client(disabled);
     await disablePlatform(second, disabled, false);
 
-    expect(second.removedRoutes).toBe(1);
+    expect(trafficRetentionSteps()).toEqual(['disable:0:routes']);
     expect(second.disabledWrites).toHaveLength(1);
     expect(listInstallationManifests()[0]?.status).toBe('disabled');
   });
diff --git a/packages/void/test/unit/platform-permission-errors.test.ts b/packages/void/test/unit/platform-permission-errors.test.ts
index 027ebaaa0..b275f5857 100644
--- a/packages/void/test/unit/platform-permission-errors.test.ts
+++ b/packages/void/test/unit/platform-permission-errors.test.ts
@@ -4,12 +4,11 @@ import { formatStreamDeployError } from '../../src/cli/deploy-errors.ts';
 import { withPlatformDiscovery } from '../helpers/platform-discovery.ts';
 
 vi.mock('../../src/cli/cf-access.ts', () => ({
-  ensureCloudflaredToken: vi.fn(),
   ensurePlatformAccessToken: vi.fn(),
   isCloudflareAccessChallenge: () => false,
 }));
 afterEach(() => vi.unstubAllGlobals());
-const client = () => new PlatformClient('test-token', 'https://api.example.test');
+const client = () => new PlatformClient('test-token', { apiUrl: 'https://api.example.test' });
 const project = 'project_1';
 const collaborator = 'collaborator, admin, or owner';
 const admin = 'admin or owner';
diff --git a/packages/void/test/unit/platform-plan.test.ts b/packages/void/test/unit/platform-plan.test.ts
index 4172a455b..48577829d 100644
--- a/packages/void/test/unit/platform-plan.test.ts
+++ b/packages/void/test/unit/platform-plan.test.ts
@@ -3,11 +3,12 @@ import { stripVTControlCharacters } from 'node:util';
 import {
   createPlatformDeploymentManifest,
   createPlatformInstallationManifest,
-  createPlatformResourceOwnershipMarker,
   createPlatformResourceNames,
   recordInstallationResource,
   recordInstallationStep,
   setInstallationEndpoints,
+  type InstallationResourceKind,
+  type PlatformInstallationManifest,
 } from '@void/platform';
 import { describe, expect, it, vi } from 'vite-plus/test';
 import { pc } from '../../src/cli/output.ts';
@@ -23,8 +24,9 @@ import {
   formatPlatformInstallPlan,
   platformProvisionIntentHash,
   revalidatePlatformInstallAction,
+  type PlatformInstallPlan,
 } from '../../src/cli/platform-plan.ts';
-import { recoverPlatformInstallations } from '../../src/cli/platform-recovery.ts';
+import { ownershipMarker } from '../helpers/platform-installation.ts';
 
 function client(overrides: Record<string, unknown> = {}) {
   return {
@@ -82,6 +84,46 @@ function legacyInstallation(suffix = '0123456789ab') {
   });
 }
 
+function manifestFor(
+  plan: Pick<PlatformInstallPlan, 'account' | 'deployment' | 'installationId'>,
+  createdAt = '2026-09-14T00:00:00.000Z',
+) {
+  return createPlatformInstallationManifest({
+    account: plan.account,
+    createdAt,
+    deployment: plan.deployment,
+    id: plan.installationId,
+    ownershipNonce: '0123456789abcdef0123456789abcdef',
+    platformVersion: '1.0.0',
+  });
+}
+
+function defaultManifest() {
+  return createPlatformInstallationManifest({
+    account: { id: 'account', name: 'Account' },
+    createdAt: '2026-09-14T00:00:00.000Z',
+    deployment: createPlatformDeploymentManifest({
+      application: { baseDomain: 'example.app', zoneName: 'example.app' },
+      displayName: 'Example',
+      installationSlug: 'example',
+    }),
+    id: 'example-a1b2c3d4',
+    ownershipNonce: '0123456789abcdef0123456789abcdef',
+    platformVersion: '1.0.0',
+  });
+}
+
+function markerFor(
+  manifest: PlatformInstallationManifest,
+  key: string,
+  kind: InstallationResourceKind,
+  name: string,
+): string {
+  return ownershipMarker(manifest, { id: name, key, kind, name });
+}
+
+const activeZone = { id: 'zone', name: 'example.app', nameServers: [], status: 'active' };
+
 describe('platform installation planning', () => {
   it('provisions the deployment Queue only for a runtime that supports its consumer', async () => {
     const listQueues = vi.fn(async () => []);
@@ -337,14 +379,7 @@ describe('platform installation planning', () => {
     expect(configured.deployment.emailSharedZoneId).toBe('mail-zone-id');
     expect(configured.deployment.emailSenderDomain).toBe('mail.example.org');
     expect(configured.deployment.capabilities.email).toBe(true);
-    const manifest = createPlatformInstallationManifest({
-      account: configured.account,
-      deployment: configured.deployment,
-      id: configured.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-      createdAt: '2026-09-17T00:00:00.000Z',
-    });
+    const manifest = manifestFor(configured, '2026-09-17T00:00:00.000Z');
     const resumed = await createPlatformInstallPlan(client(), input, manifest);
     expect(resumed.deployment.emailSharedZoneId).toBe('mail-zone-id');
     expect(resumed.deployment.emailSenderDomain).toBe('mail.example.org');
@@ -400,14 +435,7 @@ describe('platform installation planning', () => {
     };
     const configured = await createPlatformInstallPlan(client(), configuredInput, null);
     expect(configured.deployment.emailSenderDomain).toBe('mail.example.org');
-    const manifest = createPlatformInstallationManifest({
-      account: configured.account,
-      deployment: configured.deployment,
-      id: configured.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-      createdAt: '2026-09-17T00:00:00.000Z',
-    });
+    const manifest = manifestFor(configured, '2026-09-17T00:00:00.000Z');
 
     const resumed = await createPlatformInstallPlan(client(), configuredInput, manifest);
     expect(resumed.deployment.emailSenderDomain).toBe('mail.example.org');
@@ -415,14 +443,7 @@ describe('platform installation planning', () => {
 
   it('adds a configured shared email zone to a previously unconfigured installation', async () => {
     const initial = await createPlatformInstallPlan(client(), input, null);
-    const manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-      createdAt: '2026-09-17T00:00:00.000Z',
-    });
+    const manifest = manifestFor(initial, '2026-09-17T00:00:00.000Z');
     const upgraded = await createPlatformInstallPlan(
       client(),
       { ...input, emailSharedZoneId: 'mail-zone-id', emailSenderDomain: 'mail.example.org' },
@@ -435,14 +456,7 @@ describe('platform installation planning', () => {
       createPlatformInstallPlan(
         client(),
         { ...input, emailSenderDomain: 'other.example.org' },
-        createPlatformInstallationManifest({
-          account: upgraded.account,
-          deployment: upgraded.deployment,
-          id: upgraded.installationId,
-          ownershipNonce: '0123456789abcdef0123456789abcdef',
-          platformVersion: '1.0.0',
-          createdAt: '2026-09-17T00:00:00.000Z',
-        }),
+        manifestFor(upgraded, '2026-09-17T00:00:00.000Z'),
       ),
     ).rejects.toThrow('already recorded');
   });
@@ -481,14 +495,7 @@ describe('platform installation planning', () => {
 
   it('resumes the recorded namespaces using the real unfiltered KV API response', async () => {
     const initial = await createPlatformInstallPlan(client(), input, null);
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-      createdAt: '2026-09-17T00:00:00.000Z',
-    });
+    let manifest = manifestFor(initial, '2026-09-17T00:00:00.000Z');
     for (const [key, name] of [
       ['routing-kv', initial.deployment.resources.routingKv],
       ['isr-cache-kv', initial.deployment.resources.isrCacheKv],
@@ -643,12 +650,11 @@ describe('platform installation planning', () => {
     ).rejects.toThrow('KV access denied');
   });
   it('names the DNS permission when the token cannot read DNS records', async () => {
-    const zone = { id: 'zone', name: 'example.app', nameServers: [], status: 'active' };
     const deniedDns = async () => {
       throw new PlatformCloudflareApiError('Authentication error', 403, '/zones/zone/dns_records');
     };
     const wildcard = createPlatformInstallPlan(
-      client({ findZone: async () => zone, listDnsRecords: deniedDns }),
+      client({ findZone: async () => activeZone, listDnsRecords: deniedDns }),
       input,
       null,
     );
@@ -658,7 +664,7 @@ describe('platform installation planning', () => {
     await expect(wildcard).rejects.not.toThrow('Authentication error');
 
     const apiHostname = createPlatformInstallPlan(
-      client({ findZoneForHostname: async () => zone, listDnsRecords: deniedDns }),
+      client({ findZoneForHostname: async () => activeZone, listDnsRecords: deniedDns }),
       { ...input, controlPlaneDomain: 'api.example.app' },
       null,
     );
@@ -668,7 +674,7 @@ describe('platform installation planning', () => {
     await expect(
       createPlatformInstallPlan(
         client({
-          findZone: async () => zone,
+          findZone: async () => activeZone,
           listDnsRecords: async () => {
             throw new PlatformCloudflareApiError('service unavailable', 503);
           },
@@ -687,6 +693,7 @@ describe('platform installation planning', () => {
         findZone: forbidden,
         listDnsRecords: forbidden,
         listWorkerRoutes: forbidden,
+        listWorkerDomains: forbidden,
         hasActiveCertificateForHostname: forbidden,
       }),
       { ...input, applicationDomain: '', zoneName: '', workersDev: true },
@@ -764,7 +771,7 @@ describe('platform installation planning', () => {
   });
 
   it.each(['oauth-access-token', 'account-api-token'])(
-    'plans and discovers using authorized accounts for %s',
+    'plans using authorized accounts for %s',
     async (token) => {
       const requests: Array<string> = [];
       const remote = new PlatformCloudflareClient(token, {
@@ -789,8 +796,7 @@ describe('platform installation planning', () => {
       );
       const plan = await createPlatformInstallPlan(fake, input, null);
       expect(plan.account.id).toBe('account');
-      await expect(recoverPlatformInstallations(fake, 'account')).resolves.toEqual([]);
-      expect(requests).toHaveLength(2);
+      expect(requests).toHaveLength(1);
       expect(requests.every((url) => url.includes('/accounts?'))).toBe(true);
     },
   );
@@ -816,9 +822,6 @@ describe('platform installation planning', () => {
     await expect(createPlatformInstallPlan(fake, input, null)).rejects.toThrow(
       'invalid credentials',
     );
-    await expect(recoverPlatformInstallations(fake, 'account')).rejects.toThrow(
-      'invalid credentials',
-    );
   });
 
   it('builds a read-only core plan without containers', async () => {
@@ -828,7 +831,6 @@ describe('platform installation planning', () => {
     expect(plan.deployment.resources.apiWorker).toBe('void-example-api');
     expect(plan.actions).toHaveLength(16);
     expect(plan.actions.every((action) => action.action === 'create')).toBe(true);
-    expect(Object.keys(fake)).not.toContain('createZone');
   });
 
   it('keeps a fresh read-only plan stable for the later apply', async () => {
@@ -872,15 +874,11 @@ describe('platform installation planning', () => {
     },
   );
 
-  it('fails closed on an unowned deterministic-name collision', async () => {
-    const fake = client({
+  it.each([
+    {
       listKvNamespaces: async (_account: string, title: string) =>
         title.endsWith('-routing') ? [{ id: 'someone-else', name: title }] : [],
-    });
-    await expect(createPlatformInstallPlan(fake, input, null)).rejects.toThrow('not owned');
-  });
-
-  it.each([
+    },
     { listWorkerNames: async () => ['void-example-api'] },
     { listR2Buckets: async () => [{ id: 'void-example-assets', name: 'void-example-assets' }] },
     { listQueues: async (_account: string, name: string) => [{ id: 'other-queue', name }] },
@@ -895,14 +893,7 @@ describe('platform installation planning', () => {
     const name = initial.deployment.resources.assetsBucket;
     const fingerprint = '2026-09-14T00:00:00.000Z';
     const manifest = recordInstallationResource(
-      createPlatformInstallationManifest({
-        account: initial.account,
-        deployment: initial.deployment,
-        id: initial.installationId,
-        ownershipNonce: '0123456789abcdef0123456789abcdef',
-        platformVersion: '1.0.0',
-        createdAt: fingerprint,
-      }),
+      manifestFor(initial, fingerprint),
       {
         configHash: r2ConfigHash(name, fingerprint),
         id: name,
@@ -970,12 +961,7 @@ describe('platform installation planning', () => {
     await expect(
       createPlatformInstallPlan(
         client({
-          findZone: async () => ({
-            id: 'zone',
-            name: 'example.app',
-            nameServers: [],
-            status: 'active',
-          }),
+          findZone: async () => activeZone,
           listWorkerRoutes: async () => [
             { id: 'route', pattern: '*.example.app/*', script: 'other-worker' },
           ],
@@ -997,14 +983,7 @@ describe('platform installation planning', () => {
           null,
         );
         const manifest = {
-          ...createPlatformInstallationManifest({
-            account: initial.account,
-            createdAt: '2026-09-14T00:00:00.000Z',
-            deployment: initial.deployment,
-            id: initial.installationId,
-            ownershipNonce: '0123456789abcdef0123456789abcdef',
-            platformVersion: '1.0.0',
-          }),
+          ...manifestFor(initial),
           status: 'installed' as const,
         };
         existing = {
@@ -1018,12 +997,7 @@ describe('platform installation planning', () => {
       await expect(
         createPlatformInstallPlan(
           client({
-            findZone: async () => ({
-              id: 'zone',
-              name: 'example.app',
-              nameServers: [],
-              status: 'active',
-            }),
+            findZone: async () => activeZone,
             listWorkerDomains: async () => [
               { hostname: 'ai.example.app', id: 'custom-domain', service: 'existing-ai' },
             ],
@@ -1059,12 +1033,7 @@ describe('platform installation planning', () => {
     async ({ hostname, routes }) => {
       const plan = await createPlatformInstallPlan(
         client({
-          findZone: async () => ({
-            id: 'zone',
-            name: 'example.app',
-            nameServers: [],
-            status: 'active',
-          }),
+          findZone: async () => activeZone,
           listWorkerDomains: async () => [
             { hostname, id: 'custom-domain', service: 'existing-ai' },
           ],
@@ -1088,12 +1057,7 @@ describe('platform installation planning', () => {
     await expect(
       createPlatformInstallPlan(
         client({
-          findZone: async () => ({
-            id: 'zone',
-            name: 'example.app',
-            nameServers: [],
-            status: 'active',
-          }),
+          findZone: async () => activeZone,
           listWorkerDomains: async () => [
             { hostname: 'ai.example.app', id: 'custom-domain', service: 'existing-ai' },
           ],
@@ -1108,12 +1072,7 @@ describe('platform installation planning', () => {
   it('leaves apex and other application namespaces outside a shared-zone wildcard', async () => {
     const plan = await createPlatformInstallPlan(
       client({
-        findZone: async () => ({
-          id: 'zone',
-          name: 'example.app',
-          nameServers: [],
-          status: 'active',
-        }),
+        findZone: async () => activeZone,
         listWorkerDomains: async () => [
           { hostname: 'example.app', id: 'apex', service: 'existing-apex' },
           {
@@ -1130,12 +1089,7 @@ describe('platform installation planning', () => {
     expect(plan.deployment.application.dedicatedZone).toBe(false);
     const nested = await createPlatformInstallPlan(
       client({
-        findZone: async () => ({
-          id: 'zone',
-          name: 'example.app',
-          nameServers: [],
-          status: 'active',
-        }),
+        findZone: async () => activeZone,
         listWorkerDomains: async () => [
           { hostname: 'ai.example.app', id: 'existing-ai', service: 'existing-ai' },
           { hostname: 'apps.example.app', id: 'application-apex', service: 'existing-apps' },
@@ -1151,12 +1105,7 @@ describe('platform installation planning', () => {
     await expect(
       createPlatformInstallPlan(
         client({
-          findZone: async () => ({
-            id: 'zone',
-            name: 'example.app',
-            nameServers: [],
-            status: 'active',
-          }),
+          findZone: async () => activeZone,
           listWorkerDomains: async () => [
             { hostname: 'example.app', id: 'apex', service: 'existing-apex' },
           ],
@@ -1171,12 +1120,7 @@ describe('platform installation planning', () => {
     await expect(
       createPlatformInstallPlan(
         client({
-          findZone: async () => ({
-            id: 'zone',
-            name: 'example.app',
-            nameServers: [],
-            status: 'active',
-          }),
+          findZone: async () => activeZone,
           listWorkerDomains: async () => [
             { hostname: 'ai.example.app', id: 'custom-domain', service: 'void-example-dispatch' },
           ],
@@ -1205,12 +1149,7 @@ describe('platform installation planning', () => {
     );
     const plan = await createPlatformInstallPlan(
       client({
-        findZone: async () => ({
-          id: 'zone',
-          name: 'example.app',
-          nameServers: [],
-          status: 'active',
-        }),
+        findZone: async () => activeZone,
         listWorkerDomains: async () => [
           { hostname: 'owned.example.app', id: 'custom-domain', service: workerName },
         ],
@@ -1226,66 +1165,9 @@ describe('platform installation planning', () => {
     });
   });
 
-  it('does not inspect custom domains for an isolated workers.dev installation', async () => {
-    const listWorkerDomains = vi.fn().mockRejectedValue(new Error('Unexpected domain inspection'));
-    const plan = await createPlatformInstallPlan(
-      client({ listWorkerDomains }),
-      { ...input, applicationDomain: '', zoneName: '', workersDev: true },
-      null,
-    );
-    expect(plan.deployment.application.workersDev?.subdomain).toBe('example');
-    expect(listWorkerDomains).not.toHaveBeenCalled();
-  });
-
-  it('does not treat a local provision intent as remote ownership proof', async () => {
-    let manifest = createPlatformInstallationManifest({
-      account: { id: 'account', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.app', zoneName: 'example.app' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
-    manifest = recordInstallationStep(
-      manifest,
-      {
-        completedAt: '2026-09-14T00:00:01.000Z',
-        key: 'provision-intent:routing-kv',
-        resultHash: platformProvisionIntentHash(
-          manifest,
-          'routing-kv',
-          'kv-namespace',
-          'void-example-routing',
-        ),
-      },
-      '2026-09-14T00:00:01.000Z',
-    );
-    await expect(
-      createPlatformInstallPlan(
-        client({
-          listKvNamespaces: async (_account: string, title: string) =>
-            title === 'void-example-routing' ? [{ id: 'created-before-crash', name: title }] : [],
-        }),
-        input,
-        manifest,
-      ),
-    ).rejects.toThrow('not owned');
-  });
-
   it('refuses an intent-only resource after an ambiguous create response', async () => {
     const initial = await createPlatformInstallPlan(client(), input, legacyInstallation());
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial);
     const resourceName = initial.deployment.resources.routingKv;
     manifest = recordInstallationStep(
       manifest,
@@ -1336,14 +1218,7 @@ describe('platform installation planning', () => {
   it('preserves legacy recovery after an interrupted repair create', async () => {
     const initial = await createPlatformInstallPlan(client(), input, legacyInstallation());
     const resourceName = initial.deployment.resources.routingKv;
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial);
     manifest = recordInstallationResource(
       manifest,
       {
@@ -1392,14 +1267,7 @@ describe('platform installation planning', () => {
     const initial = await createPlatformInstallPlan(client(), input, legacyInstallation());
     const bucketName = initial.deployment.resources.assetsBucket;
     const fingerprint = '2026-09-14T00:00:00.000Z';
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: fingerprint,
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial, fingerprint);
     manifest = recordInstallationResource(
       manifest,
       {
@@ -1436,14 +1304,7 @@ describe('platform installation planning', () => {
     const initial = await createPlatformInstallPlan(client(), input, legacyInstallation());
     const bucketName = initial.deployment.resources.assetsBucket;
     const fingerprint = '2026-09-14T00:00:00.000Z';
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: fingerprint,
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial, fingerprint);
     manifest = recordInstallationResource(
       manifest,
       {
@@ -1457,17 +1318,7 @@ describe('platform installation planning', () => {
       },
       '2026-09-14T00:00:01.000Z',
     );
-    const marker = JSON.stringify(
-      createPlatformResourceOwnershipMarker({
-        accountId: manifest.account.id,
-        installationId: manifest.id,
-        ownershipNonce: manifest.ownershipNonce,
-        resourceId: bucketName,
-        resourceKey: 'assets-bucket',
-        resourceKind: 'r2-bucket',
-        resourceName: bucketName,
-      }),
-    );
+    const marker = markerFor(manifest, 'assets-bucket', 'r2-bucket', bucketName);
 
     const resumed = await createPlatformInstallPlan(
       client({
@@ -1487,14 +1338,7 @@ describe('platform installation planning', () => {
 
   it('recovers only an intent-only Worker with its matching durable marker', async () => {
     const initial = await createPlatformInstallPlan(client(), input, null);
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial);
     const workerName = manifest.deployment.resources.apiWorker;
     manifest = recordInstallationStep(
       manifest,
@@ -1505,17 +1349,7 @@ describe('platform installation planning', () => {
       },
       '2026-09-14T00:00:01.000Z',
     );
-    const marker = JSON.stringify(
-      createPlatformResourceOwnershipMarker({
-        accountId: 'account',
-        installationId: manifest.id,
-        ownershipNonce: manifest.ownershipNonce,
-        resourceId: workerName,
-        resourceKey: 'api-worker',
-        resourceKind: 'worker',
-        resourceName: workerName,
-      }),
-    );
+    const marker = markerFor(manifest, 'api-worker', 'worker', workerName);
     const resumed = await createPlatformInstallPlan(
       client({
         getWorkerPlainTextBindings: async () => ({ PLATFORM_OWNERSHIP_MARKER: marker }),
@@ -1543,14 +1377,7 @@ describe('platform installation planning', () => {
 
   it('resumes an intent-owned dispatch Worker after its public route was uploaded', async () => {
     const initial = await createPlatformInstallPlan(client(), input, null);
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial);
     const workerName = manifest.deployment.resources.dispatchWorker;
     manifest = recordInstallationStep(
       manifest,
@@ -1561,26 +1388,11 @@ describe('platform installation planning', () => {
       },
       '2026-09-14T00:00:01.000Z',
     );
-    const marker = JSON.stringify(
-      createPlatformResourceOwnershipMarker({
-        accountId: manifest.account.id,
-        installationId: manifest.id,
-        ownershipNonce: manifest.ownershipNonce,
-        resourceId: workerName,
-        resourceKey: 'dispatch-worker',
-        resourceKind: 'worker',
-        resourceName: workerName,
-      }),
-    );
+    const marker = markerFor(manifest, 'dispatch-worker', 'worker', workerName);
 
     const resumed = await createPlatformInstallPlan(
       client({
-        findZone: async () => ({
-          id: 'zone',
-          name: 'example.app',
-          nameServers: [],
-          status: 'active',
-        }),
+        findZone: async () => activeZone,
         getWorkerPlainTextBindings: async () => ({ PLATFORM_OWNERSHIP_MARKER: marker }),
         listWorkerNames: async () => [workerName],
         listWorkerDomains: async () => [
@@ -1603,14 +1415,7 @@ describe('platform installation planning', () => {
   it('resumes an intent-owned API Worker after its custom domain was uploaded', async () => {
     const customInput = { ...input, controlPlaneDomain: 'api.platform.example.com' };
     const initial = await createPlatformInstallPlan(client(), customInput, null);
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial);
     const workerName = manifest.deployment.resources.apiWorker;
     manifest = recordInstallationStep(
       manifest,
@@ -1621,17 +1426,7 @@ describe('platform installation planning', () => {
       },
       '2026-09-14T00:00:01.000Z',
     );
-    const marker = JSON.stringify(
-      createPlatformResourceOwnershipMarker({
-        accountId: manifest.account.id,
-        installationId: manifest.id,
-        ownershipNonce: manifest.ownershipNonce,
-        resourceId: workerName,
-        resourceKey: 'api-worker',
-        resourceKind: 'worker',
-        resourceName: workerName,
-      }),
-    );
+    const marker = markerFor(manifest, 'api-worker', 'worker', workerName);
 
     const resumed = await createPlatformInstallPlan(
       client({
@@ -1671,14 +1466,7 @@ describe('platform installation planning', () => {
 
   it('refuses to deploy over a Worker replaced after planning', async () => {
     const initial = await createPlatformInstallPlan(client(), input, null);
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial);
     const workerName = manifest.deployment.resources.apiWorker;
     manifest = recordInstallationResource(
       manifest,
@@ -1693,17 +1481,7 @@ describe('platform installation planning', () => {
       },
       '2026-09-14T00:00:01.000Z',
     );
-    const marker = JSON.stringify(
-      createPlatformResourceOwnershipMarker({
-        accountId: manifest.account.id,
-        installationId: manifest.id,
-        ownershipNonce: manifest.ownershipNonce,
-        resourceId: workerName,
-        resourceKey: 'api-worker',
-        resourceKind: 'worker',
-        resourceName: workerName,
-      }),
-    );
+    const marker = markerFor(manifest, 'api-worker', 'worker', workerName);
     let liveMarker: string | undefined = marker;
     const fake = client({
       getWorkerPlainTextBindings: async () =>
@@ -1721,14 +1499,7 @@ describe('platform installation planning', () => {
 
   it('revalidates a stable upgrade Worker without rebuilding the platform plan', async () => {
     const initial = await createPlatformInstallPlan(client(), input, null);
-    let manifest = createPlatformInstallationManifest({
-      account: initial.account,
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: initial.deployment,
-      id: initial.installationId,
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = manifestFor(initial);
     const workerName = manifest.deployment.resources.apiWorker;
     manifest = recordInstallationResource(
       manifest,
@@ -1752,17 +1523,7 @@ describe('platform installation planning', () => {
       reason: 'Update the owned Worker.',
     } as const;
     const stablePlan = { ...initial, actions: [action] };
-    let marker = JSON.stringify(
-      createPlatformResourceOwnershipMarker({
-        accountId: manifest.account.id,
-        installationId: manifest.id,
-        ownershipNonce: manifest.ownershipNonce,
-        resourceId: workerName,
-        resourceKey: action.key,
-        resourceKind: 'worker',
-        resourceName: workerName,
-      }),
-    );
+    let marker = markerFor(manifest, action.key, 'worker', workerName);
     const listAccounts = vi.fn(async () => {
       throw new Error('full planning was called');
     });
@@ -1794,18 +1555,7 @@ describe('platform installation planning', () => {
   });
 
   it('resumes resources proven by the remote ownership checkpoint', async () => {
-    let manifest = createPlatformInstallationManifest({
-      account: { id: 'account', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.app', zoneName: 'example.app' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = defaultManifest();
     const local = manifest;
     manifest = recordInstallationResource(
       manifest,
@@ -1837,27 +1587,16 @@ describe('platform installation planning', () => {
 
   it('adopts an existing zone without claiming ownership', async () => {
     const fake = client({
-      findZone: async () => ({
-        id: 'zone',
-        name: 'example.app',
-        nameServers: [],
-        status: 'active',
-      }),
+      findZone: async () => activeZone,
     });
     const plan = await createPlatformInstallPlan(fake, input, null);
     expect(plan.actions[0]).toMatchObject({ action: 'adopt', id: 'zone', kind: 'zone' });
   });
 
   it('adopts only a compatible wildcard application DNS record', async () => {
-    const zone = {
-      id: 'zone',
-      name: 'example.app',
-      nameServers: [],
-      status: 'active',
-    };
     const plan = await createPlatformInstallPlan(
       client({
-        findZone: async () => zone,
+        findZone: async () => activeZone,
         listDnsRecords: async () => [
           {
             content: '100::',
@@ -1879,7 +1618,7 @@ describe('platform installation planning', () => {
     await expect(
       createPlatformInstallPlan(
         client({
-          findZone: async () => zone,
+          findZone: async () => activeZone,
           listDnsRecords: async () => [
             {
               content: '192.0.2.1',
@@ -1897,18 +1636,7 @@ describe('platform installation planning', () => {
   });
 
   it('repairs a missing installer-owned resource', async () => {
-    let manifest = createPlatformInstallationManifest({
-      account: { id: 'account', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.app', zoneName: 'example.app' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = defaultManifest();
     manifest = recordInstallationResource(
       manifest,
       {
@@ -1932,18 +1660,7 @@ describe('platform installation planning', () => {
   });
 
   it('revalidates a missing Worker with the approved repair policy', async () => {
-    let manifest = createPlatformInstallationManifest({
-      account: { id: 'account', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.app', zoneName: 'example.app' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = defaultManifest();
     const workerName = manifest.deployment.resources.apiWorker;
     manifest = recordInstallationResource(
       manifest,
@@ -1971,18 +1688,7 @@ describe('platform installation planning', () => {
   });
 
   it('refuses to recreate a missing adopted resource', async () => {
-    let manifest = createPlatformInstallationManifest({
-      account: { id: 'account', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.app', zoneName: 'example.app' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    let manifest = defaultManifest();
     manifest = recordInstallationResource(
       manifest,
       {
diff --git a/packages/void/test/unit/platform-recovery.test.ts b/packages/void/test/unit/platform-recovery.test.ts
index 2920f7e47..2f0ce6e5e 100644
--- a/packages/void/test/unit/platform-recovery.test.ts
+++ b/packages/void/test/unit/platform-recovery.test.ts
@@ -5,8 +5,6 @@ import { join } from 'node:path';
 import {
   createPlatformDeploymentManifest,
   createPlatformInstallationManifest,
-  createPlatformResourceOwnershipMarker,
-  PLATFORM_DISABLED_KEY,
   recordInstallationResource,
   recordInstallationStep,
   setInstallationEndpoints,
@@ -17,7 +15,6 @@ import {
 import { afterEach, describe, expect, it } from 'vite-plus/test';
 import { hyperdriveOriginConfigHash } from '../../src/cli/platform-cloudflare.ts';
 import { REMOTE_INSTALLATION_MANIFEST_KEY } from '../../src/cli/platform-installer.ts';
-import { disablePlatform } from '../../src/cli/platform-management.ts';
 import {
   createPlatformInstallPlan,
   platformProvisionIntentHash,
@@ -31,6 +28,7 @@ import {
   listPlatformConnections,
   writeInstallationManifest,
 } from '../../src/cli/platform-registry.ts';
+import { ownershipMarker } from '../helpers/platform-installation.ts';
 
 const directories: Array<string> = [];
 
@@ -162,6 +160,13 @@ function remoteManifest() {
   );
 }
 
+function useRegistryDir(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
+  directories.push(directory);
+  process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+  return directory;
+}
+
 function client(manifest = remoteManifest()) {
   const byName = new Map(manifest.resources.map((resource) => [resource.name, resource]));
   return {
@@ -206,7 +211,6 @@ function client(manifest = remoteManifest()) {
         ? JSON.stringify(manifest)
         : null,
     putKvValue: async (_account: string, _namespace: string, _key: string, _value: string) => {},
-    removeRoutes: async () => {},
     getR2Object: async () => {
       const resource = manifest.resources.find((entry) => entry.kind === 'r2-bucket')!;
       return ownershipMarker(manifest, resource);
@@ -257,23 +261,6 @@ function client(manifest = remoteManifest()) {
   };
 }
 
-function ownershipMarker(
-  manifest: ReturnType<typeof remoteManifest>,
-  resource: ReturnType<typeof remoteManifest>['resources'][number],
-): string {
-  return JSON.stringify(
-    createPlatformResourceOwnershipMarker({
-      accountId: manifest.account.id,
-      installationId: manifest.id,
-      ownershipNonce: manifest.ownershipNonce,
-      resourceId: resource.id,
-      resourceKey: resource.key,
-      resourceKind: resource.kind,
-      resourceName: resource.name,
-    }),
-  );
-}
-
 describe('platform recovery', () => {
   it('authenticates endpoint verification with explicitly scoped Access proof', async () => {
     process.env.CF_ACCESS_CLIENT_ID = 'service-id';
@@ -317,9 +304,7 @@ describe('platform recovery', () => {
   });
 
   it('recovers a fully verified remote ownership manifest', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDir();
     const verified: Array<string> = [];
     const recovered = await recoverPlatformInstallations(client(), 'account', async (manifest) => {
       verified.push(manifest.id);
@@ -334,9 +319,7 @@ describe('platform recovery', () => {
   });
 
   it('recovers a verified installation with a missing owned Worker so repair can recreate it', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDir();
     const remote = remoteManifest();
     const missingWorker = remote.deployment.resources.apiWorker;
     const fake = client(remote);
@@ -376,9 +359,7 @@ describe('platform recovery', () => {
   });
 
   it('rejects discovery when a surviving Worker belongs to another installation', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDir();
     const remote = remoteManifest();
     const fake = client(remote);
     const conflicting = {
@@ -404,9 +385,7 @@ describe('platform recovery', () => {
   });
 
   it('discovers a routing namespace created under a retry name', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDir();
     const base = remoteManifest();
     const retryName = `${base.deployment.resources.routingKv}-retry-0123456789`;
     const manifest = {
@@ -429,9 +408,7 @@ describe('platform recovery', () => {
   });
 
   it('refuses ownership metadata from a different routing namespace', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDir();
     const manifest = remoteManifest();
     const tampered = {
       ...manifest,
@@ -446,9 +423,7 @@ describe('platform recovery', () => {
   });
 
   it('recovers a disabled installation without probing its private endpoint', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDir();
     const installed = remoteManifest();
     const disabled = {
       ...installed,
@@ -465,9 +440,7 @@ describe('platform recovery', () => {
   });
 
   it('recovers an interrupted uninstall without probing its removed endpoint', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDir();
     const interrupted = { ...remoteManifest(), status: 'uninstalling' as const };
     let endpointChecks = 0;
 
@@ -485,9 +458,7 @@ describe('platform recovery', () => {
   });
 
   it('recovers an interrupted install before endpoints were checkpointed', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    const directory = useRegistryDir();
     const interrupted = {
       ...remoteManifest(),
       endpoints: { apiUrl: null, dashboardUrl: null, proxyUrl: null },
@@ -509,10 +480,8 @@ describe('platform recovery', () => {
     expect(endpointChecks).toBe(0);
   });
 
-  it('recovers and disables a Worker deployed before its resource checkpoint', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+  it('recovers a Worker deployed before its resource checkpoint', async () => {
+    useRegistryDir();
     const base = remoteManifest();
     const installationId = 'example-a1b2c3d4e5f6';
     const workerName = 'void-example-a1b2c3d4e5f6-api';
@@ -553,10 +522,6 @@ describe('platform recovery', () => {
           : interrupted.resources.find((entry) => entry.kind === 'worker' && entry.name === name)!;
       return { PLATFORM_OWNERSHIP_MARKER: ownershipMarker(interrupted, resource) };
     };
-    const disabledKeys: Array<string> = [];
-    fake.putKvValue = async (_account, _namespace, key) => {
-      disabledKeys.push(key);
-    };
 
     const [recovered] = await recoverPlatformInstallations(fake, 'account', async () => {});
     expect(recovered?.resources.find((resource) => resource.key === 'api-worker')).toMatchObject({
@@ -567,14 +532,10 @@ describe('platform recovery', () => {
       ownership: 'created',
       state: 'ready',
     });
-    await disablePlatform(fake, recovered!, false);
-    expect(disabledKeys).toContain(PLATFORM_DISABLED_KEY);
   });
 
   it('keeps locally advanced lifecycle progress during discovery', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDir();
     const remote = remoteManifest();
     const local = {
       ...remote,
@@ -590,9 +551,7 @@ describe('platform recovery', () => {
   });
 
   it('rejects a locally advanced manifest with a different proxy origin', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDir();
     const remote = remoteManifest();
     const local = {
       ...remote,
@@ -610,9 +569,7 @@ describe('platform recovery', () => {
   });
 
   it('accepts a deterministic endpoint advancement from a local checkpoint', async () => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-platform-recovery-test-'));
-    directories.push(directory);
-    process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
+    useRegistryDir();
     const complete = remoteManifest();
     const remote = {
       ...complete,
diff --git a/packages/void/test/unit/platform-registry.test.ts b/packages/void/test/unit/platform-registry.test.ts
index d346b8a13..95d74183e 100644
--- a/packages/void/test/unit/platform-registry.test.ts
+++ b/packages/void/test/unit/platform-registry.test.ts
@@ -81,20 +81,7 @@ describe('platform registry', () => {
 
   it('rejects a fresh installation slug after a competing checkpoint appears', () => {
     const directory = temporaryRegistry();
-    let manifest = createPlatformInstallationManifest({
-      account: { id: 'account', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
-    manifest = { ...manifest, status: 'planned' };
-    writeInstallationManifest(manifest, directory);
+    writeInstallationManifest({ ...exampleInstallation(), status: 'planned' }, directory);
 
     expect(() => assertPlatformInstallationSlugAvailable('example', directory)).toThrow(
       'already uses this name',
@@ -291,18 +278,7 @@ describe('platform registry', () => {
 
   it('keeps recovery material private and removes it explicitly', () => {
     const directory = temporaryRegistry();
-    const manifest = createPlatformInstallationManifest({
-      account: { id: 'account_123', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.com', zoneName: 'example.com' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    const manifest = exampleInstallation();
     writeInstallationManifest(manifest, directory);
     writePendingInstallationSecrets(manifest, { databaseUrl: 'postgres://secret' }, directory);
     expect(readInstallationRecoverySecrets(manifest, directory)).toEqual({
@@ -328,18 +304,7 @@ describe('platform registry', () => {
 
   it('migrates legacy plaintext recovery material to an encrypted envelope', () => {
     const directory = temporaryRegistry();
-    const manifest = createPlatformInstallationManifest({
-      account: { id: 'account_123', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.com', zoneName: 'example.com' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    const manifest = exampleInstallation();
     writeInstallationManifest(manifest, directory);
     const legacyPath = join(directory, 'account_123', 'example-a1b2c3d4.recovery');
     writeFileSync(legacyPath, JSON.stringify({ databaseUrl: 'postgres://legacy-secret' }), {
@@ -357,18 +322,7 @@ describe('platform registry', () => {
 
   it('authenticates encrypted recovery material to the installation identity', () => {
     const directory = temporaryRegistry();
-    const manifest = createPlatformInstallationManifest({
-      account: { id: 'account_123', name: 'Account' },
-      createdAt: '2026-09-14T00:00:00.000Z',
-      deployment: createPlatformDeploymentManifest({
-        application: { baseDomain: 'example.com', zoneName: 'example.com' },
-        displayName: 'Example',
-        installationSlug: 'example',
-      }),
-      id: 'example-a1b2c3d4',
-      ownershipNonce: '0123456789abcdef0123456789abcdef',
-      platformVersion: '1.0.0',
-    });
+    const manifest = exampleInstallation();
     writeInstallationManifest(manifest, directory);
     writePendingInstallationSecrets(manifest, { databaseUrl: 'postgres://secret' }, directory);
     promoteInstallationSecrets(manifest, directory);
diff --git a/packages/void/test/unit/platform-rollback.test.ts b/packages/void/test/unit/platform-rollback.test.ts
index 4f61bada9..d882244a7 100644
--- a/packages/void/test/unit/platform-rollback.test.ts
+++ b/packages/void/test/unit/platform-rollback.test.ts
@@ -4,8 +4,7 @@ import {
 } from '@void/platform';
 import type { PlatformRuntime, PlatformRuntimeMigration } from '@void/platform/installer';
 import { describe, expect, it } from 'vite-plus/test';
-import { parsePlatformInstallationManifest } from '../../../platform/src/installation.ts';
-import { assertPlatformRuntimeSafety } from '../../src/cli/platform-installer.ts';
+import { assertPlatformRuntimeSafety } from '../../src/cli/platform-installer-database.ts';
 import { assertPlatformRollbackCompatibility } from '../../src/cli/platform-management.ts';
 
 const firstMigration: PlatformRuntimeMigration = {
@@ -197,52 +196,6 @@ describe('platform post-success rollback', () => {
       ),
     ).not.toThrow();
   });
-  it('accepts an exact compatible prefix while preserving forward schema provenance', () => {
-    const target = runtime({
-      digest: 'a'.repeat(64),
-      migrations: [firstMigration],
-      platformVersion: '1.0.0',
-      schemaDigest: 'c'.repeat(64),
-    });
-    const source = runtime({
-      digest: 'b'.repeat(64),
-      migrations: [firstMigration, secondMigration],
-      platformVersion: '1.1.0',
-      rollbackSafeFrom: [
-        { platformVersion: target.manifest.platformVersion, schemaDigest: 'c'.repeat(64) },
-      ],
-      schemaDigest: 'd'.repeat(64),
-    });
-    const installation = installed(source);
-
-    expect(() => assertPlatformRollbackCompatibility(installation, target, source)).not.toThrow();
-
-    const afterRollback = parsePlatformInstallationManifest(
-      JSON.parse(
-        JSON.stringify({
-          ...installation,
-          platformVersion: target.manifest.platformVersion,
-          runtime: {
-            manifestSha256: target.manifestSha256,
-            source: target.source,
-            sourceRevision: target.manifest.sourceRevision,
-          },
-        }),
-      ),
-    );
-    expect(afterRollback.runtime?.manifestSha256).toBe(target.manifestSha256);
-    expect(afterRollback.databaseSchemaDigest).toBe(source.manifest.database.schemaDigest);
-    expect(afterRollback.databaseSchemaDigest).not.toBe(target.manifest.database.schemaDigest);
-
-    const discoveredForRollForward = parsePlatformInstallationManifest(
-      JSON.parse(JSON.stringify(afterRollback)),
-    );
-    expect(discoveredForRollForward.platformVersion).toBe(target.manifest.platformVersion);
-    expect(discoveredForRollForward.databaseSchemaDigest).toBe(
-      source.manifest.database.schemaDigest,
-    );
-  });
-
   it('compares artifact digests for same-version custom runtimes', () => {
     const target = runtime({
       digest: 'a'.repeat(64),
diff --git a/packages/void/test/unit/platform-runtime.test.ts b/packages/void/test/unit/platform-runtime.test.ts
index beaf86be9..98aa46346 100644
--- a/packages/void/test/unit/platform-runtime.test.ts
+++ b/packages/void/test/unit/platform-runtime.test.ts
@@ -5,7 +5,6 @@ import { join } from 'node:path';
 import {
   getPlatformRuntimeDirectory,
   parsePlatformRuntimeManifest,
-  platformDatabaseSchemaDigest,
   readPlatformRuntimeManifest,
   resolvePlatformRuntime,
 } from '@void/platform/installer';
@@ -61,37 +60,6 @@ describe('platform runtime manifest', () => {
     }
   });
 
-  it('binds every packaged migration and Worker artifact to the manifest', () => {
-    const runtimeDirectory = getPlatformRuntimeDirectory();
-    const manifest = readPlatformRuntimeManifest();
-
-    expect(manifest.schemaVersion).toBe(2);
-    expect(manifest.safetyProtocols).toEqual({ sandboxDrain: 3 });
-    expect(manifest.usageProtocolVersion).toBe(2);
-    expect(manifest.database.schemaDigest).toBe(
-      platformDatabaseSchemaDigest(manifest.database.lineage, manifest.database.migrations),
-    );
-    expect(manifest.database.migrations.length).toBeGreaterThan(0);
-    for (const migration of manifest.database.migrations) {
-      expect(digest(readFileSync(join(runtimeDirectory, 'drizzle', `${migration.tag}.sql`)))).toBe(
-        migration.sha256,
-      );
-    }
-    expect(digest(readFileSync(join(runtimeDirectory, 'drizzle', 'meta', '_journal.json')))).toBe(
-      manifest.database.journalSha256,
-    );
-    expect(manifest.assets?.adminClient.path).toBe('api/assets/admin/client.js');
-    expect(manifest.assets?.adminStyle?.path).toBe('api/assets/admin/style.css');
-    for (const artifact of [
-      ...Object.values(manifest.artifacts),
-      ...Object.values(manifest.assets ?? {}),
-    ]) {
-      const contents = readFileSync(join(runtimeDirectory, artifact.path));
-      expect(contents.byteLength).toBe(artifact.size);
-      expect(digest(contents)).toBe(artifact.sha256);
-    }
-  });
-
   it('rejects malformed and internally inconsistent manifests', () => {
     const manifest = readPlatformRuntimeManifest();
 
diff --git a/packages/void/test/unit/platform-setup-flow.test.ts b/packages/void/test/unit/platform-setup-flow.test.ts
index f7e610e79..4845591d3 100644
--- a/packages/void/test/unit/platform-setup-flow.test.ts
+++ b/packages/void/test/unit/platform-setup-flow.test.ts
@@ -72,7 +72,6 @@ vi.mock('../../src/cli/auth.ts', async (original) => ({
   ...(await original<typeof import('../../src/cli/auth.ts')>()),
   openBrowser: mocks.open,
 }));
-vi.mock('../../src/cli/prompt-password.ts', () => ({ passwordWithPlaceholder: mocks.password }));
 vi.mock('../../src/cli/output.ts', async (original) => ({
   ...(await original<typeof import('../../src/cli/output.ts')>()),
   createSpinner: mocks.spinner,
@@ -673,10 +672,7 @@ describe('platform credential onboarding', () => {
         headers: expect.objectContaining({ Authorization: 'Bearer management-secret' }),
       }),
     );
-    expect(mocks.open).toHaveBeenCalledWith(
-      expect.stringContaining('name=Test+Management'),
-      expect.any(Function),
-    );
+    expect(mocks.open).toHaveBeenCalledWith(expect.stringContaining('name=Test+Management'));
     const secrets = readPendingInstallationSecrets(listInstallationManifests()[0]!);
     expect(secrets?.cloudflareApiToken).toBe(
       environment.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN,
@@ -783,10 +779,7 @@ describe('platform credential onboarding', () => {
           ([input]) => input.message === 'Paste management API token:',
         ),
       ).toHaveLength(1);
-      expect(mocks.open).toHaveBeenCalledWith(
-        expect.stringContaining('Management'),
-        expect.any(Function),
-      );
+      expect(mocks.open).toHaveBeenCalledWith(expect.stringContaining('Management'));
       expect(readPendingInstallationSecrets(manifest)?.managementApiToken).toBe(
         'replacement-secret',
       );
diff --git a/packages/void/test/unit/platform-setup.test.ts b/packages/void/test/unit/platform-setup.test.ts
index ecb311584..73a56ff80 100644
--- a/packages/void/test/unit/platform-setup.test.ts
+++ b/packages/void/test/unit/platform-setup.test.ts
@@ -43,6 +43,11 @@ function plan(domain = ''): PlatformInstallPlan {
     }),
   };
 }
+
+function permissionGroupKeys(url: string): Array<{ key: string; type: string }> {
+  return JSON.parse(new URL(url).searchParams.get('permissionGroupKeys')!);
+}
+
 describe('platform credential setup links', () => {
   it.each([false, true])(
     'includes Access in the management token only, with protection: %s',
@@ -59,42 +64,34 @@ describe('platform credential setup links', () => {
           },
         },
       };
-      const page = platformManagementSetupPage(selected);
-      const permissions = JSON.parse(new URL(page.url).searchParams.get('permissionGroupKeys')!);
+      const page = platformManagementSetupPage(selected, {
+        access: { protection, readOnly: false },
+      });
+      const permissions = permissionGroupKeys(page.url);
       expect(permissions).toContainEqual({ key: 'access', type: 'edit' });
       expect(permissions).toContainEqual({ key: 'access_acct', type: 'read' });
-      expect(permissions.some(({ key }: { key: string }) => key === 'access_service_token')).toBe(
-        protection,
-      );
+      expect(permissions.some(({ key }) => key === 'access_service_token')).toBe(protection);
       if (protection) {
         expect(permissions).toContainEqual({ key: 'access_service_token', type: 'edit' });
       }
-      expect(
-        permissions.some(({ key }: { key: string }) =>
-          ['zone', 'dns', 'workers_routes'].includes(key),
-        ),
-      ).toBe(false);
-      expect(page.instructions).toContain('Scope it to Account.');
-      const runtime = JSON.parse(
-        new URL(platformSetupPages(selected).runtime.url).searchParams.get('permissionGroupKeys')!,
+      expect(permissions.some(({ key }) => ['zone', 'dns', 'workers_routes'].includes(key))).toBe(
+        false,
       );
-      expect(runtime.some(({ key }: { key: string }) => key.startsWith('access'))).toBe(false);
-      const disabled = JSON.parse(
-        new URL(platformManagementSetupPage(selected, { access: false }).url).searchParams.get(
-          'permissionGroupKeys',
-        )!,
+      expect(page.instructions).toContain('Scope it to Account.');
+      const runtime = permissionGroupKeys(platformSetupPages(selected).runtime.url);
+      expect(runtime.some(({ key }) => key.startsWith('access'))).toBe(false);
+      const disabled = permissionGroupKeys(
+        platformManagementSetupPage(selected, { access: false }).url,
       );
-      expect(disabled.some(({ key }: { key: string }) => key.startsWith('access'))).toBe(false);
+      expect(disabled.some(({ key }) => key.startsWith('access'))).toBe(false);
     },
   );
 
   it('uses read permissions for existing Access applications', () => {
-    const permissions = JSON.parse(
-      new URL(
-        platformManagementSetupPage(plan(), { access: { readOnly: true, protection: true } }).url,
-      ).searchParams.get('permissionGroupKeys')!,
+    const permissions = permissionGroupKeys(
+      platformManagementSetupPage(plan(), { access: { readOnly: true, protection: true } }).url,
     );
-    expect(permissions.filter(({ key }: { key: string }) => key.startsWith('access'))).toEqual([
+    expect(permissions.filter(({ key }) => key.startsWith('access'))).toEqual([
       { key: 'access', type: 'read' },
       { key: 'access_acct', type: 'read' },
       { key: 'access_service_token', type: 'read' },
@@ -102,11 +99,11 @@ describe('platform credential setup links', () => {
   });
   it('prefills a separate management token with account provisioning and zone permissions', () => {
     const original = plan('example.com');
-    const page = platformManagementSetupPage(original);
+    const page = platformManagementSetupPage(original, { access: false });
     const url = new URL(page.url);
     expect(url.searchParams.get('to')).toBe('/account/api-tokens');
     expect(url.searchParams.get('name')).toBe('Test & Team Management');
-    const permissions = JSON.parse(url.searchParams.get('permissionGroupKeys')!);
+    const permissions = permissionGroupKeys(page.url);
     for (const key of [
       'workers_scripts',
       'workers_kv_storage',
@@ -121,9 +118,9 @@ describe('platform credential setup links', () => {
       expect(permissions).toContainEqual({ key, type: 'edit' });
     }
     expect(permissions).toContainEqual({ key: 'zone', type: 'read' });
-    expect(
-      permissions.some(({ key }: { key: string }) => ['cache', 'account_api_tokens'].includes(key)),
-    ).toBe(false);
+    expect(permissions.some(({ key }) => ['cache', 'account_api_tokens'].includes(key))).toBe(
+      false,
+    );
     expect(page.instructions).toBe(
       [
         'This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.',
@@ -131,50 +128,57 @@ describe('platform credential setup links', () => {
         'Change the zone policy from All Domains to Specified Domains → example.com.',
       ].join('\n'),
     );
-    const createZone = platformManagementSetupPage({
-      ...original,
-      actions: [
-        {
-          kind: 'zone',
-          key: 'zone',
-          action: 'create',
-          id: null,
-          name: 'example.com',
-          reason: 'test',
-        },
-      ],
-    });
-    expect(
-      JSON.parse(new URL(createZone.url).searchParams.get('permissionGroupKeys')!),
-    ).toContainEqual({ key: 'zone', type: 'edit' });
+    const createZone = platformManagementSetupPage(
+      {
+        ...original,
+        actions: [
+          {
+            kind: 'zone',
+            key: 'zone',
+            action: 'create',
+            id: null,
+            name: 'example.com',
+            reason: 'test',
+          },
+        ],
+      },
+      { access: false },
+    );
+    expect(permissionGroupKeys(createZone.url)).toContainEqual({ key: 'zone', type: 'edit' });
     expect(createZone.instructions).toContain(
       'Keep the zone policy on All Domains so Void can create example.com.',
     );
     expect(createZone.instructions).not.toContain('Specified Domains');
-    const separateApi = platformManagementSetupPage({
-      ...original,
-      deployment: {
-        ...original.deployment,
-        controlPlane: { ...original.deployment.controlPlane, apiHostname: 'api.company.net' },
+    const separateApi = platformManagementSetupPage(
+      {
+        ...original,
+        deployment: {
+          ...original.deployment,
+          controlPlane: { ...original.deployment.controlPlane, apiHostname: 'api.company.net' },
+        },
       },
-    });
+      { access: false },
+    );
     expect(separateApi.instructions).toContain(
       'Change the zone policy from All Domains to Specified Domains → example.com and the zone for api.company.net.',
     );
-    const workersDevApi = platformManagementSetupPage({
-      ...plan(),
-      deployment: {
-        ...plan().deployment,
-        controlPlane: { ...plan().deployment.controlPlane, apiHostname: 'api.company.net' },
+    const workersDevApi = platformManagementSetupPage(
+      {
+        ...plan(),
+        deployment: {
+          ...plan().deployment,
+          controlPlane: { ...plan().deployment.controlPlane, apiHostname: 'api.company.net' },
+        },
       },
-    });
+      { access: false },
+    );
     expect(workersDevApi.instructions).toContain(
       'Change the zone policy from All Domains to Specified Domains → the zone for api.company.net.',
     );
   });
   it('cannot preselect a zone in the account token link, so it names the dashboard change', () => {
     // Account token template links accept only permissionGroupKeys and name.
-    const url = new URL(platformManagementSetupPage(plan('example.com')).url);
+    const url = new URL(platformManagementSetupPage(plan('example.com'), { access: false }).url);
     expect([...url.searchParams.keys()]).toEqual(['to', 'name', 'permissionGroupKeys']);
     const runtime = new URL(platformSetupPages(plan('example.com')).runtime.url);
     expect([...runtime.searchParams.keys()]).toEqual(['to', 'name', 'permissionGroupKeys']);
@@ -260,7 +264,7 @@ describe('platform credential setup links', () => {
     expect(url.origin).toBe('https://dash.cloudflare.com');
     expect(url.searchParams.get('to')).toBe('/account/api-tokens');
     expect(url.searchParams.get('name')).toBe('Test & Team Runtime');
-    const permissions = JSON.parse(url.searchParams.get('permissionGroupKeys')!);
+    const permissions = permissionGroupKeys(pages.runtime.url);
     expect(permissions).toEqual([
       { key: 'account_settings', type: 'read' },
       { key: 'workers_scripts', type: 'edit' },
@@ -274,21 +278,21 @@ describe('platform credential setup links', () => {
       { key: 'aig', type: 'edit' },
     ]);
     expect(
-      permissions.some((permission: { key: string }) =>
-        ['cache', 'ssl_and_certificates', 'account_api_tokens'].includes(permission.key),
+      permissions.some(({ key }) =>
+        ['cache', 'ssl_and_certificates', 'account_api_tokens'].includes(key),
       ),
     ).toBe(false);
     expect(pages.runtime.instructions).toBe(
       'Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here.',
     );
-    expect(new URL(pages.r2.url).searchParams.get('to')).toBe('/account/r2/api-tokens/create');
-    expect(new URL(pages.r2.url).searchParams.get('type')).toBe('account');
-    expect(pages.r2.instructions).toContain('Object Read & Write');
   });
   it('opens R2 creation without claiming unsupported permission prefills', () => {
     const page = platformSetupPages(plan()).r2;
     const url = new URL(page.url);
-    expect([...url.searchParams.keys()]).toEqual(['to', 'type']);
+    expect([...url.searchParams]).toEqual([
+      ['to', '/account/r2/api-tokens/create'],
+      ['type', 'account'],
+    ]);
     expect(page.instructions).toContain('Select Object Read & Write.');
     expect(page.instructions).toContain('Keep Apply to all buckets in this account selected.');
     expect(page.instructions).not.toMatch(/[();]/);
@@ -297,9 +301,7 @@ describe('platform credential setup links', () => {
   });
   it('does not request AI Gateway permission when operator auth can manage it', () => {
     const pages = platformSetupPages({ ...plan(), actions: [] });
-    const permissions = JSON.parse(
-      new URL(pages.runtime.url).searchParams.get('permissionGroupKeys')!,
-    );
+    const permissions = permissionGroupKeys(pages.runtime.url);
     expect(permissions).not.toContainEqual({ key: 'aig', type: 'edit' });
     expect(pages.runtime.instructions).not.toContain('AI Gateway');
     expect(permissions).toContainEqual({ key: 'query_cache', type: 'edit' });
@@ -314,12 +316,14 @@ describe('platform credential setup links', () => {
         capabilities: { ...original.deployment.capabilities, customDomains: true },
       },
     };
-    const permissions = (input: PlatformInstallPlan) =>
-      JSON.parse(
-        new URL(platformSetupPages(input).runtime.url).searchParams.get('permissionGroupKeys')!,
-      );
-    expect(permissions(custom)).toContainEqual({ key: 'ssl_and_certificates', type: 'edit' });
-    expect(permissions(original)).not.toContainEqual({ key: 'ssl_and_certificates', type: 'edit' });
+    expect(permissionGroupKeys(platformSetupPages(custom).runtime.url)).toContainEqual({
+      key: 'ssl_and_certificates',
+      type: 'edit',
+    });
+    expect(permissionGroupKeys(platformSetupPages(original).runtime.url)).not.toContainEqual({
+      key: 'ssl_and_certificates',
+      type: 'edit',
+    });
   });
   it.each([false, true])(
     'requests Containers and Cloudchamber only for managed Sandbox, enabled: %s',
@@ -333,9 +337,7 @@ describe('platform credential setup links', () => {
         },
       };
       const runtimePermissions = (input: PlatformInstallPlan) =>
-        JSON.parse(
-          new URL(platformSetupPages(input).runtime.url).searchParams.get('permissionGroupKeys')!,
-        );
+        permissionGroupKeys(platformSetupPages(input).runtime.url);
       expect(runtimePermissions(selected)).toEqual([
         ...runtimePermissions(original),
         ...(sandbox
@@ -345,8 +347,8 @@ describe('platform credential setup links', () => {
             ]
           : []),
       ]);
-      expect(platformManagementSetupPage(selected).url).toBe(
-        platformManagementSetupPage(original).url,
+      expect(platformManagementSetupPage(selected, { access: false }).url).toBe(
+        platformManagementSetupPage(original, { access: false }).url,
       );
     },
   );
@@ -359,10 +361,6 @@ describe('platform credential setup links', () => {
         capabilities: { ...original.deployment.capabilities, email: true },
       },
     };
-    const permissions = (input: PlatformInstallPlan) =>
-      JSON.parse(
-        new URL(platformSetupPages(input).runtime.url).searchParams.get('permissionGroupKeys')!,
-      ) as Array<{ key: string; type: string }>;
     const emailKeys = [
       'zone',
       'zone_settings',
@@ -370,12 +368,14 @@ describe('platform credential setup links', () => {
       'email_routing_rule',
       'email_sending',
     ];
-    expect(permissions(withEmail).map((permission) => permission.key)).toEqual(
-      expect.arrayContaining(emailKeys),
-    );
-    expect(permissions(original).some((permission) => emailKeys.includes(permission.key))).toBe(
-      false,
-    );
+    expect(
+      permissionGroupKeys(platformSetupPages(withEmail).runtime.url).map(({ key }) => key),
+    ).toEqual(expect.arrayContaining(emailKeys));
+    expect(
+      permissionGroupKeys(platformSetupPages(original).runtime.url).some(({ key }) =>
+        emailKeys.includes(key),
+      ),
+    ).toBe(false);
     expect(platformSetupPages(original).runtime.instructions).not.toContain(
       'Email Routing Addresses',
     );
@@ -431,15 +431,9 @@ describe('platform credential setup links', () => {
   });
   it('includes zone permissions only for an application domain', () => {
     const page = platformSetupPages(plan('example.com')).runtime;
-    expect(JSON.parse(new URL(page.url).searchParams.get('permissionGroupKeys')!)).toContainEqual({
-      key: 'cache',
-      type: 'purge',
-    });
-    expect(page.instructions).toBe(
-      [
-        'Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here.',
-        'Change the zone policy from All Domains to Specified Domains → example.com.',
-      ].join('\n'),
+    expect(permissionGroupKeys(page.url)).toContainEqual({ key: 'cache', type: 'purge' });
+    expect(page.instructions).toContain(
+      'Change the zone policy from All Domains to Specified Domains → example.com.',
     );
     const original = plan('example.com');
     const withEmail = platformSetupPages({
@@ -468,11 +462,8 @@ describe('platform credential setup links', () => {
         },
       ],
     }).runtime;
-    expect(page.instructions).toBe(
-      [
-        'Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here.',
-        'Keep the zone policy on All Domains so the token can purge cache on example.com after Void creates it.',
-      ].join('\n'),
+    expect(page.instructions).toContain(
+      'Keep the zone policy on All Domains so the token can purge cache on example.com after Void creates it.',
     );
   });
   it('opens only in interactive mode and retains a manual link if opening fails', () => {
diff --git a/packages/void/test/unit/platform-teardown.test.ts b/packages/void/test/unit/platform-teardown.test.ts
index f4197e35b..ba397a2e8 100644
--- a/packages/void/test/unit/platform-teardown.test.ts
+++ b/packages/void/test/unit/platform-teardown.test.ts
@@ -3,20 +3,15 @@ vi.mock('../../src/cli/output.ts', async (importOriginal) => ({
   printSuccess: vi.fn(),
 }));
 import { createHash } from 'node:crypto';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { stripVTControlCharacters } from 'node:util';
+import { rmSync } from 'node:fs';
 import {
   createPlatformDeploymentManifest,
   createPlatformInstallationManifest,
-  createPlatformResourceOwnershipMarker,
   PLATFORM_DISABLED_KEY,
   PLATFORM_R2_OWNERSHIP_MARKER_KEY,
   recordInstallationResource,
   recordInstallationStep,
   transitionInstallation,
-  type InstallationResource,
   type InstallationResourceKind,
   type PlatformInstallationManifest,
   type ResourceOwnership,
@@ -24,21 +19,21 @@ import {
 import { log, note } from '@voidzero-dev/vite-plus-prompts';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 import { printSuccess } from '../../src/cli/output.ts';
-import {
-  PlatformCloudflareApiError,
-  PlatformCloudflareClient,
-} from '../../src/cli/platform-cloudflare.ts';
+import { PlatformCloudflareApiError } from '../../src/cli/platform-cloudflare.ts';
+import { readPlatformProjectSlugsConnection } from '../../src/cli/platform-installer-database.ts';
 import { uninstallPlatform } from '../../src/cli/platform-management.ts';
 import {
   listInstallationManifests,
-  promoteInstallationSecrets,
   readInstallationRecoverySecrets,
-  writeInstallationManifest,
-  writePendingInstallationSecrets,
 } from '../../src/cli/platform-registry.ts';
-import { readPlatformProjectSlugsConnection } from '../../src/cli/platform-teardown.ts';
 import { recordPlatformWorkerTraffic } from '../../src/cli/platform-traffic.ts';
 import { projectZeroTrustUninstallState } from '../../src/cli/platform-zero-trust-uninstall.ts';
+import {
+  expectInOrder,
+  noteText,
+  ownershipMarker,
+  persistInstallation,
+} from '../helpers/platform-installation.ts';
 
 vi.mock('@voidzero-dev/vite-plus-prompts', async (original) => {
   const actual = await original<typeof import('@voidzero-dev/vite-plus-prompts')>();
@@ -230,29 +225,6 @@ function installedManifest(
   return manifest;
 }
 
-function persist(manifest: PlatformInstallationManifest): void {
-  const directory = mkdtempSync(join(tmpdir(), 'void-platform-teardown-test-'));
-  directories.push(directory);
-  process.env.VOID_PLATFORM_REGISTRY_DIR = directory;
-  writeInstallationManifest(manifest);
-  writePendingInstallationSecrets(manifest, { databaseUrl: 'postgres://recovery' });
-  promoteInstallationSecrets(manifest);
-}
-
-function marker(manifest: PlatformInstallationManifest, resource: InstallationResource): string {
-  return JSON.stringify(
-    createPlatformResourceOwnershipMarker({
-      accountId: manifest.account.id,
-      installationId: manifest.id,
-      ownershipNonce: manifest.ownershipNonce,
-      resourceId: resource.id,
-      resourceKey: resource.key,
-      resourceKind: resource.kind,
-      resourceName: resource.name,
-    }),
-  );
-}
-
 /** A Cloudflare account that enforces the delete rules seen live. */
 function cloudflare(manifest: PlatformInstallationManifest) {
   const calls: Array<string> = [];
@@ -263,7 +235,7 @@ function cloudflare(manifest: PlatformInstallationManifest) {
   const workerMarkers = new Map(
     manifest.resources
       .filter((resource) => resource.kind === 'worker')
-      .map((resource) => [resource.name, marker(manifest, resource)]),
+      .map((resource) => [resource.name, ownershipMarker(manifest, resource)]),
   );
   const bucket = manifest.resources.find((resource) => resource.kind === 'r2-bucket')!;
   const live = {
@@ -299,7 +271,7 @@ function cloudflare(manifest: PlatformInstallationManifest) {
         {
           fingerprint: FINGERPRINT,
           objects: new Map([
-            [PLATFORM_R2_OWNERSHIP_MARKER_KEY, marker(manifest, bucket)],
+            [PLATFORM_R2_OWNERSHIP_MARKER_KEY, ownershipMarker(manifest, bucket)],
             ['assets/a.txt', 'a'],
           ]),
         },
@@ -547,7 +519,6 @@ function cloudflare(manifest: PlatformInstallationManifest) {
         remote = value;
       }
     },
-    removeRoutes: async () => {},
     listEmailRoutingRules: async (zone: string) => {
       calls.push(`GET email-rules ${zone}`);
       return [...live.emailRules];
@@ -591,24 +562,6 @@ function dependencies(overrides: Record<string, unknown> = {}) {
   };
 }
 
-function noteText(title: string): string {
-  return String(
-    vi
-      .mocked(note)
-      .mock.calls.filter(([, noteTitle]) => stripVTControlCharacters(noteTitle ?? '') === title)
-      .at(-1)?.[0] ?? '',
-  );
-}
-
-function expectInOrder(text: string, lines: ReadonlyArray<string>): void {
-  const positions = lines.map((line) => text.indexOf(line));
-  expect(
-    positions.map((position, index) => [lines[index], position >= 0]),
-    text,
-  ).toEqual(lines.map((line) => [line, true]));
-  expect(positions, text).toEqual([...positions].sort((left, right) => left - right));
-}
-
 function deletes(fake: ReturnType<typeof cloudflare>): Array<string> {
   return fake.calls.filter((call) => call.startsWith('DELETE') || call.startsWith('EMPTY'));
 }
@@ -617,6 +570,31 @@ function changes(fake: ReturnType<typeof cloudflare>): Array<string> {
   return fake.calls.filter((call) => !call.startsWith('GET'));
 }
 
+/** Runs a plain uninstall that stops at its last write, after every resource was recorded as kept. */
+async function stopPlainUninstallAtLastWrite(
+  fake: ReturnType<typeof cloudflare>,
+  manifest: PlatformInstallationManifest,
+): Promise<PlatformInstallationManifest> {
+  const putKvValue = fake.putKvValue;
+  let failed = false;
+  fake.putKvValue = async (account, namespace, key, value) => {
+    if (!failed && value.includes('"status":"uninstalled"')) {
+      failed = true;
+      throw new Error('checkpoint write failed');
+    }
+    return putKvValue(account, namespace, key, value);
+  };
+  await expect(
+    uninstallPlatform(
+      fake,
+      manifest,
+      { ...purgeResourcesArgs, purgeResources: false, purgeData: false },
+      dependencies(),
+    ),
+  ).rejects.toThrow('checkpoint write failed');
+  return listInstallationManifests()[0]!;
+}
+
 const FULL_ORDER = [
   'DELETE worker-custom-domain domain-1',
   'DELETE worker-route route-1',
@@ -648,7 +626,7 @@ const FULL_ORDER = [
 describe('uninstall --purge-resources', () => {
   it('plans every deletion in order and every kept resource, using only reads', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
 
     await uninstallPlatform(fake, manifest, { ...purgeResourcesArgs, plan: true }, dependencies());
@@ -697,7 +675,7 @@ describe('uninstall --purge-resources', () => {
 
   it('shows the deletion plan before interactive confirmation and leaves cancellation unchanged', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     const confirm = vi.fn(async () => {
       expect(noteText('Uninstall plan')).toContain(`5. worker: ${names.apiWorker}`);
@@ -720,7 +698,7 @@ describe('uninstall --purge-resources', () => {
 
   it('deletes in an order Cloudflare accepts, with the tail Worker after its producers and routing KV last', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
 
     await uninstallPlatform(fake, manifest, purgeResourcesArgs, dependencies());
@@ -764,39 +742,9 @@ describe('uninstall --purge-resources', () => {
     expect(printSuccess).toHaveBeenCalledWith('Uninstalled Example.');
   });
 
-  it('detaches queue consumers that Cloudflare names by script_name before deleting their Workers', async () => {
-    const manifest = installedManifest();
-    persist(manifest);
-    const fake = cloudflare(manifest);
-    // Answer with the documented consumer shape, read by the real client.
-    fake.listQueueConsumers = async (account: string, queue: string) => [
-      ...(await new PlatformCloudflareClient('token', {
-        fetcher: async () =>
-          Response.json({
-            success: true,
-            result: (fake.live.consumers.get(queue) ?? []).map((entry) =>
-              entry.script === null
-                ? { consumer_id: entry.id, type: 'http_pull' }
-                : { consumer_id: entry.id, script_name: entry.script, type: 'worker' },
-            ),
-          }),
-      }).listQueueConsumers(account, queue)),
-    ];
-
-    await uninstallPlatform(fake, manifest, purgeResourcesArgs, dependencies());
-
-    expect(fake.live.consumers.get('cron-id')).toEqual([]);
-    expect(fake.live.consumers.get('usage-id')).toEqual([
-      { id: 'foreign-consumer', script: 'someone-else' },
-    ]);
-    expect(fake.calls).toContain('DELETE queue-consumer cron-id cron-consumer');
-    expect(fake.calls).toContain('DELETE queue-consumer usage-id usage-consumer');
-    expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
-  });
-
   it('resumes after a failure without repeating finished deletions', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.failures.set(`DELETE queue ${names.usageQueue}`, new Error('temporary failure'));
 
@@ -821,30 +769,44 @@ describe('uninstall --purge-resources', () => {
     expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
   });
 
-  it('resumes an R2 deletion after its ownership marker was removed', async () => {
-    const manifest = installedManifest();
-    persist(manifest);
-    const fake = cloudflare(manifest);
-    fake.failures.set(`DELETE r2-bucket ${names.assetsBucket}`, new Error('temporary failure'));
+  it.each([
+    { bucket: 'with a creation fingerprint', legacy: false },
+    { bucket: 'recorded before creation fingerprints', legacy: true },
+  ])(
+    'resumes an R2 deletion after its ownership marker was removed, for a bucket $bucket',
+    async ({ legacy }) => {
+      let manifest = installedManifest();
+      if (legacy) {
+        const bucket = manifest.resources.find((resource) => resource.kind === 'r2-bucket')!;
+        manifest = recordInstallationResource(
+          manifest,
+          { ...bucket, configHash: hash({ kind: 'r2-bucket', name: bucket.name }) },
+          manifest.updatedAt,
+        );
+      }
+      persistInstallation(manifest, directories);
+      const fake = cloudflare(manifest);
+      fake.failures.set(`DELETE r2-bucket ${names.assetsBucket}`, new Error('temporary failure'));
 
-    await expect(
-      uninstallPlatform(fake, manifest, purgeResourcesArgs, dependencies()),
-    ).rejects.toThrow('temporary failure');
-    expect(fake.live.buckets.get(names.assetsBucket)?.objects.size).toBe(0);
+      await expect(
+        uninstallPlatform(fake, manifest, purgeResourcesArgs, dependencies()),
+      ).rejects.toThrow('temporary failure');
+      expect(fake.live.buckets.get(names.assetsBucket)?.objects.size).toBe(0);
 
-    await uninstallPlatform(
-      fake,
-      listInstallationManifests()[0]!,
-      purgeResourcesArgs,
-      dependencies(),
-    );
-    expect(fake.live.buckets.has(names.assetsBucket)).toBe(false);
-    expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
-  });
+      await uninstallPlatform(
+        fake,
+        listInstallationManifests()[0]!,
+        purgeResourcesArgs,
+        dependencies(),
+      );
+      expect(fake.live.buckets.has(names.assetsBucket)).toBe(false);
+      expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
+    },
+  );
 
   it('refuses an R2 bucket replaced after its ownership marker was removed', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.failures.set(`DELETE r2-bucket ${names.assetsBucket}`, new Error('temporary failure'));
     await expect(
@@ -863,12 +825,12 @@ describe('uninstall --purge-resources', () => {
 
   it('refuses before any change when a Worker no longer carries this installation marker', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     const replacement = { ...manifest, ownershipNonce: 'replacement-owner-nonce-00000000' };
     fake.live.workers.set(
       names.proxyWorker,
-      marker(
+      ownershipMarker(
         replacement,
         manifest.resources.find((resource) => resource.key === 'proxy-worker')!,
       ),
@@ -883,7 +845,7 @@ describe('uninstall --purge-resources', () => {
 
   it('keeps a route that now serves another Worker, lists why, and does not let it block a rerun', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.live.routes[1]!.script = 'someone-else';
     // A later, unrelated stop makes the run resume.
@@ -913,7 +875,7 @@ describe('uninstall --purge-resources', () => {
 
   it('keeps a custom domain that now serves another Worker and continues', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.live.domains[0]!.service = 'someone-else';
 
@@ -929,7 +891,7 @@ describe('uninstall --purge-resources', () => {
 
   it('keeps a DNS record whose configuration changed and continues', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.listDnsRecords = async (_zone: string, name: string) =>
       fake.live.dns
@@ -952,7 +914,7 @@ describe('uninstall --purge-resources', () => {
 
   it('keeps an Access application whose name changed and continues', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.live.access.set('access-app', { accountId: 'account', name: 'renamed' });
 
@@ -969,7 +931,7 @@ describe('uninstall --purge-resources', () => {
 
   it('detaches Email Routing rules that send mail to the gateway Worker before deleting it', async () => {
     const manifest = installedManifest({ email: true });
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     const gateway = names.emailGatewayWorker;
     fake.live.emailRules.push(
@@ -1004,7 +966,7 @@ describe('uninstall --purge-resources', () => {
 
   it('leaves an Email Routing catch-all that sends mail to another Worker', async () => {
     const manifest = installedManifest({ email: true });
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.live.catchAll = { enabled: true, workerName: 'someone-else' };
 
@@ -1017,7 +979,7 @@ describe('uninstall --purge-resources', () => {
 
   it('names the Email Routing permission when the credential cannot read the rules', async () => {
     const manifest = installedManifest({ email: true });
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.listEmailRoutingRules = async () => {
       throw new PlatformCloudflareApiError('Authentication error', 403);
@@ -1033,7 +995,7 @@ describe('uninstall --purge-resources', () => {
 
   it('makes no Email Routing call when the platform does not send email', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
 
     await uninstallPlatform(fake, manifest, { ...purgeResourcesArgs, plan: true }, dependencies());
@@ -1045,7 +1007,7 @@ describe('uninstall --purge-resources', () => {
 
   it('finishes with --purge-resources what a stopped --purge-data uninstall kept', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
 
     // The namespace still holds an application Worker, so --purge-data stops.
@@ -1077,24 +1039,10 @@ describe('uninstall --purge-resources', () => {
 
   it('finishes with --purge-resources what a stopped plain uninstall kept, including routing KV', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
-    const putKvValue = fake.putKvValue;
-    let failed = false;
-    // Stop at the last write, after every resource was recorded as kept.
-    fake.putKvValue = async (account: string, namespace: string, key: string, value: string) => {
-      if (!failed && value.includes('"status":"uninstalled"')) {
-        failed = true;
-        throw new Error('checkpoint write failed');
-      }
-      return putKvValue(account, namespace, key, value);
-    };
-    const plain = { ...purgeResourcesArgs, purgeResources: false, purgeData: false };
 
-    await expect(uninstallPlatform(fake, manifest, plain, dependencies())).rejects.toThrow(
-      'checkpoint write failed',
-    );
-    const stopped = listInstallationManifests()[0]!;
+    const stopped = await stopPlainUninstallAtLastWrite(fake, manifest);
     expect(stopped.status).toBe('failed');
     expect(stopped.resources.find((resource) => resource.key === 'routing-kv')?.state).toBe(
       'retained',
@@ -1109,34 +1057,16 @@ describe('uninstall --purge-resources', () => {
 
   it('refuses before any change when a Worker a stopped uninstall kept no longer carries this installation marker', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
-    const putKvValue = fake.putKvValue;
-    let failed = false;
-    // Stop at the last write, after every resource was recorded as kept.
-    fake.putKvValue = async (account: string, namespace: string, key: string, value: string) => {
-      if (!failed && value.includes('"status":"uninstalled"')) {
-        failed = true;
-        throw new Error('checkpoint write failed');
-      }
-      return putKvValue(account, namespace, key, value);
-    };
-    await expect(
-      uninstallPlatform(
-        fake,
-        manifest,
-        { ...purgeResourcesArgs, purgeResources: false, purgeData: false },
-        dependencies(),
-      ),
-    ).rejects.toThrow('checkpoint write failed');
-    const stopped = listInstallationManifests()[0]!;
+    const stopped = await stopPlainUninstallAtLastWrite(fake, manifest);
     expect(stopped.resources.find((resource) => resource.key === 'proxy-worker')?.state).toBe(
       'retained',
     );
     const replacement = { ...manifest, ownershipNonce: 'replacement-owner-nonce-00000000' };
     fake.live.workers.set(
       names.proxyWorker,
-      marker(
+      ownershipMarker(
         replacement,
         manifest.resources.find((resource) => resource.key === 'proxy-worker')!,
       ),
@@ -1157,7 +1087,7 @@ describe('uninstall --purge-resources', () => {
 
   it('lists an Access resource an earlier --purge-resources kept with the other kept resources, not as connected', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.live.access.set('access-app', { accountId: 'account', name: 'renamed' });
     // A later, unrelated stop makes the run resume.
@@ -1184,7 +1114,7 @@ describe('uninstall --purge-resources', () => {
 
   it('never reopens an uninstall that finished', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     await uninstallPlatform(
       fake,
@@ -1208,7 +1138,7 @@ describe('uninstall --purge-resources', () => {
 
   it('never forces a Worker that a Worker outside the installation binds to, and names it', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.live.foreignWorkers.add('customer-worker');
     fake.live.serviceBindings.push({ from: 'customer-worker', to: names.proxyWorker as string });
@@ -1240,7 +1170,7 @@ describe('uninstall --purge-resources', () => {
 
   it('never forces a Worker whose dependent has a recorded name but is not proven to be the installation’s', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     // While the run is going, another Worker takes the API Worker's name and
     // still binds to the proxy.
@@ -1250,7 +1180,7 @@ describe('uninstall --purge-resources', () => {
       if (args[1].name === names.proxyWorker) {
         fake.live.workers.set(
           names.apiWorker as string,
-          marker(
+          ownershipMarker(
             replacement,
             manifest.resources.find((resource) => resource.key === 'api-worker')!,
           ),
@@ -1274,7 +1204,7 @@ describe('uninstall --purge-resources', () => {
         resource.key === 'api-worker' ? { ...resource, state: 'deleted' as const } : resource,
       ),
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(recorded);
 
     const error = await uninstallPlatform(fake, manifest, purgeResourcesArgs, dependencies()).catch(
@@ -1289,7 +1219,7 @@ describe('uninstall --purge-resources', () => {
 
   it('never forces a Worker when Cloudflare cannot list what depends on it', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.listWorkerDependents = async () => {
       throw new PlatformCloudflareApiError('Authentication error (code 10000)', 403);
@@ -1305,7 +1235,7 @@ describe('uninstall --purge-resources', () => {
 
   it('stops with a clear message when Cloudflare refuses the tail Worker, and never forces it', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.live.foreignTailProducer = true;
 
@@ -1335,7 +1265,7 @@ describe('uninstall --purge-resources', () => {
 
   it('refuses before any change while projects remain, in the plan too', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     const withProjects = dependencies({ readProjects: async () => ['blog', 'shop'] });
     const message = [
@@ -1384,7 +1314,7 @@ describe('uninstall --purge-resources', () => {
 
   it('refuses browser login before any change and names the token permissions', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     const oauth = dependencies({ credential: { source: 'oauth', aiGatewayToken: true } });
 
@@ -1404,7 +1334,7 @@ describe('uninstall --purge-resources', () => {
 
   it('names a token permission that a read probe shows is missing', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     fake.listDnsRecords = async () => {
       throw new PlatformCloudflareApiError('Authentication error', 403);
@@ -1420,7 +1350,7 @@ describe('uninstall --purge-resources', () => {
 
   it('makes no Workers for Platforms call when the installation has no dispatch namespace', async () => {
     const manifest = installedManifest({ dispatchNamespace: false });
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
 
     await uninstallPlatform(fake, manifest, { ...purgeResourcesArgs, plan: true }, dependencies());
@@ -1438,7 +1368,7 @@ describe('uninstall --purge-resources', () => {
         resource.key === 'service-token' ? { ...resource, accountId: 'identity' } : resource,
       ),
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
 
     await uninstallPlatform(fake, manifest, purgeResourcesArgs, dependencies());
@@ -1455,7 +1385,7 @@ describe('uninstall --purge-resources', () => {
         resource.key === 'service-token' ? { ...resource, accountId: 'identity' } : resource,
       ),
     };
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     const getAccessResource = fake.getAccessResource;
     fake.getAccessResource = async (account: string, kind: string, id: string) => {
@@ -1475,7 +1405,7 @@ describe('uninstall --purge-resources', () => {
 
   it('keeps an AI Gateway that Cloudflare shows was not created during installation', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     // Someone deleted the original gateway and made a new one with the same id.
     fake.live.aiGateways[0]!.createdAt = '2026-10-01T00:00:00.000Z';
@@ -1494,7 +1424,7 @@ describe('uninstall --purge-resources', () => {
 
   it('keeps an AI Gateway whose creation time Cloudflare does not report', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     delete fake.live.aiGateways[0]!.createdAt;
 
@@ -1506,7 +1436,7 @@ describe('uninstall --purge-resources', () => {
 
   it('stops before deleting application Workers when a project appears during the run', async () => {
     const manifest = installedManifest();
-    persist(manifest);
+    persistInstallation(manifest, directories);
     const fake = cloudflare(manifest);
     let reads = 0;
     // Both checks before the first change see no project; one is created after.
@@ -1521,31 +1451,4 @@ describe('uninstall --purge-resources', () => {
     expect(fake.live.namespaceScripts.has('leftover-app')).toBe(true);
     expect(listInstallationManifests()[0]?.status).toBe('failed');
   });
-
-  it('resumes an R2 deletion for a bucket recorded before creation fingerprints', async () => {
-    let manifest = installedManifest();
-    const bucket = manifest.resources.find((resource) => resource.kind === 'r2-bucket')!;
-    manifest = recordInstallationResource(
-      manifest,
-      { ...bucket, configHash: hash({ kind: 'r2-bucket', name: bucket.name }) },
-      manifest.updatedAt,
-    );
-    persist(manifest);
-    const fake = cloudflare(manifest);
-    fake.failures.set(`DELETE r2-bucket ${names.assetsBucket}`, new Error('temporary failure'));
-
-    await expect(
-      uninstallPlatform(fake, manifest, purgeResourcesArgs, dependencies()),
-    ).rejects.toThrow('temporary failure');
-    expect(fake.live.buckets.get(names.assetsBucket)?.objects.size).toBe(0);
-
-    await uninstallPlatform(
-      fake,
-      listInstallationManifests()[0]!,
-      purgeResourcesArgs,
-      dependencies(),
-    );
-    expect(fake.live.buckets.has(names.assetsBucket)).toBe(false);
-    expect(listInstallationManifests()[0]?.status).toBe('uninstalled');
-  });
 });
diff --git a/packages/void/test/unit/platform-traffic.test.ts b/packages/void/test/unit/platform-traffic.test.ts
index f9d88f192..ab810d6fb 100644
--- a/packages/void/test/unit/platform-traffic.test.ts
+++ b/packages/void/test/unit/platform-traffic.test.ts
@@ -3,13 +3,10 @@ import {
   createPlatformInstallationManifest,
 } from '@void/platform';
 import { describe, expect, it } from 'vite-plus/test';
-import {
-  recordPlatformWorkerTraffic,
-  trackedPlatformWorkerTraffic,
-} from '../../src/cli/platform-traffic.ts';
+import { recordPlatformWorkerTraffic } from '../../src/cli/platform-traffic.ts';
 
 describe('platform traffic checkpoints', () => {
-  it('records observed traffic as retained but never schedules unattended deletion', () => {
+  it('records observed traffic as retained', () => {
     const deployment = createPlatformDeploymentManifest({
       application: { baseDomain: 'apps.example.com', zoneName: 'example.com' },
       controlPlane: { apiHostname: 'api.example.com' },
@@ -76,7 +73,6 @@ describe('platform traffic checkpoints', () => {
       { id: 'route-one', ownership: 'external', state: 'retained' },
       { id: 'route-two', ownership: 'external', state: 'retained' },
     ]);
-    expect(trackedPlatformWorkerTraffic(manifest)).toEqual({ customDomains: [], routes: [] });
   });
 
   it('fails closed when published traffic is ambiguous or missing', () => {
diff --git a/packages/void/test/unit/platform-worker-reuse.test.ts b/packages/void/test/unit/platform-worker-reuse.test.ts
index e9382b65b..f9db9e4ad 100644
--- a/packages/void/test/unit/platform-worker-reuse.test.ts
+++ b/packages/void/test/unit/platform-worker-reuse.test.ts
@@ -11,7 +11,7 @@ import { expect, it, vi } from 'vite-plus/test';
 import {
   deployPlatformWorker,
   platformWorkerUploadFingerprint,
-} from '../../src/cli/platform-installer.ts';
+} from '../../src/cli/platform-installer-workers.ts';
 
 const VERSION = '11111111-1111-4111-8111-111111111111';
 
@@ -200,7 +200,6 @@ async function attemptReuse(input: {
       previousPublicEndpoints: true,
       publishCustomDomains: async () => {},
       publishRoutes: async () => {},
-      removeCustomDomains: async () => {},
       retainNewWorker,
       runner,
       workerExisted: true,
diff --git a/packages/void/test/unit/platform-worker-upload-contract.test.ts b/packages/void/test/unit/platform-worker-upload-contract.test.ts
index 2dfd0fd29..3b9a02d9d 100644
--- a/packages/void/test/unit/platform-worker-upload-contract.test.ts
+++ b/packages/void/test/unit/platform-worker-upload-contract.test.ts
@@ -7,131 +7,21 @@ import { join } from 'node:path';
 import { toSlash } from 'pathslash';
 import { expect, it } from 'vite-plus/test';
 import { encodeCloudflareOperation } from '../../src/cli/cloudflare-process.ts';
-import { withConditionalPlatformWorkerCreate } from '../../src/cli/platform-installer.ts';
+import { withConditionalPlatformWorkerCreate } from '../../src/cli/platform-installer-process.ts';
 import { resolveCloudflareOperationArgv } from '../../src/cli/preset.ts';
 
-it('accepts the bundled uploader query while preserving the create-only precondition', async () => {
-  const directory = mkdtempSync(join(tmpdir(), 'void-worker-upload-contract-'));
-  const uploads: Array<{ url: string; precondition: string | undefined }> = [];
-  const requests: Array<string> = [];
-  // This is a local fake API. A synthetic credential and isolated config ensure
-  // this contract test cannot deploy to any real Cloudflare account.
-  const server = createServer((request, response) => {
-    const url = request.url ?? '';
-    requests.push(`${request.method} ${url}`);
-    response.setHeader('Content-Type', 'application/json');
-    if (request.method === 'PUT') {
-      uploads.push({ url, precondition: request.headers['if-none-match'] });
-      request.resume();
-      response.writeHead(412);
-      response.end(
-        JSON.stringify({
-          success: false,
-          errors: [{ code: 1000, message: 'Simulated concurrent creation.' }],
-        }),
-      );
-    } else if (url.endsWith('/workers/subdomain')) {
-      response.end(JSON.stringify({ success: true, result: { subdomain: 'test' } }));
-    } else {
-      response.writeHead(404);
-      response.end(
-        JSON.stringify({ success: false, errors: [{ code: 10007, message: 'Worker not found.' }] }),
-      );
-    }
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const origin = `http://127.0.0.1:${(server.address() as AddressInfo).port}/client/v4`;
-  try {
-    writeFileSync(
-      join(directory, 'worker.mjs'),
-      'export default { fetch() { return new Response("local test"); } };',
-    );
-    const config = join(directory, 'wrangler.json');
-    writeFileSync(
-      config,
-      JSON.stringify({
-        name: 'void-contract',
-        account_id: 'account',
-        main: 'worker.mjs',
-        compatibility_date: '2026-02-24',
-        workers_dev: false,
-        preview_urls: false,
-        no_bundle: true,
-      }),
-    );
-    const [command, ...prefix] = resolveCloudflareOperationArgv(process.cwd());
-    let output = '';
-    const failure = await withConditionalPlatformWorkerCreate(
-      'account',
-      'void-contract',
-      async (apiBase) => {
-        await new Promise<void>((resolve) => {
-          const child = execFile(
-            command!,
-            [
-              ...prefix,
-              ...encodeCloudflareOperation({ type: 'worker.deploy', configPath: config }),
-            ],
-            {
-              cwd: directory,
-              encoding: 'utf8',
-              timeout: 20_000,
-              maxBuffer: 1024 * 1024,
-              env: {
-                PATH: process.env.PATH,
-                SYSTEMROOT: process.env.SYSTEMROOT,
-                WINDIR: process.env.WINDIR,
-                TMP: process.env.TMP,
-                TEMP: process.env.TEMP,
-                CI: 'true',
-                CLOUDFLARE_API_TOKEN: 'synthetic-token',
-                CLOUDFLARE_API_BASE_URL: apiBase,
-                WRANGLER_SEND_METRICS: 'false',
-                WRANGLER_LOG_PATH: join(directory, 'logs'),
-              },
-            },
-            (_error, stdout, stderr) => {
-              output = stdout + stderr;
-              resolve();
-            },
-          );
-          child.stdin?.end();
-        });
-      },
-      origin,
-    ).catch((error: unknown) => error);
-    expect(String(failure), output + '\n' + requests.join('\n')).toContain(
-      'created concurrently (HTTP 412)',
-    );
-    expect(uploads).toHaveLength(1);
-    const url = new URL(uploads[0]!.url, origin);
-    expect(url.pathname).toBe('/client/v4/accounts/account/workers/scripts/void-contract');
-    expect(Object.fromEntries(url.searchParams)).toEqual({
-      excludeScript: 'true',
-      bindings_inherit: 'strict',
-    });
-    expect(uploads[0]!.precondition).toBe('*');
-  } finally {
-    await new Promise<void>((resolve, reject) => {
-      server.close((error) => (error ? reject(error) : resolve()));
-      server.closeAllConnections();
-    });
-    rmSync(directory, { recursive: true, force: true });
-  }
-}, 30_000);
-
 function unsignedJwt(payload: Record<string, unknown>): string {
   const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString('base64url');
   return `${encode({ alg: 'none' })}.${encode(payload)}.signature`;
 }
 
-it.each([false, true])(
-  'uploads static assets before the guarded create of a new Worker (single-file uploads: %s)',
-  async (singleAssetUploads) => {
-    const directory = mkdtempSync(join(tmpdir(), 'void-worker-assets-contract-'));
+it.each(['none', 'batch', 'single-file'] as const)(
+  'keeps the create-only precondition on the bundled uploader query (assets: %s)',
+  async (assets) => {
+    const directory = mkdtempSync(join(tmpdir(), 'void-worker-upload-contract-'));
     const sessionJwt = unsignedJwt({
       exp: Math.floor(Date.now() / 1000) + 3600,
-      ...(singleAssetUploads ? { wrangler_single_asset_uploads: true } : {}),
+      ...(assets === 'single-file' ? { wrangler_single_asset_uploads: true } : {}),
     });
     const completionJwt = unsignedJwt({ exp: Math.floor(Date.now() / 1000) + 3600, done: true });
     const requests: Array<{
@@ -181,6 +71,8 @@ it.each([false, true])(
               errors: [{ code: 1000, message: 'Simulated concurrent creation.' }],
             }),
           );
+        } else if (path.endsWith('/workers/subdomain')) {
+          response.end(JSON.stringify({ success: true, result: { subdomain: 'test' } }));
         } else {
           response.writeHead(404);
           response.end(
@@ -199,8 +91,10 @@ it.each([false, true])(
         join(directory, 'worker.mjs'),
         'export default { fetch() { return new Response("local test"); } };',
       );
-      mkdirSync(join(directory, 'public'));
-      writeFileSync(join(directory, 'public', 'client.js'), 'console.log("admin");');
+      if (assets !== 'none') {
+        mkdirSync(join(directory, 'public'));
+        writeFileSync(join(directory, 'public', 'client.js'), 'console.log("admin");');
+      }
       const config = join(directory, 'wrangler.json');
       writeFileSync(
         config,
@@ -212,10 +106,12 @@ it.each([false, true])(
           workers_dev: false,
           preview_urls: false,
           no_bundle: true,
-          assets: { directory: toSlash(join(directory, 'public')) },
+          ...(assets === 'none'
+            ? {}
+            : { assets: { directory: toSlash(join(directory, 'public')) } }),
         }),
       );
-      const [command, ...prefix] = resolveCloudflareOperationArgv(process.cwd());
+      const [command, ...prefix] = resolveCloudflareOperationArgv();
       let output = '';
       const failure = await withConditionalPlatformWorkerCreate(
         'account',
@@ -258,25 +154,38 @@ it.each([false, true])(
       ).catch((error: unknown) => error);
       const trace = output + '\n' + requests.map((entry) => entry.request).join('\n');
       expect(String(failure), trace).toContain('created concurrently (HTTP 412)');
-      const mutations = requests.filter((entry) => !entry.request.startsWith('GET '));
-      const hash = /upload\/([0-9a-f]{32})$/.exec(mutations[1]?.request ?? '')?.[1];
+      const create = {
+        request:
+          'PUT /client/v4/accounts/account/workers/scripts/void-contract?excludeScript=true&bindings_inherit=strict',
+        authorization: 'Bearer synthetic-token',
+        precondition: '*',
+      };
       expect(
-        mutations.map((entry) => entry.request),
+        requests.filter((entry) => !entry.request.startsWith('GET ')),
         trace,
-      ).toEqual([
-        'POST /client/v4/accounts/account/workers/scripts/void-contract/assets-upload-session',
-        singleAssetUploads
-          ? `POST /client/v4/accounts/account/workers/assets/upload/${hash}`
-          : 'POST /client/v4/accounts/account/workers/assets/upload?base64=true',
-        'PUT /client/v4/accounts/account/workers/scripts/void-contract?excludeScript=true&bindings_inherit=strict',
-      ]);
-      expect(mutations.map((entry) => entry.authorization)).toEqual([
-        'Bearer synthetic-token',
-        `Bearer ${sessionJwt}`,
-        'Bearer synthetic-token',
-      ]);
-      expect(mutations.map((entry) => entry.precondition)).toEqual([undefined, undefined, '*']);
-      expect(mutations[2]!.body).toContain(completionJwt);
+      ).toMatchObject(
+        assets === 'none'
+          ? [create]
+          : [
+              {
+                request:
+                  'POST /client/v4/accounts/account/workers/scripts/void-contract/assets-upload-session',
+                authorization: 'Bearer synthetic-token',
+                precondition: undefined,
+              },
+              {
+                request:
+                  assets === 'batch'
+                    ? 'POST /client/v4/accounts/account/workers/assets/upload?base64=true'
+                    : expect.stringMatching(
+                        /^POST \/client\/v4\/accounts\/account\/workers\/assets\/upload\/[0-9a-f]{32}$/,
+                      ),
+                authorization: `Bearer ${sessionJwt}`,
+                precondition: undefined,
+              },
+              { ...create, body: expect.stringContaining(completionJwt) },
+            ],
+      );
     } finally {
       await new Promise<void>((resolve, reject) => {
         server.close((error) => (error ? reject(error) : resolve()));
diff --git a/packages/void/test/unit/playground-snapshots.test.ts b/packages/void/test/unit/playground-snapshots.test.ts
deleted file mode 100644
index 7e5408310..000000000
--- a/packages/void/test/unit/playground-snapshots.test.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, expect, it, vi } from 'vite-plus/test';
-import { createIsolatedPlayground } from '../../../../test/integration-helpers.ts';
-
-let root: string;
-afterEach(() => {
-  vi.unstubAllEnvs();
-  if (root) {
-    rmSync(root, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
-  }
-});
-
-it('clones stable source snapshots while resolving dependencies from the actual workspace', () => {
-  root = mkdtempSync(join(tmpdir(), 'void-snapshot-test-'));
-  const source = join(root, 'playground/react-pages');
-  const snapshot = join(root, 'snapshots/playground/react-pages');
-  mkdirSync(join(source, 'node_modules'), { recursive: true });
-  mkdirSync(join(source, 'node_modules', 'fixture-dependency'));
-  writeFileSync(join(source, 'node_modules', 'fixture-dependency', 'index.js'), 'installed source');
-  mkdirSync(snapshot, { recursive: true });
-  for (const path of [source, snapshot]) {
-    writeFileSync(join(path, 'package.json'), JSON.stringify({ name: 'test-app' }));
-  }
-  writeFileSync(join(source, 'page.ts'), 'temporary HMR mutation');
-  writeFileSync(join(snapshot, 'page.ts'), 'original source');
-  vi.stubEnv('VOID_TEST_SOURCE_SNAPSHOTS', join(root, 'snapshots'));
-
-  const fixture = createIsolatedPlayground(root, 'playground/react-pages');
-  expect(readFileSync(join(fixture.root, 'page.ts'), 'utf8')).toBe('original source');
-  expect(realpathSync(join(fixture.root, 'node_modules', 'fixture-dependency'))).toBe(
-    realpathSync(join(source, 'node_modules', 'fixture-dependency')),
-  );
-  expect(readFileSync(join(source, 'page.ts'), 'utf8')).toBe('temporary HMR mutation');
-  fixture.cleanup();
-});
-
-it('uses current source outside the integration snapshot lifecycle', () => {
-  root = mkdtempSync(join(tmpdir(), 'void-snapshot-test-'));
-  const source = join(root, 'playground/test');
-  mkdirSync(source, { recursive: true });
-  writeFileSync(join(source, 'package.json'), JSON.stringify({ name: 'test-app' }));
-  writeFileSync(join(source, 'page.ts'), 'current source');
-  vi.stubEnv('VOID_TEST_SOURCE_SNAPSHOTS', undefined);
-  const fixture = createIsolatedPlayground(root, 'playground/test');
-  expect(readFileSync(join(fixture.root, 'page.ts'), 'utf8')).toBe('current source');
-  fixture.cleanup();
-});
diff --git a/packages/void/test/unit/plugin-ai-setup.test.ts b/packages/void/test/unit/plugin-ai-setup.test.ts
new file mode 100644
index 000000000..93652308e
--- /dev/null
+++ b/packages/void/test/unit/plugin-ai-setup.test.ts
@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vite-plus/test';
+import { resolveWorkersAiBindingName, shouldBindWorkersAi } from '../../src/plugin-ai-setup.ts';
+
+describe('shouldBindWorkersAi', () => {
+  it("does not override a user's root-wrangler `ai` binding", () => {
+    expect(shouldBindWorkersAi('build', true, { binding: 'X' }, undefined)).toBe(false);
+  });
+});
+
+describe('resolveWorkersAiBindingName', () => {
+  it('uses a custom inference binding name', () => {
+    expect(resolveWorkersAiBindingName(undefined, 'MY_AI')).toBe('MY_AI');
+  });
+
+  it('preserves a root Wrangler binding over the inference name', () => {
+    expect(resolveWorkersAiBindingName({ binding: 'ROOT_AI' }, 'MY_AI')).toBe('ROOT_AI');
+  });
+});
diff --git a/packages/void/test/unit/plugin-binding-runtime.test.ts b/packages/void/test/unit/plugin-binding-runtime.test.ts
index 3a9fdc435..684b9afa0 100644
--- a/packages/void/test/unit/plugin-binding-runtime.test.ts
+++ b/packages/void/test/unit/plugin-binding-runtime.test.ts
@@ -1,15 +1,6 @@
 import { describe, expect, it } from 'vite-plus/test';
 import { bindingRuntimePlugin } from '../../src/plugin-binding-runtime.ts';
-
-function getHookHandler<T>(hook: T | { handler: T } | undefined): T {
-  if (typeof hook === 'function') {
-    return hook;
-  }
-  if (hook && typeof hook === 'object' && 'handler' in hook) {
-    return hook.handler;
-  }
-  throw new Error('Expected Vite hook handler.');
-}
+import { getHookHandler } from '../helpers/vite-hooks.ts';
 
 describe('bindingRuntimePlugin', () => {
   it('uses custom binding names in KV and R2 runtime helpers', () => {
diff --git a/packages/void/test/unit/plugin-class-a-wrapper.test.ts b/packages/void/test/unit/plugin-class-a-wrapper.test.ts
index 00ef3d397..17859bbe3 100644
--- a/packages/void/test/unit/plugin-class-a-wrapper.test.ts
+++ b/packages/void/test/unit/plugin-class-a-wrapper.test.ts
@@ -6,15 +6,7 @@ import { pathToFileURL } from 'node:url';
 import type { Plugin, ResolvedConfig } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 
-type MockCloudflarePluginConfig = {
-  config: (resolved: Record<string, unknown>) => Record<string, unknown>;
-};
-
-vi.mock('@cloudflare/vite-plugin', () => ({
-  cloudflare(pluginConfig: MockCloudflarePluginConfig): Array<Plugin> {
-    return [{ name: 'mock:cloudflare', api: { pluginConfig } } as Plugin];
-  },
-}));
+vi.mock('@cloudflare/vite-plugin', () => import('../helpers/cloudflare-vite-plugin.ts'));
 
 const roots: Array<string> = [];
 
@@ -50,62 +42,44 @@ function callConfigResolved(plugin: Plugin, config: Partial<ResolvedConfig>) {
 afterEach(() => {
   vi.restoreAllMocks();
   vi.resetModules();
+  vi.unstubAllEnvs();
   while (roots.length > 0) {
     rmSync(roots.pop()!, { recursive: true, force: true });
   }
 });
 
 describe('Class A framework build wrapper', () => {
-  it('falls through framework 404 responses to ASSETS for uploaded client assets', async () => {
-    const root = createTanStackRoot();
-    vi.spyOn(process, 'cwd').mockReturnValue(root);
-
-    const { voidPlugin } = await import('../../src/index.ts');
-    const plugins = voidPlugin();
-    const wrapperPlugin = plugins.find((plugin) => plugin.name === 'void:framework-build-wrapper');
-    if (!wrapperPlugin) {
-      throw new Error('Expected Class A wrapper plugin.');
-    }
-
-    callConfigResolved(wrapperPlugin, {
-      command: 'build',
-      build: { assetsDir: 'static' } as ResolvedConfig['build'],
-    } as Partial<ResolvedConfig>);
-
-    const code = readFileSync(join(root, '.void', 'tanstack-start-trigger-wrapper.ts'), 'utf-8');
-    expect(code).toContain('return serveWithAssets(request, env, await original.fetch');
-    expect(code).toContain('import { createAssetFallback as __createAssetFallback }');
-    expect(code).toContain(
-      'const serveWithAssets = __createAssetFallback({"assetsDir":"static","serveSpaFallback":false,"notFound":"none"});',
-    );
-  });
-
-  // A Class A app deploys through `runFullDeploy`, which DOES honor
-  // `routing.notFound` when it builds the wrangler asset config. This wrapper is
-  // the code that then sits in front of the asset binding, so it has to agree —
-  // otherwise it fetches the generator's `404.html` and throws it away.
-  it('honors routing.notFound: 404-page in the generated wrapper', async () => {
-    const root = createTanStackRoot({ routing: { notFound: '404-page' } });
-    vi.spyOn(process, 'cwd').mockReturnValue(root);
-
-    const { voidPlugin } = await import('../../src/index.ts');
-    const plugins = voidPlugin();
-    const wrapperPlugin = plugins.find((plugin) => plugin.name === 'void:framework-build-wrapper');
-    if (!wrapperPlugin) {
-      throw new Error('Expected Class A wrapper plugin.');
-    }
-
-    callConfigResolved(wrapperPlugin, {
-      command: 'build',
-      build: { assetsDir: 'static' } as ResolvedConfig['build'],
-    } as Partial<ResolvedConfig>);
+  it.each([
+    [undefined, 'none'],
+    ['404-page', '404-page'],
+  ] as const)(
+    'falls through framework 404s to ASSETS with routing.notFound %s',
+    async (notFound, expected) => {
+      const root = createTanStackRoot(notFound ? { routing: { notFound } } : undefined);
+      vi.spyOn(process, 'cwd').mockReturnValue(root);
+
+      const { voidPlugin } = await import('../../src/index.ts');
+      const plugins = voidPlugin();
+      const wrapperPlugin = plugins.find(
+        (plugin) => plugin.name === 'void:framework-build-wrapper',
+      );
+      if (!wrapperPlugin) {
+        throw new Error('Expected Class A wrapper plugin.');
+      }
 
-    const code = readFileSync(join(root, '.void', 'tanstack-start-trigger-wrapper.ts'), 'utf-8');
-    expect(code).toContain('return serveWithAssets(request, env, await original.fetch');
-    expect(code).toContain(
-      'const serveWithAssets = __createAssetFallback({"assetsDir":"static","serveSpaFallback":false,"notFound":"404-page"});',
-    );
-  });
+      callConfigResolved(wrapperPlugin, {
+        command: 'build',
+        build: { assetsDir: 'static' } as ResolvedConfig['build'],
+      } as Partial<ResolvedConfig>);
+
+      const code = readFileSync(join(root, '.void', 'tanstack-start-trigger-wrapper.ts'), 'utf-8');
+      expect(code).toContain('return serveWithAssets(request, env, await original.fetch');
+      expect(code).toContain('import { createAssetFallback as __createAssetFallback }');
+      expect(code).toContain(
+        `const serveWithAssets = __createAssetFallback({"assetsDir":"static","serveSpaFallback":false,"notFound":"${expected}"});`,
+      );
+    },
+  );
 });
 
 describe('Class A framework dev wrapper', () => {
@@ -146,18 +120,6 @@ describe('Class A framework dev wrapper', () => {
   });
 });
 
-// `routing.notFound` reaches a Class A worker only through the DEPLOYED script's
-// `assets` config, and Void writes none for these frameworks. Managed
-// `void deploy` supplies it out-of-band (`manifest.assetConfig`) and marks the
-// build child with `VOID_DEPLOY_BUILD`; every other build is a self-hosted
-// `vite build && wrangler deploy`, which has to be told that Void generated
-// nothing instead of having the setting dropped silently.
-//
-// The warning must NOT say the setting does nothing. The generated wrapper
-// consumes `routing.notFound` and serves through `env.ASSETS`, and
-// `mergeBindings` leaves a Class A root wrangler `assets` block untouched, so a
-// user who writes a complete policy themselves has a WORKING config and must
-// not be told otherwise.
 describe('Class A routing.notFound self-host warning', () => {
   /** Run a Class A `build` twice and return every line the plugin logged. */
   async function buildTwiceWithNotFound(): Promise<Array<string>> {
@@ -195,34 +157,14 @@ describe('Class A routing.notFound self-host warning', () => {
     expect(warnings[0]).toContain('tanstack-start');
     expect(warnings[0]).toContain('direct Cloudflare deployment');
     expect(warnings[0]).toContain('void deploy');
-  });
-
-  // Guards the correction from PR review: an earlier draft told every self-host
-  // build the setting was "inert", which is false for anyone who declares their
-  // own complete `assets` policy — Void leaves that policy alone and the wrapper
-  // honors it.
-  it('does not claim the setting is inert, and names the config that makes it work', async () => {
-    const [warning] = notFoundWarnings(await buildTwiceWithNotFound());
-
-    expect(warning).toBeDefined();
-    expect(warning).not.toMatch(/\binert\b/);
     for (const field of ['binding', 'directory', 'not_found_handling', 'run_worker_first']) {
-      expect(warning).toContain(field);
+      expect(warnings[0]).toContain(field);
     }
   });
 
   it('stays quiet when a managed `void deploy` drives the build', async () => {
-    const previous = process.env.VOID_DEPLOY_BUILD;
-    process.env.VOID_DEPLOY_BUILD = '1';
-    try {
-      expect(notFoundWarnings(await buildTwiceWithNotFound())).toEqual([]);
-    } finally {
-      if (previous === undefined) {
-        delete process.env.VOID_DEPLOY_BUILD;
-      } else {
-        process.env.VOID_DEPLOY_BUILD = previous;
-      }
-    }
+    vi.stubEnv('VOID_DEPLOY_BUILD', '1');
+    expect(notFoundWarnings(await buildTwiceWithNotFound())).toEqual([]);
   });
 
   it('says nothing when routing.notFound is unset', async () => {
diff --git a/packages/void/test/unit/plugin-database-bindings.test.ts b/packages/void/test/unit/plugin-database-bindings.test.ts
index ba4d15179..743d1c21c 100644
--- a/packages/void/test/unit/plugin-database-bindings.test.ts
+++ b/packages/void/test/unit/plugin-database-bindings.test.ts
@@ -1,18 +1,14 @@
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import type { Plugin, ResolvedConfig } from 'vite';
+import type { ResolvedConfig } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 
 type MockCloudflarePluginConfig = {
   config: (resolved: Record<string, unknown>) => Record<string, unknown>;
 };
 
-vi.mock('@cloudflare/vite-plugin', () => ({
-  cloudflare(pluginConfig: MockCloudflarePluginConfig): Array<Plugin> {
-    return [{ name: 'mock:cloudflare', api: { pluginConfig } } as Plugin];
-  },
-}));
+vi.mock('@cloudflare/vite-plugin', () => import('../helpers/cloudflare-vite-plugin.ts'));
 
 const roots: Array<string> = [];
 
diff --git a/packages/void/test/unit/plugin-dev-asset-routing.test.ts b/packages/void/test/unit/plugin-dev-asset-routing.test.ts
index 1c28ac026..f213f480c 100644
--- a/packages/void/test/unit/plugin-dev-asset-routing.test.ts
+++ b/packages/void/test/unit/plugin-dev-asset-routing.test.ts
@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import type { Plugin } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
+import { getHookHandler } from '../helpers/vite-hooks.ts';
 
 type MockCloudflarePluginConfig = {
   config: (resolved: Record<string, unknown>) => Record<string, unknown>;
@@ -15,16 +16,7 @@ type MockCloudflarePlugin = Plugin & {
   };
 };
 
-vi.mock('@cloudflare/vite-plugin', () => ({
-  cloudflare(pluginConfig: MockCloudflarePluginConfig): Array<MockCloudflarePlugin> {
-    return [
-      {
-        name: 'mock:cloudflare',
-        api: { pluginConfig },
-      },
-    ];
-  },
-}));
+vi.mock('@cloudflare/vite-plugin', () => import('../helpers/cloudflare-vite-plugin.ts'));
 
 const tempDirs: Array<string> = [];
 
@@ -186,16 +178,6 @@ function createDocumentRouteProjectRoot(): string {
   return root;
 }
 
-function getHookHandler<T>(hook: T | { handler: T } | undefined): T {
-  if (typeof hook === 'function') {
-    return hook;
-  }
-  if (hook && typeof hook === 'object' && 'handler' in hook) {
-    return hook.handler;
-  }
-  throw new Error('Expected Vite hook handler.');
-}
-
 afterEach(() => {
   while (tempDirs.length > 0) {
     rmSync(tempDirs.pop()!, { recursive: true, force: true });
@@ -261,12 +243,22 @@ describe('voidPlugin dev asset routing', () => {
     root: string,
     resolved: Record<string, unknown> = {},
     configEnv: import('vite').ConfigEnv = { command: 'serve', mode: 'development' },
+    { envSchema = false }: { envSchema?: boolean } = {},
   ): Promise<Record<string, unknown>> {
     vi.spyOn(process, 'cwd').mockReturnValue(root);
 
     const { voidPlugin } = await import('../../src/index.ts');
     const plugins = voidPlugin();
 
+    if (envSchema) {
+      const schemaPlugin = plugins.find((plugin) => plugin.name === 'void:env-schema');
+      const schemaConfig = getHookHandler(schemaPlugin?.config) as (
+        config: import('vite').UserConfig,
+        env: import('vite').ConfigEnv,
+      ) => Promise<void>;
+      await schemaConfig({}, configEnv);
+    }
+
     const envPlugin = plugins.find((plugin) => plugin.name === 'void:env');
     const config = getHookHandler(envPlugin?.config) as (
       config: import('vite').UserConfig,
@@ -310,27 +302,43 @@ describe('voidPlugin dev asset routing', () => {
     expect(assets?.not_found_handling).toBe('none');
   });
 
-  it('keeps API-only projects on the static SPA fallback while routing API requests to the worker', async () => {
-    const root = createApiOnlyProjectRoot();
-    const assets = await resolveVoidPluginAssets(root, {
-      assets: {
-        binding: 'ASSETS',
-        not_found_handling: 'none',
-        run_worker_first: ['/', '/*.html'],
+  it.each([
+    ['API-only projects', createApiOnlyProjectRoot, undefined],
+    ['a dev-only API route in dev', createDevOnlyApiProjectRoot, undefined],
+    [
+      'a prod-only API route in a preview run',
+      () => {
+        const root = createProjectRoot();
+        mkdirSync(join(root, 'routes/api'), { recursive: true });
+        writeFileSync(
+          join(root, 'routes/api/health.prod.ts'),
+          'export const GET = () => Response.json({});',
+        );
+        return root;
       },
-    });
-
-    expect(assets?.not_found_handling).toBe('single-page-application');
-    expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
-  });
-
-  it('routes API requests to the worker in dev when the only route is dev-only', async () => {
-    const root = createDevOnlyApiProjectRoot();
-    const assets = await resolveVoidPluginAssets(root);
+      { command: 'serve', mode: 'production', isPreview: true },
+    ],
+    ['API websocket-only projects', createApiWebSocketOnlyProjectRoot, undefined],
+    ['auth-only projects', createAuthOnlyProjectRoot, undefined],
+    [
+      'an API-only project with an inactive middleware directory',
+      () => {
+        const root = createApiOnlyProjectRoot();
+        mkdirSync(join(root, 'middleware'), { recursive: true });
+        writeFileSync(join(root, 'middleware', '_ignored.ts'), 'export default () => undefined;');
+        return root;
+      },
+      undefined,
+    ],
+  ] as const)(
+    'routes API requests to the worker and keeps documents static-first for %s',
+    async (_label, createRoot, configEnv) => {
+      const assets = await resolveVoidPluginAssets(createRoot(), {}, configEnv);
 
-    expect(assets?.not_found_handling).toBe('single-page-application');
-    expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
-  });
+      expect(assets?.not_found_handling).toBe('single-page-application');
+      expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
+    },
+  );
 
   it('drops the API worker-first rules in a build when the only route is dev-only', async () => {
     const root = createDevOnlyApiProjectRoot();
@@ -394,67 +402,25 @@ describe('voidPlugin dev asset routing', () => {
   });
 
   it('lets managed production dispatch keep the inferred asset-first policy', async () => {
-    const savedProjectId = process.env.VOID_DEPLOY_PROJECT_ID;
-    process.env.VOID_DEPLOY_PROJECT_ID = 'managed-project';
-    try {
-      const root = createConfiguredEdgeRulesProjectRoot();
-      const assets = await resolveVoidPluginAssets(
-        root,
-        {},
-        { command: 'build', mode: 'production' },
-      );
+    vi.stubEnv('VOID_DEPLOY_PROJECT_ID', 'managed-project');
+    const assets = await resolveVoidPluginAssets(
+      createConfiguredEdgeRulesProjectRoot(),
+      {},
+      { command: 'build', mode: 'production' },
+    );
 
-      expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
-    } finally {
-      if (savedProjectId === undefined) {
-        delete process.env.VOID_DEPLOY_PROJECT_ID;
-      } else {
-        process.env.VOID_DEPLOY_PROJECT_ID = savedProjectId;
-      }
-    }
+    expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
   });
 
   it('ignores an ambient managed project marker during native development', async () => {
-    const savedProjectId = process.env.VOID_DEPLOY_PROJECT_ID;
-    process.env.VOID_DEPLOY_PROJECT_ID = 'managed-project';
-    try {
-      const root = createConfiguredEdgeRulesProjectRoot();
-      const assets = await resolveVoidPluginAssets(
-        root,
-        {},
-        { command: 'serve', mode: 'development' },
-      );
-
-      expect(assets?.run_worker_first).toContain('/**');
-    } finally {
-      if (savedProjectId === undefined) {
-        delete process.env.VOID_DEPLOY_PROJECT_ID;
-      } else {
-        process.env.VOID_DEPLOY_PROJECT_ID = savedProjectId;
-      }
-    }
-  });
-
-  it('keeps the API worker-first rules in a preview run of a prod-only route', async () => {
-    const root = createProjectRoot();
-    mkdirSync(join(root, 'routes/api'), { recursive: true });
-    writeFileSync(
-      join(root, 'routes/api/health.prod.ts'),
-      'export const GET = () => Response.json({});',
-    );
-
+    vi.stubEnv('VOID_DEPLOY_PROJECT_ID', 'managed-project');
     const assets = await resolveVoidPluginAssets(
-      root,
+      createConfiguredEdgeRulesProjectRoot(),
       {},
-      {
-        command: 'serve',
-        mode: 'production',
-        isPreview: true,
-      },
+      { command: 'serve', mode: 'development' },
     );
 
-    expect(assets?.not_found_handling).toBe('single-page-application');
-    expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
+    expect(assets?.run_worker_first).toContain('/**');
   });
 
   it('does not return existing D1 or R2 bindings when adding inferred defaults', async () => {
@@ -508,7 +474,6 @@ describe('voidPlugin dev asset routing', () => {
     vi.stubEnv('VOID_TEST_SHELL_ONLY', 'shell-only');
     vi.stubEnv('VOID_TEST_UNDECLARED', 'from-shell');
     vi.stubEnv('VOID_TEST_UNRELATED', 'must-stay-out');
-    vi.spyOn(process, 'cwd').mockReturnValue(root);
 
     const { defineEnv } = await import('../../src/runtime/env-public.ts');
     const { string } = await import('../../src/runtime/env-helpers.ts');
@@ -518,27 +483,7 @@ describe('voidPlugin dev asset routing', () => {
       VOID_TEST_SHELL_ONLY: string(),
     });
 
-    const { voidPlugin } = await import('../../src/index.ts');
-    const plugins = voidPlugin();
-    const schemaPlugin = plugins.find((plugin) => plugin.name === 'void:env-schema');
-    const schemaConfig = getHookHandler(schemaPlugin?.config) as (
-      config: import('vite').UserConfig,
-      env: import('vite').ConfigEnv,
-    ) => Promise<void>;
-    await schemaConfig({}, { command: 'serve', mode: 'development' });
-
-    const envPlugin = plugins.find((plugin) => plugin.name === 'void:env');
-    const envConfig = getHookHandler(envPlugin?.config) as (
-      config: import('vite').UserConfig,
-      env: import('vite').ConfigEnv,
-    ) => void;
-    envConfig({}, { command: 'serve', mode: 'development' });
-
-    const cloudflarePlugin = plugins.find(
-      (plugin): plugin is MockCloudflarePlugin => plugin.name === 'mock:cloudflare',
-    );
-    expect(cloudflarePlugin).toBeDefined();
-    const config = cloudflarePlugin!.api.pluginConfig.config({});
+    const config = await resolveCloudflareConfig(root, {}, undefined, { envSchema: true });
     expect(config.vars).toMatchObject({
       VOID_TEST_TOKEN: 'from-shell',
       VOID_TEST_FILE_ONLY: 'local',
@@ -548,40 +493,6 @@ describe('voidPlugin dev asset routing', () => {
     expect(config.vars).not.toHaveProperty('VOID_TEST_UNRELATED');
   });
 
-  it('keeps reserved names set only in the shell out of the dev Worker', async () => {
-    const root = createProjectRoot();
-    writeFileSync(join(root, '.env'), 'API_URL=http://localhost\n');
-    vi.stubEnv('__VOID_PROXY_TOKEN', 'from-shell');
-    vi.stubEnv('__VOID_EMAIL_FROM', 'from-shell');
-    vi.spyOn(process, 'cwd').mockReturnValue(root);
-
-    const { voidPlugin } = await import('../../src/index.ts');
-    const plugins = voidPlugin();
-    const schemaPlugin = plugins.find((plugin) => plugin.name === 'void:env-schema');
-    const schemaConfig = getHookHandler(schemaPlugin?.config) as (
-      config: import('vite').UserConfig,
-      env: import('vite').ConfigEnv,
-    ) => Promise<void>;
-    await expect(schemaConfig({}, { command: 'serve', mode: 'development' })).resolves.toBe(
-      undefined,
-    );
-
-    const envPlugin = plugins.find((plugin) => plugin.name === 'void:env');
-    const envConfig = getHookHandler(envPlugin?.config) as (
-      config: import('vite').UserConfig,
-      env: import('vite').ConfigEnv,
-    ) => void;
-    envConfig({}, { command: 'serve', mode: 'development' });
-
-    const cloudflarePlugin = plugins.find(
-      (plugin): plugin is MockCloudflarePlugin => plugin.name === 'mock:cloudflare',
-    );
-    const config = cloudflarePlugin!.api.pluginConfig.config({});
-    expect(config.vars).toMatchObject({ API_URL: 'http://localhost' });
-    expect(config.vars).not.toHaveProperty('__VOID_PROXY_TOKEN');
-    expect(config.vars).not.toHaveProperty('__VOID_EMAIL_FROM');
-  });
-
   function createSvelteKitProjectRoot(): string {
     const root = createProjectRoot();
     mkdirSync(join(root, 'src/routes'), { recursive: true });
@@ -592,43 +503,27 @@ describe('voidPlugin dev asset routing', () => {
     return root;
   }
 
-  const reservedEnvApps = [
+  it.each([
     ['native', createProjectRoot],
     ['Class A framework', createFrameworkProjectRoot],
     ['Class B/C framework', createSvelteKitProjectRoot],
     ['Node target', createNodeProjectRoot],
-  ] as const;
-
-  for (const [label, createRoot] of reservedEnvApps) {
-    for (const command of ['serve', 'build'] as const) {
-      for (const requiredEnvKey of [false, true]) {
-        it(`stops ${label} ${command} on a reserved .env name (env.ts with required key: ${requiredEnvKey})`, async () => {
-          const root = createRoot();
-          if (requiredEnvKey) {
-            writeFileSync(join(root, 'env.ts'), 'export default {};\n');
-            const { defineEnv } = await import('../../src/runtime/env-public.ts');
-            const { string } = await import('../../src/runtime/env-helpers.ts');
-            defineEnv({ API_KEY: string() });
-          }
-          writeFileSync(join(root, '.env'), 'API_KEY=k\n__VOID_PROXY_TOKEN=local\n');
-          vi.spyOn(process, 'cwd').mockReturnValue(root);
-
-          const { voidPlugin } = await import('../../src/index.ts');
-          const schemaPlugins = voidPlugin().filter((plugin) => plugin.name === 'void:env-schema');
-          expect(schemaPlugins).toHaveLength(1);
-          const schemaConfig = getHookHandler(schemaPlugins[0]!.config) as (
-            config: import('vite').UserConfig,
-            env: import('vite').ConfigEnv,
-          ) => Promise<void>;
-          await expect(
-            schemaConfig({}, { command, mode: command === 'build' ? 'production' : 'development' }),
-          ).rejects.toThrow(
-            '.env defines names reserved for Void: __VOID_PROXY_TOKEN. Void sets these itself',
-          );
-        });
-      }
-    }
-  }
+  ] as const)('stops a %s app on a reserved .env name', async (_label, createRoot) => {
+    const root = createRoot();
+    writeFileSync(join(root, '.env'), 'API_KEY=k\n__VOID_PROXY_TOKEN=local\n');
+    vi.spyOn(process, 'cwd').mockReturnValue(root);
+
+    const { voidPlugin } = await import('../../src/index.ts');
+    const schemaPlugins = voidPlugin().filter((plugin) => plugin.name === 'void:env-schema');
+    expect(schemaPlugins).toHaveLength(1);
+    const schemaConfig = getHookHandler(schemaPlugins[0]!.config) as (
+      config: import('vite').UserConfig,
+      env: import('vite').ConfigEnv,
+    ) => Promise<void>;
+    await expect(schemaConfig({}, { command: 'serve', mode: 'development' })).rejects.toThrow(
+      '.env defines names reserved for Void: __VOID_PROXY_TOKEN. Void sets these itself',
+    );
+  });
 
   it('enables remote mode on an explicit Workers AI binding during direct development', async () => {
     vi.stubEnv('CLOUDFLARE_AUTH_USE_KEYRING', 'false');
@@ -682,33 +577,6 @@ describe('voidPlugin dev asset routing', () => {
     expect(process.env.CLOUDFLARE_AUTH_USE_KEYRING).toBe('false');
   });
 
-  it('keeps projects with only API websocket routes static-first for document requests', async () => {
-    const root = createApiWebSocketOnlyProjectRoot();
-    const assets = await resolveVoidPluginAssets(root);
-
-    expect(assets?.not_found_handling).toBe('single-page-application');
-    expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
-  });
-
-  it('routes managed auth endpoints to the worker without making all documents worker-first', async () => {
-    const root = createAuthOnlyProjectRoot();
-    const assets = await resolveVoidPluginAssets(root);
-
-    expect(assets?.not_found_handling).toBe('single-page-application');
-    expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
-  });
-
-  it('keeps API-only projects static-first when middleware directory has no active files', async () => {
-    const root = createApiOnlyProjectRoot();
-    mkdirSync(join(root, 'middleware'), { recursive: true });
-    writeFileSync(join(root, 'middleware', '_ignored.ts'), 'export default () => undefined;');
-
-    const assets = await resolveVoidPluginAssets(root);
-
-    expect(assets?.not_found_handling).toBe('single-page-application');
-    expect(assets?.run_worker_first).toEqual(['/api', '/api/*', '/__void', '/__void/*']);
-  });
-
   it('passes worker.limits.cpu_ms from void.json into the generated worker config', async () => {
     const root = createProjectRoot();
     writeFileSync(
diff --git a/packages/void/test/unit/plugin-dev-config.test.ts b/packages/void/test/unit/plugin-dev-config.test.ts
index 701771886..04cf67be4 100644
--- a/packages/void/test/unit/plugin-dev-config.test.ts
+++ b/packages/void/test/unit/plugin-dev-config.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vite-plus/test';
+import { describe, expect, it } from 'vite-plus/test';
 import {
   devTriggerSecretGuardPlugin,
   isDevTriggerSecretRequest,
@@ -67,48 +67,7 @@ describe('isDevTriggerSecretRequest', () => {
 });
 
 describe('devTriggerSecretGuardPlugin', () => {
-  type Middleware = (req: { url?: string }, res: unknown, next: () => void) => void;
-
-  function installGuard(): Middleware {
-    const plugin = devTriggerSecretGuardPlugin();
-    let middleware: Middleware | undefined;
-    const server = {
-      middlewares: {
-        use(fn: Middleware) {
-          middleware = fn;
-        },
-      },
-    };
-    (plugin.configureServer as (this: unknown, s: unknown) => void).call(plugin, server);
-    if (!middleware) {
-      throw new Error('Expected the guard to register a middleware.');
-    }
-    return middleware;
-  }
-
-  it('runs before other dev server plugins and only in serve', () => {
-    const plugin = devTriggerSecretGuardPlugin();
-    expect(plugin.apply).toBe('serve');
-    expect(plugin.enforce).toBe('pre');
-  });
-
-  it('answers 404 for the token file without calling the next middleware', () => {
-    const guard = installGuard();
-    const res = { statusCode: 200, end: vi.fn() };
-    const next = vi.fn();
-    guard({ url: '/.void/dev-trigger-token' }, res, next);
-    expect(res.statusCode).toBe(404);
-    expect(res.end).toHaveBeenCalledTimes(1);
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('passes other requests through untouched', () => {
-    const guard = installGuard();
-    const res = { statusCode: 200, end: vi.fn() };
-    const next = vi.fn();
-    guard({ url: '/src/main.ts' }, res, next);
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(res.statusCode).toBe(200);
-    expect(res.end).not.toHaveBeenCalled();
+  it('runs before other dev server plugins', () => {
+    expect(devTriggerSecretGuardPlugin().enforce).toBe('pre');
   });
 });
diff --git a/packages/void/test/unit/plugin-dev-triggers-hint.test.ts b/packages/void/test/unit/plugin-dev-triggers-hint.test.ts
index c83035467..569c26473 100644
--- a/packages/void/test/unit/plugin-dev-triggers-hint.test.ts
+++ b/packages/void/test/unit/plugin-dev-triggers-hint.test.ts
@@ -28,11 +28,16 @@ async function runConfigureServer(plugin: ReturnType<typeof devTriggersHintPlugi
   if (typeof fn !== 'function') {
     throw new Error('configureServer not callable');
   }
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  await (fn as any)(server);
-  server.httpServer.emit('listening');
-  // afterReady defers via setTimeout(_, 100)
-  await new Promise((r) => setTimeout(r, 150));
+  vi.useFakeTimers();
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    await (fn as any)(server);
+    server.httpServer.emit('listening');
+    // afterServerReady prints 100 ms after 'listening'.
+    vi.advanceTimersByTime(100);
+  } finally {
+    vi.useRealTimers();
+  }
   return server;
 }
 
@@ -48,12 +53,7 @@ describe('devTriggersHintPlugin', () => {
   it('prints nothing when there are no crons or queues', async () => {
     const root = createTempRoot();
     const log = vi.spyOn(console, 'log').mockImplementation(() => {});
-    await runConfigureServer(
-      devTriggersHintPlugin(root, {
-        framework: false,
-        devTriggerToken: 'dev-token-test',
-      }),
-    );
+    await runConfigureServer(devTriggersHintPlugin(root, 'dev-token-test'));
     expect(log).not.toHaveBeenCalled();
   });
 
@@ -66,12 +66,7 @@ describe('devTriggersHintPlugin', () => {
     );
     const log = vi.spyOn(console, 'log').mockImplementation(() => {});
 
-    await runConfigureServer(
-      devTriggersHintPlugin(root, {
-        framework: false,
-        devTriggerToken: 'dev-token-test',
-      }),
-    );
+    await runConfigureServer(devTriggersHintPlugin(root, 'dev-token-test'));
 
     const output = log.mock.calls.map((c) => String(c[0] ?? '')).join('\n');
     expect(output).toContain('Detected 1 cron');
@@ -95,12 +90,7 @@ describe('devTriggersHintPlugin', () => {
     writeFileSync(join(root, 'queues', 'emails.ts'), 'export default async () => {};\n');
     const log = vi.spyOn(console, 'log').mockImplementation(() => {});
 
-    await runConfigureServer(
-      devTriggersHintPlugin(root, {
-        framework: false,
-        devTriggerToken: 'dev-token-test',
-      }),
-    );
+    await runConfigureServer(devTriggersHintPlugin(root, 'dev-token-test'));
 
     const output = log.mock.calls.map((c) => String(c[0] ?? '')).join('\n');
     expect(output).toContain('Detected 2 crons and 1 queue');
@@ -108,45 +98,4 @@ describe('devTriggersHintPlugin', () => {
     expect(output).toContain('x-void-dev-trigger: dev-token-test');
     expect(output).toContain('"queue":"emails"');
   });
-
-  it('always prints the dev-trigger header, whatever .env holds', async () => {
-    const root = createTempRoot();
-    mkdirSync(join(root, 'crons'), { recursive: true });
-    writeFileSync(
-      join(root, 'crons', 'heartbeat.ts'),
-      'export const cron = "0 * * * *";\nexport default async () => {};\n',
-    );
-    writeFileSync(join(root, '.env'), '__VOID_PROXY_TOKEN=local-proxy-token\n');
-    const log = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    await runConfigureServer(
-      devTriggersHintPlugin(root, { framework: false, devTriggerToken: 'dev-token-test' }),
-    );
-
-    const output = log.mock.calls.map((c) => String(c[0] ?? '')).join('\n');
-    expect(output).toContain('x-void-dev-trigger: dev-token-test');
-    expect(output).not.toContain('x-void-internal');
-  });
-
-  it('prints curl examples in framework mode (same as default mode)', async () => {
-    const root = createTempRoot();
-    mkdirSync(join(root, 'crons'), { recursive: true });
-    writeFileSync(
-      join(root, 'crons', 'heartbeat.ts'),
-      'export const cron = "0 * * * *";\nexport default async () => {};\n',
-    );
-    const log = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    await runConfigureServer(
-      devTriggersHintPlugin(root, {
-        framework: true,
-        devTriggerToken: 'dev-token-test',
-      }),
-    );
-
-    const output = log.mock.calls.map((c) => String(c[0] ?? '')).join('\n');
-    expect(output).toContain('Detected 1 cron');
-    expect(output).toContain('/__void/scheduled');
-    expect(output).toContain('x-void-dev-trigger: dev-token-test');
-  });
 });
diff --git a/packages/void/test/unit/plugin-drizzle.test.ts b/packages/void/test/unit/plugin-drizzle.test.ts
index eee21dd13..3937d9cb2 100644
--- a/packages/void/test/unit/plugin-drizzle.test.ts
+++ b/packages/void/test/unit/plugin-drizzle.test.ts
@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
+import { getHookHandler } from '../helpers/vite-hooks.ts';
 
 vi.mock('../../src/log', () => ({
   voidLog: vi.fn(),
@@ -28,16 +29,6 @@ function createProjectRoot(options?: { schema?: boolean }): string {
   return root;
 }
 
-function getHookHandler<T>(hook: T | { handler: T } | undefined): T {
-  if (typeof hook === 'function') {
-    return hook;
-  }
-  if (hook && typeof hook === 'object' && 'handler' in hook) {
-    return hook.handler;
-  }
-  throw new Error('Expected Vite hook handler.');
-}
-
 type FakePoolRecord = {
   dialect: 'postgresql' | 'mysql';
   options: Record<string, unknown>;
diff --git a/packages/void/test/unit/plugin-email-config.test.ts b/packages/void/test/unit/plugin-email-config.test.ts
index 994f09a05..f6bc3b748 100644
--- a/packages/void/test/unit/plugin-email-config.test.ts
+++ b/packages/void/test/unit/plugin-email-config.test.ts
@@ -11,12 +11,10 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { Plugin } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
+import { getHookHandler } from '../helpers/vite-hooks.ts';
 
-// Runs the REAL `mergeBindings` closure: `voidPlugin()` hands it to the
-// Cloudflare plugin as `config`, and the mock captures it. The Cloudflare
-// plugin then `defu`-merges the returned object over the `resolved` config it
-// passed in, so a key can only be REMOVED by mutating `resolved` — which is
-// what the `send_email` assertions below check on both objects.
+// The Cloudflare plugin defu-merges the returned patch over `resolved`, so a key
+// can only be removed by mutating `resolved`.
 type MockCloudflarePluginConfig = {
   config: (resolved: Record<string, unknown>) => Record<string, unknown>;
 };
@@ -27,16 +25,7 @@ type MockCloudflarePlugin = Plugin & {
   };
 };
 
-vi.mock('@cloudflare/vite-plugin', () => ({
-  cloudflare(pluginConfig: MockCloudflarePluginConfig): Array<MockCloudflarePlugin> {
-    return [
-      {
-        name: 'mock:cloudflare',
-        api: { pluginConfig },
-      },
-    ];
-  },
-}));
+vi.mock('@cloudflare/vite-plugin', () => import('../helpers/cloudflare-vite-plugin.ts'));
 
 const tempDirs: Array<string> = [];
 
@@ -84,16 +73,6 @@ export async function POST() {
   return root;
 }
 
-function getHookHandler<T>(hook: T | { handler: T } | undefined): T {
-  if (typeof hook === 'function') {
-    return hook;
-  }
-  if (hook && typeof hook === 'object' && 'handler' in hook) {
-    return hook.handler;
-  }
-  throw new Error('Expected Vite hook handler.');
-}
-
 async function resolveCloudflareConfig(
   root: string,
   resolved: Record<string, unknown>,
@@ -148,8 +127,6 @@ describe('mergeBindings email config (void dev)', () => {
 
     const result = await resolveCloudflareConfig(root, resolved, SERVE);
 
-    // Removed from the object the Cloudflare plugin merges over, and not
-    // re-added by the returned patch.
     expect('send_email' in resolved).toBe(false);
     expect('send_email' in result).toBe(false);
   });
@@ -182,31 +159,7 @@ describe('mergeBindings email config (void dev)', () => {
     expect('send_email' in result).toBe(false);
   });
 
-  it('preserves a user send_email binding when the app does not import void/email', async () => {
-    // Nothing in this app goes through `sendEmail`, so the strip has nothing
-    // to guard: the user's own binding must reach miniflare exactly as
-    // wrangler.jsonc declares it, or `env.MAILER.send()` is a dev-only crash.
-    const root = createProjectRoot({}, { usesVoidEmail: false });
-    const resolved = {
-      assets: { binding: 'ASSETS' },
-      send_email: [{ name: 'MAILER', destination_address: 'ops@example.com' }],
-    };
-
-    const result = await resolveCloudflareConfig(root, resolved, SERVE);
-
-    expect(resolved.send_email).toEqual([
-      { name: 'MAILER', destination_address: 'ops@example.com' },
-    ]);
-    // Not re-added by the patch either: defu concatenates arrays, so a patch
-    // entry would double the binding rather than replace it.
-    expect('send_email' in result).toBe(false);
-  });
-
   it('leaves a SEND_EMAIL entry alone when the app does not import void/email', async () => {
-    // The same `needsEmail` that arms the dev inbox gates the strip. Without
-    // `void/email` in the app, `sendEmail` never runs, so a `SEND_EMAIL` entry
-    // is either a stale leftover nothing reads or the user's own choice of
-    // name — both belong to the root config, as `void deploy` also treats them.
     const root = createProjectRoot({}, { usesVoidEmail: false });
     const resolved = { send_email: [{ name: 'SEND_EMAIL' }] };
 
@@ -238,9 +191,6 @@ describe('mergeBindings dev inbox vars (void dev)', () => {
 
     const vars = result.vars as Record<string, string>;
     expect(vars.__VOID_EMAIL_DEV_INBOX).toBe('ASSETS');
-    // The same per-project token the cron/queue dev routes check: the inbox
-    // middleware requires it on every route, including the worker's capture
-    // POST, so the worker must hold the value the plugin was handed.
     const persisted = readFileSync(join(root, '.void', 'dev-trigger-token'), 'utf8').trim();
     expect(persisted.length).toBeGreaterThan(0);
     expect(vars.__VOID_EMAIL_DEV_INBOX_TOKEN).toBe(persisted);
@@ -267,13 +217,6 @@ describe('mergeBindings dev inbox vars (void dev)', () => {
   });
 });
 
-// The token file is the one credential every inbox route accepts, so its mode
-// is part of the inbox's authorization: under the usual 022 umask a default
-// `openSync(.., 'wx')` leaves it 0644, readable by every other account on a
-// shared host — and loopback needs no `--host`, so that account can read raw
-// MIME, clear the buffer, or plant captures against the owner's dev server.
-// Windows has no group/other bits (`mode` and `chmod` only toggle write
-// there), so the mode assertions are POSIX-only.
 describe('dev-trigger token file mode (inbox credential)', () => {
   const tokenPath = (root: string) => join(root, '.void', 'dev-trigger-token');
   const modeOf = (path: string) => statSync(path).mode & 0o777;
@@ -283,18 +226,15 @@ describe('dev-trigger token file mode (inbox credential)', () => {
     async () => {
       const root = createProjectRoot();
 
-      const result = await resolveCloudflareConfig(root, { assets: { binding: 'ASSETS' } }, SERVE);
+      await resolveCloudflareConfig(root, { assets: { binding: 'ASSETS' } }, SERVE);
 
       expect(modeOf(tokenPath(root))).toBe(0o600);
-      const vars = result.vars as Record<string, string>;
-      expect(vars.__VOID_EMAIL_DEV_INBOX_TOKEN).toBe(readFileSync(tokenPath(root), 'utf8').trim());
     },
   );
 
   it.skipIf(process.platform === 'win32')(
     'tightens a pre-existing 0644 token file to 0600 and keeps its value',
     async () => {
-      // A token persisted by an earlier void release, before the mode was set.
       const root = createProjectRoot();
       mkdirSync(join(root, '.void'), { recursive: true });
       writeFileSync(tokenPath(root), 'stable-token\n');
@@ -337,8 +277,6 @@ describe('mergeBindings email config (build)', () => {
 
     const result = await resolveCloudflareConfig(root, resolved, BUILD);
 
-    // The root entry survives on `resolved` and the patch does not clobber it
-    // (defu concatenates arrays, so a patch entry would double the binding).
     expect(resolved.send_email).toEqual([{ name: 'SEND_EMAIL' }]);
     expect('send_email' in result).toBe(false);
   });
@@ -348,8 +286,6 @@ describe('mergeBindings email config (build)', () => {
 
     const result = await resolveCloudflareConfig(root, { assets: { binding: 'ASSETS' } }, BUILD);
 
-    // Not injected by the plugin: the CLI writes it into the root wrangler.jsonc
-    // only once the domain is set up, and the managed deploy supplies its own.
     expect((result.vars as Record<string, string> | undefined)?.__VOID_EMAIL_FROM).toBeUndefined();
   });
 });
diff --git a/packages/void/test/unit/plugin-framework-ai.test.ts b/packages/void/test/unit/plugin-framework-ai.test.ts
index 8004530ef..7f392779d 100644
--- a/packages/void/test/unit/plugin-framework-ai.test.ts
+++ b/packages/void/test/unit/plugin-framework-ai.test.ts
@@ -114,14 +114,4 @@ describe('framework Workers AI bindings', () => {
     const config = await runFrameworkSync(root);
     expect(config.ai).toBeUndefined();
   });
-
-  it('does not add a paid AI binding for a type-only framework import', async () => {
-    const root = project('cloudflare');
-    writeFileSync(
-      join(root, 'src/routes/+page.server.ts'),
-      "import type { AI } from 'void/ai'; export const load = () => ({ ok: true });",
-    );
-    const config = await runFrameworkSync(root);
-    expect(config.ai).toBeUndefined();
-  });
 });
diff --git a/packages/void/test/unit/plugin-framework-triggers.test.ts b/packages/void/test/unit/plugin-framework-triggers.test.ts
index 14674549e..374d2b6d7 100644
--- a/packages/void/test/unit/plugin-framework-triggers.test.ts
+++ b/packages/void/test/unit/plugin-framework-triggers.test.ts
@@ -11,7 +11,6 @@ import {
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { toSlash } from 'pathslash';
 import { build } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import {
@@ -308,33 +307,11 @@ export default (controller, env) => env.run();`,
     expect(await response?.json()).toEqual({ ok: false });
   });
 
-  it('writes a dispatch module that imports each cron and queue handler', () => {
+  it('marks the dispatch module @ts-nocheck', () => {
     const root = createTempRoot();
-    mkdirSync(join(root, 'crons'), { recursive: true });
-    mkdirSync(join(root, 'queues'), { recursive: true });
-    writeFileSync(
-      join(root, 'crons', 'a.ts'),
-      'export const cron = "0 * * * *";\nexport default async () => {};\n',
-    );
-    writeFileSync(
-      join(root, 'crons', 'b.ts'),
-      'export const cron = "*/5 * * * *";\nexport default async () => {};\n',
-    );
-    writeFileSync(join(root, 'queues', 'emails.ts'), 'export default async () => {};\n');
+    callConfigResolved(frameworkTriggersPlugin(root, { devTriggerToken: 'dev-token-test' }));
 
-    const plugin = frameworkTriggersPlugin(root, { devTriggerToken: 'dev-token-test' });
-    callConfigResolved(plugin);
-
-    const generated = readFileSync(frameworkTriggersDispatchPath(root), 'utf-8');
-    expect(generated).toContain('@ts-nocheck');
-    expect(generated).toContain(`__DEV_TRIGGER_TOKEN = "dev-token-test"`);
-    expect(generated).toContain(`from ${JSON.stringify(toSlash(join(root, 'crons', 'a.ts')))}`);
-    expect(generated).toContain(`from ${JSON.stringify(toSlash(join(root, 'crons', 'b.ts')))}`);
-    expect(generated).toContain(
-      `from ${JSON.stringify(toSlash(join(root, 'queues', 'emails.ts')))}`,
-    );
-    expect(generated).toContain('"0 * * * *"');
-    expect(generated).toContain('export async function handleDevTrigger');
+    expect(readFileSync(frameworkTriggersDispatchPath(root), 'utf-8')).toContain('@ts-nocheck');
   });
 
   // The generated module embeds the dev trigger token, which is the whole
@@ -609,20 +586,6 @@ describe('analogDevTriggerInjectPlugin', () => {
     expect(gitignore).toContain('src/server/routes/api/__void/queue-trigger.ts');
   });
 
-  it('registers a Vite middleware for the URL proxy', () => {
-    const root = createTempRoot();
-    const plugin = analogDevTriggerInjectPlugin(root);
-    let registered = 0;
-    callConfigureServer(plugin, {
-      middlewares: {
-        use() {
-          registered += 1;
-        },
-      },
-    });
-    expect(registered).toBeGreaterThan(0);
-  });
-
   async function proxyTrigger(address: unknown) {
     const root = createTempRoot();
     const plugin = analogDevTriggerInjectPlugin(root);
diff --git a/packages/void/test/unit/plugin-inference.test.ts b/packages/void/test/unit/plugin-inference.test.ts
index e3396cd3b..0abbd9aed 100644
--- a/packages/void/test/unit/plugin-inference.test.ts
+++ b/packages/void/test/unit/plugin-inference.test.ts
@@ -5,6 +5,7 @@ import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { LATEST_KNOWN_COMPAT_DATE } from '../../src/cli/wrangler.ts';
 import { voidPlugin } from '../../src/index.ts';
 import { inferProjectBindings, detectFramework } from '../../src/plugin-inference.ts';
+import { getHookHandler } from '../helpers/vite-hooks.ts';
 
 const tempDirs: Array<string> = [];
 
@@ -22,16 +23,6 @@ function writeCompatConfig(root: string): void {
   );
 }
 
-function getHookHandler<T>(hook: T | { handler: T } | undefined): T {
-  if (typeof hook === 'function') {
-    return hook;
-  }
-  if (hook && typeof hook === 'object' && 'handler' in hook) {
-    return hook.handler;
-  }
-  throw new Error('Expected Vite hook handler.');
-}
-
 describe('inferProjectBindings', () => {
   afterEach(() => {
     while (tempDirs.length > 0) {
@@ -179,12 +170,6 @@ describe('inferProjectBindings', () => {
     expect(inferProjectBindings(root, undefined, ['routes', 'lib']).needsLive).toBe(true);
   });
 
-  it('detects live in the react-pages playground', () => {
-    const playground = join(import.meta.dirname, '../../../../playground/react-pages');
-
-    expect(inferProjectBindings(playground).needsLive).toBe(true);
-  });
-
   it('detects auth from void/auth import in routes/', () => {
     const root = createTempRoot();
     mkdirSync(join(root, 'routes', 'api'), { recursive: true });
@@ -455,9 +440,22 @@ describe('detectFramework', () => {
     }
   });
 
-  it('externalizes Cloudflare builtins for default worker builds', () => {
+  it.each([
+    { kind: 'default worker builds', dependencies: undefined, compat: true },
+    {
+      kind: 'class A frameworks',
+      dependencies: { '@tanstack/react-start': '^1.0.0' },
+      compat: true,
+    },
+    { kind: 'class B/C server builds', dependencies: { '@sveltejs/kit': '^2.0.0' }, compat: false },
+  ])('externalizes Cloudflare builtins for $kind', ({ dependencies, compat }) => {
     const root = createTempRoot();
-    writeCompatConfig(root);
+    if (compat) {
+      writeCompatConfig(root);
+    }
+    if (dependencies) {
+      writeFileSync(join(root, 'package.json'), JSON.stringify({ dependencies }));
+    }
     const cwd = vi.spyOn(process, 'cwd').mockReturnValue(root);
 
     try {
@@ -472,15 +470,7 @@ describe('detectFramework', () => {
       ) => import('vite').UserConfig | void;
 
       expect(externalPlugin).toBeTruthy();
-      const result = config.call(
-        {} as never,
-        {},
-        {
-          command: 'build',
-          mode: 'production',
-        },
-      );
-
+      const result = config.call({} as never, {}, { command: 'build', mode: 'production' });
       const rootExternal = result?.build?.rollupOptions?.external as Array<unknown>;
       expect(rootExternal).toBeTruthy();
       expect(
@@ -533,74 +523,6 @@ describe('detectFramework', () => {
     }
   });
 
-  it('includes Cloudflare builtin externalization for class A frameworks', () => {
-    const root = createTempRoot();
-    writeCompatConfig(root);
-    writeFileSync(
-      join(root, 'package.json'),
-      JSON.stringify({ dependencies: { '@tanstack/react-start': '^1.0.0' } }),
-    );
-
-    const cwd = vi.spyOn(process, 'cwd').mockReturnValue(root);
-
-    try {
-      const plugins = voidPlugin();
-      const externalPlugin = plugins.find(
-        (plugin) => plugin.name === 'void:cloudflare-builtins-external',
-      );
-      const config = getHookHandler(externalPlugin?.config) as (
-        this: object,
-        config: import('vite').UserConfig,
-        env: import('vite').ConfigEnv,
-      ) => import('vite').UserConfig | void;
-
-      expect(externalPlugin).toBeTruthy();
-
-      const result = config.call({} as never, {}, { command: 'build', mode: 'production' });
-      const rootExternal = result?.build?.rollupOptions?.external as Array<unknown>;
-      expect(rootExternal).toBeTruthy();
-      expect(
-        rootExternal.some((value) => value instanceof RegExp && value.test('cloudflare:workers')),
-      ).toBe(true);
-      expect(result?.environments).toBeUndefined();
-    } finally {
-      cwd.mockRestore();
-    }
-  });
-
-  it('externalizes Cloudflare builtins for class B/C server builds', () => {
-    const root = createTempRoot();
-    writeFileSync(
-      join(root, 'package.json'),
-      JSON.stringify({ dependencies: { '@sveltejs/kit': '^2.0.0' } }),
-    );
-
-    const cwd = vi.spyOn(process, 'cwd').mockReturnValue(root);
-
-    try {
-      const plugins = voidPlugin();
-      const externalPlugin = plugins.find(
-        (plugin) => plugin.name === 'void:cloudflare-builtins-external',
-      );
-      const config = getHookHandler(externalPlugin?.config) as (
-        this: object,
-        config: import('vite').UserConfig,
-        env: import('vite').ConfigEnv,
-      ) => import('vite').UserConfig | void;
-
-      expect(externalPlugin).toBeTruthy();
-      const result = config.call({} as never, {}, { command: 'build', mode: 'production' });
-      const rootExternal = result?.build?.rollupOptions?.external as Array<unknown>;
-      expect(rootExternal).toBeTruthy();
-      expect(
-        rootExternal.some((value) => value instanceof RegExp && value.test('cloudflare:workers')),
-      ).toBe(true);
-      expect(result?.environments).toBeUndefined();
-    } finally {
-      cwd.mockRestore();
-    }
-  });
-
   it('does not add Cloudflare builtin externalization for node targets', () => {
     const root = createTempRoot();
     writeFileSync(join(root, 'void.json'), JSON.stringify({ target: 'node' }));
diff --git a/packages/void/test/unit/plugin-restart.test.ts b/packages/void/test/unit/plugin-restart.test.ts
index 455c1183b..e03b56e0a 100644
--- a/packages/void/test/unit/plugin-restart.test.ts
+++ b/packages/void/test/unit/plugin-restart.test.ts
@@ -171,7 +171,7 @@ describe('restartPlugin middlewares', () => {
     vi.useRealTimers();
   });
 
-  it.each(['javascript:alert(document.domain)', '//evil.com', 'https://evil.com'])(
+  it.each(['javascript:alert(document.domain)', '//evil.com'])(
     'GET /__void/restarting?return=%s navigates to /',
     (value) => {
       const { dispatch } = createFakeViteServer();
@@ -181,16 +181,13 @@ describe('restartPlugin middlewares', () => {
     },
   );
 
-  it('GET /__void/restarting keeps a same-origin return path', () => {
-    const { dispatch } = createFakeViteServer();
-    const res = dispatch('GET', `/__void/restarting?return=${encodeURIComponent('/foo?x=1')}`);
-    expect(targetOf(res.body)).toBe('/foo?x=1');
-  });
-
   it('GET /__void/restarting keeps the token out of the return path and the referrer', () => {
     const { dispatch, token } = createFakeViteServer();
-    const res = dispatch('GET', `/__void/restarting?return=%2Ffoo&t=${token}`);
-    expect(targetOf(res.body)).toBe('/foo');
+    const res = dispatch(
+      'GET',
+      `/__void/restarting?return=${encodeURIComponent('/foo?x=1')}&t=${token}`,
+    );
+    expect(targetOf(res.body)).toBe('/foo?x=1');
     expect(pageTokenOf(res.body)).toBe(token);
     expect(res.headers['Referrer-Policy']).toBe('no-referrer');
   });
diff --git a/packages/void/test/unit/plugin-route-binding-environment.test.ts b/packages/void/test/unit/plugin-route-binding-environment.test.ts
index 8740e255c..fb7d53a5b 100644
--- a/packages/void/test/unit/plugin-route-binding-environment.test.ts
+++ b/packages/void/test/unit/plugin-route-binding-environment.test.ts
@@ -1,18 +1,14 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import type { ConfigEnv, Plugin, UserConfig } from 'vite';
+import type { ConfigEnv, UserConfig } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 
 type MockCloudflareConfig = {
   config: (resolved: Record<string, unknown>) => Record<string, unknown>;
 };
 
-vi.mock('@cloudflare/vite-plugin', () => ({
-  cloudflare(config: MockCloudflareConfig): Array<Plugin> {
-    return [{ name: 'mock:cloudflare', api: { config } } as Plugin];
-  },
-}));
+vi.mock('@cloudflare/vite-plugin', () => import('../helpers/cloudflare-vite-plugin.ts'));
 
 // Binding inference must not consult a developer's system keychain.
 vi.mock('../../src/cli/auth.ts', async (importOriginal) => ({
@@ -69,7 +65,7 @@ async function generatedBindings(
   if (!cloudflarePlugin) {
     throw new Error('Expected mocked Cloudflare plugin.');
   }
-  return (cloudflarePlugin.api as { config: MockCloudflareConfig }).config.config({});
+  return (cloudflarePlugin.api as { pluginConfig: MockCloudflareConfig }).pluginConfig.config({});
 }
 
 describe('environment-specific route binding inference', () => {
diff --git a/packages/void/test/unit/plugin-routing.test.ts b/packages/void/test/unit/plugin-routing.test.ts
index 34e51faf3..e936a03dd 100644
--- a/packages/void/test/unit/plugin-routing.test.ts
+++ b/packages/void/test/unit/plugin-routing.test.ts
@@ -1,8 +1,12 @@
 import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import type { ConfigEnv, ResolvedConfig, UserConfig } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
+import { analyzeApplicationSync } from '../../src/application-analysis.ts';
+import { readConfig } from '../../src/config.ts';
 import { routingPlugin } from '../../src/plugin-routing.ts';
+import { getHookHandler } from '../helpers/vite-hooks.ts';
 
 const tempDirs: Array<string> = [];
 
@@ -20,16 +24,82 @@ function createBareTempRoot(): string {
   return root;
 }
 
-function getHookHandler<T>(hook: T | { handler: T } | undefined): T {
-  if (typeof hook === 'function') {
-    return hook;
-  }
-  if (hook && typeof hook === 'object' && 'handler' in hook) {
-    return hook.handler;
+type RoutingPlugin = ReturnType<typeof routingPlugin>;
+
+function createRoutingPlugin(
+  root: string,
+  options: Omit<Parameters<typeof routingPlugin>[1], 'getApplicationAnalysis'>,
+): RoutingPlugin {
+  return routingPlugin(root, {
+    ...options,
+    getApplicationAnalysis: (environment) =>
+      analyzeApplicationSync(root, { config: readConfig(root), environment }),
+  });
+}
+
+function runConfig(plugin: RoutingPlugin, env: ConfigEnv): void {
+  (getHookHandler(plugin.config) as (config: UserConfig, env: ConfigEnv) => unknown)({}, env);
+}
+
+function resolveConfig(plugin: RoutingPlugin, command: 'build' | 'serve'): void {
+  (getHookHandler(plugin.configResolved) as (config: ResolvedConfig) => void)({
+    build: { assetsDir: 'assets' },
+    command,
+    mode: command === 'build' ? 'production' : 'development',
+    plugins: [],
+  } as unknown as ResolvedConfig);
+}
+
+async function runBuildStart(plugin: RoutingPlugin): Promise<void> {
+  await (getHookHandler(plugin.buildStart) as () => Promise<void>).call({} as never);
+}
+
+function fakeDevServer(moduleIds: Array<string> = []) {
+  const handlers = new Map<string, Array<(path: string) => Promise<void> | void>>();
+  const invalidated: Array<string> = [];
+  const restart = vi.fn(async () => {});
+  const modules = new Map(moduleIds.map((id) => [id, { id }]));
+  const server = {
+    watcher: {
+      on(event: string, handler: (path: string) => Promise<void> | void) {
+        handlers.set(event, [...(handlers.get(event) ?? []), handler]);
+      },
+    },
+    environments: {
+      void_worker: {
+        moduleGraph: {
+          getModuleById(id: string) {
+            return modules.get(id);
+          },
+          invalidateModule(mod: { id: string }) {
+            invalidated.push(mod.id);
+          },
+        },
+        hot: { send() {} },
+      },
+    },
+    restart,
+  };
+  async function emit(event: string, path: string): Promise<void> {
+    for (const handler of handlers.get(event) ?? []) {
+      await handler(path);
+    }
   }
-  throw new Error('Expected Vite hook handler.');
+  return { server, invalidated, restart, emit };
 }
 
+function startDevServer(plugin: RoutingPlugin, moduleIds?: Array<string>) {
+  const dev = fakeDevServer(moduleIds);
+  (getHookHandler(plugin.configureServer) as (server: unknown) => void)(dev.server);
+  return dev;
+}
+
+const PAGE_MODULE_IDS = [
+  '\0virtual:void-pages-renderer',
+  '\0virtual:void-pages-client',
+  'virtual:void-routes',
+];
+
 describe('routingPlugin', () => {
   afterEach(() => {
     while (tempDirs.length > 0) {
@@ -45,20 +115,9 @@ describe('routingPlugin', () => {
       'export default defineWebSocket({});\n',
     );
 
-    const plugin = routingPlugin(root, { isAuthEnabled: () => false });
-    const configResolved = getHookHandler(plugin.configResolved) as (
-      config: import('vite').ResolvedConfig,
-    ) => void;
-    const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
-
-    configResolved({
-      build: { assetsDir: 'assets' },
-      command: 'build',
-      mode: 'production',
-      plugins: [],
-    } as unknown as import('vite').ResolvedConfig);
-
-    await buildStart.call({} as never);
+    const plugin = createRoutingPlugin(root, { isAuthEnabled: () => false });
+    resolveConfig(plugin, 'build');
+    await runBuildStart(plugin);
 
     const entry = readFileSync(join(root, '.void', 'entry.ts'), 'utf-8');
     expect(entry).toContain('app, assets: serveWithAssets');
@@ -71,20 +130,9 @@ describe('routingPlugin', () => {
     const root = createTempRoot();
     writeFileSync(join(root, 'void.json'), JSON.stringify({ auth: { providers: ['email'] } }));
 
-    const plugin = routingPlugin(root, { isAuthEnabled: () => true });
-    const configResolved = getHookHandler(plugin.configResolved) as (
-      config: import('vite').ResolvedConfig,
-    ) => void;
-    const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
-
-    configResolved({
-      build: { assetsDir: 'assets' },
-      command: 'build',
-      mode: 'production',
-      plugins: [],
-    } as unknown as import('vite').ResolvedConfig);
-
-    await buildStart.call({} as never);
+    const plugin = createRoutingPlugin(root, { isAuthEnabled: () => true });
+    resolveConfig(plugin, 'build');
+    await runBuildStart(plugin);
 
     const entry = readFileSync(join(root, '.void', 'entry.ts'), 'utf-8');
     expect(entry).toContain(
@@ -105,25 +153,12 @@ describe('routingPlugin', () => {
     const savedProjectId = process.env.VOID_DEPLOY_PROJECT_ID;
     delete process.env.VOID_DEPLOY_PROJECT_ID;
     try {
-      const plugin = routingPlugin(root, { isAuthEnabled: () => false });
-      const config = getHookHandler(plugin.config) as (
-        config: import('vite').UserConfig,
-        env: import('vite').ConfigEnv,
-      ) => void;
-      const configResolved = getHookHandler(plugin.configResolved) as (
-        config: import('vite').ResolvedConfig,
-      ) => void;
-      const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
+      const plugin = createRoutingPlugin(root, { isAuthEnabled: () => false });
       const load = getHookHandler(plugin.load) as (id: string) => Promise<string | undefined>;
 
-      config({}, { command: 'build', mode: 'production' });
-      configResolved({
-        build: { assetsDir: 'assets' },
-        command: 'build',
-        mode: 'production',
-        plugins: [],
-      } as unknown as import('vite').ResolvedConfig);
-      await buildStart.call({} as never);
+      runConfig(plugin, { command: 'build', mode: 'production' });
+      resolveConfig(plugin, 'build');
+      await runBuildStart(plugin);
       const routes = await load('virtual:void-routes');
 
       expect(routes).toContain(
@@ -141,22 +176,14 @@ describe('routingPlugin', () => {
 
   it('resolves explicit framework client subpaths to framework auth clients', async () => {
     const root = createBareTempRoot();
-    const plugin = routingPlugin(root, { isAuthEnabled: () => false });
-    const configResolved = getHookHandler(plugin.configResolved) as (
-      config: import('vite').ResolvedConfig,
-    ) => void;
+    const plugin = createRoutingPlugin(root, { isAuthEnabled: () => false });
     const resolveId = getHookHandler(plugin.resolveId) as (
       this: { environment?: { name?: string } },
       id: string,
     ) => string | undefined;
     const load = getHookHandler(plugin.load) as (id: string) => Promise<string | undefined>;
 
-    configResolved({
-      build: { assetsDir: 'assets' },
-      command: 'serve',
-      mode: 'development',
-      plugins: [],
-    } as unknown as import('vite').ResolvedConfig);
+    resolveConfig(plugin, 'serve');
 
     expect(resolveId.call({ environment: { name: 'client' } }, 'void/client/react')).toBe(
       'virtual:void-client-browser:react',
@@ -175,31 +202,18 @@ describe('routingPlugin', () => {
   });
 
   it('refuses to load the route table in the client environment', async () => {
-    const plugin = routingPlugin(createBareTempRoot(), {
+    const plugin = createRoutingPlugin(createBareTempRoot(), {
       isAuthEnabled: () => false,
       devTriggerToken: 'secret-dev-token',
     });
-    const config = getHookHandler(plugin.config) as (
-      config: import('vite').UserConfig,
-      env: import('vite').ConfigEnv,
-    ) => void;
-    const configResolved = getHookHandler(plugin.configResolved) as (
-      config: import('vite').ResolvedConfig,
-    ) => void;
-    const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
     const load = getHookHandler(plugin.load) as (
       this: { environment?: { name?: string } },
       id: string,
     ) => Promise<string | undefined>;
 
-    config({}, { command: 'serve', mode: 'development' });
-    configResolved({
-      build: { assetsDir: 'assets' },
-      command: 'serve',
-      mode: 'development',
-      plugins: [],
-    } as unknown as import('vite').ResolvedConfig);
-    await buildStart.call({} as never);
+    runConfig(plugin, { command: 'serve', mode: 'development' });
+    resolveConfig(plugin, 'serve');
+    await runBuildStart(plugin);
 
     await expect(
       load.call({ environment: { name: 'client' } }, 'virtual:void-routes'),
@@ -209,104 +223,55 @@ describe('routingPlugin', () => {
     ).resolves.toContain('secret-dev-token');
   });
 
-  it('restarts dev when a structural route change changes the asset routing policy', async () => {
-    const root = createTempRoot();
-    writeFileSync(join(root, 'routes', 'api.ts'), 'export const GET = () => new Response();\n');
-
-    const onPolicyChange = vi.fn(() => true);
-    const plugin = routingPlugin(root, {
-      isAuthEnabled: () => false,
-      onDevAssetRoutingPolicyChange: onPolicyChange,
-    });
-    const configResolved = getHookHandler(plugin.configResolved) as (
-      config: import('vite').ResolvedConfig,
-    ) => void;
-    const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
-    const configureServer = getHookHandler(plugin.configureServer) as (server: unknown) => void;
-
-    configResolved({
-      build: { assetsDir: 'assets' },
-      command: 'serve',
-      mode: 'development',
-      plugins: [],
-    } as unknown as import('vite').ResolvedConfig);
-    await buildStart.call({} as never);
-
-    const handlers: Record<string, (path: string) => Promise<void>> = {};
-    const restart = vi.fn(async () => {});
-    configureServer({
-      watcher: {
-        on: vi.fn((event: string, handler: (path: string) => Promise<void>) => {
-          handlers[event] = handler;
-        }),
-      },
-      environments: {},
-      restart,
-    });
-
-    const documentRoute = join(root, 'routes', 'dashboard.ts');
-    writeFileSync(documentRoute, 'export const GET = () => new Response("dashboard");\n');
-    await handlers.add(documentRoute);
-
-    expect(onPolicyChange).toHaveBeenCalledWith(
-      expect.objectContaining({
+  it.each([
+    {
+      change: 'a structural route change',
+      initialRoute: 'api.ts',
+      addedRoute: 'dashboard.ts',
+      policy: {
         assetConfig: expect.objectContaining({ not_found_handling: 'none' }),
         workerFirst: true,
-      }),
-    );
-    expect(restart).toHaveBeenCalledTimes(1);
-  });
-
-  it('restarts dev when adding the first API route changes the asset routing policy', async () => {
-    const root = createTempRoot();
-
-    const onPolicyChange = vi.fn(() => true);
-    const plugin = routingPlugin(root, {
-      isAuthEnabled: () => false,
-      onDevAssetRoutingPolicyChange: onPolicyChange,
-    });
-    const configResolved = getHookHandler(plugin.configResolved) as (
-      config: import('vite').ResolvedConfig,
-    ) => void;
-    const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
-    const configureServer = getHookHandler(plugin.configureServer) as (server: unknown) => void;
-
-    configResolved({
-      build: { assetsDir: 'assets' },
-      command: 'serve',
-      mode: 'development',
-      plugins: [],
-    } as unknown as import('vite').ResolvedConfig);
-    await buildStart.call({} as never);
-
-    const handlers: Record<string, (path: string) => Promise<void>> = {};
-    const restart = vi.fn(async () => {});
-    configureServer({
-      watcher: {
-        on: vi.fn((event: string, handler: (path: string) => Promise<void>) => {
-          handlers[event] = handler;
-        }),
       },
-      environments: {},
-      restart,
-    });
-
-    const apiRoute = join(root, 'routes', 'api.ts');
-    writeFileSync(apiRoute, 'export const GET = () => new Response("api");\n');
-    await handlers.add(apiRoute);
-
-    expect(onPolicyChange).toHaveBeenCalledWith(
-      expect.objectContaining({
+    },
+    {
+      change: 'adding the first API route',
+      initialRoute: undefined,
+      addedRoute: 'api.ts',
+      policy: {
         apiWorkerFirst: true,
         assetConfig: expect.objectContaining({
           not_found_handling: 'single-page-application',
           run_worker_first: ['/api', '/api/*', '/__void', '/__void/*'],
         }),
         workerFirst: false,
-      }),
-    );
-    expect(restart).toHaveBeenCalledTimes(1);
-  });
+      },
+    },
+  ])(
+    'restarts dev when $change changes the asset routing policy',
+    async ({ initialRoute, addedRoute, policy }) => {
+      const root = createTempRoot();
+      const routeSource = 'export const GET = () => new Response();\n';
+      if (initialRoute) {
+        writeFileSync(join(root, 'routes', initialRoute), routeSource);
+      }
+
+      const onPolicyChange = vi.fn(() => true);
+      const plugin = createRoutingPlugin(root, {
+        isAuthEnabled: () => false,
+        onDevAssetRoutingPolicyChange: onPolicyChange,
+      });
+      resolveConfig(plugin, 'serve');
+      await runBuildStart(plugin);
+      const { emit, restart } = startDevServer(plugin);
+
+      const addedPath = join(root, 'routes', addedRoute);
+      writeFileSync(addedPath, routeSource);
+      await emit('add', addedPath);
+
+      expect(onPolicyChange).toHaveBeenCalledWith(expect.objectContaining(policy));
+      expect(restart).toHaveBeenCalledTimes(1);
+    },
+  );
 
   it('invalidates page renderer modules before route table reloads for new pages', async () => {
     const root = createTempRoot();
@@ -316,52 +281,16 @@ describe('routingPlugin', () => {
       'export default function Index() { return null; }',
     );
 
-    const plugin = routingPlugin(root, { isAuthEnabled: () => false });
-    const configureServer = getHookHandler(plugin.configureServer) as (server: unknown) => void;
-    const handlers = new Map<string, Array<(path: string) => Promise<void> | void>>();
-    const invalidated: Array<string> = [];
-    const modules = new Map(
-      ['\0virtual:void-pages-renderer', '\0virtual:void-pages-client', 'virtual:void-routes'].map(
-        (id) => [id, { id }],
-      ),
-    );
-
-    configureServer({
-      watcher: {
-        on(event: string, handler: (path: string) => Promise<void> | void) {
-          const eventHandlers = handlers.get(event) ?? [];
-          eventHandlers.push(handler);
-          handlers.set(event, eventHandlers);
-        },
-      },
-      environments: {
-        void_worker: {
-          moduleGraph: {
-            getModuleById(id: string) {
-              return modules.get(id);
-            },
-            invalidateModule(mod: { id: string }) {
-              invalidated.push(mod.id);
-            },
-          },
-          hot: { send() {} },
-        },
-      },
-    });
+    const plugin = createRoutingPlugin(root, { isAuthEnabled: () => false });
+    const { emit, invalidated } = startDevServer(plugin, PAGE_MODULE_IDS);
 
     writeFileSync(
       join(root, 'pages', 'test.tsx'),
       'export default function Test() { return null; }',
     );
-    for (const handler of handlers.get('add') ?? []) {
-      await handler(join(root, 'pages', 'test.tsx'));
-    }
+    await emit('add', join(root, 'pages', 'test.tsx'));
 
-    expect(invalidated).toEqual([
-      '\0virtual:void-pages-renderer',
-      '\0virtual:void-pages-client',
-      'virtual:void-routes',
-    ]);
+    expect(invalidated).toEqual(PAGE_MODULE_IDS);
   });
 
   it('does not invalidate page renderer modules for component-only page saves', async () => {
@@ -370,43 +299,11 @@ describe('routingPlugin', () => {
     const pagePath = join(root, 'pages', 'index.tsx');
     writeFileSync(pagePath, 'export default function Index() { return null; }');
 
-    const plugin = routingPlugin(root, { isAuthEnabled: () => false });
-    const configureServer = getHookHandler(plugin.configureServer) as (server: unknown) => void;
-    const handlers = new Map<string, Array<(path: string) => Promise<void> | void>>();
-    const invalidated: Array<string> = [];
-    const modules = new Map(
-      ['\0virtual:void-pages-renderer', '\0virtual:void-pages-client', 'virtual:void-routes'].map(
-        (id) => [id, { id }],
-      ),
-    );
-
-    configureServer({
-      watcher: {
-        on(event: string, handler: (path: string) => Promise<void> | void) {
-          const eventHandlers = handlers.get(event) ?? [];
-          eventHandlers.push(handler);
-          handlers.set(event, eventHandlers);
-        },
-      },
-      environments: {
-        void_worker: {
-          moduleGraph: {
-            getModuleById(id: string) {
-              return modules.get(id);
-            },
-            invalidateModule(mod: { id: string }) {
-              invalidated.push(mod.id);
-            },
-          },
-          hot: { send() {} },
-        },
-      },
-    });
+    const plugin = createRoutingPlugin(root, { isAuthEnabled: () => false });
+    const { emit, invalidated } = startDevServer(plugin, PAGE_MODULE_IDS);
 
     writeFileSync(pagePath, 'export default function Index() { return <h1>Updated</h1>; }');
-    for (const handler of handlers.get('change') ?? []) {
-      await handler(pagePath);
-    }
+    await emit('change', pagePath);
 
     expect(invalidated).toEqual(['virtual:void-routes']);
   });
@@ -417,43 +314,15 @@ describe('routingPlugin', () => {
     mkdirSync(join(root, 'src', 'routes'), { recursive: true });
 
     const onPolicyChange = vi.fn(() => false);
-    const plugin = routingPlugin(root, {
+    const plugin = createRoutingPlugin(root, {
       isAuthEnabled: () => false,
       onDevAssetRoutingPolicyChange: onPolicyChange,
     });
-    const configureServer = getHookHandler(plugin.configureServer) as (server: unknown) => void;
-    const handlers = new Map<string, Array<(path: string) => Promise<void> | void>>();
-    const invalidated: Array<string> = [];
-    const modules = new Map([['virtual:void-routes', { id: 'virtual:void-routes' }]]);
-
-    configureServer({
-      watcher: {
-        on(event: string, handler: (path: string) => Promise<void> | void) {
-          const eventHandlers = handlers.get(event) ?? [];
-          eventHandlers.push(handler);
-          handlers.set(event, eventHandlers);
-        },
-      },
-      environments: {
-        void_worker: {
-          moduleGraph: {
-            getModuleById(id: string) {
-              return modules.get(id);
-            },
-            invalidateModule(mod: { id: string }) {
-              invalidated.push(mod.id);
-            },
-          },
-          hot: { send() {} },
-        },
-      },
-    });
+    const { emit, invalidated } = startDevServer(plugin, ['virtual:void-routes']);
 
     const routePath = join(root, 'src', 'routes', 'api.ts');
     writeFileSync(routePath, 'export const GET = () => new Response("ok");\n');
-    for (const handler of handlers.get('add') ?? []) {
-      await handler(routePath);
-    }
+    await emit('add', routePath);
 
     expect(onPolicyChange).toHaveBeenCalled();
     expect(invalidated).toEqual(['virtual:void-routes']);
@@ -467,50 +336,14 @@ describe('routingPlugin', () => {
     writeFileSync(join(root, 'void.json'), JSON.stringify({ sourceDir: 'src' }));
     mkdirSync(join(root, 'src', 'pages'), { recursive: true });
 
-    const plugin = routingPlugin(root, { isAuthEnabled: () => false });
-    const configureServer = getHookHandler(plugin.configureServer) as (server: unknown) => void;
-    const handlers = new Map<string, Array<(path: string) => Promise<void> | void>>();
-    const invalidated: Array<string> = [];
-    const modules = new Map(
-      ['\0virtual:void-pages-renderer', '\0virtual:void-pages-client', 'virtual:void-routes'].map(
-        (id) => [id, { id }],
-      ),
-    );
-
-    configureServer({
-      watcher: {
-        on(event: string, handler: (path: string) => Promise<void> | void) {
-          const eventHandlers = handlers.get(event) ?? [];
-          eventHandlers.push(handler);
-          handlers.set(event, eventHandlers);
-        },
-      },
-      environments: {
-        void_worker: {
-          moduleGraph: {
-            getModuleById(id: string) {
-              return modules.get(id);
-            },
-            invalidateModule(mod: { id: string }) {
-              invalidated.push(mod.id);
-            },
-          },
-          hot: { send() {} },
-        },
-      },
-    });
+    const plugin = createRoutingPlugin(root, { isAuthEnabled: () => false });
+    const { emit, invalidated } = startDevServer(plugin, PAGE_MODULE_IDS);
 
     const pagePath = join(root, 'src', 'pages', 'test.tsx');
     writeFileSync(pagePath, 'export default function Test() { return null; }');
-    for (const handler of handlers.get('add') ?? []) {
-      await handler(pagePath);
-    }
+    await emit('add', pagePath);
 
-    expect(invalidated).toEqual([
-      '\0virtual:void-pages-renderer',
-      '\0virtual:void-pages-client',
-      'virtual:void-routes',
-    ]);
+    expect(invalidated).toEqual(PAGE_MODULE_IDS);
   });
 
   // Manual trigger auth is baked into the route table: dev accepts only the
@@ -530,23 +363,15 @@ describe('routingPlugin', () => {
         'export const cron = "0 * * * *";\nexport default async () => {};\n',
       );
 
-      const plugin = routingPlugin(root, { isAuthEnabled: () => false });
-      const config = getHookHandler(plugin.config) as (
-        config: import('vite').UserConfig,
-        env: import('vite').ConfigEnv,
-      ) => unknown;
-      const configResolved = getHookHandler(plugin.configResolved) as (
-        config: import('vite').ResolvedConfig,
-      ) => void;
+      const plugin = createRoutingPlugin(root, { isAuthEnabled: () => false });
       const load = getHookHandler(plugin.load) as (id: string) => Promise<string | undefined>;
 
-      config({}, { command, mode: command === 'build' ? 'production' : 'development', isPreview });
-      configResolved({
-        build: { assetsDir: 'assets' },
+      runConfig(plugin, {
         command,
-        mode: 'development',
-        plugins: [],
-      } as unknown as import('vite').ResolvedConfig);
+        mode: command === 'build' ? 'production' : 'development',
+        isPreview,
+      });
+      resolveConfig(plugin, command);
 
       const code = await load('virtual:void-routes');
       expect(code).toContain('app.post("/__void/scheduled"');
@@ -563,30 +388,16 @@ describe('routingPlugin', () => {
     'writes the live dev flag for $command (preview: $isPreview) as $dev',
     async ({ command, isPreview, dev }) => {
       const root = createTempRoot();
-      const plugin = routingPlugin(root, {
+      const plugin = createRoutingPlugin(root, {
         isAuthEnabled: () => false,
         live: { bindingName: 'VOID_LIVE', className: 'VoidLiveStreamDurableObject' },
       });
       const entryPath = join(root, '.void', 'entry.ts');
       expect(readFileSync(entryPath, 'utf-8')).not.toContain('__setLiveDev');
 
-      const config = getHookHandler(plugin.config) as (
-        config: import('vite').UserConfig,
-        env: import('vite').ConfigEnv,
-      ) => unknown;
-      const configResolved = getHookHandler(plugin.configResolved) as (
-        config: import('vite').ResolvedConfig,
-      ) => void;
-      const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
-
-      config({}, { command, mode: 'development', isPreview });
-      configResolved({
-        build: { assetsDir: 'assets' },
-        command,
-        mode: 'development',
-        plugins: [],
-      } as unknown as import('vite').ResolvedConfig);
-      await buildStart.call({} as never);
+      runConfig(plugin, { command, mode: 'development', isPreview });
+      resolveConfig(plugin, command);
+      await runBuildStart(plugin);
 
       const entry = readFileSync(entryPath, 'utf-8');
       expect(entry).toContain('__setLiveBindingName("VOID_LIVE")');
diff --git a/packages/void/test/unit/plugin-version-metadata.test.ts b/packages/void/test/unit/plugin-version-metadata.test.ts
index e29b24728..98f428c60 100644
--- a/packages/void/test/unit/plugin-version-metadata.test.ts
+++ b/packages/void/test/unit/plugin-version-metadata.test.ts
@@ -1,7 +1,7 @@
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import type { ConfigEnv, Plugin, UserConfig } from 'vite';
+import type { ConfigEnv, UserConfig } from 'vite';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { createWorkerFetch } from '../../src/runtime/routing-worker.ts';
 import { CLOUDFLARE_DEPLOY_BUILD_ENV } from '../../src/shared/env.ts';
@@ -11,11 +11,7 @@ import {
 } from '../../src/shared/version-metadata.ts';
 
 type Config = { config: (resolved: Record<string, unknown>) => Record<string, unknown> };
-vi.mock('@cloudflare/vite-plugin', () => ({
-  cloudflare(config: Config): Array<Plugin> {
-    return [{ name: 'mock:cloudflare', api: { config } }];
-  },
-}));
+vi.mock('@cloudflare/vite-plugin', () => import('../helpers/cloudflare-vite-plugin.ts'));
 vi.mock('../../src/cli/auth.ts', async (original) => ({
   ...(await original<typeof import('../../src/cli/auth.ts')>()),
   getToken: () => null,
@@ -56,7 +52,7 @@ async function generate(resolved: Record<string, unknown>, command: 'build' | 's
   if (!cloudflare) {
     throw new Error('Cloudflare configuration callback missing');
   }
-  const patch = (cloudflare.api as { config: Config }).config.config(resolved);
+  const patch = (cloudflare.api as { pluginConfig: Config }).pluginConfig.config(resolved);
   const routingHook = plugins.find((plugin) => plugin.name === 'void:routing')?.buildStart;
   const buildStart = typeof routingHook === 'function' ? routingHook : routingHook?.handler;
   if (!buildStart) {
diff --git a/packages/void/test/unit/postgres-concurrency-tests.test.ts b/packages/void/test/unit/postgres-concurrency-tests.test.ts
deleted file mode 100644
index 4b959ad5d..000000000
--- a/packages/void/test/unit/postgres-concurrency-tests.test.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { afterEach, describe, expect, it } from 'vite-plus/test';
-import { postgresConcurrencyTestFiles } from '../../../../.github/scripts/postgres-concurrency-tests.ts';
-
-const roots: Array<string> = [];
-
-function createFixture(files: Record<string, string>): string {
-  const root = mkdtempSync(join(tmpdir(), 'void-postgres-selection-'));
-  roots.push(root);
-  const directory = join(root, 'platform/packages/api/test/integration');
-  mkdirSync(directory, { recursive: true });
-  for (const [file, source] of Object.entries(files)) {
-    const path = join(directory, file);
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, source);
-  }
-  return root;
-}
-
-afterEach(() => {
-  for (const root of roots.splice(0)) {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-describe('PostgreSQL concurrency test selection', () => {
-  it('finds direct, aliased, multiline and computed environment gates without selecting comments', () => {
-    const root = createFixture({
-      'direct.test.ts': 'it.runIf(Boolean(process.env.VOID_TEST_DATABASE_URL))("race", () => {});',
-      'aliased.test.ts': 'const postgres = it.runIf(Boolean(process.env.VOID_TEST_DATABASE_URL));',
-      'nested/multiline.test.ts': `it
-        .runIf(Boolean(process.env.VOID_TEST_DATABASE_URL))
-        .each(['one', 'two'])('race', () => {});`,
-      'computed.test.ts': `const connectionString = process['env']['VOID_TEST_DATABASE_URL'];`,
-      'ordinary.test.ts': 'it("ordinary test", () => {});',
-      'comment.test.ts': '// it.runIf(Boolean(process.env.VOID_TEST_DATABASE_URL));',
-      'string.test.ts': `const example = 'process.env.VOID_TEST_DATABASE_URL';`,
-      'helper.ts': 'const databaseUrl = process.env.VOID_TEST_DATABASE_URL;',
-    });
-    expect(postgresConcurrencyTestFiles(root)).toEqual(
-      ['aliased.test.ts', 'computed.test.ts', 'direct.test.ts', 'nested/multiline.test.ts'].map(
-        (file) => `platform/packages/api/test/integration/${file}`,
-      ),
-    );
-  });
-
-  it('fails when there is no real PostgreSQL coverage to execute', () => {
-    const root = createFixture({ 'ordinary.test.ts': 'it("ordinary test", () => {});' });
-    expect(() => postgresConcurrencyTestFiles(root)).toThrow(
-      'No PostgreSQL concurrency test files',
-    );
-  });
-
-  it('fails on an invalid test file instead of silently omitting its coverage', () => {
-    const root = createFixture({ 'invalid.test.ts': 'it.runIf(' });
-    expect(() => postgresConcurrencyTestFiles(root)).toThrow(
-      'Cannot inspect PostgreSQL test coverage',
-    );
-  });
-});
diff --git a/packages/void/test/unit/prefetch.test.ts b/packages/void/test/unit/prefetch.test.ts
index 344e959bc..ac5109478 100644
--- a/packages/void/test/unit/prefetch.test.ts
+++ b/packages/void/test/unit/prefetch.test.ts
@@ -142,18 +142,12 @@ describe('PrefetchCache', () => {
 
   it('expired entries are not returned by get', () => {
     const cache = new PrefetchCache();
-    // Use a past timestamp by directly manipulating staleAt/expiresAt via a zero-duration entry
-    // then advance conceptually. We instead set a very short TTL and use a manipulated entry.
-    // Since we can't mock Date.now() without vi.useFakeTimers here, we use a workaround:
-    // set the entry then manually expire it by setting expiresAt in the past.
     cache.set('http://example.com/api/data', 'GET', Promise.resolve({}), {
       stale: 10000,
       expires: 10000,
     });
     const entry = cache.get('http://example.com/api/data')!;
-    // Manually set expiresAt to the past
     (entry as { expiresAt: number }).expiresAt = Date.now() - 1;
-    // Non-singleUse entry past expiresAt should be removed on next get
     expect(cache.get('http://example.com/api/data')).toBeNull();
   });
 
diff --git a/packages/void/test/unit/prepare-args.test.ts b/packages/void/test/unit/prepare-args.test.ts
index 28adcb7c2..3c5c3c10e 100644
--- a/packages/void/test/unit/prepare-args.test.ts
+++ b/packages/void/test/unit/prepare-args.test.ts
@@ -3,7 +3,7 @@ import { parsePrepareArgs } from '../../src/cli/prepare-args.ts';
 
 describe('parsePrepareArgs', () => {
   it('accepts no arguments', () => {
-    expect(parsePrepareArgs([])).toEqual({});
+    expect(() => parsePrepareArgs([])).not.toThrow();
   });
 
   it('rejects unexpected positional arguments', () => {
diff --git a/packages/void/test/unit/prerender.test.ts b/packages/void/test/unit/prerender.test.ts
index de8554a05..a1893cc57 100644
--- a/packages/void/test/unit/prerender.test.ts
+++ b/packages/void/test/unit/prerender.test.ts
@@ -21,14 +21,8 @@ function createTempWorkerDir(): string {
 }
 
 describe('stripInternalEnvKeys', () => {
-  it('returns empty sanitized + empty stripped for undefined input', () => {
-    const result = stripInternalEnvKeys(undefined);
-    expect(result.sanitized).toEqual({});
-    expect(result.stripped).toEqual([]);
-  });
-
-  it('returns empty sanitized + empty stripped for empty object', () => {
-    const result = stripInternalEnvKeys({});
+  it.each([undefined, {}])('returns empty sanitized + empty stripped for %j', (input) => {
+    const result = stripInternalEnvKeys(input);
     expect(result.sanitized).toEqual({});
     expect(result.stripped).toEqual([]);
   });
@@ -230,7 +224,6 @@ describe('buildPrerenderBindings', () => {
   it('passes only the selected proxy Access credentials to the local Worker', () => {
     const result = buildPrerenderBindings({
       wranglerVars: {},
-      env: {},
       voidToken: 'human',
       voidProjectId: 'project',
       voidProxyUrl: 'https://proxy.example.com',
@@ -247,50 +240,25 @@ describe('buildPrerenderBindings', () => {
     });
     expect(JSON.stringify(result)).not.toContain('api-proof');
   });
-  it('omits __VOID_* bindings when the token is missing', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: {},
-      env: {},
-      voidToken: null,
-      voidProjectId: 'proj',
-      voidProxyUrl: 'https://proxy.example.test',
-      remoteMode: false,
-    });
-
-    expect(result).toStrictEqual({});
-    expect(Object.keys(result).some((key) => key.startsWith('__VOID_'))).toBe(false);
-  });
 
-  it('omits __VOID_* bindings when the projectId is missing', () => {
+  it.each([
+    { voidToken: null, voidProjectId: 'proj', remoteMode: false },
+    { voidToken: 'tkn', voidProjectId: undefined, remoteMode: false },
+    { voidToken: null, voidProjectId: undefined, remoteMode: false },
+    { voidToken: null, voidProjectId: undefined, remoteMode: true },
+  ])('omits __VOID_* bindings without both token and projectId (%j)', (credentials) => {
     const result = buildPrerenderBindings({
       wranglerVars: {},
-      env: {},
-      voidToken: 'tkn',
-      voidProjectId: undefined,
-      remoteMode: false,
-    });
-
-    expect(result).toStrictEqual({});
-    expect(Object.keys(result).some((key) => key.startsWith('__VOID_'))).toBe(false);
-  });
-
-  it('omits __VOID_* bindings when both token and projectId are missing', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: {},
-      env: {},
-      voidToken: null,
-      voidProjectId: undefined,
-      remoteMode: false,
+      voidProxyUrl: 'https://proxy.example.test',
+      ...credentials,
     });
 
     expect(result).toStrictEqual({});
-    expect(Object.keys(result).some((key) => key.startsWith('__VOID_'))).toBe(false);
   });
 
   it('sets credentials and the selected proxy URL when token+projectId are present', () => {
     const result = buildPrerenderBindings({
       wranglerVars: {},
-      env: {},
       voidToken: 'tkn',
       voidProjectId: 'proj',
       voidProxyUrl: 'https://proxy.example.test',
@@ -308,7 +276,6 @@ describe('buildPrerenderBindings', () => {
     expect(() =>
       buildPrerenderBindings({
         wranglerVars: {},
-        env: {},
         voidToken: 'token',
         voidProjectId: 'project',
         remoteMode: true,
@@ -316,24 +283,9 @@ describe('buildPrerenderBindings', () => {
     ).toThrow('No connected platform proxy');
   });
 
-  it('pins custom platform credentials to its discovered proxy', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: {},
-      env: {},
-      voidToken: 'custom-token',
-      voidProjectId: 'custom-project',
-      voidProxyUrl: 'https://void-company-proxy.example.workers.dev',
-      remoteMode: true,
-    });
-
-    expect(result.__VOID_PROXY_URL).toBe('https://void-company-proxy.example.workers.dev');
-    expect(JSON.stringify(result)).not.toContain('proxy.void.cloud');
-  });
-
   it('sets __VOID_REMOTE when remote mode is enabled', () => {
     const result = buildPrerenderBindings({
       wranglerVars: {},
-      env: {},
       voidToken: 'tkn',
       voidProjectId: 'proj',
       voidProxyUrl: 'https://proxy.example.test',
@@ -343,114 +295,28 @@ describe('buildPrerenderBindings', () => {
     expect(result.__VOID_REMOTE).toBe('1');
   });
 
-  it('does not set __VOID_REMOTE when credentials are missing', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: {},
-      env: {},
-      voidToken: null,
-      voidProjectId: undefined,
-      remoteMode: true,
-    });
-
-    expect(result).not.toHaveProperty('__VOID_REMOTE');
-    expect(Object.keys(result).some((key) => key.startsWith('__VOID_'))).toBe(false);
-  });
-
-  it('passes user wranglerVars through to the final bindings record', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: { API_URL: 'https://api.example.com' },
-      env: {},
-      voidToken: null,
-      voidProjectId: undefined,
-      remoteMode: false,
-    });
-
-    expect(result.API_URL).toBe('https://api.example.com');
-  });
-
-  it('passes filtered dotenv vars through to the final bindings record', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: {},
-      env: { FOO: 'bar' },
-      voidToken: null,
-      voidProjectId: undefined,
-      remoteMode: false,
-    });
-
-    expect(result.FOO).toBe('bar');
-  });
-
-  it('overrides user wranglerVars with __VOID_* bindings of the same name', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: { __VOID_TOKEN: 'USER_SET_WRONG' },
-      env: {},
-      voidToken: 'real',
-      voidProjectId: 'proj',
-      voidProxyUrl: 'https://proxy.example.test',
-      remoteMode: false,
-    });
-
-    expect(result.__VOID_TOKEN).toBe('real');
-  });
-
-  it('strips __VOID_TOKEN from wranglerVars when credentials are absent', () => {
+  it('keeps user wranglerVars and strips internal keys when credentials are absent', () => {
     const result = buildPrerenderBindings({
-      wranglerVars: { __VOID_TOKEN: 'polluted-token', API_URL: 'https://api.example.com' },
-      env: {},
-      voidToken: null,
-      voidProjectId: undefined,
-      remoteMode: false,
-    });
-
-    expect(result).not.toHaveProperty('__VOID_TOKEN');
-    expect(result.API_URL).toBe('https://api.example.com');
-  });
-
-  it('strips __VOID_REMOTE from env when credentials are absent', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: {},
-      env: { __VOID_REMOTE: '1', FOO: 'bar' },
-      voidToken: null,
-      voidProjectId: undefined,
-      remoteMode: false,
-    });
-
-    expect(result).not.toHaveProperty('__VOID_REMOTE');
-    expect(result.FOO).toBe('bar');
-  });
-
-  it('strips __VOID_PROJECT_ID from wranglerVars when credentials are absent', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: { __VOID_PROJECT_ID: 'polluted-project' },
-      env: {},
-      voidToken: null,
-      voidProjectId: undefined,
-      remoteMode: false,
-    });
-
-    expect(result).not.toHaveProperty('__VOID_PROJECT_ID');
-  });
-
-  it('strips polluted __VOID_* from both wranglerVars and env simultaneously', () => {
-    const result = buildPrerenderBindings({
-      wranglerVars: { __VOID_TOKEN: 'wv-poll', API_URL: 'https://api.example.com' },
-      env: { __VOID_REMOTE: '1', __VOID_STAGING: '1', FOO: 'bar' },
+      wranglerVars: {
+        __VOID_TOKEN: 'polluted-token',
+        __VOID_PROJECT_ID: 'polluted-project',
+        API_URL: 'https://api.example.com',
+      },
       voidToken: null,
       voidProjectId: undefined,
       remoteMode: false,
     });
 
-    expect(result).not.toHaveProperty('__VOID_TOKEN');
-    expect(result).not.toHaveProperty('__VOID_REMOTE');
-    expect(result).not.toHaveProperty('__VOID_STAGING');
-    expect(result.API_URL).toBe('https://api.example.com');
-    expect(result.FOO).toBe('bar');
+    expect(result).toStrictEqual({ API_URL: 'https://api.example.com' });
   });
 
   it('still strips polluted __VOID_* even when real credentials are present', () => {
     const result = buildPrerenderBindings({
-      wranglerVars: { __VOID_TOKEN: 'wv-poll', __VOID_PROXY_TOKEN: 'poll' },
-      env: { __VOID_PROXY_URL: 'https://evil.example.com' },
+      wranglerVars: {
+        __VOID_TOKEN: 'wv-poll',
+        __VOID_PROXY_TOKEN: 'poll',
+        __VOID_PROXY_URL: 'https://evil.example.com',
+      },
       voidToken: 'real',
       voidProjectId: 'proj',
       voidProxyUrl: 'https://proxy.example.test',
diff --git a/packages/void/test/unit/preset.test.ts b/packages/void/test/unit/preset.test.ts
index ca73dd47c..36080005f 100644
--- a/packages/void/test/unit/preset.test.ts
+++ b/packages/void/test/unit/preset.test.ts
@@ -9,7 +9,6 @@ import {
   formatProjectCommand,
   hasBackendFiles,
   resolveProjectCommand,
-  resolveCloudflareOperationArgv,
 } from '../../src/cli/preset.ts';
 
 const TMP = join(import.meta.dirname, '.tmp-preset');
@@ -100,50 +99,16 @@ describe('detectPreset', () => {
     });
   });
 
-  it('returns null when routes/ dir exists (backend files)', () => {
-    const root = setupProject({
-      pkg: { dependencies: { vite: '^6.0.0' } },
-      dirs: ['routes'],
-    });
-    const result = detectPreset(root);
-    expect(result).toBeNull();
-  });
-
-  it('returns null when crons/ dir exists (backend files)', () => {
-    const root = setupProject({
-      pkg: { dependencies: { vite: '^6.0.0' } },
-      dirs: ['crons'],
-    });
-    const result = detectPreset(root);
-    expect(result).toBeNull();
-  });
-
-  it('returns null when middleware/ dir exists (backend files)', () => {
-    const root = setupProject({
-      pkg: { dependencies: { vite: '^6.0.0' } },
-      dirs: ['middleware'],
-    });
-    const result = detectPreset(root);
-    expect(result).toBeNull();
-  });
-
-  it('returns null when pages/ dir exists (backend files)', () => {
-    const root = setupProject({
-      pkg: { dependencies: { vite: '^6.0.0' } },
-      dirs: ['pages'],
-    });
-    const result = detectPreset(root);
-    expect(result).toBeNull();
-  });
-
-  it('returns null when queues/ dir exists (backend files)', () => {
-    const root = setupProject({
-      pkg: { dependencies: { vite: '^6.0.0' } },
-      dirs: ['queues'],
-    });
-    const result = detectPreset(root);
-    expect(result).toBeNull();
-  });
+  it.each(['routes', 'crons', 'middleware', 'pages', 'queues'])(
+    'returns null when %s/ dir exists (backend files)',
+    (dir) => {
+      const root = setupProject({
+        pkg: { dependencies: { vite: '^6.0.0' } },
+        dirs: [dir],
+      });
+      expect(detectPreset(root)).toBeNull();
+    },
+  );
 
   it('detects plain Vite SPA (no backend files)', () => {
     const root = setupProject({
@@ -330,12 +295,6 @@ describe('findBackendSources', () => {
     expect(findBackendSources(root)).toEqual([]);
     expect(hasBackendFiles(root)).toBe(false);
   });
-
-  it('agrees with hasBackendFiles when a backend exists', () => {
-    const root = setupProject({ dirs: ['queues'] });
-    expect(findBackendSources(root)).toEqual(['queues/']);
-    expect(hasBackendFiles(root)).toBe(true);
-  });
 });
 
 describe('project Vite commands', () => {
@@ -370,48 +329,6 @@ describe('project Vite commands', () => {
   });
 });
 
-describe('resolveProjectCommand with Wrangler', () => {
-  it('resolves to the local wrangler binary with the subcommand', () => {
-    const root = setupProject({
-      pkg: { dependencies: { wrangler: '^4.0.0' } },
-      files: { 'node_modules/.bin/wrangler': '' },
-    });
-
-    expect(resolveProjectCommand(root, 'wrangler deploy')).toBe(
-      `${toSlash(join(root, 'node_modules', '.bin', 'wrangler'))} deploy`,
-    );
-  });
-
-  it('preserves multi-argument subcommands', () => {
-    const root = setupProject({
-      pkg: { dependencies: { wrangler: '^4.0.0' } },
-      files: { 'node_modules/.bin/wrangler': '' },
-    });
-
-    expect(resolveProjectCommand(root, 'wrangler d1 create foo --binding DB --update-config')).toBe(
-      `${toSlash(join(root, 'node_modules', '.bin', 'wrangler'))} d1 create foo --binding DB --update-config`,
-    );
-  });
-
-  it('falls back to a bare wrangler command when no local binary exists', () => {
-    const root = setupProject({
-      pkg: { dependencies: { wrangler: '^4.0.0' } },
-    });
-
-    expect(resolveProjectCommand(root, 'wrangler deploy')).toBe('wrangler deploy');
-  });
-});
-
-describe('Cloudflare command transport', () => {
-  it('resolves Void’s bundled cf adapter independently of an app-installed Wrangler', () => {
-    const root = setupProject({ pkg: { dependencies: { wrangler: '^3.0.0' } } });
-    const argv = resolveCloudflareOperationArgv(root);
-    expect(argv[0]).toBe(process.execPath);
-    expect(argv[1].replace(/\\/g, '/')).toMatch(/\/cloudflare-operation-process\.ts$/);
-    expect(argv[1]).not.toContain(root);
-  });
-});
-
 describe('resolveProjectCommand shell safety (project root with spaces)', () => {
   // A dedicated root whose path contains a space + a single quote — both are
   // shell-significant and must be quoted before the string reaches execSync.
@@ -437,29 +354,29 @@ describe('resolveProjectCommand shell safety (project root with spaces)', () =>
   }
 
   it('quotes the resolved executable path so the shell does not word-split it', () => {
-    const { root, binPath } = setupSpacedProject('wrangler');
-    const cmd = resolveProjectCommand(root, 'wrangler deploy');
+    const { root, binPath } = setupSpacedProject('vitepress');
+    const cmd = resolveProjectCommand(root, 'vitepress build');
 
     // The bin path (which contains a space and a single quote) must be quoted
     // as a single token, not left as a bare substring the shell would split.
-    expect(cmd).not.toBe(`${binPath} deploy`);
-    expect(cmd.endsWith(' deploy')).toBe(true);
+    expect(cmd).not.toBe(`${binPath} build`);
+    expect(cmd.endsWith(' build')).toBe(true);
     if (process.platform === 'win32') {
-      expect(cmd).toBe(`"${toSlash(binPath)}" deploy`);
+      expect(cmd).toBe(`"${toSlash(binPath)}" build`);
     } else {
       // POSIX single-quote wrap, embedded `'` escaped as '\''.
-      expect(cmd).toBe(`'${binPath.replace(/'/g, "'\\''")}' deploy`);
+      expect(cmd).toBe(`'${binPath.replace(/'/g, "'\\''")}' build`);
     }
   });
 
   it.skipIf(process.platform === 'win32')(
     'executes the correct binary through a shell for a spaced root',
     () => {
-      const { root } = setupSpacedProject('wrangler');
-      const cmd = resolveProjectCommand(root, 'wrangler deploy --dry-run');
+      const { root } = setupSpacedProject('vitepress');
+      const cmd = resolveProjectCommand(root, 'vitepress build docs');
       const out = execSync(cmd, { encoding: 'utf-8' });
       expect(out).toContain('VOID_BIN_OK');
-      expect(out).toContain('args=deploy --dry-run');
+      expect(out).toContain('args=build docs');
     },
   );
 
diff --git a/packages/void/test/unit/production-baseline.test.ts b/packages/void/test/unit/production-baseline.test.ts
deleted file mode 100644
index 9f4d27028..000000000
--- a/packages/void/test/unit/production-baseline.test.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-import { describe, expect, it, vi } from 'vite-plus/test';
-import { productionBaseline } from '../../../../.github/scripts/production-baseline.ts';
-
-describe('production compatibility baseline', () => {
-  const old = 'a'.repeat(40);
-  const candidate = 'b'.repeat(40);
-  it('accepts an explicitly pinned revision without network access', async () => {
-    const request = vi.fn();
-    expect(await productionBaseline({ configuredSha: old, repository: '', request })).toBe(old);
-    expect(request).not.toHaveBeenCalled();
-  });
-  it.each(['prod', 'v0.10.14', 'main', `${old}\n`])(
-    'rejects mutable or malformed baseline %s',
-    async (configuredSha) => {
-      await expect(productionBaseline({ configuredSha, repository: '' })).rejects.toThrow(
-        'immutable',
-      );
-    },
-  );
-  it('selects the successful deployment instead of a pending candidate', async () => {
-    const request = vi
-      .fn<typeof fetch>()
-      .mockResolvedValueOnce(
-        Response.json([
-          { id: 2, environment: 'Prod', sha: candidate },
-          { id: 1, environment: 'Prod', sha: old },
-        ]),
-      )
-      .mockResolvedValueOnce(Response.json([{ state: 'pending' }]))
-      .mockResolvedValueOnce(Response.json([{ state: 'success' }]));
-    expect(await productionBaseline({ repository: 'owner/repo', token: 'test', request })).toBe(
-      old,
-    );
-  });
-  it('fails closed without a completed deployment or on a history read failure', async () => {
-    const request = vi.fn<typeof fetch>().mockResolvedValue(Response.json([]));
-    await expect(
-      productionBaseline({ repository: 'owner/repo', token: 'test', request }),
-    ).rejects.toThrow('No successful');
-    request.mockResolvedValue(new Response(null, { status: 403 }));
-    await expect(
-      productionBaseline({ repository: 'owner/repo', token: 'test', request }),
-    ).rejects.toThrow('(403)');
-  });
-});
diff --git a/packages/void/test/unit/project-config.test.ts b/packages/void/test/unit/project-config.test.ts
index f09fce1c8..3570a4292 100644
--- a/packages/void/test/unit/project-config.test.ts
+++ b/packages/void/test/unit/project-config.test.ts
@@ -184,21 +184,16 @@ describe('project config', () => {
       writeProjectJson(root, { platformUrl, projectId: 'project', slug: 'demo' });
       expect(() => getApiUrl(root)).toThrow(`void connect ${platformUrl}`);
       expect(() =>
-        attachSelectedPlatform(root, { projectId: 'project', slug: 'demo' }, platformUrl),
+        attachSelectedPlatform({ projectId: 'project', slug: 'demo' }, platformUrl),
       ).toThrow('No verified metadata');
     },
   );
 
   it('attaches the operation platform instead of the active connection', () => {
-    const root = makeRoot();
     connection('https://b.example.test');
     connection('https://a.example.test');
     expect(
-      attachSelectedPlatform(
-        root,
-        { projectId: 'project-b', slug: 'app-b' },
-        'https://b.example.test',
-      ),
+      attachSelectedPlatform({ projectId: 'project-b', slug: 'app-b' }, 'https://b.example.test'),
     ).toEqual({
       applicationDomain: 'apps.example.test',
       platformUrl: 'https://b.example.test',
diff --git a/packages/void/test/unit/project-delete-command.test.ts b/packages/void/test/unit/project-delete-command.test.ts
index 0ba4e0be5..9ac0a988d 100644
--- a/packages/void/test/unit/project-delete-command.test.ts
+++ b/packages/void/test/unit/project-delete-command.test.ts
@@ -2,6 +2,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
+import { captureOutput } from '../helpers/cli-command.ts';
 
 vi.mock('../../src/cli/auth', async (importOriginal) => ({
   ...(await importOriginal<typeof import('../../src/cli/auth.ts')>()),
@@ -29,24 +30,6 @@ afterEach(() => {
   }
 });
 
-function captureOutput(): { output: () => string; restore: () => void } {
-  const chunks: Array<string> = [];
-  const write = vi.spyOn(process.stdout, 'write').mockImplementation((chunk: unknown) => {
-    chunks.push(String(chunk));
-    return true;
-  });
-  const log = vi.spyOn(console, 'log').mockImplementation((...args: Array<unknown>) => {
-    chunks.push(args.map(String).join(' ') + '\n');
-  });
-  return {
-    output: () => chunks.join(''),
-    restore: () => {
-      write.mockRestore();
-      log.mockRestore();
-    },
-  };
-}
-
 describe('void project delete', () => {
   it('reports the deletion once', async () => {
     const root = mkdtempSync(join(tmpdir(), 'void-root-'));
diff --git a/packages/void/test/unit/project-team-command.test.ts b/packages/void/test/unit/project-team-command.test.ts
index 492ab67be..07d548429 100644
--- a/packages/void/test/unit/project-team-command.test.ts
+++ b/packages/void/test/unit/project-team-command.test.ts
@@ -58,6 +58,8 @@ beforeEach(() => {
   keyring.read.mockReset().mockReturnValue(null);
   keyring.write.mockReset().mockReturnValue(true);
   keyring.remove.mockReset().mockReturnValue(true);
+  vi.spyOn(console, 'log').mockImplementation(() => undefined);
+  vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
 });
 
 afterEach(() => {
@@ -93,8 +95,6 @@ describe('project team target selection', () => {
         : Response.json({});
     });
     vi.stubGlobal('fetch', withPlatformDiscovery(fetchMock));
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
 
     await runProjectCommand(root, { subcommand: 'team', action: 'pending' });
     await runProjectCommand(root, {
@@ -123,7 +123,6 @@ describe('project team target selection', () => {
       const root = rootWithPlatform(platform, { platformUrl: platformA });
       const projectPath = join(root, '.void', 'project.json');
       const originalProject = readFileSync(projectPath, 'utf8');
-      vi.stubEnv('VOID_PLATFORM_REGISTRY_DIR', join(root, 'registry'));
       connect(platformA, 'Platform A');
       connect(platformB, 'Platform B');
       keyring.read.mockImplementation((service: string, account: string) => {
@@ -143,8 +142,6 @@ describe('project team target selection', () => {
           : Response.json({});
       });
       vi.stubGlobal('fetch', withPlatformDiscovery(fetchMock));
-      vi.spyOn(console, 'log').mockImplementation(() => undefined);
-      vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
 
       chmodSync(projectPath, 0o444);
       chmodSync(join(root, '.void'), 0o555);
@@ -185,7 +182,6 @@ describe('project team target selection', () => {
       const platformA = 'https://platform-a.example.test';
       const platformB = 'https://platform-b.example.test';
       const root = rootWithPlatform(platform, { platformUrl: platformA });
-      vi.stubEnv('VOID_PLATFORM_REGISTRY_DIR', join(root, 'registry'));
       vi.stubEnv('VOID_TOKEN', 'void-cloud-token');
       vi.stubEnv('VOID_API_URL', undefined);
       connect(platformA, 'Platform A');
@@ -197,8 +193,6 @@ describe('project team target selection', () => {
       );
       const fetchMock = vi.fn(async () => Response.json({ invitations: [] }));
       vi.stubGlobal('fetch', withPlatformDiscovery(fetchMock));
-      vi.spyOn(console, 'log').mockImplementation(() => undefined);
-      vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
 
       await expect(
         runProjectCommand(root, { subcommand: 'team', action: 'pending' }),
@@ -209,14 +203,12 @@ describe('project team target selection', () => {
 
   it('uses an explicit environment origin and its matching token over saved project and active connections', async () => {
     const root = rootWithPlatform('void', { platformUrl: 'https://platform-a.example.test' });
-    vi.stubEnv('VOID_PLATFORM_REGISTRY_DIR', join(root, 'registry'));
     connect('https://platform-b.example.test', 'Platform B');
     connect('https://platform-c.example.test', 'Platform C');
     vi.stubEnv('VOID_API_URL', 'https://platform-c.example.test/');
     vi.stubEnv('VOID_TOKEN', 'platform-c-token');
     const fetchMock = vi.fn(async () => Response.json({ invitations: [] }));
     vi.stubGlobal('fetch', withPlatformDiscovery(fetchMock));
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
     const output: Array<string> = [];
     vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
       output.push(String(chunk));
@@ -238,7 +230,6 @@ describe('project team target selection', () => {
     const platformA = 'https://platform-a.example.test';
     const platformB = 'https://platform-b.example.test';
     const root = rootWithPlatform('void', { platformUrl: platformA });
-    vi.stubEnv('VOID_PLATFORM_REGISTRY_DIR', join(root, 'registry'));
     connect(platformA, 'Platform A');
     connect(platformB, 'Platform B');
     keyring.read.mockImplementation((service: string, account: string) =>
@@ -248,8 +239,6 @@ describe('project team target selection', () => {
     );
     const fetchMock = vi.fn();
     vi.stubGlobal('fetch', withPlatformDiscovery(fetchMock));
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
     vi.spyOn(process, 'exit').mockImplementation(() => {
       throw new Error('missing login');
     });
@@ -264,7 +253,6 @@ describe('project team target selection', () => {
     const platformA = 'https://platform-a.example.test';
     const platformB = 'https://platform-b.example.test';
     const root = rootWithPlatform('void', { platformUrl: platformA });
-    vi.stubEnv('VOID_PLATFORM_REGISTRY_DIR', join(root, 'registry'));
     connect(platformA, 'Platform A');
     connect(platformB, 'Platform B');
     keyring.read.mockImplementation((service: string, account: string) => {
@@ -282,8 +270,6 @@ describe('project team target selection', () => {
       }),
     );
     vi.stubGlobal('fetch', withPlatformDiscovery(fetchMock));
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
 
     await runProjectCommand(root, {
       subcommand: 'team',
@@ -320,7 +306,6 @@ describe('project team target selection', () => {
       written += String(chunk);
       return true;
     });
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
     const warnedAt: Array<number> = [];
     const warn = vi.spyOn(log, 'warn').mockImplementation(() => {
       warnedAt.push(written.length);
@@ -362,8 +347,6 @@ describe('project team target selection', () => {
         }),
       );
     vi.stubGlobal('fetch', withPlatformDiscovery(fetchMock));
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
 
     await runProjectCommand(root, {
       subcommand: 'team',
@@ -397,7 +380,6 @@ describe('project team target selection', () => {
         }),
       ),
     );
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
     const output: Array<string> = [];
     vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
       output.push(String(chunk));
@@ -432,7 +414,6 @@ describe('project team target selection', () => {
           }),
         ),
       );
-      vi.spyOn(console, 'log').mockImplementation(() => undefined);
       const output: Array<string> = [];
       vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
         output.push(String(chunk));
@@ -488,8 +469,6 @@ describe('project team target selection', () => {
       'fetch',
       vi.fn(async () => Response.json({ error }, { status })),
     );
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
 
     const result = runProjectCommand(root, {
       subcommand: 'team',
@@ -518,8 +497,6 @@ describe('project team target selection', () => {
       'fetch',
       vi.fn(async () => new Response(body, { status: 403 })),
     );
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
     const error = await runProjectCommand(root, {
       subcommand: 'team',
       action: 'accept',
@@ -541,8 +518,6 @@ describe('project team target selection', () => {
         Response.json({ error: 'user is already a project member' }, { status: 409 }),
       ),
     );
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
     await expect(
       runProjectCommand(root, {
         subcommand: 'team',
diff --git a/packages/void/test/unit/project-tsconfig.test.ts b/packages/void/test/unit/project-tsconfig.test.ts
index f942f7585..01eb329cb 100644
--- a/packages/void/test/unit/project-tsconfig.test.ts
+++ b/packages/void/test/unit/project-tsconfig.test.ts
@@ -1,12 +1,4 @@
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  statSync,
-  utimesSync,
-  writeFileSync,
-} from 'node:fs';
+import { mkdirSync, readFileSync, rmSync, statSync, utimesSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vite-plus/test';
@@ -31,19 +23,6 @@ describe('ensureProjectTsconfig', () => {
     return JSON.parse(readFileSync(join(root, '.void', 'tsconfig.json'), 'utf-8'));
   }
 
-  it('creates tsconfig.json in .void directory', () => {
-    ensureProjectTsconfig(root);
-    expect(existsSync(join(root, '.void', 'tsconfig.json'))).toBe(true);
-  });
-
-  it('includes routes.d.ts when routes/ directory exists', () => {
-    mkdirSync(join(root, 'routes'), { recursive: true });
-    ensureProjectTsconfig(root);
-    const tsconfig = readTsconfig();
-    expect(tsconfig.files).toContain('routes.d.ts');
-    expect(tsconfig.compilerOptions.paths['void/routes']).toEqual(['./routes.d.ts']);
-  });
-
   it('uses sourceDir conventions for route, queue, and schema paths', () => {
     writeFileSync(join(root, 'void.json'), JSON.stringify({ sourceDir: 'src' }));
     mkdirSync(join(root, 'src', 'routes'), { recursive: true });
@@ -71,32 +50,7 @@ describe('ensureProjectTsconfig', () => {
     ensureProjectTsconfig(root, true);
     const tsconfig = readTsconfig();
     expect(tsconfig.files).toContain('routes.d.ts');
-  });
-
-  it('includes queues.d.ts when queues/ directory exists', () => {
-    mkdirSync(join(root, 'queues'), { recursive: true });
-    ensureProjectTsconfig(root);
-    const tsconfig = readTsconfig();
-    expect(tsconfig.files).toContain('queues.d.ts');
-    expect(tsconfig.compilerOptions.paths['void/queues']).toEqual(['./queues.d.ts']);
-  });
-
-  it('includes db.d.ts when hasDb is true', () => {
-    ensureProjectTsconfig(root, undefined, true);
-    const tsconfig = readTsconfig();
-    expect(tsconfig.files).toContain('db.d.ts');
-    expect(tsconfig.compilerOptions.paths['void/db']).toEqual(['./db.d.ts']);
-  });
-
-  it('auto-detects md.d.ts and adds paths entry', () => {
-    writeFileSync(
-      join(root, '.void', 'md.d.ts'),
-      'declare const pages: any[]; export default pages;',
-    );
-    ensureProjectTsconfig(root);
-    const tsconfig = readTsconfig();
-    expect(tsconfig.files).toContain('md.d.ts');
-    expect(tsconfig.compilerOptions.paths['@void/md/pages']).toEqual(['./md.d.ts']);
+    expect(tsconfig.compilerOptions.paths['void/routes']).toEqual(['./routes.d.ts']);
   });
 
   it('excludes md.d.ts when file does not exist', () => {
@@ -106,21 +60,6 @@ describe('ensureProjectTsconfig', () => {
     expect(tsconfig.compilerOptions?.paths?.['@void/md/pages']).toBeUndefined();
   });
 
-  it('preserves md.d.ts across repeated calls', () => {
-    writeFileSync(
-      join(root, '.void', 'md.d.ts'),
-      'declare const pages: any[]; export default pages;',
-    );
-
-    ensureProjectTsconfig(root);
-    ensureProjectTsconfig(root);
-    ensureProjectTsconfig(root);
-
-    const tsconfig = readTsconfig();
-    expect(tsconfig.files).toContain('md.d.ts');
-    expect(tsconfig.compilerOptions.paths['@void/md/pages']).toEqual(['./md.d.ts']);
-  });
-
   it('does not rewrite tsconfig.json when generated content is unchanged', () => {
     const tsconfigPath = join(root, '.void', 'tsconfig.json');
     const oldTime = new Date('2024-01-01T00:00:00.000Z');
@@ -153,10 +92,4 @@ describe('ensureProjectTsconfig', () => {
     expect(tsconfig.compilerOptions.paths['void/queues']).toEqual(['./queues.d.ts']);
     expect(tsconfig.compilerOptions.paths['@void/md/pages']).toEqual(['./md.d.ts']);
   });
-
-  it('configures @schema paths when hasSchema is true', () => {
-    ensureProjectTsconfig(root, undefined, true, true);
-    const tsconfig = readTsconfig();
-    expect(tsconfig.compilerOptions.paths['@schema']).toBeDefined();
-  });
 });
diff --git a/packages/void/test/unit/projects-command.test.ts b/packages/void/test/unit/projects-command.test.ts
index dfc757d20..bc892c065 100644
--- a/packages/void/test/unit/projects-command.test.ts
+++ b/packages/void/test/unit/projects-command.test.ts
@@ -1,9 +1,8 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { Buffer } from '../../src/cli/node-buffer.ts';
-import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
+import { captureOutput, setIsolatedHome } from '../helpers/cli-command.ts';
 
 const tempHomes: Array<string> = [];
 const mockGetToken = vi.fn<() => string | null>();
@@ -13,31 +12,9 @@ vi.mock('../../src/cli/auth', async (importOriginal) => ({
   getToken: () => mockGetToken(),
 }));
 
-function setIsolatedHome(): void {
-  const dir = mkdtempSync(join(tmpdir(), 'void-home-'));
-  tempHomes.push(dir);
-  process.env.HOME = dir;
-  process.env.USERPROFILE = dir;
-  process.env.VOID_PLATFORM_REGISTRY_DIR = join(dir, 'registry');
-  savePlatformConnection({
-    accountId: null,
-    apiUrl: 'https://api.example.test',
-    applicationDomain: 'apps.example.test',
-    displayName: 'Test platform',
-    installationId: null,
-    kind: 'connected',
-    proxyUrl: 'https://proxy.example.test',
-  });
-}
-
-function createProjectRoot(opts?: { staging?: boolean }): string {
+function createProjectRoot(): string {
   const dir = mkdtempSync(join(tmpdir(), 'void-project-'));
   tempHomes.push(dir);
-  if (opts?.staging) {
-    const voidDir = join(dir, '.void');
-    mkdirSync(voidDir, { recursive: true });
-    writeFileSync(join(voidDir, 'project.json'), JSON.stringify({ voidInternalStaging: true }));
-  }
   return dir;
 }
 
@@ -47,31 +24,6 @@ async function importRunProjectsCommand() {
   return mod.runProjectsCommand;
 }
 
-function captureOutput(): { output: () => string; restore: () => void } {
-  const chunks: Array<string> = [];
-  const writeMock = vi
-    .spyOn(process.stdout, 'write')
-    .mockImplementation((...args: Array<unknown>) => {
-      const chunk = args[0];
-      if (typeof chunk === 'string') {
-        chunks.push(chunk);
-      } else if (Buffer.isBuffer(chunk)) {
-        chunks.push(chunk.toString());
-      }
-      return true;
-    });
-  const logMock = vi.spyOn(console, 'log').mockImplementation((...args: Array<unknown>) => {
-    chunks.push(args.map(String).join(' ') + '\n');
-  });
-  return {
-    output: () => chunks.join(''),
-    restore: () => {
-      writeMock.mockRestore();
-      logMock.mockRestore();
-    },
-  };
-}
-
 describe('runProjectsCommand', () => {
   beforeEach(() => {
     mockGetToken.mockReset().mockReturnValue(null);
@@ -92,8 +44,8 @@ describe('runProjectsCommand', () => {
   });
 
   it('prints projects for the authenticated user', async () => {
-    setIsolatedHome();
-    const root = createProjectRoot({ staging: true });
+    tempHomes.push(setIsolatedHome());
+    const root = createProjectRoot();
     mockGetToken.mockReturnValue('test-token');
     process.env.VOID_API_URL = 'https://api.example.test';
 
@@ -139,7 +91,7 @@ describe('runProjectsCommand', () => {
   });
 
   it('prints a friendly message when there are no projects', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
     const root = createProjectRoot();
     mockGetToken.mockReturnValue('test-token');
     process.env.VOID_API_URL = 'https://api.example.test';
@@ -159,11 +111,11 @@ describe('runProjectsCommand', () => {
   });
 
   it('exits with error when not logged in', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
     const root = createProjectRoot();
 
     const capture = captureOutput();
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
       throw new Error(`process.exit:${code ?? 0}`);
     }) as never);
 
@@ -173,6 +125,5 @@ describe('runProjectsCommand', () => {
     capture.restore();
 
     expect(out).toContain('Not logged in');
-    expect(exitSpy).toHaveBeenCalled();
   });
 });
diff --git a/packages/void/test/unit/prompt-password.test.ts b/packages/void/test/unit/prompt-password.test.ts
deleted file mode 100644
index e71b55518..000000000
--- a/packages/void/test/unit/prompt-password.test.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-import { PassThrough, Writable } from 'node:stream';
-import { stripVTControlCharacters } from 'node:util';
-import { isCancel } from '@voidzero-dev/vite-plus-prompts';
-import { afterEach, expect, it, vi } from 'vite-plus/test';
-import { passwordWithPlaceholder } from '../../src/cli/prompt-password.ts';
-
-let cleanup: (() => Promise<void>) | undefined;
-afterEach(async () => {
-  await cleanup?.();
-  cleanup = undefined;
-  vi.unstubAllEnvs();
-});
-
-function openPrompt(validate?: (value: string | undefined) => string | undefined) {
-  const input = Object.assign(new PassThrough(), { isRaw: false, setRawMode: vi.fn() });
-  const writes: Array<string> = [];
-  const output = Object.assign(
-    new Writable({
-      write(chunk, _encoding, callback) {
-        writes.push(chunk.toString());
-        callback();
-      },
-    }),
-    { columns: 80, rows: 24 },
-  );
-  const controller = new AbortController();
-  const result = passwordWithPlaceholder({
-    message: 'PostgreSQL DATABASE_URL:',
-    placeholder: 'postgresql://user:pw@…/database',
-    input,
-    output,
-    signal: controller.signal,
-    validate: validate ?? ((value) => (value ? undefined : 'A value is required.')),
-  });
-  cleanup = async () => {
-    controller.abort();
-    await result;
-    input.destroy();
-    output.destroy();
-  };
-  return {
-    result,
-    writes,
-    key: (key: string) => input.emit('data', Buffer.from(key)),
-    rendered: () => stripVTControlCharacters(writes.join('')),
-  };
-}
-
-it('shows a placeholder without accepting it as a default', async () => {
-  const prompt = openPrompt();
-  expect(prompt.rendered()).toContain('postgresql://user:pw@…/database');
-  prompt.key('\r');
-  await vi.waitFor(() => expect(prompt.rendered()).toContain('A value is required.'));
-  prompt.key('real-secret');
-  prompt.key('\r');
-  expect(await prompt.result).toBe('real-secret');
-  expect(prompt.rendered()).not.toContain('real-secret');
-});
-
-it.each(['', '1'])(
-  'never echoes the database URL on submission (ACCESSIBLE=%s)',
-  async (accessible) => {
-    vi.stubEnv('ACCESSIBLE', accessible);
-    const prompt = openPrompt();
-    const secret = 'postgresql://owner:secret@database.example/db';
-    prompt.writes.length = 0;
-    prompt.key(secret);
-    expect(prompt.rendered()).not.toContain('postgresql://');
-    prompt.key('\r');
-    expect(await prompt.result).toBe(secret);
-    expect(prompt.rendered()).not.toContain(secret);
-    expect(prompt.rendered()).not.toContain('owner:secret');
-  },
-);
-
-it('keeps rejected and cancelled values masked', async () => {
-  const prompt = openPrompt(() => 'Invalid URL.');
-  prompt.key('invalid-secret');
-  prompt.key('\r');
-  await vi.waitFor(() => expect(prompt.rendered()).toContain('Invalid URL.'));
-  prompt.key('\x03');
-  expect(isCancel(await prompt.result)).toBe(true);
-  expect(prompt.rendered()).not.toContain('invalid-secret');
-});
diff --git a/packages/void/test/unit/provision-fixtures.ts b/packages/void/test/unit/provision-fixtures.ts
new file mode 100644
index 000000000..478b0480a
--- /dev/null
+++ b/packages/void/test/unit/provision-fixtures.ts
@@ -0,0 +1,228 @@
+import { spawn, type ChildProcess } from 'node:child_process';
+import {
+  mkdir,
+  mkdirSync,
+  readFileSync,
+  realpath,
+  rmdir,
+  rmdirSync,
+  rmSync,
+  stat,
+  utimes,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { parse as parseJsoncRaw } from 'jsonc-parser';
+import { toSlash } from 'pathslash';
+import { afterEach, beforeEach, vi } from 'vite-plus/test';
+import { operationFixture } from '../../../deploy-cloudflare/test/operation-fixture.ts';
+import {
+  provisionCloudflareResources as provisionCloudflareResourcesImpl,
+  type DesiredResourceSet,
+  type ProvisionLogger,
+  type ProvisionOptions,
+  type RunWrangler,
+  type RunWranglerResult,
+  type WranglerCallContext,
+} from '../../src/cli/provision.ts';
+
+/** proper-lockfile's callback-style fs seam. Tests override single calls on top of it. */
+export const passthruFs: {
+  mkdir: typeof mkdir;
+  stat: typeof stat;
+  utimes: typeof utimes;
+  rmdir: typeof rmdir;
+  realpath: typeof realpath;
+  rmdirSync: typeof rmdirSync;
+} = { mkdir, stat, utimes, rmdir, realpath, rmdirSync };
+
+/**
+ * Remote work needs a resolvable account, as in a real deploy, so every test runs with this
+ * ambient account. Tests of the no-account and mismatch paths stub it themselves.
+ */
+export const AMBIENT_ACCOUNT = 'ambient-test-account';
+
+export interface ProvisionTestDir {
+  tmpDir: string;
+  wranglerPath: string;
+  /** Recreate the project with `content` as its `wrangler.jsonc`. */
+  setup: (content: string) => void;
+  readConfig: () => Record<string, unknown>;
+  /** Mimic `wrangler <res> create --update-config`: upsert a binding entry by binding. */
+  simulateUpdateConfig: (field: string, entry: Record<string, unknown>, path?: string) => void;
+}
+
+/**
+ * A temp project for one test file. Registers hooks that pin the ambient account before each
+ * test and remove the project, env stubs and global stubs after it.
+ */
+export function useProvisionTestDir(name: string): ProvisionTestDir {
+  const tmpDir = join(import.meta.dirname, `.tmp-provision-test-${name}`);
+  const wranglerPath = toSlash(join(tmpDir, 'wrangler.jsonc'));
+
+  beforeEach(() => {
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', AMBIENT_ACCOUNT);
+  });
+
+  afterEach(() => {
+    rmSync(tmpDir, { recursive: true, force: true });
+    vi.unstubAllEnvs();
+    vi.unstubAllGlobals();
+  });
+
+  return {
+    tmpDir,
+    wranglerPath,
+    setup(content) {
+      rmSync(tmpDir, { recursive: true, force: true });
+      mkdirSync(tmpDir, { recursive: true });
+      writeFileSync(wranglerPath, content);
+    },
+    readConfig() {
+      return parseJsoncRaw(readFileSync(wranglerPath, 'utf-8')) as Record<string, unknown>;
+    },
+    simulateUpdateConfig(field, entry, path = wranglerPath) {
+      const cfg = parseJsoncRaw(readFileSync(path, 'utf-8')) as Record<string, unknown>;
+      const list = Array.isArray(cfg[field]) ? (cfg[field] as Array<Record<string, unknown>>) : [];
+      const index = list.findIndex((e) => e.binding === entry.binding);
+      if (index >= 0) {
+        list[index] = { ...list[index], ...entry };
+      } else {
+        list.push(entry);
+      }
+      cfg[field] = list;
+      writeFileSync(path, `${JSON.stringify(cfg, null, 2)}\n`);
+    },
+  };
+}
+
+/** The shared operation fixture, with the provision call context passed to `callback`. */
+export function provisionOperationFixture(
+  callback: (
+    args: Array<string>,
+    options: WranglerCallContext,
+  ) => RunWranglerResult | Promise<RunWranglerResult>,
+): RunWrangler {
+  // The shared fixture forwards the runner's call context unchanged.
+  return operationFixture((args, options) =>
+    callback(args, options as unknown as WranglerCallContext),
+  );
+}
+
+/** A logger that swallows output (the default one prints to console). */
+export const silentLog: ProvisionLogger = { info: () => {}, warn: () => {} };
+
+type Handler = { match: RegExp; reply: (sub: string) => RunWranglerResult };
+
+/**
+ * A runWrangler stub that records each operation as fixture argv. Handlers match on the
+ * space-joined argv; unmatched operations succeed with empty output.
+ */
+export function makeRunner(handlers: Array<Handler>): {
+  run: RunWrangler;
+  calls: Array<Array<string>>;
+} {
+  const calls: Array<Array<string>> = [];
+  const run: RunWrangler = provisionOperationFixture((args) => {
+    calls.push(args);
+    const sub = args.join(' ');
+    for (const handler of handlers) {
+      if (handler.match.test(sub)) {
+        return handler.reply(sub);
+      }
+    }
+    return { stdout: '', stderr: '', status: 0 };
+  });
+  return { run, calls };
+}
+
+/** Stub `fetch` with an empty Hyperdrive config list and record every requested URL. */
+export function stubEmptyHyperdriveList(): Array<string> {
+  const urls: Array<string> = [];
+  vi.stubGlobal('fetch', async (url: string | URL) => {
+    urls.push(String(url));
+    return new Response(
+      JSON.stringify({ success: true, result: [], result_info: { total_count: 0 } }),
+      { status: 200 },
+    );
+  });
+  return urls;
+}
+
+/** True when an argv array is a `wrangler <a> <b> …` invocation of a given kind. */
+export function isCall(argv: Array<string>, ...prefix: Array<string>): boolean {
+  return prefix.every((token, i) => argv[i] === token);
+}
+
+export function ok(stdout: string = ''): RunWranglerResult {
+  return { stdout, stderr: '', status: 0 };
+}
+
+export function fail(stdout: string, stderr: string = ''): RunWranglerResult {
+  return { stdout, stderr, status: 1 };
+}
+
+// Synthetic ids in the real formats: KV and Hyperdrive ids are 32 lowercase hex characters,
+// D1 ids are UUIDs. Equal-length seeds keep their order, so tie-break tests stay valid.
+export function hex32(seed: string): string {
+  const raw = Buffer.from(seed, 'utf8').toString('hex').slice(0, 32);
+  return (raw + '0'.repeat(32)).slice(0, 32);
+}
+
+export function uuid(seed: string): string {
+  const h = hex32(seed);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+
+export const emptyDesired: DesiredResourceSet = { kvNamespaces: [], queues: [] };
+
+/**
+ * `provisionCloudflareResources` with the D1 replication update stubbed whenever the runner is
+ * injected. Tests of the real API path call the implementation directly.
+ */
+export function provisionCloudflareResources(
+  ...args: Parameters<typeof provisionCloudflareResourcesImpl>
+): ReturnType<typeof provisionCloudflareResourcesImpl> {
+  const [root, configPath, desired, opts] = args;
+  const replicationStub: ProvisionOptions['enableD1ReadReplication'] = async () => {};
+  return provisionCloudflareResourcesImpl(root, configPath, desired, {
+    ...opts,
+    enableD1ReadReplication:
+      opts?.enableD1ReadReplication ?? (opts?.runWrangler ? replicationStub : undefined),
+  });
+}
+
+/** Poll until `pid` no longer exists, or `timeoutMs` passes. */
+export async function waitForDead(pid: number, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      process.kill(pid, 0);
+    } catch {
+      return true;
+    }
+    await new Promise((r) => setTimeout(r, 25));
+  }
+  return false;
+}
+
+/** A detached process group that hangs until killed. */
+export function spawnHang(): ChildProcess {
+  return spawn(process.execPath, ['-e', 'setInterval(() => {}, 1 << 30)'], {
+    detached: true,
+    stdio: 'ignore',
+  });
+}
+
+/** SIGKILL the child's process group, or the child alone where groups are unsupported. */
+export function reap(child: ChildProcess): void {
+  try {
+    process.kill(-child.pid!, 'SIGKILL');
+  } catch {
+    try {
+      child.kill('SIGKILL');
+    } catch {
+      // already gone
+    }
+  }
+}
diff --git a/packages/void/test/unit/provision-lock-durability.test.ts b/packages/void/test/unit/provision-lock-durability.test.ts
index 91863669f..6e64c469a 100644
--- a/packages/void/test/unit/provision-lock-durability.test.ts
+++ b/packages/void/test/unit/provision-lock-durability.test.ts
@@ -1,3 +1,355 @@
-import { runProvisionTestShard } from './provision-test-shard.ts';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it } from 'vite-plus/test';
+import {
+  acquireProvisionLock,
+  WranglerQuarantineError,
+  type RunWrangler,
+} from '../../src/cli/provision.ts';
+import {
+  emptyDesired,
+  makeRunner,
+  ok,
+  provisionCloudflareResources,
+  provisionOperationFixture,
+  reap,
+  silentLog,
+  spawnHang,
+  useProvisionTestDir,
+  waitForDead,
+} from './provision-fixtures.ts';
 
-await runProvisionTestShard('lock-durability');
+const { tmpDir, wranglerPath, setup } = useProvisionTestDir('lock-durability');
+
+describe('acquireProvisionLock — durable sidecar is a PRECONDITION for quarantine', () => {
+  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
+  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
+  // A directory at the sidecar's temp path makes the durable write fail with no sidecar.
+  const tmpBlocker = `${sidecar}.tmp-${process.pid}`;
+
+  // The retention watchdog frees the process-wide provision slot a microtask after the
+  // mutex is gone. Poll a throwaway provision until it gets past the slot guard, so the
+  // next test does not trip on a watchdog that is still resolving.
+  async function drainRetentionWatchdog(timeoutMs = 20_000): Promise<void> {
+    const probeDir = join(import.meta.dirname, '.tmp-provision-drain');
+    const probeCfg = join(probeDir, 'wrangler.jsonc');
+    const deadline = Date.now() + timeoutMs;
+    try {
+      for (;;) {
+        rmSync(probeDir, { recursive: true, force: true });
+        mkdirSync(probeDir, { recursive: true });
+        writeFileSync(probeCfg, JSON.stringify({ account_id: 'acct', name: 'drain' }));
+        let guardHeld = false;
+        try {
+          await provisionCloudflareResources(probeDir, probeCfg, emptyDesired, {
+            runWrangler: provisionOperationFixture(() => ok('[]')),
+            log: silentLog,
+          });
+        } catch (error) {
+          // Only the slot-guard error means the watchdog is still active.
+          guardHeld = /still retaining its lock|already active in this process/.test(
+            (error as Error).message,
+          );
+        }
+        if (!guardHeld) {
+          return;
+        }
+        if (Date.now() >= deadline) {
+          throw new Error('retention watchdog did not resolve within the drain window');
+        }
+        await new Promise((r) => setTimeout(r, 50));
+      }
+    } finally {
+      rmSync(probeDir, { recursive: true, force: true });
+    }
+  }
+
+  afterEach(async () => {
+    await drainRetentionWatchdog();
+  });
+
+  it('a sidecar-write failure keeps the lock TRACKED (heartbeat running, NOT stealable) and throws a hard error', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const lock = await acquireProvisionLock(wranglerPath, { stale: 2_000 });
+    try {
+      mkdirSync(tmpBlocker);
+      expect(() => lock.quarantine({ pid: 99_999, reason: 'sidecar blocked' })).toThrow(
+        /intentionally STILL HELD/,
+      );
+      expect(existsSync(sidecar)).toBe(false);
+      // The lock stays tracked, so its heartbeat keeps it fresh past proper-lockfile's
+      // 2000ms stale floor.
+      await new Promise((r) => setTimeout(r, 2_300));
+      await expect(
+        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
+      ).rejects.toThrow(/already being held/);
+    } finally {
+      rmSync(tmpBlocker, { recursive: true, force: true });
+      // Still tracked → release works normally and frees the mutex.
+      await lock.release();
+    }
+    expect(existsSync(lockMutex)).toBe(false);
+  }, 15_000);
+
+  it('provision level: a persistence failure surfaces BOTH errors, arms the retention watchdog, and resolves by confirming the child DEAD (mutex released cleanly)', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    // A real child that is already dead stands in for the unconfirmed wrangler group.
+    const child = spawnHang();
+    const childPid = child.pid!;
+    reap(child);
+    expect(await waitForDead(childPid, 10_000)).toBe(true);
+    const quarantineError = new WranglerQuarantineError(childPid, 'child unconfirmed');
+    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
+    let thrown: unknown;
+    try {
+      await provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        {
+          runWrangler: run,
+          log: silentLog,
+          lockOptions: {
+            stale: 2_000,
+            // Every persistence attempt fails, so only the death probe can resolve it.
+            dirDurability: {
+              fsyncSync: () => {
+                throw Object.assign(new Error('ENOSPC: no space left on device, fsync'), {
+                  code: 'ENOSPC',
+                });
+              },
+            },
+          },
+        },
+      );
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toBeInstanceOf(AggregateError);
+    expect((thrown as AggregateError).message).toMatch(/intentionally still held/);
+    expect((thrown as AggregateError).errors[0]).toBe(quarantineError);
+    expect(String((thrown as AggregateError).errors[1])).toMatch(/could not persist/);
+    expect(existsSync(lockMutex)).toBe(true);
+    expect(existsSync(sidecar)).toBe(false);
+    // The watchdog confirms the recorded group dead and releases the mutex. The bound is
+    // generous because its tick is a real timer.
+    const deadline = Date.now() + 15_000;
+    while (existsSync(lockMutex) && Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, 50));
+    }
+    expect(existsSync(lockMutex)).toBe(false);
+    expect(existsSync(sidecar)).toBe(false);
+    await drainRetentionWatchdog();
+    const { run: okRun } = makeRunner([{ match: /^d1 list/, reply: () => ok('[]') }]);
+    await expect(
+      provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
+        runWrangler: okRun,
+        log: silentLog,
+      }),
+    ).resolves.toBeDefined();
+  }, 30_000);
+
+  it('while the child LIVES, the watchdog retries persistence with backoff and detaches once it succeeds', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const live = spawnHang();
+    let failPersistence = true;
+    const quarantineError = new WranglerQuarantineError(live.pid, 'live child');
+    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
+    try {
+      let thrown: unknown;
+      try {
+        await provisionCloudflareResources(
+          tmpDir,
+          wranglerPath,
+          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+          {
+            runWrangler: run,
+            log: silentLog,
+            lockOptions: {
+              stale: 2_000,
+              dirDurability: {
+                fsyncSync: () => {
+                  if (failPersistence) {
+                    throw Object.assign(new Error('EIO: i/o error, fsync'), { code: 'EIO' });
+                  }
+                },
+              },
+            },
+          },
+        );
+      } catch (error) {
+        thrown = error;
+      }
+      expect(thrown).toBeInstanceOf(AggregateError);
+      expect(existsSync(lockMutex)).toBe(true);
+      expect(existsSync(sidecar)).toBe(false);
+      // Once persistence works, the watchdog's next retry writes the sidecar and detaches
+      // the lock. The bound is generous because the retry is a real backoff timer.
+      failPersistence = false;
+      const deadline = Date.now() + 15_000;
+      while (!existsSync(sidecar) && Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, 50));
+      }
+      expect(existsSync(sidecar)).toBe(true);
+      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
+      expect(recorded.pid).toBe(live.pid);
+      expect(existsSync(lockMutex)).toBe(true); // retained, now safely detached
+      // The retained mutex is guarded by the sidecar: an acquirer fails closed on the
+      // live recorded group even with the mutex aged stale.
+      const old = new Date(Date.now() - 3_600_000);
+      utimesSync(lockMutex, old, old);
+      await expect(
+        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
+      ).rejects.toThrow(/QUARANTINED/);
+    } finally {
+      reap(live);
+      rmSync(lockMutex, { recursive: true, force: true });
+      rmSync(sidecar, { force: true });
+    }
+  }, 30_000);
+
+  it('the watchdog HOLDS the process at natural exit until the child dies, then releases and exits cleanly', async () => {
+    // proper-lockfile's exit sweep removes every tracked mutex, so the watchdog must keep
+    // the process alive until the child is confirmed dead.
+    const WATCHDOG_EXIT_TMP = join(import.meta.dirname, '.tmp-watchdog-exit');
+    rmSync(WATCHDOG_EXIT_TMP, { recursive: true, force: true });
+    mkdirSync(WATCHDOG_EXIT_TMP, { recursive: true });
+    const appRoot = join(WATCHDOG_EXIT_TMP, 'app');
+    const probe = join(WATCHDOG_EXIT_TMP, 'probe.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      probe,
+      `import { mkdirSync, writeFileSync } from 'node:fs';\n` +
+        `import { spawn } from 'node:child_process';\n` +
+        `import { join } from 'node:path';\n` +
+        `import { provisionCloudflareResources, WranglerQuarantineError } from ${JSON.stringify(provisionUrl)};\n` +
+        `const root = ${JSON.stringify(appRoot)};\n` +
+        `mkdirSync(root, { recursive: true });\n` +
+        `const cfg = join(root, 'wrangler.jsonc');\n` +
+        `writeFileSync(cfg, JSON.stringify({ name: 'app', account_id: 'acct' }));\n` +
+        // A real detached child standing in for the unconfirmed wrangler group; it
+        // exits BY ITSELF after 700ms.
+        `const child = spawn(process.execPath, ['-e', 'setTimeout(() => process.exit(0), 700)'], { detached: true, stdio: 'ignore' });\n` +
+        `child.unref();\n` +
+        `const startedAt = Date.now();\n` +
+        `provisionCloudflareResources(root, cfg, { kvNamespaces: [], queues: [], d1: { binding: 'DB', name: 'myapp-db' } }, {\n` +
+        `  runWrangler: () => Promise.reject(new WranglerQuarantineError(child.pid, 'unconfirmed')),\n` +
+        `  log: { info: () => {}, warn: () => {} },\n` +
+        `  lockOptions: {\n` +
+        `    dirDurability: { fsyncSync: () => { throw Object.assign(new Error('ENOSPC'), { code: 'ENOSPC' }); } },\n` +
+        `  },\n` +
+        `}).then(\n` +
+        `  () => writeFileSync(join(root, 'outcome.txt'), 'RESOLVED'),\n` +
+        `  () => writeFileSync(join(root, 'outcome.txt'), 'REJECTED:' + (Date.now() - startedAt)),\n` +
+        `);\n` +
+        `process.on('exit', () => {\n` +
+        `  let childAlive = true;\n` +
+        `  try { process.kill(child.pid, 0); } catch { childAlive = false; }\n` +
+        `  writeFileSync(join(root, 'exit.txt'), JSON.stringify({ elapsed: Date.now() - startedAt, childAlive }));\n` +
+        `});\n`,
+    );
+    const { spawn } = await import('node:child_process');
+    const parent = spawn(process.execPath, [probe], {
+      cwd: WATCHDOG_EXIT_TMP,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stderr = '';
+    parent.stderr.setEncoding('utf-8');
+    parent.stderr.on('data', (chunk: string) => {
+      stderr += chunk;
+    });
+    const killTimer = setTimeout(() => parent.kill('SIGKILL'), 15_000);
+    try {
+      const [code, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
+        parent.on('close', (c, s) => res([c, s]));
+      });
+      clearTimeout(killTimer);
+      expect(signal).toBeNull();
+      expect(code).toBe(0);
+      expect(readFileSync(join(appRoot, 'outcome.txt'), 'utf-8')).toContain('REJECTED:');
+      // The watchdog held the process open past the child's 700ms lifetime.
+      const exitState = JSON.parse(readFileSync(join(appRoot, 'exit.txt'), 'utf-8')) as {
+        elapsed: number;
+        childAlive: boolean;
+      };
+      expect(exitState.childAlive).toBe(false);
+      expect(exitState.elapsed).toBeGreaterThanOrEqual(650);
+      expect(stderr).toMatch(/RETAINED by this process/);
+      const cfgReal = realpathSync(join(appRoot, 'wrangler.jsonc'));
+      expect(existsSync(`${cfgReal}.void-provision.lock.lock`)).toBe(false);
+      expect(existsSync(`${cfgReal}.void-provision.lock.quarantine.json`)).toBe(false);
+    } finally {
+      clearTimeout(killTimer);
+      try {
+        parent.kill('SIGKILL');
+      } catch {
+        // already gone
+      }
+      rmSync(WATCHDOG_EXIT_TMP, { recursive: true, force: true });
+    }
+  }, 20_000);
+});
+
+describe('acquireProvisionLock — sidecar DIRECTORY durability failures propagate', () => {
+  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
+  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
+
+  it('ENOSPC on the directory fsync is a PERSISTENCE FAILURE: no detach, lock stays tracked, hard error', async () => {
+    // Without a durable directory entry the sidecar can vanish on a crash, so only
+    // platform-unsupported codes may be ignored.
+    setup(JSON.stringify({ name: 'app' }));
+    const lock = await acquireProvisionLock(wranglerPath, {
+      stale: 2_000,
+      dirDurability: {
+        fsyncSync: () => {
+          throw Object.assign(new Error('ENOSPC: no space left on device, fsync'), {
+            code: 'ENOSPC',
+          });
+        },
+      },
+    });
+    try {
+      expect(() => lock.quarantine({ pid: 42_424, reason: 'enospc' })).toThrow(
+        /could not persist quarantine metadata.*ENOSPC/s,
+      );
+      // The non-durable sidecar was rolled back.
+      expect(existsSync(sidecar)).toBe(false);
+      // The lock stays tracked, so its heartbeat keeps it fresh past the 2000ms stale floor.
+      await new Promise((r) => setTimeout(r, 2_300));
+      await expect(
+        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
+      ).rejects.toThrow(/already being held/);
+    } finally {
+      // Still tracked → release works normally and frees the mutex.
+      await lock.release();
+    }
+    expect(existsSync(lockMutex)).toBe(false);
+  }, 15_000);
+
+  it('a platform-unsupported code (EINVAL) is ignored — the quarantine still detaches behind the verified sidecar', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const lock = await acquireProvisionLock(wranglerPath, {
+      stale: 2_000,
+      dirDurability: {
+        fsyncSync: () => {
+          throw Object.assign(new Error('EINVAL: invalid argument, fsync'), { code: 'EINVAL' });
+        },
+      },
+    });
+    lock.quarantine({ pid: 42_425, reason: 'einval' }); // must not throw
+    expect(existsSync(sidecar)).toBe(true);
+    expect(existsSync(lockMutex)).toBe(true); // retained (detached from the exit sweep)
+    await lock.release(); // no-op after a successful quarantine
+    expect(existsSync(lockMutex)).toBe(true);
+    rmSync(lockMutex, { recursive: true, force: true });
+    rmSync(sidecar, { force: true });
+  });
+});
diff --git a/packages/void/test/unit/provision-lock-recovery.test.ts b/packages/void/test/unit/provision-lock-recovery.test.ts
index 6e3df2dec..1b513f264 100644
--- a/packages/void/test/unit/provision-lock-recovery.test.ts
+++ b/packages/void/test/unit/provision-lock-recovery.test.ts
@@ -1,3 +1,282 @@
-import { runProvisionTestShard } from './provision-test-shard.ts';
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { describe, expect, it } from 'vite-plus/test';
+import { acquireProvisionLock, resolveProperLockfileKey } from '../../src/cli/provision.ts';
+import {
+  passthruFs,
+  reap,
+  spawnHang,
+  useProvisionTestDir,
+  waitForDead,
+} from './provision-fixtures.ts';
 
-await runProvisionTestShard('lock-recovery');
+const { tmpDir, wranglerPath, setup } = useProvisionTestDir('lock-recovery');
+
+describe('acquireProvisionLock — quarantine sidecar gate', () => {
+  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
+  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
+
+  it('a quarantined mutex is NOT stealable by age while the recorded group lives (fail closed, sidecar atomic)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    // A live process group stands in for the unconfirmed wrangler child.
+    const child = spawnHang();
+    try {
+      const lock = await acquireProvisionLock(wranglerPath);
+      lock.quarantine({ pid: child.pid, reason: 'test quarantine (child unconfirmed)' });
+      // The sidecar is written atomically, with no temp-file leftovers.
+      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
+      expect(recorded).toMatchObject({
+        pid: child.pid,
+        // Windows has no process groups, so `writeQuarantineSidecar` records `null` there by
+        // design and the gate falls back to probing the plain pid.
+        pgid: process.platform === 'win32' ? null : child.pid,
+        reason: 'test quarantine (child unconfirmed)',
+      });
+      expect(typeof recorded.quarantinedAt).toBe('string');
+      expect(readdirSync(tmpDir).filter((f) => f.includes('.tmp-'))).toEqual([]);
+      expect(existsSync(lockMutex)).toBe(true);
+      // Age the retained mutex far past any stale window.
+      const old = new Date(Date.now() - 3_600_000);
+      utimesSync(lockMutex, old, old);
+      await expect(
+        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
+      ).rejects.toThrow(
+        new RegExp(`QUARANTINED.*process group ${child.pid}.*test quarantine`, 's'),
+      );
+      // The gate did NOT clear the quarantine (the group still lives).
+      expect(existsSync(sidecar)).toBe(true);
+      expect(existsSync(lockMutex)).toBe(true);
+    } finally {
+      reap(child);
+    }
+    expect(await waitForDead(child.pid!, 10_000)).toBe(true);
+  }, 15_000);
+
+  it('once the recorded group is DEAD, the next acquisition clears the sidecar and proceeds', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const child = spawnHang();
+    const lock = await acquireProvisionLock(wranglerPath);
+    lock.quarantine({ pid: child.pid, reason: 'test quarantine' });
+    reap(child);
+    expect(await waitForDead(child.pid!, 10_000)).toBe(true);
+    // Backdate the mutex so proper-lockfile's stale lifecycle reclaims it; the gate never
+    // removes it by hand.
+    const old = new Date(Date.now() - 3_600_000);
+    utimesSync(lockMutex, old, old);
+    const second = await acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 5 });
+    expect(existsSync(sidecar)).toBe(false);
+    await second.release();
+    expect(existsSync(lockMutex)).toBe(false);
+  }, 15_000);
+
+  it('an unreadable/malformed sidecar FAILS CLOSED (cannot verify the recorded owner)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    writeFileSync(sidecar, '{ not json');
+    await expect(acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 })).rejects.toThrow(
+      /QUARANTINED.*an unrecorded process/s,
+    );
+    expect(existsSync(sidecar)).toBe(true);
+  });
+});
+
+describe('acquireProvisionLock — the gate runs on EVERY attempt + post-acquire revalidation', () => {
+  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
+  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
+
+  it('a waiter that started while the holder was HEALTHY fails closed when the holder quarantines mid-wait', async () => {
+    // A gate run only before proper-lockfile's retry loop would let this waiter
+    // stale-take the quarantined mutex without seeing the sidecar.
+    setup(JSON.stringify({ name: 'app' }));
+    const holder = await acquireProvisionLock(wranglerPath, { stale: 2_000 });
+    const child = spawnHang();
+    try {
+      const waiter = acquireProvisionLock(wranglerPath, {
+        stale: 2_000,
+        retries: { retries: 60, factor: 1, minTimeout: 150, maxTimeout: 150 },
+      });
+      // Let the waiter run a few healthy attempts first, THEN quarantine the holder.
+      await new Promise((r) => setTimeout(r, 400));
+      holder.quarantine({ pid: child.pid, reason: 'waiter crosses quarantine' });
+      await expect(waiter).rejects.toThrow(/QUARANTINED.*waiter crosses quarantine/s);
+      expect(existsSync(sidecar)).toBe(true);
+      expect(existsSync(lockMutex)).toBe(true);
+    } finally {
+      reap(child);
+    }
+    expect(await waitForDead(child.pid!, 5_000)).toBe(true);
+    rmSync(lockMutex, { recursive: true, force: true });
+    rmSync(sidecar, { force: true });
+  }, 15_000);
+
+  it('the same waiter PROCEEDS (sidecar cleared) once the recorded group is dead', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const holder = await acquireProvisionLock(wranglerPath, { stale: 2_000 });
+    const child = spawnHang();
+    const waiter = acquireProvisionLock(wranglerPath, {
+      stale: 2_000,
+      retries: { retries: 80, factor: 1, minTimeout: 150, maxTimeout: 150 },
+    });
+    await new Promise((r) => setTimeout(r, 300));
+    // Kill the group before quarantining, so the waiter's next gate always probes it dead.
+    reap(child);
+    expect(await waitForDead(child.pid!, 5_000)).toBe(true);
+    holder.quarantine({ pid: child.pid, reason: 'waiter proceeds once dead' });
+    const lock = await waiter;
+    expect(existsSync(sidecar)).toBe(false);
+    await lock.release();
+    expect(existsSync(lockMutex)).toBe(false);
+  }, 15_000);
+
+  it('post-acquire REVALIDATION: a sidecar appearing DURING acquisition releases the fresh lock and fails closed', async () => {
+    // A holder quarantines between this attempt's gate and the mkdir that acquires the mutex.
+    setup(JSON.stringify({ name: 'app' }));
+    const child = spawnHang();
+    try {
+      const seamFs = {
+        ...passthruFs,
+        mkdir: (...args: Array<unknown>) => {
+          writeFileSync(
+            sidecar,
+            JSON.stringify({
+              pid: child.pid,
+              pgid: child.pid,
+              reason: 'appeared mid-acquisition',
+            }),
+          );
+          (passthruFs.mkdir as (...a: Array<unknown>) => void)(...args);
+        },
+      };
+      await expect(
+        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0, fs: seamFs }),
+      ).rejects.toThrow(/QUARANTINED.*appeared mid-acquisition/s);
+      // The fresh mutex was released and the sidecar remains for the next gate.
+      expect(existsSync(lockMutex)).toBe(false);
+      expect(existsSync(sidecar)).toBe(true);
+    } finally {
+      reap(child);
+    }
+    expect(await waitForDead(child.pid!, 5_000)).toBe(true);
+    rmSync(sidecar, { force: true });
+  });
+});
+
+describe('acquireProvisionLock — proper-lockfile registry key spelling', () => {
+  it('preserves the native separators used by proper-lockfile on each platform', () => {
+    const lockTarget = 'D:/a/void/void/wrangler.jsonc.void-provision.lock';
+
+    expect(resolveProperLockfileKey(lockTarget, 'win32')).toBe(
+      'D:\\a\\void\\void\\wrangler.jsonc.void-provision.lock',
+    );
+    expect(resolveProperLockfileKey('/tmp/void/wrangler.jsonc.void-provision.lock', 'linux')).toBe(
+      '/tmp/void/wrangler.jsonc.void-provision.lock',
+    );
+  });
+});
+
+describe('acquireProvisionLock — recovery decisions are serialized + generation-verified', () => {
+  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
+  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
+  const recoveryTarget = `${wranglerPath}.void-provision.lock.recovery`;
+
+  async function deadPid(): Promise<number> {
+    const child = spawnHang();
+    const pid = child.pid!;
+    reap(child);
+    expect(await waitForDead(pid, 5_000)).toBe(true);
+    return pid;
+  }
+
+  it('a held RECOVERY mutex blocks another acquirer from acting on the sidecar at all (decision serialized)', async () => {
+    // The whole gate, probe, clear, acquire and revalidate sequence runs under the recovery
+    // mutex, so one recoverer cannot act on a read another has invalidated.
+    setup(JSON.stringify({ name: 'app' }));
+    const pid = await deadPid();
+    writeFileSync(
+      sidecar,
+      JSON.stringify({ pid, pgid: pid, reason: 'dead group', generation: 'gen-stale' }),
+    );
+    const properLockfile = (await import('proper-lockfile')).default;
+    const releaseRecovery = await properLockfile.lock(recoveryTarget, {
+      stale: 6_000,
+      realpath: false,
+    });
+    try {
+      // The dead-group sidecar would be cleared, but the recovery mutex is held.
+      await expect(acquireProvisionLock(wranglerPath, { retries: 0 })).rejects.toThrow(
+        /already being held/,
+      );
+      expect(existsSync(sidecar)).toBe(true); // the decision was NOT made
+    } finally {
+      await releaseRecovery();
+    }
+    // With the recovery mutex free the same acquirer clears the dead-group quarantine
+    // and proceeds.
+    const lock = await acquireProvisionLock(wranglerPath, { retries: 2 });
+    expect(existsSync(sidecar)).toBe(false);
+    await lock.release();
+    expect(existsSync(lockMutex)).toBe(false);
+  });
+
+  it("a stale recovery decision cannot delete a NEWER quarantine generation (B's decision detects S1; A's retained mutex stays protected)", async () => {
+    // The recovery mutex cannot serialize a main-mutex holder's quarantine write. B decides
+    // to clear dead S0, then A's newer live-group S1 replaces the file before B's unlink.
+    setup(JSON.stringify({ name: 'app' }));
+    const dead = await deadPid();
+    const live = spawnHang();
+    try {
+      writeFileSync(
+        sidecar,
+        JSON.stringify({
+          pid: dead,
+          pgid: dead,
+          reason: 'S0 (dead group)',
+          generation: 'gen-first',
+        }),
+      );
+      // A's retained mutex, which B would stale-reclaim if it deleted S1.
+      mkdirSync(lockMutex);
+      const old = new Date(Date.now() - 3_600_000);
+      utimesSync(lockMutex, old, old);
+      const swapInNewerGeneration = (): void => {
+        writeFileSync(
+          sidecar,
+          JSON.stringify({
+            pid: live.pid,
+            pgid: live.pid,
+            reason: 'S1 (live group, newer quarantine)',
+            generation: 'gen-second',
+          }),
+        );
+      };
+      await expect(
+        acquireProvisionLock(wranglerPath, {
+          stale: 2_000,
+          retries: 0,
+          onBeforeQuarantineClear: swapInNewerGeneration,
+        }),
+      ).rejects.toThrow(/changed while this recovery decision was being made/);
+      // S1 survives the stale decision.
+      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
+      expect(recorded.generation).toBe('gen-second');
+      expect(recorded.pid).toBe(live.pid);
+      // The next acquisition gates on S1's live group instead of reclaiming A's mutex.
+      expect(existsSync(lockMutex)).toBe(true);
+      await expect(
+        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
+      ).rejects.toThrow(/QUARANTINED/);
+      expect(existsSync(lockMutex)).toBe(true);
+    } finally {
+      reap(live);
+    }
+    expect(await waitForDead(live.pid!, 5_000)).toBe(true);
+    rmSync(lockMutex, { recursive: true, force: true });
+    rmSync(sidecar, { force: true });
+  });
+});
diff --git a/packages/void/test/unit/provision-locking.test.ts b/packages/void/test/unit/provision-locking.test.ts
index 5c9781a1c..26731167a 100644
--- a/packages/void/test/unit/provision-locking.test.ts
+++ b/packages/void/test/unit/provision-locking.test.ts
@@ -1,3 +1,501 @@
-import { runProvisionTestShard } from './provision-test-shard.ts';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vite-plus/test';
+import {
+  acquireProvisionLock,
+  WranglerQuarantineError,
+  type RunWrangler,
+} from '../../src/cli/provision.ts';
+import {
+  emptyDesired,
+  fail,
+  hex32,
+  isCall,
+  makeRunner,
+  ok,
+  passthruFs,
+  provisionCloudflareResources,
+  provisionOperationFixture,
+  silentLog,
+  useProvisionTestDir,
+} from './provision-fixtures.ts';
 
-await runProvisionTestShard('locking');
+const { tmpDir, wranglerPath, setup, simulateUpdateConfig } = useProvisionTestDir('locking');
+
+describe('provisionCloudflareResources — whole-provision cross-process lock (proper-lockfile)', () => {
+  // proper-lockfile uses a synthetic adjacent identity without creating that pathname;
+  // the actual mutex is a `${target}.lock` DIRECTORY and is removed on release.
+  const lockTarget = `${wranglerPath}.void-provision.lock`;
+  const recoveryTarget = `${lockTarget}.recovery`;
+  const lockMutex = `${lockTarget}.lock`;
+  const recoveryMutex = `${recoveryTarget}.lock`;
+  const delay = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));
+
+  it('a SECOND in-process provision fails fast with a clear hard error (at most one per process)', async () => {
+    setup(
+      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
+    );
+    let createCalls = 0;
+    const run: RunWrangler = provisionOperationFixture((args) => {
+      if (isCall(args, 'hyperdrive', 'create')) {
+        createCalls++;
+        simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('hd-1') });
+        return ok();
+      }
+      return ok();
+    });
+    const desired = {
+      ...emptyDesired,
+      hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+    };
+    const opts = {
+      runWrangler: run,
+      log: silentLog,
+      // Keep the first provision ACTIVE long enough that the second demonstrably starts
+      // while it runs (the guard is taken synchronously at entry regardless).
+      listHyperdriveConfigs: async (): Promise<Array<never>> => {
+        await delay(60);
+        return [];
+      },
+    };
+    const first = provisionCloudflareResources(tmpDir, wranglerPath, desired, opts);
+    // The second provision starts while the first is active → the process-wide guard
+    // rejects it OUTRIGHT (no lock contention, no wrangler work, no config read).
+    await expect(provisionCloudflareResources(tmpDir, wranglerPath, desired, opts)).rejects.toThrow(
+      /a provision is already active in this process.*run provisions sequentially/s,
+    );
+    const result = await first;
+    expect(result.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
+    expect(createCalls).toBe(1);
+    // Mutex always released — no leak; and the slot freed: a THIRD (sequential) run works.
+    expect(existsSync(lockMutex)).toBe(false);
+    const third = await provisionCloudflareResources(tmpDir, wranglerPath, desired, opts);
+    expect(third.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('reused');
+    expect(createCalls).toBe(1);
+  });
+
+  it('leaves no persistent marker files and lets different app configs lock concurrently', async () => {
+    setup(JSON.stringify({ name: 'app-a' }));
+    const otherDir = join(tmpDir, 'other-app');
+    const otherConfig = join(otherDir, 'wrangler.jsonc');
+    const otherLockTarget = `${otherConfig}.void-provision.lock`;
+    const otherRecoveryTarget = `${otherLockTarget}.recovery`;
+    mkdirSync(otherDir, { recursive: true });
+    writeFileSync(otherConfig, JSON.stringify({ name: 'app-b' }));
+
+    const first = await acquireProvisionLock(wranglerPath, { retries: 0 });
+    const second = await acquireProvisionLock(otherConfig, { retries: 0 });
+    try {
+      // Both are held at once: lock identity is per canonical config, not machine-global.
+      expect(existsSync(lockMutex)).toBe(true);
+      expect(existsSync(`${otherLockTarget}.lock`)).toBe(true);
+      // Synthetic identities never materialize as empty files in either project.
+      expect(existsSync(lockTarget)).toBe(false);
+      expect(existsSync(recoveryTarget)).toBe(false);
+      expect(existsSync(otherLockTarget)).toBe(false);
+      expect(existsSync(otherRecoveryTarget)).toBe(false);
+    } finally {
+      await Promise.all([first.release(), second.release()]);
+    }
+
+    expect(existsSync(lockMutex)).toBe(false);
+    expect(existsSync(recoveryMutex)).toBe(false);
+    expect(existsSync(`${otherLockTarget}.lock`)).toBe(false);
+    expect(existsSync(`${otherRecoveryTarget}.lock`)).toBe(false);
+  });
+
+  it('two concurrent provisions in SEPARATE processes race — exactly ONE create, the other reuses, mutex released', async () => {
+    // One provision runs per process, so a race needs two real processes.
+    setup(
+      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
+    );
+    const probe = join(tmpDir, 'race-probe.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      probe,
+      `import { readFileSync, writeFileSync } from 'node:fs';\n` +
+        `import { provisionCloudflareResources } from ${JSON.stringify(provisionUrl)};\n` +
+        `const cfgPath = ${JSON.stringify(wranglerPath)};\n` +
+        `const run = (args) => {\n` +
+        `  if (args.type === 'hyperdrive.create') {\n` +
+        `    const cfg = JSON.parse(readFileSync(cfgPath, 'utf-8'));\n` +
+        `    cfg.hyperdrive = [{ binding: 'HYPERDRIVE', id: process.argv[2] }];\n` +
+        `    writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));\n` +
+        `  }\n` +
+        `  return { stdout: '', stderr: '', status: 0 };\n` +
+        `};\n` +
+        `provisionCloudflareResources(${JSON.stringify(tmpDir)}, cfgPath, {\n` +
+        `  kvNamespaces: [],\n` +
+        `  queues: [],\n` +
+        `  hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },\n` +
+        `}, {\n` +
+        `  runWrangler: run,\n` +
+        `  log: { info: () => {}, warn: () => {} },\n` +
+        `  // Barrier: the winner holds the lock while LISTING, so the loser must block\n` +
+        `  // on the on-disk lock (proving the LOCK, not sequencing, serializes them).\n` +
+        `  listHyperdriveConfigs: () => new Promise((r) => setTimeout(() => r([]), 300)),\n` +
+        `}).then(\n` +
+        `  (res) => console.log('ACTION:' + res.resources.find((r) => r.kind === 'hyperdrive').action),\n` +
+        `  (err) => { console.log('REJECTED:' + err.message); process.exitCode = 7; },\n` +
+        `);\n`,
+    );
+    const { spawn } = await import('node:child_process');
+    const runChild = (id: string): Promise<{ code: number | null; stdout: string }> =>
+      new Promise((res) => {
+        const child = spawn(process.execPath, [probe, hex32(id)], {
+          cwd: tmpDir,
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        child.stdout.setEncoding('utf-8');
+        child.stdout.on('data', (chunk: string) => {
+          stdout += chunk;
+        });
+        child.on('close', (code) => res({ code, stdout }));
+      });
+    const [a, b] = await Promise.all([runChild('hd-a'), runChild('hd-b')]);
+    expect(a.code).toBe(0);
+    expect(b.code).toBe(0);
+    const actions = [a.stdout, b.stdout].map((s) => s.match(/ACTION:(\w+)/)?.[1]).sort();
+    // Exactly one create; the loser's read-first (under the lock) reused the winner's id.
+    expect(actions).toEqual(['created', 'reused']);
+    // Mutex always released — no leak.
+    expect(existsSync(lockMutex)).toBe(false);
+  }, 30_000);
+
+  it('recovers a STALE/abandoned lock (old mtime, crashed owner) and proceeds', async () => {
+    setup(
+      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
+    );
+    // Simulate a crashed owner's abandoned mutex dir whose mtime is well past the 120s
+    // stale window, so proper-lockfile compromises + steals it.
+    mkdirSync(lockMutex);
+    const old = new Date(Date.now() - 300_000);
+    utimesSync(lockMutex, old, old);
+    const { run } = makeRunner([
+      {
+        match: /^hyperdrive create /,
+        reply: () => {
+          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('hd-real') });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+      },
+      { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+    );
+    expect(result.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
+    expect(existsSync(lockMutex)).toBe(false);
+  });
+
+  it('always releases the lock even when the provision THROWS (no leak)', async () => {
+    setup(
+      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
+    );
+    const { run } = makeRunner([{ match: /^hyperdrive create /, reply: () => fail('', 'boom') }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+      ),
+    ).rejects.toThrow(/hyperdrive create myapp-hd.*failed/s);
+    expect(existsSync(lockMutex)).toBe(false);
+  });
+
+  it('acquireProvisionLock serializes — a second acquire waits until the first releases, then proceeds; release always frees it', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const first = await acquireProvisionLock(wranglerPath);
+    expect(existsSync(lockMutex)).toBe(true);
+    let secondAcquired = false;
+    const secondPromise = acquireProvisionLock(wranglerPath).then((lock) => {
+      secondAcquired = true;
+      return lock;
+    });
+    // While the first holds the lock the second cannot acquire (it retries/blocks).
+    await delay(60);
+    expect(secondAcquired).toBe(false);
+    await first.release();
+    const second = await secondPromise;
+    expect(secondAcquired).toBe(true);
+    // Release is idempotent and always frees the mutex.
+    await second.release();
+    await second.release();
+    expect(existsSync(lockMutex)).toBe(false);
+  });
+
+  it('a provision via a SYMLINK ALIAS contends on the SAME canonical lock and reuses the id written via the real path', async () => {
+    // Without realpath canonicalization each lexical path would get its own mutex,
+    // and an alias provision could create a duplicate.
+    setup(
+      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
+    );
+    const aliasName = 'wrangler.alias.jsonc';
+    symlinkSync(wranglerPath, join(tmpDir, aliasName));
+    // Sanity: the alias and the real config canonicalize to the same real file.
+    expect(realpathSync(join(tmpDir, aliasName))).toBe(realpathSync(wranglerPath));
+    let createCalls = 0;
+    const run: RunWrangler = provisionOperationFixture((args) => {
+      if (isCall(args, 'hyperdrive', 'create')) {
+        createCalls++;
+        simulateUpdateConfig('hyperdrive', {
+          binding: 'HYPERDRIVE',
+          id: hex32('hd-' + createCalls),
+        });
+        return ok();
+      }
+      return ok();
+    });
+    const makeProv = (
+      configArg: string,
+      retries?: number,
+    ): Promise<{ resources: Array<{ kind: string; action: string }> }> =>
+      provisionCloudflareResources(
+        tmpDir,
+        configArg,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => [],
+          ...(retries !== undefined ? { lockOptions: { retries } } : {}),
+        },
+      ) as Promise<{ resources: Array<{ kind: string; action: string }> }>;
+    // While the canonical lock is held, an alias-path provision cannot acquire it.
+    const held = await acquireProvisionLock(realpathSync(wranglerPath));
+    await expect(makeProv(aliasName, 0)).rejects.toThrow(/already being held/);
+    await held.release();
+    // One underlying file: a create via the REAL path is read-first-REUSED via the alias.
+    const a = await makeProv(wranglerPath);
+    const b = await makeProv(aliasName);
+    expect(a.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
+    expect(b.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('reused');
+    expect(createCalls).toBe(1);
+    // The single canonical mutex was released.
+    expect(existsSync(`${realpathSync(wranglerPath)}.void-provision.lock.lock`)).toBe(false);
+  });
+
+  it('a wrangler call blocking past a SHORT stale window does NOT let a second process steal the mutex (async heartbeat keeps it fresh)', async () => {
+    setup(JSON.stringify({ account_id: 'acct', kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
+    const run: RunWrangler = provisionOperationFixture(async (args) => {
+      if (isCall(args, 'kv', 'namespace', 'list')) {
+        // blocks (async) longer than the probe below, which is past the 2s stale window
+        await delay(2400);
+        return ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }]));
+      }
+      return ok();
+    });
+    const prov = provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+      { runWrangler: run, log: silentLog, lockOptions: { stale: 2000, update: 1000, retries: 0 } },
+    );
+    // 2.2s into the block — PAST the 2s stale window (proper-lockfile floors stale at 2000
+    // and update at 1000, so 2.2s is the minimum that proves freshness). If the async
+    // heartbeat did not keep the mutex fresh, a retries:0 acquire would STEAL it; it must
+    // be REFUSED instead.
+    await delay(2200);
+    await expect(acquireProvisionLock(wranglerPath, { stale: 2000, retries: 0 })).rejects.toThrow();
+    const result = await prov;
+    expect(result.resources[0]).toMatchObject({ kind: 'kv', action: 'adopted', id: hex32('kv') });
+    expect(existsSync(lockMutex)).toBe(false);
+  }, 15000);
+
+  it('a genuine unlock failure REJECTS the provision (leaked mutex surfaced, not swallowed)', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const failingFs = {
+      ...passthruFs,
+      rmdir: (_p: string, cb: (e: Error | null) => void) =>
+        cb(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' })),
+    };
+    await expect(
+      provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
+        log: silentLog,
+        lockOptions: { fs: failingFs },
+      }),
+    ).rejects.toThrow(/failed to release the cross-process provision lock/);
+  });
+
+  it('a body failure COMBINED with an unlock failure surfaces BOTH (AggregateError)', async () => {
+    setup(
+      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
+    );
+    // rmdir fails → the mutex leaks on release; the body also fails (hyperdrive create).
+    const failingFs = {
+      ...passthruFs,
+      rmdir: (_p: string, cb: (e: Error | null) => void) =>
+        cb(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' })),
+    };
+    const { run } = makeRunner([
+      { match: /^hyperdrive create /, reply: () => fail('', 'boom-body') },
+    ]);
+    let caught: unknown;
+    try {
+      await provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => [],
+          lockOptions: { fs: failingFs },
+        },
+      );
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(AggregateError);
+    const agg = caught as AggregateError;
+    const messages = agg.errors
+      .map((e) => (e instanceof Error ? e.message : String(e)))
+      .join(' || ');
+    // BOTH the body (hyperdrive create) error AND the leaked-mutex release error surface.
+    expect(messages).toMatch(/hyperdrive create myapp-hd.*failed.*boom-body/s);
+    expect(messages).toMatch(/failed to release the cross-process provision lock/);
+    // The primary body error is also preserved as `cause` for cause-walking loggers.
+    expect((agg.cause as Error).message).toMatch(/hyperdrive create/);
+  });
+});
+
+describe('provisionCloudflareResources — quarantine retains the whole-provision lock', () => {
+  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
+
+  it('a quarantine rejection RETAINS the mutex (not released) and surfaces the quarantine error', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    // A runner whose child could not be confirmed dead — the default runner rejects
+    // with a quarantine error in that state; injecting the same rejection exercises the
+    // provision-level contract: NO release, mutex retained, error surfaced verbatim.
+    const quarantineError = new WranglerQuarantineError(43210, 'test: child unconfirmed');
+    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
+    let thrown: unknown;
+    try {
+      await provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      );
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toBe(quarantineError);
+    expect((thrown as Error).message).toMatch(/pid 43210/);
+    expect((thrown as Error).message).toMatch(/intentionally RETAINED/);
+    // The lock is not released while the wrangler child may still be alive.
+    expect(existsSync(lockMutex)).toBe(true);
+    // Later acquisitions gate on the recorded group instead of stealing the lock by age.
+    const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
+    expect(existsSync(sidecar)).toBe(true);
+    const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
+    expect(recorded.pid).toBe(43210);
+    expect(String(recorded.reason)).toMatch(/pid 43210/);
+    // quarantine() detached the lock from proper-lockfile, so removing it fires no callback.
+    rmSync(lockMutex, { recursive: true, force: true });
+    rmSync(sidecar, { force: true });
+  });
+});
+
+describe('provisionCloudflareResources — dangling-symlink lock identity', () => {
+  it('provisions via dangling-symlink aliases to the SAME not-yet-created target share ONE lock identity (one create)', async () => {
+    // Two dangling symlinks point at the same not-yet-created config. Each must resolve to
+    // the target's lock, not its own lexical path.
+    const sharedDir = join(tmpDir, 'shared');
+    mkdirSync(sharedDir, { recursive: true });
+    const target = join(sharedDir, 'wrangler.jsonc'); // NOT created yet — dangling
+    const aliasA = join(tmpDir, 'aliasA.jsonc');
+    const aliasB = join(tmpDir, 'aliasB.jsonc');
+    symlinkSync(target, aliasA);
+    symlinkSync(target, aliasB);
+    expect(existsSync(target)).toBe(false); // both aliases are dangling at start
+
+    let createCalls = 0;
+    const run: RunWrangler = provisionOperationFixture((args) => {
+      if (isCall(args, 'hyperdrive', 'create')) {
+        createCalls++;
+        // --update-config writes to the CANONICAL target (both aliases resolve to it).
+        simulateUpdateConfig(
+          'hyperdrive',
+          { binding: 'HYPERDRIVE', id: hex32('hd-' + createCalls) },
+          target,
+        );
+        return ok();
+      }
+      return ok();
+    });
+    const makeProv = (
+      aliasPath: string,
+      retries?: number,
+    ): Promise<{ resources: Array<{ kind: string; action: string }> }> =>
+      provisionCloudflareResources(
+        tmpDir,
+        aliasPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => [],
+          ...(retries !== undefined ? { lockOptions: { retries } } : {}),
+        },
+      ) as Promise<{ resources: Array<{ kind: string; action: string }> }>;
+    // While the real-target lock is held, a dangling-alias provision cannot acquire it.
+    const canonicalTarget = join(realpathSync(sharedDir), 'wrangler.jsonc');
+    const held = await acquireProvisionLock(canonicalTarget);
+    await expect(makeProv(aliasA, 0)).rejects.toThrow(/already being held/);
+    await held.release();
+    // One underlying (initially not-yet-created) file: a create via alias A is
+    // read-first-REUSED via alias B.
+    const a = await makeProv(aliasA);
+    const b = await makeProv(aliasB);
+    expect(a.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
+    expect(b.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('reused');
+    expect(createCalls).toBe(1);
+    // The ONE canonical mutex (keyed on the real target) is released.
+    expect(existsSync(`${realpathSync(target)}.void-provision.lock.lock`)).toBe(false);
+  }, 15_000);
+
+  it('a non-ENOENT realpath error (a self-referential symlink cycle → ELOOP) SURFACES, not swallowed', async () => {
+    // A symlink cycle makes realpath throw ELOOP, which must not fall back to the lexical path.
+    mkdirSync(tmpDir, { recursive: true });
+    const loop = join(tmpDir, 'loop.jsonc');
+    symlinkSync(loop, loop);
+    const { run } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        loop,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/ELOOP/);
+  });
+});
diff --git a/packages/void/test/unit/provision-resources.test.ts b/packages/void/test/unit/provision-resources.test.ts
index 0973abc27..d8ff104ac 100644
--- a/packages/void/test/unit/provision-resources.test.ts
+++ b/packages/void/test/unit/provision-resources.test.ts
@@ -1,3 +1,3926 @@
-import { runProvisionTestShard } from './provision-test-shard.ts';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as parseJsoncRaw } from 'jsonc-parser';
+import { toSlash } from 'pathslash';
+import { beforeEach, describe, expect, it, vi } from 'vite-plus/test';
+import type { CloudflareOperation } from '../../../deploy-cloudflare/src/operations.ts';
+import { encodeCloudflareOperation } from '../../src/cli/cloudflare-process.ts';
+import {
+  assertNoTransportRedirectInProjectDotenv,
+  checkCloudflareProvisionDrift,
+  enableD1ReadReplicationViaApi,
+  normalizeRunWranglerResult,
+  provisionCloudflareResources as provisionCloudflareResourcesImpl,
+  provisionEnv,
+  resolvePinnedApiBaseUrl,
+  WranglerQuarantineError,
+  type DesiredResourceSet,
+  type RunWrangler,
+} from '../../src/cli/provision.ts';
+import { materializeCloudflareConfig } from '../../src/cloudflare-config.ts';
+import {
+  AMBIENT_ACCOUNT,
+  emptyDesired,
+  fail,
+  hex32,
+  isCall,
+  makeRunner,
+  ok,
+  provisionCloudflareResources,
+  provisionOperationFixture,
+  silentLog,
+  stubEmptyHyperdriveList,
+  useProvisionTestDir,
+  uuid,
+} from './provision-fixtures.ts';
 
-await runProvisionTestShard('resources');
+const { tmpDir, wranglerPath, setup, readConfig, simulateUpdateConfig } =
+  useProvisionTestDir('resources');
+
+describe('D1 read-replication API', () => {
+  it('uses the pinned account and endpoint with an authenticated update', async () => {
+    const requests: Array<{ url: string; init: RequestInit }> = [];
+    await enableD1ReadReplicationViaApi(
+      {
+        accountId: 'account-one',
+        apiBaseUrl: 'https://api.example.test/client/v4',
+        databaseId: uuid('db1'),
+      },
+      'token-one',
+      async (url, init) => {
+        requests.push({ url: String(url), init: init! });
+        return Response.json({ success: true });
+      },
+    );
+
+    expect(requests).toHaveLength(1);
+    expect(requests[0].url).toBe(
+      `https://api.example.test/client/v4/accounts/account-one/d1/database/${uuid('db1')}`,
+    );
+    expect(requests[0].init.method).toBe('PUT');
+    expect(requests[0].init.headers).toEqual({
+      Authorization: 'Bearer token-one',
+      'Content-Type': 'application/json',
+    });
+    expect(requests[0].init.body).toBe(JSON.stringify({ read_replication: { mode: 'auto' } }));
+  });
+
+  it('fails closed when Cloudflare rejects the replication update', async () => {
+    const update = enableD1ReadReplicationViaApi(
+      {
+        accountId: 'account-one',
+        apiBaseUrl: 'https://api.example.test/client/v4',
+        databaseId: uuid('db1'),
+      },
+      'secret-token',
+      async () => Response.json({ success: false }, { status: 403 }),
+    );
+
+    await expect(update).rejects.toThrow(/D1 Edit permission/);
+  });
+});
+
+describe('provisionCloudflareResources — typed operations', () => {
+  it('sends a Hyperdrive connection only through stdin while literal public targets stay structured', async () => {
+    setup('{}');
+    const connection = 'postgres://user:synthetic-password@host/database';
+    const operations: Array<CloudflareOperation> = [];
+    const inputs: Array<string | undefined> = [];
+    const run: RunWrangler = (operation, options) => {
+      operations.push(operation);
+      inputs.push(options.input);
+      simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('typed') });
+      return ok();
+    };
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { name: 'typed-hd', binding: 'HYPERDRIVE', connectionString: connection },
+      },
+      { runWrangler: run, listHyperdriveConfigs: async () => [], log: silentLog },
+    );
+    expect(operations).toEqual([
+      {
+        type: 'hyperdrive.create',
+        name: 'typed-hd',
+        binding: 'HYPERDRIVE',
+        configPath: wranglerPath,
+      },
+    ]);
+    expect(inputs).toEqual([connection]);
+    expect(JSON.stringify(operations)).not.toContain('synthetic-password');
+    const encoded = encodeCloudflareOperation(operations[0]!);
+    expect(encoded).toHaveLength(1);
+    expect(encoded.join(' ')).not.toContain('synthetic-password');
+    expect(JSON.parse(encoded[0]!)).toEqual(operations[0]);
+  });
+
+  it('adopts structured Queue identity despite misleading human prose', async () => {
+    setup('{}');
+    const operations: Array<CloudflareOperation> = [];
+    const run: RunWrangler = (operation) => {
+      operations.push(operation);
+      return {
+        status: 0,
+        stdout: 'Queue "typed-jobs" does not exist.',
+        stderr: '',
+        data: { name: 'typed-jobs' },
+      };
+    };
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, queues: ['typed-jobs'] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(operations).toEqual([
+      { type: 'queues.info', name: 'typed-jobs', configPath: wranglerPath },
+    ]);
+  });
+
+  it('creates a Queue from a structured not-found result and verifies the new identity', async () => {
+    setup('{}');
+    const operations: Array<CloudflareOperation> = [];
+    let created = false;
+    const run: RunWrangler = (operation) => {
+      operations.push(operation);
+      if (operation.type === 'queues.create') {
+        created = true;
+        return ok();
+      }
+      return created
+        ? { ...ok(), data: { name: 'typed-jobs' } }
+        : { status: 1, stdout: '', stderr: 'Provider presentation changed.', failure: 'not-found' };
+    };
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, queues: ['typed-jobs'] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(operations.map((operation) => operation.type)).toEqual([
+      'queues.info',
+      'queues.create',
+      'queues.info',
+    ]);
+  });
+
+  it('rejects signal provenance even when structured D1 data looks valid', async () => {
+    setup('{}');
+    const run: RunWrangler = () => ({
+      status: 0,
+      stdout: '',
+      stderr: '',
+      data: [],
+      signal: 'SIGTERM',
+    });
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { name: 'typed-db', binding: 'DB' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/SIGTERM|failed|invalid/);
+  });
+});
+
+describe('provisionCloudflareResources — read-first', () => {
+  it('enables D1 replication for a reused database before continuing the deploy', async () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
+      }),
+    );
+    const enabled: Array<unknown> = [];
+    const { run } = makeRunner([]);
+
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      {
+        runWrangler: run,
+        log: silentLog,
+        enableD1ReadReplication: async (context: unknown) => {
+          enabled.push(context);
+        },
+      },
+    );
+
+    expect(enabled).toEqual([
+      {
+        databaseId: uuid('db1'),
+        accountId: AMBIENT_ACCOUNT,
+        apiBaseUrl: 'https://api.cloudflare.com/client/v4',
+      },
+    ]);
+  });
+
+  it('does not skip replication when the Wrangler runner is injected', async () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
+      }),
+    );
+    const requests: Array<string> = [];
+    vi.stubGlobal('fetch', async (input: string | URL) => {
+      requests.push(String(input));
+      return Response.json({ success: true });
+    });
+    const { run } = makeRunner([]);
+    await provisionCloudflareResourcesImpl(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, apiToken: 'test-token', log: silentLog },
+    );
+    expect(requests).toEqual([
+      `https://api.cloudflare.com/client/v4/accounts/${AMBIENT_ACCOUNT}/d1/database/${uuid('db1')}`,
+    ]);
+  });
+
+  it('does NOT treat a placeholder database_id ("local") as real — proceeds to provision', async () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
+      }),
+    );
+    const { run, calls } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      {
+        match: /^d1 create /,
+        reply: () => {
+          simulateUpdateConfig('d1_databases', {
+            binding: 'DB',
+            database_name: 'myapp-db',
+            database_id: uuid('created'),
+          });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls[0]).toEqual(['d1', 'list', '--json', '-c', wranglerPath, '--env=']);
+    expect(result.resources[0].action).toBe('created');
+  });
+});
+
+describe('provisionCloudflareResources — config discovery (fail closed, single file)', () => {
+  it('reads a BOM-prefixed config correctly — ids found, no re-provision', async () => {
+    setup(
+      '' +
+        JSON.stringify({
+          d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
+        }),
+    );
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    // A BOM must NOT defeat read-first (a fail-open-to-{} parse would re-provision).
+    expect(calls.some((c) => c[0] === 'd1')).toBe(false);
+    expect(result.resources[0]).toMatchObject({ kind: 'd1', action: 'reused', id: uuid('db1') });
+    // BOM survives the writer's migrations_dir fill.
+    expect(readFileSync(wranglerPath, 'utf-8').charCodeAt(0)).toBe(0xfeff);
+  });
+
+  it('fails closed on a malformed root config — throws, no wrangler calls, no write', async () => {
+    const malformed = '{ "name": "x" "d1_databases": [] }'; // missing comma
+    setup(malformed);
+    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/not valid JSON/);
+    expect(calls).toEqual([]);
+    expect(readFileSync(wranglerPath, 'utf-8')).toBe(malformed);
+  });
+
+  it('reads and writes the SAME single resolved file when both wrangler.json and wrangler.jsonc exist', async () => {
+    rmSync(tmpDir, { recursive: true, force: true });
+    mkdirSync(tmpDir, { recursive: true });
+    const jsoncPath = join(tmpDir, 'wrangler.jsonc');
+    const jsonPath = join(tmpDir, 'wrangler.json');
+    // The caller pins wrangler.json; the writer must not rediscover .jsonc.
+    writeFileSync(jsonPath, JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
+    writeFileSync(jsoncPath, JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
+    const { run } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      jsonPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(result.configPath).toBe(toSlash(jsonPath));
+    // The adopted id landed in the passed file (wrangler.json) — NOT split into .jsonc.
+    const jsonAfter = parseJsoncRaw(readFileSync(jsonPath, 'utf-8')) as Record<string, unknown>;
+    expect((jsonAfter.kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe(hex32('kv'));
+    // wrangler.jsonc is untouched (still the placeholder).
+    const jsoncAfter = parseJsoncRaw(readFileSync(jsoncPath, 'utf-8')) as Record<string, unknown>;
+    expect((jsoncAfter.kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe('local');
+  });
+});
+
+describe('provisionCloudflareResources — D1', () => {
+  it('creates a missing D1 with --update-config then writes migrations_dir', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      {
+        match: /^d1 create /,
+        reply: () => {
+          simulateUpdateConfig('d1_databases', {
+            binding: 'DB',
+            database_name: 'myapp-db',
+            database_id: uuid('created'),
+          });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([
+      ['d1', 'list', '--json', '-c', wranglerPath, '--env='],
+      [
+        'd1',
+        'create',
+        'myapp-db',
+        '--binding',
+        'DB',
+        '--update-config',
+        '-c',
+        wranglerPath,
+        '--env=',
+      ],
+    ]);
+    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
+    expect(d1).toEqual([
+      {
+        binding: 'DB',
+        database_name: 'myapp-db',
+        database_id: uuid('created'),
+        migrations_dir: './db/migrations',
+      },
+    ]);
+    expect(result.resources).toEqual([
+      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'created' },
+    ]);
+  });
+
+  it('repairs a missing migrations_dir on the read-first reused path (retry convergence, no duplicate D1)', async () => {
+    // Simulates a prior run that created the D1 (real id written) then crashed
+    // before migrations_dir. The retry takes read-first → reused and must still
+    // fill migrations_dir — without re-creating (no duplicate D1).
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
+      }),
+    );
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([]); // read-first — no create, no list
+    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
+    expect(d1).toHaveLength(1); // no duplicate D1 minted
+    expect(d1[0]).toEqual({
+      binding: 'DB',
+      database_name: 'myapp-db',
+      database_id: uuid('db1'),
+      migrations_dir: './db/migrations',
+    });
+    expect(result.resources).toEqual([
+      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'reused', id: uuid('db1') },
+    ]);
+  });
+
+  it('adopts an existing D1 found in the account (list hit) — no create, writes id + migrations_dir', async () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
+      }),
+    );
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () => ok(JSON.stringify([{ uuid: uuid('existing'), name: 'myapp-db' }])),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([['d1', 'list', '--json', '-c', wranglerPath, '--env=']]);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
+    expect(d1).toEqual([
+      {
+        binding: 'DB',
+        database_name: 'myapp-db',
+        database_id: uuid('existing'),
+        migrations_dir: './db/migrations',
+      },
+    ]);
+    expect(result.resources).toEqual([
+      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'adopted', id: uuid('existing') },
+    ]);
+  });
+
+  it('treats a create-time 7502 (already exists) as adopt — captures the id via d1 info', async () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
+      }),
+    );
+    const { run, calls } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      {
+        match: /^d1 create /,
+        reply: () => fail('', 'X [ERROR] A database with that name already exists [code: 7502]'),
+      },
+      {
+        match: /^d1 info myapp-db --json/,
+        reply: () => ok(JSON.stringify({ uuid: uuid('raced'), name: 'myapp-db' })),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([
+      ['d1', 'list', '--json', '-c', wranglerPath, '--env='],
+      [
+        'd1',
+        'create',
+        'myapp-db',
+        '--binding',
+        'DB',
+        '--update-config',
+        '-c',
+        wranglerPath,
+        '--env=',
+      ],
+      ['d1', 'info', 'myapp-db', '--json', '-c', wranglerPath, '--env='],
+    ]);
+    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
+    expect(d1[0]).toMatchObject({ binding: 'DB', database_id: uuid('raced') });
+    expect(result.resources[0]).toEqual({
+      kind: 'd1',
+      binding: 'DB',
+      name: 'myapp-db',
+      action: 'adopted',
+      id: uuid('raced'),
+    });
+  });
+
+  it('throws on a non-7502 create failure', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      {
+        match: /^d1 create /,
+        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/d1 create myapp-db.*failed/s);
+  });
+});
+
+describe('provisionCloudflareResources — D1 discovery gate + strict validation', () => {
+  const d1Desired: DesiredResourceSet = {
+    ...emptyDesired,
+    d1: { binding: 'DB', name: 'myapp-db' },
+  };
+
+  it('fails closed (no create) when `d1 list` exits non-zero', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
+        runWrangler: run,
+        log: silentLog,
+      }),
+    ).rejects.toThrow(/d1 list.*failed/s);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+    expect(readConfig().d1_databases).toBeUndefined();
+  });
+
+  it('fails closed (no create) when `d1 list` returns truncated JSON (status 0)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[{ "uuid": "a", "name": "myapp-db"') },
+    ]);
+    await expect(
+      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
+        runWrangler: run,
+        log: silentLog,
+      }),
+    ).rejects.toThrow(/did not return a JSON array/);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+
+  it('fails closed (no create) when a `d1 list` member is malformed — even when it IS the target name', async () => {
+    // The target-named member carries NO id → it must NOT be filtered to a false
+    // "absent" that mints a duplicate D1.
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok(JSON.stringify([{ name: 'myapp-db' }])) },
+    ]);
+    await expect(
+      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
+        runWrangler: run,
+        log: silentLog,
+      }),
+    ).rejects.toThrow(/D1 database named "myapp-db" with no valid id/);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+
+  it('fails closed (no adopt/write) when the collision `d1 info` exits non-zero', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      { match: /^d1 create /, reply: () => fail('', 'X [ERROR] already exists [code: 7502]') },
+      {
+        match: /^d1 info myapp-db --json/,
+        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
+        runWrangler: run,
+        log: silentLog,
+      }),
+    ).rejects.toThrow(/d1 info myapp-db.*failed/s);
+    // The 7502 create wrote nothing, and the failed info produced no adopt/write.
+    expect(readConfig().d1_databases).toBeUndefined();
+  });
+});
+
+describe('provisionCloudflareResources — KV', () => {
+  it('retains a created namespace when typed config is materialized again', async () => {
+    setup('{}');
+    rmSync(wranglerPath);
+    writeFileSync(
+      join(tmpDir, 'void.config.ts'),
+      `export default { cloudflare: { name: 'app', account_id: '${AMBIENT_ACCOUNT}' } };\n`,
+    );
+    const generatedPath = materializeCloudflareConfig(tmpDir);
+    const namespaceId = hex32('newkv');
+    const { run } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok('[]') },
+      {
+        match: /^kv namespace create /,
+        reply: () => {
+          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: namespaceId }, generatedPath);
+          return ok();
+        },
+      },
+    ]);
+
+    await provisionCloudflareResources(
+      tmpDir,
+      generatedPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'app-kv' }] },
+      { runWrangler: run, log: silentLog },
+    );
+
+    const lock = JSON.parse(readFileSync(join(tmpDir, 'void.lock.json'), 'utf8')) as {
+      resolved: { kv_namespaces: Array<{ binding: string; id: string }> };
+    };
+    expect(lock.resolved.kv_namespaces).toEqual([{ binding: 'KV', id: namespaceId }]);
+    materializeCloudflareConfig(tmpDir);
+    const generated = parseJsoncRaw(readFileSync(generatedPath, 'utf8')) as Record<string, unknown>;
+    expect(generated.kv_namespaces).toEqual([{ binding: 'KV', id: namespaceId }]);
+  });
+
+  it('adopts when the namespace list shows a title match (writes id, no create)', async () => {
+    setup(JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([['kv', 'namespace', 'list', '-c', wranglerPath, '--env=']]);
+    const kv = readConfig().kv_namespaces as Array<Record<string, unknown>>;
+    expect(kv).toEqual([{ binding: 'KV', id: hex32('kv') }]);
+    expect(result.resources).toEqual([
+      { kind: 'kv', binding: 'KV', name: 'myapp-kv', action: 'adopted', id: hex32('kv') },
+    ]);
+  });
+
+  it('creates when the namespace list is empty', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok('[]') },
+      {
+        match: /^kv namespace create /,
+        reply: () => {
+          simulateUpdateConfig('kv_namespaces', { binding: 'ISR_CACHE', id: hex32('newkv') });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'ISR_CACHE', title: 'myapp-isr' }] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([
+      ['kv', 'namespace', 'list', '-c', wranglerPath, '--env='],
+      [
+        'kv',
+        'namespace',
+        'create',
+        'myapp-isr',
+        '--binding',
+        'ISR_CACHE',
+        '--update-config',
+        '-c',
+        wranglerPath,
+        '--env=',
+      ],
+    ]);
+    expect(result.resources).toEqual([
+      { kind: 'kv', binding: 'ISR_CACHE', name: 'myapp-isr', action: 'created' },
+    ]);
+  });
+
+  it('fails closed (no create) when `kv namespace list` exits non-zero', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/kv namespace list.*failed/s);
+    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
+  });
+
+  it('fails closed (no create) when `kv namespace list` returns non-JSON output', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok('not a json list at all') },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/did not return a JSON array/);
+    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
+  });
+
+  it('picks the lexicographically-smallest id and warns on multiple title matches', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const warnings: Array<string> = [];
+    const { run } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () =>
+          ok(
+            JSON.stringify([
+              { id: hex32('zzz'), title: 'myapp-kv' },
+              { id: hex32('aaa'), title: 'myapp-kv' },
+              { id: hex32('mmm'), title: 'other' },
+            ]),
+          ),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+      { runWrangler: run, log: { info: () => {}, warn: (m) => warnings.push(m) } },
+    );
+    // hex32 is order-preserving on equal-length seeds, so hex32('aaa') < hex32('zzz').
+    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: hex32('aaa') });
+    expect((readConfig().kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe(hex32('aaa'));
+    expect(
+      warnings.some((w) => w.includes('multiple KV namespaces') && w.includes(hex32('aaa'))),
+    ).toBe(true);
+  });
+
+  it('provisions each KV binding independently (ISR_CACHE + app KV)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok('[]') },
+      {
+        match: /^kv namespace create /,
+        reply: (sub) => {
+          const binding = sub.includes('ISR_CACHE') ? 'ISR_CACHE' : 'KV';
+          simulateUpdateConfig('kv_namespaces', { binding, id: hex32(binding) });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        kvNamespaces: [
+          { binding: 'KV', title: 'myapp-kv' },
+          { binding: 'ISR_CACHE', title: 'myapp-isr' },
+        ],
+      },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(result.resources.map((r) => r.action)).toEqual(['created', 'created']);
+    const kv = readConfig().kv_namespaces as Array<Record<string, unknown>>;
+    expect(kv.map((e) => e.binding).sort()).toEqual(['ISR_CACHE', 'KV']);
+    expect(calls.filter((c) => isCall(c, 'kv', 'namespace', 'create'))).toHaveLength(2);
+  });
+});
+
+describe('provisionCloudflareResources — account_id', () => {
+  it('writes top-level account_id via the writer when provided', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([]);
+    const result = await provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
+      runWrangler: run,
+      accountId: 'acc-123',
+      log: silentLog,
+    });
+    expect(readConfig().account_id).toBe('acc-123');
+    expect(result.accountIdWritten).toBe(true);
+  });
+
+  it('does not write account_id when not provided (and none resolvable)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    // No account anywhere; with no remote work the account fence does not fire.
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', undefined);
+    const { run } = makeRunner([]);
+    const result = await provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
+      runWrangler: run,
+      log: silentLog,
+    });
+    expect(readConfig().account_id).toBeUndefined();
+    expect(result.accountIdWritten).toBe(false);
+  });
+});
+
+describe('provisionCloudflareResources — idempotent re-run', () => {
+  it('a second run after adoption is a read-first no-op (byte-identical config, no wrangler calls)', async () => {
+    setup(JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
+    const first = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
+      },
+    ]);
+    const desired: DesiredResourceSet = {
+      ...emptyDesired,
+      kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
+    };
+    await provisionCloudflareResources(tmpDir, wranglerPath, desired, {
+      runWrangler: first.run,
+      log: silentLog,
+    });
+    const afterFirst = readFileSync(wranglerPath, 'utf-8');
+
+    const second = makeRunner([]);
+    const result = await provisionCloudflareResources(tmpDir, wranglerPath, desired, {
+      runWrangler: second.run,
+      log: silentLog,
+    });
+    expect(second.calls).toEqual([]);
+    expect(result.resources).toEqual([
+      { kind: 'kv', binding: 'KV', name: 'myapp-kv', action: 'reused', id: hex32('kv') },
+    ]);
+    expect(readFileSync(wranglerPath, 'utf-8')).toBe(afterFirst);
+  });
+});
+
+describe('provisionCloudflareResources — R2', () => {
+  it('reuses when the bucket_name is already real (no wrangler call)', async () => {
+    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'myapp-uploads' }] }));
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([]);
+    expect(result.resources).toEqual([
+      { kind: 'r2', binding: 'STORAGE', name: 'myapp-uploads', action: 'reused' },
+    ]);
+  });
+
+  it('adopts an existing bucket via `r2 bucket info` (status 0) — writes the entry, no create', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^r2 bucket info myapp-uploads --json/,
+        reply: () => ok(JSON.stringify({ name: 'myapp-uploads', created: 'x' })),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([
+      ['r2', 'bucket', 'info', 'myapp-uploads', '--json', '-c', wranglerPath, '--env='],
+    ]);
+    expect(readConfig().r2_buckets).toEqual([{ binding: 'STORAGE', bucket_name: 'myapp-uploads' }]);
+    expect(result.resources).toEqual([
+      { kind: 'r2', binding: 'STORAGE', name: 'myapp-uploads', action: 'adopted' },
+    ]);
+  });
+
+  it('creates the bucket when `r2 bucket info` reports it does not exist', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^r2 bucket info /,
+        reply: () => fail('', 'X [ERROR] The specified bucket does not exist [code: 10006]'),
+      },
+      {
+        match: /^r2 bucket create /,
+        reply: () => {
+          simulateUpdateConfig('r2_buckets', {
+            binding: 'STORAGE',
+            bucket_name: 'myapp-uploads',
+          });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([
+      ['r2', 'bucket', 'info', 'myapp-uploads', '--json', '-c', wranglerPath, '--env='],
+      [
+        'r2',
+        'bucket',
+        'create',
+        'myapp-uploads',
+        '--binding',
+        'STORAGE',
+        '--update-config',
+        '-c',
+        wranglerPath,
+        '--env=',
+      ],
+    ]);
+    expect(result.resources).toEqual([
+      { kind: 'r2', binding: 'STORAGE', name: 'myapp-uploads', action: 'created' },
+    ]);
+  });
+
+  it('does NOT create on an R2 info failure that is not a confirmed not-found (auth/metrics) — surfaces the error', async () => {
+    // `r2 bucket info` also runs a metrics query, so an existing bucket can exit
+    // non-zero on an auth or metrics failure.
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^r2 bucket info /,
+        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/r2 bucket info myapp-uploads.*(failed|refusing)/s);
+    // No create attempted (the existing bucket must not be duplicated/errored on).
+    expect(calls).toEqual([
+      ['r2', 'bucket', 'info', 'myapp-uploads', '--json', '-c', wranglerPath, '--env='],
+    ]);
+  });
+});
+
+describe('provisionCloudflareResources — Hyperdrive', () => {
+  it('adopts an existing Hyperdrive config found by name — writes id via the writer, no create', async () => {
+    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }));
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+      },
+      {
+        runWrangler: run,
+        log: silentLog,
+        listHyperdriveConfigs: async () => [
+          { id: hex32('other-hd'), name: 'someone-else' },
+          { id: hex32('existing'), name: 'myapp-hd' },
+        ],
+      },
+    );
+    // No wrangler create — existence via the injected REST seam, id via the writer.
+    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+    const hd = readConfig().hyperdrive as Array<Record<string, unknown>>;
+    expect(hd).toEqual([{ binding: 'HYPERDRIVE', id: hex32('existing') }]);
+    expect(result.resources).toEqual([
+      {
+        kind: 'hyperdrive',
+        binding: 'HYPERDRIVE',
+        name: 'myapp-hd',
+        action: 'adopted',
+        id: hex32('existing'),
+      },
+    ]);
+  });
+
+  it('creates the config when confirmed absent and a connection string is present', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^hyperdrive create /,
+        reply: () => {
+          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('newhd') });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: {
+          binding: 'HYPERDRIVE',
+          name: 'myapp-hd',
+          connectionString: 'postgres://u:p@h/db',
+        },
+      },
+      { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+    );
+    expect(calls).toEqual([
+      [
+        'hyperdrive',
+        'create',
+        'myapp-hd',
+        '--binding',
+        'HYPERDRIVE',
+        '--update-config',
+        '-c',
+        wranglerPath,
+        '--env=',
+      ],
+    ]);
+    expect(result.resources).toEqual([
+      { kind: 'hyperdrive', binding: 'HYPERDRIVE', name: 'myapp-hd', action: 'created' },
+    ]);
+  });
+
+  it('fails closed when existence is ambiguous (check throws) and a connection string is present — no create', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: {
+            binding: 'HYPERDRIVE',
+            name: 'myapp-hd',
+            connectionString: 'postgres://u:p@h/db',
+          },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => {
+            throw new Error('network down');
+          },
+        },
+      ),
+    ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
+    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+  });
+
+  it('still skips (structured, never creates) when a lister can look but finds nothing', async () => {
+    // A lister IS available, so this run COULD have adopted a same-named config; it
+    // just did not find one. Nothing can be minted without a connection string, so the
+    // structured skip — not a throw — remains the right report for that outcome.
+    setup(JSON.stringify({ name: 'app' }));
+    const warnings: Array<string> = [];
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      {
+        accountId: 'acct',
+        runWrangler: run,
+        listHyperdriveConfigs: async () => [],
+        log: { info: () => {}, warn: (m) => warnings.push(m) },
+      },
+    );
+    expect(calls).toEqual([]);
+    expect(result.resources).toEqual([
+      {
+        kind: 'hyperdrive',
+        binding: 'HYPERDRIVE',
+        name: 'myapp-hd',
+        action: 'skipped',
+        reason: 'no connection string provided',
+      },
+    ]);
+    expect(warnings.some((w) => w.includes('skipping Hyperdrive'))).toBe(true);
+  });
+
+  it('adopts a same-named config with NO connection string (adoption never needs one)', async () => {
+    // Guards the stringless fail-closed fence from over-reaching: a run with no
+    // connection string whose lister DOES find a match must still adopt, not throw.
+    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }));
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      {
+        accountId: 'acct',
+        runWrangler: run,
+        listHyperdriveConfigs: async () => [{ id: hex32('adopted'), name: 'myapp-hd' }],
+        log: silentLog,
+      },
+    );
+    expect(calls).toEqual([]);
+    expect(result.resources).toEqual([
+      {
+        kind: 'hyperdrive',
+        binding: 'HYPERDRIVE',
+        name: 'myapp-hd',
+        action: 'adopted',
+        id: hex32('adopted'),
+      },
+    ]);
+  });
+});
+
+// The Hyperdrive existence check needs an API token (there is no machine-readable list
+// command), so a missing token must be reported before any other resource is created.
+describe('provisionCloudflareResources — Hyperdrive API token requirement', () => {
+  beforeEach(() => {
+    vi.stubEnv('CLOUDFLARE_API_TOKEN', undefined);
+  });
+
+  it('fails with an actionable token error BEFORE any account mutation when the config has no id', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          d1: { binding: 'DB', name: 'myapp-db' },
+          hyperdrive: {
+            binding: 'HYPERDRIVE',
+            name: 'myapp-hd',
+            connectionString: 'postgres://u:p@h/db',
+          },
+        },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/CLOUDFLARE_API_TOKEN/);
+    // Nothing ran: no `d1 create`, no Hyperdrive call — the account is untouched.
+    expect(calls).toEqual([]);
+    // The config was not touched either (no account_id pin, no new entries).
+    expect(readConfig()).toEqual({ name: 'app' });
+  });
+
+  it('names the two remedies: export a token, or put an existing Hyperdrive id in the config', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([]);
+    const error = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: {
+          binding: 'HYPERDRIVE',
+          name: 'myapp-hd',
+          connectionString: 'postgres://u:p@h/db',
+        },
+      },
+      { runWrangler: run, log: silentLog },
+    ).catch((e: unknown) => e as Error);
+    expect(error).toBeInstanceOf(Error);
+    const message = (error as Error).message;
+    expect(message).toContain('CLOUDFLARE_API_TOKEN');
+    expect(message).toContain('Hyperdrive');
+    // Explains WHY a token is needed where `wrangler login` suffices elsewhere.
+    expect(message).toMatch(/no machine-readable/i);
+    // Remedy 2: create the config yourself and paste its id into wrangler.jsonc.
+    expect(message).toContain(wranglerPath);
+    expect(message).toMatch(/wrangler login|OAuth/i);
+    // The connection string is never echoed into the error.
+    expect(message).not.toContain('postgres://');
+  });
+
+  it('proceeds with NO token when the Hyperdrive id is already in the config (no REST call)', async () => {
+    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: hex32('hd') }] }));
+    const { run, calls } = makeRunner([]);
+    const fetchUrls: Array<string> = [];
+    vi.stubGlobal('fetch', async (url: string | URL) => {
+      fetchUrls.push(String(url));
+      throw new Error('the read-first path must not reach the network');
+    });
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: {
+          binding: 'HYPERDRIVE',
+          name: 'myapp-hd',
+          connectionString: 'postgres://u:p@h/db',
+        },
+      },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(fetchUrls).toEqual([]);
+    expect(calls).toEqual([]);
+    expect(result.resources).toEqual([
+      {
+        kind: 'hyperdrive',
+        binding: 'HYPERDRIVE',
+        name: 'myapp-hd',
+        action: 'reused',
+        id: hex32('hd'),
+      },
+    ]);
+  });
+
+  it('runs the existence check unchanged when a token IS resolvable', async () => {
+    vi.stubEnv('CLOUDFLARE_API_TOKEN', 'ambient-tok');
+    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
+    const urls = stubEmptyHyperdriveList();
+    const { run, calls } = makeRunner([
+      {
+        match: /^hyperdrive create /,
+        reply: () => {
+          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('newhd') });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: {
+          binding: 'HYPERDRIVE',
+          name: 'myapp-hd',
+          connectionString: 'postgres://u:p@h/db',
+        },
+      },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(urls[0]).toContain('/accounts/config-acct/hyperdrive/configs');
+    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(true);
+    expect(result.resources).toEqual([
+      { kind: 'hyperdrive', binding: 'HYPERDRIVE', name: 'myapp-hd', action: 'created' },
+    ]);
+  });
+
+  it('needs no token when a listHyperdriveConfigs seam is injected', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^hyperdrive create /,
+        reply: () => {
+          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('newhd') });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: {
+          binding: 'HYPERDRIVE',
+          name: 'myapp-hd',
+          connectionString: 'postgres://u:p@h/db',
+        },
+      },
+      { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+    );
+    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(true);
+    expect(result.resources).toEqual([
+      { kind: 'hyperdrive', binding: 'HYPERDRIVE', name: 'myapp-hd', action: 'created' },
+    ]);
+  });
+
+  it('fails closed on a MISSING connection string when nothing can look the account up', async () => {
+    // No connection string AND no token/lister → this run can neither create nor adopt,
+    // so its only reachable outcome is the structured `skipped`, which deploy treats as
+    // FATAL. Reaching that costs the user a half-provisioned account, so it stops here.
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+        },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/no DATABASE_URL to create it from/);
+    // Nothing ran: no wrangler call, so no resource was created before the rejection.
+    expect(calls).toEqual([]);
+  });
+
+  it('names DATABASE_URL and the manual adopt route, and does not suggest a dotenv file', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([]);
+    const err = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      { runWrangler: run, log: silentLog },
+    ).catch((e: unknown) => e as Error);
+    expect(err).toBeInstanceOf(Error);
+    const message = (err as Error).message;
+    expect(message).toContain('DATABASE_URL');
+    expect(message).toContain('wrangler hyperdrive create');
+    expect(message).toContain('HYPERDRIVE');
+    // The remedy must point at the shell, never at a dotenv file — project-derived env
+    // is read only inside the build subprocess, and a shipped .env value would leak.
+    expect(message).toMatch(/shell/);
+    expect(message).toMatch(/NOT used here/);
+  });
+
+  it('fails closed BEFORE the account pin and before any other resource is created', async () => {
+    // The whole point of fencing early: a run that also wants KV/R2 must not create
+    // them (and must not stamp account_id) only to abort at the Hyperdrive block.
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
+          r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' },
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+        },
+        { runWrangler: run, accountId: 'acct-A', log: silentLog },
+      ),
+    ).rejects.toThrow(/no DATABASE_URL to create it from/);
+    // No create seam was invoked at all — KV and R2 were never touched.
+    expect(calls).toEqual([]);
+    // …and the account was never pinned, so a retry under a different account is still free.
+    expect(readConfig().account_id).toBeUndefined();
+  });
+
+  it('a hyperdrive already provisioned with a real id needs neither a string nor a token', async () => {
+    // The read-first path is pure config I/O — the stringless fence must not touch it.
+    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: hex32('hd') }] }));
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([]);
+    expect(result.resources).toEqual([
+      {
+        kind: 'hyperdrive',
+        binding: 'HYPERDRIVE',
+        name: 'myapp-hd',
+        action: 'reused',
+        id: hex32('hd'),
+      },
+    ]);
+  });
+});
+
+describe('provisionCloudflareResources — Queues (resource only)', () => {
+  it('reuses a queue that `queues info` finds (no create, never writes queue config)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^queues info jobs/, reply: () => ok('Queue Name: jobs') },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, queues: ['jobs'] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([['queues', 'info', 'jobs', '-c', wranglerPath, '--env=']]);
+    expect(result.resources).toEqual([{ kind: 'queue', name: 'jobs', action: 'reused' }]);
+    // Provisioning writes no queue producer or consumer entries.
+    expect(readConfig().queues).toBeUndefined();
+  });
+
+  it('creates a queue that `queues info` reports missing; verifies with a follow-up info probe', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    // Queues write no config, so a follow-up `queues info` is the only check that the
+    // create really happened.
+    let created = false;
+    const { run, calls } = makeRunner([
+      {
+        match: /^queues info emails/,
+        reply: () =>
+          created ? ok('Queue Name: emails') : fail('', 'X [ERROR] Queue "emails" does not exist.'),
+      },
+      {
+        match: /^queues create emails/,
+        reply: () => {
+          created = true;
+          return ok('Created queue emails');
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, queues: ['emails'] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([
+      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
+      ['queues', 'create', 'emails', '-c', wranglerPath, '--env='],
+      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
+    ]);
+    expect(result.resources).toEqual([{ kind: 'queue', name: 'emails', action: 'created' }]);
+    expect(readConfig().queues).toBeUndefined();
+  });
+
+  it('handles a mix of existing and missing queues', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    let created = false;
+    const { run, calls } = makeRunner([
+      { match: /^queues info jobs/, reply: () => ok('Queue Name: jobs') },
+      {
+        match: /^queues info emails/,
+        reply: () =>
+          created ? ok('Queue Name: emails') : fail('', 'Queue "emails" does not exist.'),
+      },
+      {
+        match: /^queues create emails/,
+        reply: () => {
+          created = true;
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, queues: ['jobs', 'emails'] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([
+      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
+      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
+      ['queues', 'create', 'emails', '-c', wranglerPath, '--env='],
+      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
+    ]);
+    expect(result.resources).toEqual([
+      { kind: 'queue', name: 'jobs', action: 'reused' },
+      { kind: 'queue', name: 'emails', action: 'created' },
+    ]);
+  });
+
+  it('throws (does NOT create) when `queues info` fails for a non-missing reason', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^queues info jobs/,
+        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, queues: ['jobs'] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/queues info jobs.*failed/s);
+    expect(calls.some((c) => isCall(c, 'queues', 'create'))).toBe(false);
+  });
+
+  it('fails closed when a masked-signal `queues create` (wrapper exit 0) did NOT create the queue', async () => {
+    // wrangler's bin wrapper maps a signal-killed inner CLI to exit 0. Queues write
+    // no config, so the ONLY backstop is the post-create verify probe: a create that
+    // reports clean 0 but whose follow-up `queues info` still does not confirm the
+    // queue must fail closed (never a false `created`).
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        // Both the initial probe AND the verify probe report the queue absent — the
+        // masked-kill create never actually created it.
+        match: /^queues info jobs/,
+        reply: () => fail('', 'X [ERROR] Queue "jobs" does not exist.'),
+      },
+      // A signal-killed inner CLI surfaced as a clean exit 0 by the wrapper.
+      { match: /^queues create jobs/, reply: () => ok('') },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, queues: ['jobs'] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/did not confirm the queue exists afterward/);
+    // The verify probe ran (info, create, info) but the queue was never recorded.
+    expect(calls).toEqual([
+      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
+      ['queues', 'create', 'jobs', '-c', wranglerPath, '--env='],
+      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
+    ]);
+  });
+});
+
+describe('provisionCloudflareResources — account reconciliation + config pin', () => {
+  it('fails closed BEFORE any wrangler/REST call when config account_id differs from opts.accountId', async () => {
+    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
+    let restCalled = false;
+    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        {
+          runWrangler: run,
+          accountId: 'requested-acct',
+          log: silentLog,
+          listHyperdriveConfigs: async () => {
+            restCalled = true;
+            return [];
+          },
+        },
+      ),
+    ).rejects.toThrow(/account mismatch.*config-acct.*requested-acct/s);
+    // No wrangler call and no REST call happened before the fail-closed throw.
+    expect(calls).toEqual([]);
+    expect(restCalled).toBe(false);
+  });
+
+  it.each([
+    { source: 'opts.accountId', ambient: AMBIENT_ACCOUNT, accountId: 'acct-A', pinned: 'acct-A' },
+    {
+      source: 'the ambient CLOUDFLARE_ACCOUNT_ID',
+      ambient: 'ambient-A',
+      accountId: undefined,
+      pinned: 'ambient-A',
+    },
+  ])(
+    'persists the account from $source before any remote op so a later different-account retry fails closed',
+    async ({ ambient, accountId, pinned }) => {
+      vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', ambient);
+      setup(JSON.stringify({ name: 'app' }));
+      // Run 1: D1 create writes a real id, then a later op fails.
+      const run1 = makeRunner([
+        { match: /^d1 list --json/, reply: () => ok('[]') },
+        {
+          match: /^d1 create /,
+          reply: () => {
+            simulateUpdateConfig('d1_databases', {
+              binding: 'DB',
+              database_name: 'myapp-db',
+              database_id: uuid('createdA'),
+            });
+            return ok();
+          },
+        },
+        {
+          match: /^queues info jobs/,
+          reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
+        },
+      ]);
+      await expect(
+        provisionCloudflareResources(
+          tmpDir,
+          wranglerPath,
+          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' }, queues: ['jobs'] },
+          { runWrangler: run1.run, accountId, log: silentLog },
+        ),
+      ).rejects.toThrow(/queues info jobs.*failed/s);
+      // The account was pinned before D1, alongside the real D1 id.
+      const after1 = readConfig();
+      expect(after1.account_id).toBe(pinned);
+      expect((after1.d1_databases as Array<Record<string, unknown>>)[0].database_id).toBe(
+        uuid('createdA'),
+      );
+
+      // Run 2 under account B fails closed with no wrangler or REST call.
+      let restCalled = false;
+      const run2 = makeRunner([{ match: /.*/, reply: () => ok() }]);
+      await expect(
+        provisionCloudflareResources(
+          tmpDir,
+          wranglerPath,
+          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' }, queues: ['jobs'] },
+          {
+            runWrangler: run2.run,
+            accountId: 'acct-B',
+            log: silentLog,
+            listHyperdriveConfigs: async () => {
+              restCalled = true;
+              return [];
+            },
+          },
+        ),
+      ).rejects.toThrow(new RegExp(`account mismatch.*${pinned}.*acct-B`, 's'));
+      expect(run2.calls).toEqual([]);
+      expect(restCalled).toBe(false);
+      expect(readConfig()).toEqual(after1);
+    },
+  );
+
+  it('passes -c <configPath> to EVERY wrangler invocation (list, info, create)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    let queueCreated = false;
+    const { run, calls } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      {
+        match: /^d1 create /,
+        reply: () => {
+          simulateUpdateConfig('d1_databases', {
+            binding: 'DB',
+            database_name: 'myapp-db',
+            database_id: uuid('created'),
+          });
+          return ok();
+        },
+      },
+      { match: /^kv namespace list/, reply: () => ok('[]') },
+      {
+        match: /^kv namespace create /,
+        reply: () => {
+          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: hex32('newkv') });
+          return ok();
+        },
+      },
+      {
+        match: /^r2 bucket info /,
+        reply: () => fail('', 'The specified bucket does not exist. [code: 10006]'),
+      },
+      {
+        match: /^r2 bucket create /,
+        reply: () => {
+          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'bucket-b' });
+          return ok();
+        },
+      },
+      {
+        match: /^queues info /,
+        reply: () =>
+          queueCreated ? ok('Queue Name: jobs') : fail('', 'Queue "jobs" does not exist.'),
+      },
+      {
+        match: /^queues create /,
+        reply: () => {
+          queueCreated = true;
+          return ok();
+        },
+      },
+    ]);
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        d1: { binding: 'DB', name: 'myapp-db' },
+        kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
+        r2: { binding: 'STORAGE', bucketName: 'bucket-b' },
+        queues: ['jobs'],
+      },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls.length).toBeGreaterThan(0);
+    for (const argv of calls) {
+      const i = argv.indexOf('-c');
+      expect(i).toBeGreaterThanOrEqual(0);
+      expect(argv[i + 1]).toBe(wranglerPath);
+    }
+  });
+
+  it('the default Hyperdrive existence REST call targets the effective (config) account id', async () => {
+    setup(
+      JSON.stringify({
+        account_id: 'config-acct',
+        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
+      }),
+    );
+    const urls = stubEmptyHyperdriveList();
+    const { run } = makeRunner([]);
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        // No connection string: only the existence check runs, never a create.
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      { runWrangler: run, apiToken: 'tok', log: silentLog },
+    );
+    expect(urls.length).toBeGreaterThan(0);
+    expect(urls[0]).toContain('/accounts/config-acct/hyperdrive/configs');
+    expect(urls[0]).toMatch(/^https:\/\/api\.cloudflare\.com\/client\/v4\//);
+  });
+});
+
+describe('provisionCloudflareResources — pinned transport (one base for wrangler + REST)', () => {
+  it('resolvePinnedApiBaseUrl mirrors wrangler: default prod, direct override, staging, fedramp', () => {
+    expect(resolvePinnedApiBaseUrl({})).toBe('https://api.cloudflare.com/client/v4');
+    expect(resolvePinnedApiBaseUrl({ CLOUDFLARE_API_BASE_URL: 'https://api.example/v9' })).toBe(
+      'https://api.example/v9',
+    );
+    // Deprecated alias honored when the primary is absent.
+    expect(resolvePinnedApiBaseUrl({ CF_API_BASE_URL: 'https://cf.example/v4' })).toBe(
+      'https://cf.example/v4',
+    );
+    expect(resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: 'staging' })).toBe(
+      'https://api.staging.cloudflare.com/client/v4',
+    );
+    expect(resolvePinnedApiBaseUrl({ CLOUDFLARE_COMPLIANCE_REGION: 'fedramp_high' })).toBe(
+      'https://api.fed.cloudflare.com/client/v4',
+    );
+  });
+
+  it('the default Hyperdrive REST lister honors a pinned CLOUDFLARE_API_BASE_URL (not hardcoded prod)', async () => {
+    vi.stubEnv('CLOUDFLARE_API_BASE_URL', 'https://api.staging.cloudflare.com/client/v4');
+    setup(
+      JSON.stringify({
+        account_id: 'config-acct',
+        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
+      }),
+    );
+    const urls = stubEmptyHyperdriveList();
+    const { run } = makeRunner([]);
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      { runWrangler: run, apiToken: 'tok', log: silentLog },
+    );
+    expect(urls[0]).toMatch(/^https:\/\/api\.staging\.cloudflare\.com\/client\/v4\//);
+    expect(urls[0]).toContain('/accounts/config-acct/hyperdrive/configs');
+  });
+
+  it('the lister URL uses the pinned base with wrangler-EXACT concatenation (no trailing-slash trim)', async () => {
+    // Wrangler appends the resource path to the base verbatim, so a trailing slash gives
+    // `//accounts/`. The lister must request the same URL as the create.
+    const pinnedBase = 'https://proxy.example/api/';
+    vi.stubEnv('CLOUDFLARE_API_BASE_URL', pinnedBase);
+    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
+    const urls = stubEmptyHyperdriveList();
+    const { run } = makeRunner([]);
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      { runWrangler: run, apiToken: 'tok', log: silentLog },
+    );
+    expect(urls[0]).toBe(
+      `${pinnedBase}/accounts/config-acct/hyperdrive/configs?page=1&per_page=100`,
+    );
+    expect(urls[0]).toContain('/api//accounts/');
+  });
+
+  it('the injected lister receives the pinned apiBaseUrl + a deadline AbortSignal in its transport context', async () => {
+    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
+    let seen: { accountId: string; apiBaseUrl: string; signal: AbortSignal } | undefined;
+    const { run } = makeRunner([]);
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      {
+        runWrangler: run,
+        log: silentLog,
+        listHyperdriveConfigs: async (ctx) => {
+          seen = ctx;
+          return [];
+        },
+      },
+    );
+    expect(seen?.accountId).toBe('config-acct');
+    expect(seen?.apiBaseUrl).toBe('https://api.cloudflare.com/client/v4');
+    // The lister is handed the overall-deadline signal to thread into every fetch.
+    expect(seen?.signal).toBeInstanceOf(AbortSignal);
+  });
+
+  it('FAILS CLOSED when a project .env sets a transport-redirect var (no wrangler/REST)', async () => {
+    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
+    // A repo .env that would redirect wrangler's transport on every command.
+    writeFileSync(
+      join(tmpDir, '.env'),
+      'CLOUDFLARE_API_BASE_URL=https://api.staging.cloudflare.com/client/v4\n',
+    );
+    let listerCalled = false;
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          d1: { binding: 'DB', name: 'myapp-db' },
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => {
+            listerCalled = true;
+            return [];
+          },
+        },
+      ),
+    ).rejects.toThrow(/refusing to provision.*\.env.*CLOUDFLARE_API_BASE_URL.*redirect/s);
+    // Failed closed BEFORE any remote work.
+    expect(calls.length).toBe(0);
+    expect(listerCalled).toBe(false);
+  });
+});
+
+describe('provisionCloudflareResources — Hyperdrive discovery (pagination + fail closed)', () => {
+  /** Serve `pages` in order (repeating the last) and record every requested URL. */
+  function stubFetch(pages: Array<{ status?: number; body: unknown }>): Array<string> {
+    const urls: Array<string> = [];
+    vi.stubGlobal('fetch', async (url: string | URL) => {
+      const page = pages[Math.min(urls.length, pages.length - 1)];
+      urls.push(String(url));
+      return new Response(typeof page.body === 'string' ? page.body : JSON.stringify(page.body), {
+        status: page.status ?? 200,
+      });
+    });
+    return urls;
+  }
+
+  it('follows result_info pagination and adopts a match found on page 2 (no create)', async () => {
+    setup(
+      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
+    );
+    const urls = stubFetch([
+      {
+        body: {
+          success: true,
+          result: [{ id: hex32('p1a'), name: 'other-1' }],
+          result_info: { total_count: 2 },
+        },
+      },
+      {
+        body: {
+          success: true,
+          result: [{ id: hex32('p2hd'), name: 'myapp-hd' }],
+          result_info: { total_count: 2 },
+        },
+      },
+    ]);
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+      },
+      { runWrangler: run, apiToken: 'tok', log: silentLog },
+    );
+    expect(urls.length).toBe(2);
+    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+    const hd = readConfig().hyperdrive as Array<Record<string, unknown>>;
+    expect(hd).toEqual([{ binding: 'HYPERDRIVE', id: hex32('p2hd') }]);
+    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: hex32('p2hd') });
+  });
+
+  it('fails closed on a non-2xx envelope (never treats it as absence, no create)', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    stubFetch([{ status: 500, body: { success: false } }]);
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        { runWrangler: run, apiToken: 'tok', log: silentLog },
+      ),
+    ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
+    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+  });
+
+  it('fails closed on success:false and on a malformed entry (missing id) — no create', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    for (const body of [
+      { success: false, result: [] },
+      { success: true, result: [{ name: 'myapp-hd' }], result_info: { total_count: 1 } },
+    ]) {
+      stubFetch([{ body }]);
+      const { run, calls } = makeRunner([]);
+      await expect(
+        provisionCloudflareResources(
+          tmpDir,
+          wranglerPath,
+          {
+            ...emptyDesired,
+            hyperdrive: {
+              binding: 'HYPERDRIVE',
+              name: 'myapp-hd',
+              connectionString: 'postgres://x',
+            },
+          },
+          { runWrangler: run, apiToken: 'tok', log: silentLog },
+        ),
+      ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
+      expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+    }
+  });
+
+  it('fails closed when two configs share the requested name (ambiguous) — no create', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => [
+            { id: hex32('hd-1'), name: 'myapp-hd' },
+            { id: hex32('hd-2'), name: 'myapp-hd' },
+          ],
+        },
+      ),
+    ).rejects.toThrow(/cannot adopt Hyperdrive config "myapp-hd".*share that name/s);
+    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+  });
+
+  it('fails closed on malformed pagination (missing/premature-empty/duplicate/inconsistent) — never declares absence, no create', async () => {
+    // A same-named config could sit on an unread page, so incomplete listings never
+    // count as absence.
+    const cases: Array<Array<{ status?: number; body: unknown }>> = [
+      // 1. missing result_info.total_count metadata (cannot prove completeness)
+      [{ body: { success: true, result: [{ id: 'a', name: 'other' }] } }],
+      // 2. premature empty page before all configs are listed
+      [
+        {
+          body: {
+            success: true,
+            result: [{ id: 'a', name: 'other' }],
+            result_info: { total_count: 3 },
+          },
+        },
+        { body: { success: true, result: [], result_info: { total_count: 3 } } },
+      ],
+      // 3. repeated/duplicate id across pages (padding to satisfy a count)
+      [
+        {
+          body: {
+            success: true,
+            result: [{ id: 'a', name: 'x' }],
+            result_info: { total_count: 2 },
+          },
+        },
+        {
+          body: {
+            success: true,
+            result: [{ id: 'a', name: 'x' }],
+            result_info: { total_count: 2 },
+          },
+        },
+      ],
+      // 4. inconsistent total_count between pages
+      [
+        {
+          body: {
+            success: true,
+            result: [{ id: 'a', name: 'x' }],
+            result_info: { total_count: 2 },
+          },
+        },
+        {
+          body: {
+            success: true,
+            result: [{ id: 'b', name: 'y' }],
+            result_info: { total_count: 5 },
+          },
+        },
+      ],
+    ];
+    for (const pages of cases) {
+      setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+      stubFetch(pages);
+      const { run, calls } = makeRunner([]);
+      await expect(
+        provisionCloudflareResources(
+          tmpDir,
+          wranglerPath,
+          {
+            ...emptyDesired,
+            hyperdrive: {
+              binding: 'HYPERDRIVE',
+              name: 'myapp-hd',
+              connectionString: 'postgres://x',
+            },
+          },
+          { runWrangler: run, apiToken: 'tok', log: silentLog },
+        ),
+      ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
+      expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+    }
+  });
+});
+
+describe('provisionCloudflareResources — KV/R2 fail closed on schema-valid ambiguity', () => {
+  it('KV: fails closed (no create) when the target title matches but the entry has no id', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok(JSON.stringify([{ title: 'myapp-kv' }])) },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/namespace titled "myapp-kv" with no valid id/);
+    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
+  });
+
+  it('KV: fails closed (no create) when the list has a malformed member (null) — never filtered away', async () => {
+    // Filtering out the malformed member would turn the list into a false "absent".
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => ok(JSON.stringify([null, { id: 'other', title: 'someone-else' }])),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/malformed KV namespace entry/);
+    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
+  });
+
+  it('R2: does NOT adopt when `r2 bucket info` exits 0 but the payload names a different bucket', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^r2 bucket info /,
+        reply: () => ok(JSON.stringify({ name: 'a-different-bucket' })),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/did not identify the requested bucket/);
+    // Neither adopted nor created — the config is untouched.
+    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(false);
+    expect(readConfig().r2_buckets).toBeUndefined();
+  });
+});
+
+describe('provisionEnv — scrubbed and pinned keys', () => {
+  it('provisionEnv scrubs CLOUDFLARE_ENV + the CF Access token pair and pins the account', () => {
+    vi.stubEnv('CLOUDFLARE_ENV', 'staging');
+    vi.stubEnv('CF_ACCESS_CLIENT_ID', 'id');
+    vi.stubEnv('CF_ACCESS_CLIENT_SECRET', 'secret');
+    vi.stubEnv('CF_ACCESS_TOKEN', 'short-lived-user-jwt');
+    const env = provisionEnv({ accountId: 'acct-X' });
+    // CLOUDFLARE_ENV would let wrangler select an env-specific account block.
+    expect(env.CLOUDFLARE_ENV).toBeUndefined();
+    expect(env.CF_ACCESS_CLIENT_ID).toBeUndefined();
+    expect(env.CF_ACCESS_CLIENT_SECRET).toBeUndefined();
+    expect(env.CF_ACCESS_TOKEN).toBeUndefined();
+    expect(env.CLOUDFLARE_ACCOUNT_ID).toBe('acct-X');
+  });
+
+  it('provisionEnv scrubs EVERY transport-redirect var and pins the ONE resolved API base', () => {
+    vi.stubEnv('CLOUDFLARE_API_BASE_URL', 'https://evil.example');
+    vi.stubEnv('CF_API_BASE_URL', 'https://evil2.example');
+    vi.stubEnv('WRANGLER_API_ENVIRONMENT', 'staging');
+    vi.stubEnv('CLOUDFLARE_COMPLIANCE_REGION', 'fedramp_high');
+    const env = provisionEnv({
+      accountId: 'acct-X',
+      apiBaseUrl: 'https://api.cloudflare.com/client/v4',
+    });
+    expect(env.CF_API_BASE_URL).toBeUndefined();
+    expect(env.WRANGLER_API_ENVIRONMENT).toBeUndefined();
+    expect(env.CLOUDFLARE_COMPLIANCE_REGION).toBeUndefined();
+    expect(env.CLOUDFLARE_API_BASE_URL).toBe('https://api.cloudflare.com/client/v4');
+  });
+});
+
+describe('provisionCloudflareResources — resource-name validation', () => {
+  const badNames = ['--help', '--config', '-h'];
+  const kinds: Array<{
+    label: RegExp;
+    desired: (name: string) => DesiredResourceSet;
+  }> = [
+    {
+      // badNames all start with "-", so the universal option-injection guard fires FIRST
+      // with "refusing to pass an unsafe <label> name", before the grammar check.
+      label: /unsafe D1 database name/,
+      desired: (name) => ({ ...emptyDesired, d1: { binding: 'DB', name } }),
+    },
+    {
+      label: /unsafe KV namespace name/,
+      desired: (name) => ({ ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: name }] }),
+    },
+    {
+      label: /unsafe R2 bucket name/,
+      desired: (name) => ({ ...emptyDesired, r2: { binding: 'STORAGE', bucketName: name } }),
+    },
+    {
+      label: /unsafe Hyperdrive config name/,
+      desired: (name) => ({
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name, connectionString: 'postgres://x' },
+      }),
+    },
+    {
+      label: /unsafe queue name/,
+      desired: (name) => ({ ...emptyDesired, queues: [name] }),
+    },
+  ];
+
+  it('rejects option-like names for EVERY resource kind before any wrangler call', async () => {
+    for (const bad of badNames) {
+      for (const kind of kinds) {
+        setup(JSON.stringify({ name: 'app' }));
+        const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+        await expect(
+          provisionCloudflareResources(tmpDir, wranglerPath, kind.desired(bad), {
+            runWrangler: run,
+            log: silentLog,
+            listHyperdriveConfigs: async () => [],
+          }),
+        ).rejects.toThrow(kind.label);
+        expect(calls).toEqual([]);
+      }
+    }
+  });
+});
+
+describe('provisionCloudflareResources — signal-killed probe never authorizes create', () => {
+  it('queues: a SIGTERM-killed probe with buffered "does not exist" text fails closed (no create)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const killed = normalizeRunWranglerResult({
+      stdout: '',
+      stderr: 'X [ERROR] Queue "jobs" does not exist.',
+      status: null,
+      signal: 'SIGTERM',
+    });
+    const { run, calls } = makeRunner([{ match: /^queues info jobs/, reply: () => killed }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, queues: ['jobs'] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/queues info jobs.*failed/s);
+    expect(calls.some((c) => isCall(c, 'queues', 'create'))).toBe(false);
+  });
+
+  it('R2: a SIGTERM-killed probe with buffered 10006 text fails closed (no create)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const killed = normalizeRunWranglerResult({
+      stdout: '',
+      stderr: 'X [ERROR] The bucket is not present [code: 10006]',
+      status: null,
+      signal: 'SIGTERM',
+    });
+    const { run, calls } = makeRunner([{ match: /^r2 bucket info /, reply: () => killed }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/r2 bucket info myapp-uploads.*(failed|refusing)/s);
+    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(false);
+  });
+});
+
+describe('provisionCloudflareResources — create postcondition', () => {
+  it('KV: a create that reports success but writes NO id fails closed', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok('[]') },
+      // Success exit, but nothing written to config (simulates a killed child the
+      // wrapper masked as exit 0, or a silent partial create).
+      { match: /^kv namespace create /, reply: () => ok() },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(
+      /reported success but .* does not hold the expected KV namespace .*need a real id/s,
+    );
+    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(true);
+    expect(readConfig().kv_namespaces).toBeUndefined();
+  });
+
+  it('D1: a create that reports success but writes NO id fails closed', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      { match: /^d1 create /, reply: () => ok() },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(
+      /reported success but .* does not hold the expected D1 database .*need a real database_id/s,
+    );
+    expect(readConfig().d1_databases).toBeUndefined();
+  });
+
+  it('R2: a create that reports success but writes NO bucket fails closed', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([
+      {
+        match: /^r2 bucket info /,
+        reply: () => fail('', 'The specified bucket does not exist. [code: 10006]'),
+      },
+      { match: /^r2 bucket create /, reply: () => ok() },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(
+      /reported success but .* does not hold the expected R2 bucket .*need a real bucket_name/s,
+    );
+    expect(readConfig().r2_buckets).toBeUndefined();
+  });
+
+  it('Hyperdrive: a create that reports success but writes NO id fails closed', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([{ match: /^hyperdrive create /, reply: () => ok() }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+      ),
+    ).rejects.toThrow(
+      /reported success but .* does not hold the expected Hyperdrive config .*need a real id/s,
+    );
+    expect(readConfig().hyperdrive).toBeUndefined();
+  });
+});
+
+describe('provisionCloudflareResources — strict D1 identity', () => {
+  it('adopts (not create) a list member with uuid:"" but a valid database_id', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        // Empty-string uuid must NOT shadow the valid database_id.
+        reply: () =>
+          ok(JSON.stringify([{ uuid: '', database_id: uuid('realdb'), name: 'myapp-db' }])),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
+    expect(d1[0].database_id).toBe(uuid('realdb'));
+    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: uuid('realdb') });
+  });
+
+  it('fails closed when the target-named list member has conflicting non-empty ids (ambiguous)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () =>
+          ok(JSON.stringify([{ uuid: uuid('id-a'), database_id: uuid('id-b'), name: 'myapp-db' }])),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/no valid id.*agreeing on one id/s);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+
+  it('rejects a 7502-collision `d1 info` payload with an id but NO name (unverified) — no adopt', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      { match: /^d1 create /, reply: () => fail('', 'X [ERROR] already exists [code: 7502]') },
+      { match: /^d1 info myapp-db --json/, reply: () => ok(JSON.stringify({ database_id: 'x' })) },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/did not return a database with a matching name/);
+    expect(readConfig().d1_databases).toBeUndefined();
+  });
+
+  it('rejects a 7502-collision `d1 info` payload whose name MISMATCHES the request — no adopt', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      { match: /^d1 create /, reply: () => fail('', 'X [ERROR] already exists [code: 7502]') },
+      {
+        match: /^d1 info myapp-db --json/,
+        reply: () => ok(JSON.stringify({ database_id: 'x', name: 'a-different-db' })),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/did not return a database with a matching name/);
+    expect(readConfig().d1_databases).toBeUndefined();
+  });
+});
+
+describe('provisionCloudflareResources — boundary account fence', () => {
+  it('fails closed BEFORE any INJECTED seam call when no account is resolvable', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    vi.stubEnv('CLOUDFLARE_ACCOUNT_ID', undefined);
+    let restCalled = false;
+    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => {
+            restCalled = true;
+            return [];
+          },
+        },
+      ),
+    ).rejects.toThrow(/no Cloudflare account is resolvable/);
+    expect(calls).toEqual([]);
+    expect(restCalled).toBe(false);
+    expect(readConfig().account_id).toBeUndefined();
+  });
+});
+
+describe('provisionCloudflareResources — absolute config path', () => {
+  it('resolves a RELATIVE rootWranglerPath against root (not cwd) so reads + wrangler ops target ONE file', async () => {
+    // Node would resolve a relative path against cwd while wrangler resolves `-c` against
+    // root, so the provisioner makes it absolute against root up front.
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' })); // at tmpDir/wrangler.jsonc
+    const relPath = 'wrangler.jsonc'; // relative to root (tmpDir), NOT to process.cwd()
+    const abs = join(tmpDir, relPath);
+    const { run, calls } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir, // root — absolute, and different from process.cwd()
+      relPath, // RELATIVE config path
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+      { runWrangler: run, log: silentLog },
+    );
+    // Returned + threaded config path is the absolute resolution against root.
+    expect(result.configPath).toBe(toSlash(abs));
+    expect(calls.length).toBeGreaterThan(0);
+    for (const argv of calls) {
+      const i = argv.indexOf('-c');
+      expect(i).toBeGreaterThanOrEqual(0);
+      expect(argv[i + 1]).toBe(toSlash(abs)); // wrangler `-c` is the SAME absolute file
+    }
+    // The adopted id landed in root/wrangler.jsonc — the file Node read from too.
+    const after = parseJsoncRaw(readFileSync(abs, 'utf-8')) as Record<string, unknown>;
+    expect((after.kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe(hex32('kv'));
+  });
+});
+
+describe('provisionCloudflareResources — one D1 normalizer', () => {
+  it('fails closed on CONFLICTING name aliases (name vs database_name) for the requested database', async () => {
+    // A member claims the requested name via `name` while its `database_name` disagrees.
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () =>
+          ok(
+            JSON.stringify([
+              { name: 'myapp-db', database_name: 'other-db', database_id: uuid('the-id') },
+            ]),
+          ),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/ambiguous or empty id/);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+    expect(readConfig().d1_databases).toBeUndefined();
+  });
+
+  it('fails closed when TWO list entries both match the requested name (ambiguous)', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () =>
+          ok(
+            JSON.stringify([
+              { name: 'myapp-db', database_id: uuid('id-1') },
+              { name: 'myapp-db', database_id: uuid('id-2') },
+            ]),
+          ),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/2 D1 databases named/);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+
+  it('adopts the single unambiguous match (agreeing aliases + uuid) — no create', async () => {
+    setup(JSON.stringify({ name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () =>
+          ok(
+            JSON.stringify([{ name: 'myapp-db', database_name: 'myapp-db', uuid: uuid('theid') }]),
+          ),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: uuid('theid') });
+    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
+    expect(d1[0].database_id).toBe(uuid('theid'));
+  });
+});
+
+describe('provisionCloudflareResources — transport account context', () => {
+  it('threads the reconciled account into EVERY wrangler call AND the Hyperdrive lister', async () => {
+    // Config pins the account → it is the reconciled effective account (config wins
+    // over the ambient CLOUDFLARE_ACCOUNT_ID). Every seam invocation must receive it.
+    setup(JSON.stringify({ account_id: 'reconciled-acct' }));
+    const seenRunAccounts: Array<string> = [];
+    const seenListAccounts: Array<string> = [];
+    const run: RunWrangler = provisionOperationFixture((args, opts) => {
+      seenRunAccounts.push(opts.accountId);
+      const sub = args.join(' ');
+      if (/^d1 list --json/.test(sub)) {
+        return ok('[]');
+      }
+      if (/^d1 create /.test(sub)) {
+        simulateUpdateConfig('d1_databases', {
+          binding: 'DB',
+          database_name: 'myapp-db',
+          database_id: uuid('dbid'),
+        });
+        return ok();
+      }
+      if (/^kv namespace list/.test(sub)) {
+        return ok('[]');
+      }
+      if (/^kv namespace create /.test(sub)) {
+        simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: hex32('kvid') });
+        return ok();
+      }
+      return ok();
+    });
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        d1: { binding: 'DB', name: 'myapp-db' },
+        kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
+        // Empty connection string → only the existence check runs (no create), so the
+        // lister IS invoked and records the account it was called with.
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      {
+        runWrangler: run,
+        log: silentLog,
+        listHyperdriveConfigs: async ({ accountId }) => {
+          seenListAccounts.push(accountId);
+          return [];
+        },
+      },
+    );
+    expect(seenRunAccounts.length).toBeGreaterThan(0);
+    for (const acct of seenRunAccounts) {
+      expect(acct).toBe('reconciled-acct');
+    }
+    expect(seenListAccounts).toEqual(['reconciled-acct']);
+  });
+});
+
+describe('provisionCloudflareResources — boundary duplicate-member guard', () => {
+  it('fails closed at entry on a config with duplicate kv_namespaces members — NO wrangler/REST calls', async () => {
+    // jsonc-parser.parse() (used by readRootConfig) silently resolves a duplicate to
+    // the LAST member, so without the boundary guard a `kv namespace create` could
+    // orphan or a reuse be false. The SAME strict detector the writer uses runs at the
+    // provisioner boundary — before account persistence, discovery, or any remote work.
+    setup(`{
+  "account_id": "acct",
+  "kv_namespaces": [{ "binding": "KV", "id": "aaa" }],
+  "kv_namespaces": [{ "binding": "KV", "id": "bbb" }]
+}`);
+    let restCalled = false;
+    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => {
+            restCalled = true;
+            return [];
+          },
+        },
+      ),
+    ).rejects.toThrow(/duplicate key "kv_namespaces"/);
+    expect(calls).toEqual([]);
+    expect(restCalled).toBe(false);
+  });
+});
+
+describe('provisionCloudflareResources — Hyperdrive list validation at the caller', () => {
+  const hdDesired: DesiredResourceSet = {
+    ...emptyDesired,
+    hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+  };
+
+  function provisionWithInjectedList(list: Array<unknown>): Promise<unknown> {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+    return provisionCloudflareResources(tmpDir, wranglerPath, hdDesired, {
+      runWrangler: run,
+      log: silentLog,
+      // The injected lister LIES about its return type — the caller-side validator must
+      // reject the malformed shape at runtime rather than adopt an empty/garbage id.
+      listHyperdriveConfigs: async () => list as never,
+    });
+  }
+
+  it('fails closed on an injected entry with an EMPTY id — never adopts', async () => {
+    await expect(provisionWithInjectedList([{ id: '', name: 'myapp-hd' }])).rejects.toThrow(
+      /malformed config entry/,
+    );
+    expect(readConfig().hyperdrive).toBeUndefined();
+  });
+
+  it('fails closed on a non-object member', async () => {
+    await expect(provisionWithInjectedList([null])).rejects.toThrow(/malformed config entry/);
+    expect(readConfig().hyperdrive).toBeUndefined();
+  });
+
+  it('fails closed on a duplicate id across members', async () => {
+    await expect(
+      provisionWithInjectedList([
+        { id: hex32('dup'), name: 'other' },
+        { id: hex32('dup'), name: 'myapp-hd' },
+      ]),
+    ).rejects.toThrow(/duplicate config id/);
+    expect(readConfig().hyperdrive).toBeUndefined();
+  });
+
+  it('fails closed on a NON-matching member with a malformed id (no create)', async () => {
+    // A member for a different config carries a non-hex id, so the list cannot prove absence.
+    await expect(
+      provisionWithInjectedList([{ id: 'bogus', name: 'someone-else' }]),
+    ).rejects.toThrow(/malformed id "bogus".*32-character hex Hyperdrive id/s);
+    expect(readConfig().hyperdrive).toBeUndefined();
+  });
+
+  // A runtime null/undefined/non-array OUTER result must be treated as UNKNOWN
+  // (never coerced to "empty" = confirmed absence), so it fails closed BEFORE any
+  // create instead of authorizing a blind `hyperdrive create` on a same-named config.
+  for (const [label, bad] of [
+    ['null', null],
+    ['undefined', undefined],
+    ['a non-array object', { configs: [] }],
+    ['a string', 'nope'],
+  ] as const) {
+    it(`fails closed (no create) when the lister returns ${label}`, async () => {
+      setup(JSON.stringify({ account_id: 'acct' }));
+      const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
+      await expect(
+        provisionCloudflareResources(tmpDir, wranglerPath, hdDesired, {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => bad as never,
+        }),
+      ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
+      // No blind create, and nothing written to the config.
+      expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
+      expect(readConfig().hyperdrive).toBeUndefined();
+    });
+  }
+});
+
+describe('provisionCloudflareResources — whole-list id-format gate (D1 + KV, before name filtering)', () => {
+  it('D1: a NON-matching list member with a malformed id fails the whole list closed (no create)', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run, calls } = makeRunner([
+      // A different database with a bogus (non-UUID) id. Target "myapp-db" is absent, but
+      // the untrustworthy member must reject the list rather than authorize a create.
+      {
+        match: /^d1 list --json/,
+        reply: () => ok(JSON.stringify([{ name: 'other', database_id: 'bogus' }])),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/no valid id/);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+
+  it('KV: a NON-matching list member with a malformed id fails the whole list closed (no create)', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => ok(JSON.stringify([{ title: 'other', id: 'bogus' }])),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/no valid id/);
+    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
+  });
+
+  it('D1: a well-formed non-matching member still allows the target to be created (absence is authoritative)', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () => ok(JSON.stringify([{ name: 'other', database_id: uuid('other') }])),
+      },
+      {
+        match: /^d1 create /,
+        reply: () => {
+          simulateUpdateConfig('d1_databases', {
+            binding: 'DB',
+            database_name: 'myapp-db',
+            database_id: uuid('mine'),
+          });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(result.resources).toEqual([
+      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'created' },
+    ]);
+  });
+});
+
+describe('provisionCloudflareResources — strict duplicate-safe binding reader', () => {
+  it('read-first fails closed on DUPLICATE same-binding entries in the target field (not reused)', async () => {
+    // Two d1_databases entries share binding "DB".
+    setup(
+      JSON.stringify({
+        account_id: 'acct',
+        d1_databases: [
+          { binding: 'DB', database_id: uuid('a'), database_name: 'myapp-db' },
+          { binding: 'DB', database_id: uuid('b'), database_name: 'myapp-db' },
+        ],
+      }),
+    );
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/binding "DB" is declared 2 times in "d1_databases"/);
+    // Failed closed before any wrangler call — never reused/created.
+    expect(calls.length).toBe(0);
+  });
+
+  it('read-first fails closed on a CROSS-TYPE collision (binding used by another field) — not reused', async () => {
+    // Binding "DB" is used by a d1_databases entry and a kv_namespaces entry, which
+    // wrangler rejects.
+    setup(
+      JSON.stringify({
+        account_id: 'acct',
+        d1_databases: [{ binding: 'DB', database_id: uuid('a'), database_name: 'myapp-db' }],
+        kv_namespaces: [{ binding: 'DB', id: hex32('kv') }],
+      }),
+    );
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/binding "DB" in "d1_databases" is also used by a KV Namespace binding/);
+    expect(calls.length).toBe(0);
+  });
+
+  it('read-first fails closed when a QUEUE PRODUCER collides with the binding (cross-type) — not reused', async () => {
+    setup(
+      JSON.stringify({
+        account_id: 'acct',
+        kv_namespaces: [{ binding: 'CACHE', id: hex32('cache') }],
+        queues: { producers: [{ binding: 'CACHE', queue: 'jobs' }] },
+      }),
+    );
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'CACHE', title: 'cache' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/binding "CACHE" in "kv_namespaces" is also used by a Queue binding/);
+    expect(calls.length).toBe(0);
+  });
+
+  it('reuses cleanly when the binding is unique across the worker (no false collision)', async () => {
+    setup(
+      JSON.stringify({
+        account_id: 'acct',
+        d1_databases: [{ binding: 'DB', database_id: uuid('db'), database_name: 'myapp-db' }],
+        kv_namespaces: [{ binding: 'CACHE', id: hex32('cache') }],
+      }),
+    );
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(result.resources).toEqual([
+      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'reused', id: uuid('db') },
+    ]);
+    // Reused via read-first — no discovery/create.
+    expect(calls.some((c) => isCall(c, 'd1', 'list'))).toBe(false);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+});
+
+describe('provisionCloudflareResources — resource-specific create postcondition', () => {
+  it('R2: fails closed when create writes a DIFFERENT bucket_name than requested', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run } = makeRunner([
+      {
+        match: /^r2 bucket info /,
+        reply: () => fail('', 'The specified bucket does not exist. [code: 10006]'),
+      },
+      {
+        match: /^r2 bucket create /,
+        reply: () => {
+          // create "succeeds" but writes a DIFFERENT bucket than requested (a race /
+          // stale --update-config / wrong-account write). bucket_name IS the identity.
+          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'other-bucket' });
+          return ok();
+        },
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/does not hold the expected R2 bucket .*bucket_name === "myapp-uploads"/s);
+  });
+
+  it('D1: fails closed when create writes a real id but a MISMATCHED database_name', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run } = makeRunner([
+      { match: /^d1 list --json/, reply: () => ok('[]') },
+      {
+        match: /^d1 create /,
+        reply: () => {
+          simulateUpdateConfig('d1_databases', {
+            binding: 'DB',
+            database_name: 'other-db',
+            database_id: 'real-id',
+          });
+          return ok();
+        },
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/does not hold the expected D1 database .*database_name === "myapp-db"/s);
+  });
+});
+
+describe('provisionCloudflareResources — resource-specific real-id validators', () => {
+  it('KV: an id of " " is NOT real — runs discovery instead of read-first reuse', async () => {
+    setup(JSON.stringify({ account_id: 'acct', kv_namespaces: [{ binding: 'KV', id: ' ' }] }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^kv namespace list/,
+        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'list'))).toBe(true);
+    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: hex32('kv') });
+  });
+
+  it('D1: an id of "xyz" is NOT real — runs discovery instead of read-first reuse', async () => {
+    setup(
+      JSON.stringify({
+        account_id: 'acct',
+        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: 'xyz' }],
+      }),
+    );
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () => ok(JSON.stringify([{ name: 'myapp-db', database_id: uuid('db') }])),
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls.some((c) => isCall(c, 'd1', 'list'))).toBe(true);
+    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: uuid('db') });
+  });
+
+  it('KV: create postcondition FAILS when --update-config wrote a non-hex id', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok('[]') },
+      {
+        match: /^kv namespace create/,
+        reply: () => {
+          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: 'not-a-real-id' });
+          return ok();
+        },
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/does not hold the expected KV namespace/);
+  });
+});
+
+describe('provisionCloudflareResources — KV title grammar vs option-injection guard', () => {
+  it('accepts a KV title with spaces ("My Own Namespace") and creates it under that exact name', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run, calls } = makeRunner([
+      { match: /^kv namespace list/, reply: () => ok('[]') },
+      {
+        match: /^kv namespace create/,
+        reply: () => {
+          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: hex32('kv') });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'My Own Namespace' }] },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(result.resources[0]).toMatchObject({ kind: 'kv', action: 'created' });
+    const createCall = calls.find((c) => isCall(c, 'kv', 'namespace', 'create'));
+    expect(createCall).toContain('My Own Namespace');
+  });
+
+  it('rejects an R2 bucket name with invalid characters (uppercase/underscore)', async () => {
+    setup(JSON.stringify({ account_id: 'acct' }));
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'My_Bucket' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/invalid R2 bucket name/);
+    expect(calls.length).toBe(0);
+  });
+});
+
+describe('provisionCloudflareResources — queue name grammar (Cloudflare Queues)', () => {
+  // Underscores are NOT allowed; a trailing separator is NOT allowed; > 63 chars rejected.
+  for (const bad of ['jobs_v2', 'jobs_', 'jobs-', '_jobs', '-jobs', 'a'.repeat(64)]) {
+    it(`rejects the invalid queue name ${JSON.stringify(bad)} before any wrangler call`, async () => {
+      setup(JSON.stringify({ account_id: 'acct' }));
+      const { run, calls } = makeRunner([]);
+      await expect(
+        provisionCloudflareResources(
+          tmpDir,
+          wranglerPath,
+          { ...emptyDesired, queues: [bad] },
+          { runWrangler: run, log: silentLog },
+        ),
+      ).rejects.toThrow(/unsafe queue name|invalid queue name/);
+      expect(calls.length).toBe(0);
+    });
+  }
+
+  // Valid: single alphanumeric, 63 chars, and internal dashes.
+  for (const good of ['a', 'Q9', 'a'.repeat(63), 'jobs-v2', 'my-queue-1']) {
+    it(`accepts the valid queue name ${JSON.stringify(good)} (reaches wrangler)`, async () => {
+      setup(JSON.stringify({ account_id: 'acct' }));
+      const { run, calls } = makeRunner([
+        { match: /^queues info /, reply: () => ok(`Queue Name: ${good}`) },
+      ]);
+      const result = await provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, queues: [good] },
+        { runWrangler: run, log: silentLog },
+      );
+      expect(result.resources).toEqual([{ kind: 'queue', name: good, action: 'reused' }]);
+      expect(calls.some((c) => isCall(c, 'queues', 'info'))).toBe(true);
+    });
+  }
+});
+
+describe('provisionCloudflareResources — config compliance_region pins the transport', () => {
+  it('resolvePinnedApiBaseUrl honors the config compliance_region (fedramp) with no ambient override', () => {
+    // Config says fedramp_high, no CLOUDFLARE_COMPLIANCE_REGION ambient → the FedRAMP base.
+    expect(resolvePinnedApiBaseUrl({}, 'fedramp_high')).toBe(
+      'https://api.fed.cloudflare.com/client/v4',
+    );
+    // Config "public" → public base; absent config → public base.
+    expect(resolvePinnedApiBaseUrl({}, 'public')).toBe('https://api.cloudflare.com/client/v4');
+    expect(resolvePinnedApiBaseUrl({}, undefined)).toBe('https://api.cloudflare.com/client/v4');
+  });
+
+  it('resolvePinnedApiBaseUrl fails closed on a config-vs-ambient compliance_region conflict', () => {
+    expect(() =>
+      resolvePinnedApiBaseUrl({ CLOUDFLARE_COMPLIANCE_REGION: 'public' }, 'fedramp_high'),
+    ).toThrow(/conflicting values/);
+    // Equal on both sides is fine (no conflict).
+    expect(
+      resolvePinnedApiBaseUrl({ CLOUDFLARE_COMPLIANCE_REGION: 'fedramp_high' }, 'fedramp_high'),
+    ).toBe('https://api.fed.cloudflare.com/client/v4');
+  });
+
+  it('rejects an invalid config compliance_region value', () => {
+    expect(() => resolvePinnedApiBaseUrl({}, 'somewhere')).toThrow(
+      /one of "public" or "fedramp_high"/,
+    );
+  });
+
+  it('a fedramp config pins BOTH the wrangler child env AND the Hyperdrive REST lister to the .fed base', async () => {
+    vi.stubEnv('CLOUDFLARE_COMPLIANCE_REGION', undefined);
+    setup(
+      JSON.stringify({
+        account_id: 'config-acct',
+        compliance_region: 'fedramp_high',
+        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
+      }),
+    );
+    let seen: { apiBaseUrl: string } | undefined;
+    const run: RunWrangler = provisionOperationFixture((_args, opts) => {
+      expect(opts.apiBaseUrl).toBe('https://api.fed.cloudflare.com/client/v4');
+      return { stdout: '', stderr: '', status: 0 };
+    });
+    await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      {
+        ...emptyDesired,
+        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
+      },
+      {
+        runWrangler: run,
+        log: silentLog,
+        listHyperdriveConfigs: async (ctx) => {
+          seen = ctx;
+          return [];
+        },
+      },
+    );
+    expect(seen?.apiBaseUrl).toBe('https://api.fed.cloudflare.com/client/v4');
+  });
+
+  it('fails closed when the config compliance_region conflicts with an ambient CLOUDFLARE_COMPLIANCE_REGION', async () => {
+    vi.stubEnv('CLOUDFLARE_COMPLIANCE_REGION', 'public');
+    setup(
+      JSON.stringify({
+        account_id: 'config-acct',
+        compliance_region: 'fedramp_high',
+        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
+      }),
+    );
+    let listerCalled = false;
+    const { run } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: async () => {
+            listerCalled = true;
+            return [];
+          },
+        },
+      ),
+    ).rejects.toThrow(/conflicting values/);
+    expect(listerCalled).toBe(false);
+  });
+});
+
+describe('provisionCloudflareResources — wrangler-exact base resolution order', () => {
+  it('an INVALID WRANGLER_API_ENVIRONMENT fails closed (wrangler assertOneOf) instead of pinning prod', () => {
+    // wrangler's env factory has choices ["production","staging"]; a present out-of-choices
+    // value (typo'd "stagng", or an empty string) throws — never silently public production.
+    expect(() => resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: 'stagng' })).toThrow(
+      /WRANGLER_API_ENVIRONMENT.*"production" or "staging".*"stagng"/s,
+    );
+    expect(() => resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: '' })).toThrow(
+      /WRANGLER_API_ENVIRONMENT/,
+    );
+    // An explicit "production" is a valid choice → the public base.
+    expect(resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: 'production' })).toBe(
+      'https://api.cloudflare.com/client/v4',
+    );
+  });
+
+  it('an empty direct base override is honored AS-IS (presence + nullish semantics, like wrangler)', () => {
+    // wrangler: `getCloudflareApiBaseUrlFromEnv() ?? derived` — a PRESENT empty string is
+    // returned (nullish, not falsy, coalescing) and CLOUDFLARE_* presence beats CF_*.
+    expect(resolvePinnedApiBaseUrl({ CLOUDFLARE_API_BASE_URL: '' })).toBe('');
+    expect(
+      resolvePinnedApiBaseUrl({
+        CLOUDFLARE_API_BASE_URL: '',
+        CF_API_BASE_URL: 'https://cf.example',
+      }),
+    ).toBe('');
+    expect(resolvePinnedApiBaseUrl({ CF_API_BASE_URL: '' })).toBe('');
+  });
+
+  it('provisionEnv pins a resolved EMPTY base into the child env (presence, not truthiness)', () => {
+    const env = provisionEnv({ accountId: 'acct', apiBaseUrl: '' });
+    // The child wrangler must see the SAME (empty) override the ambient env carried — never
+    // a scrubbed env that would silently re-derive the default endpoint (split-brain).
+    expect(env.CLOUDFLARE_API_BASE_URL).toBe('');
+  });
+
+  it('a direct base + CONFLICTING compliance settings resolves to the direct base (no false reject)', () => {
+    // wrangler's `??` short-circuits past getComplianceRegionSubdomain when a direct base is
+    // present, so the env-vs-config conflict is never evaluated there.
+    expect(
+      resolvePinnedApiBaseUrl(
+        {
+          CLOUDFLARE_API_BASE_URL: 'https://direct.example',
+          CLOUDFLARE_COMPLIANCE_REGION: 'public',
+        },
+        'fedramp_high',
+      ),
+    ).toBe('https://direct.example');
+    // Same for an invalid STAGING selector — unread on the direct branch.
+    expect(
+      resolvePinnedApiBaseUrl({
+        CLOUDFLARE_API_BASE_URL: 'https://direct.example',
+        WRANGLER_API_ENVIRONMENT: 'stagng',
+      }),
+    ).toBe('https://direct.example');
+  });
+
+  it('the config compliance_region VALUE is still validated with a direct base present (wrangler config validation)', () => {
+    expect(() =>
+      resolvePinnedApiBaseUrl({ CLOUDFLARE_API_BASE_URL: 'https://direct.example' }, 'bogus'),
+    ).toThrow(/one of "public" or "fedramp_high"/);
+  });
+});
+
+describe('provisionCloudflareResources — Hyperdrive password never reaches wrangler diagnostics', () => {
+  it('provisionEnv scrubs the session-output sinks and PINS sanitized logging', () => {
+    vi.stubEnv('WRANGLER_OUTPUT_FILE_PATH', '/tmp/wrangler-output.json');
+    vi.stubEnv('WRANGLER_OUTPUT_FILE_DIRECTORY', '/tmp/wrangler-output');
+    vi.stubEnv('WRANGLER_LOG_SANITIZE', 'false');
+    const env = provisionEnv({ accountId: 'acct' });
+    // Output sinks would write the child's diagnostics to disk.
+    expect(env.WRANGLER_OUTPUT_FILE_PATH).toBeUndefined();
+    expect(env.WRANGLER_OUTPUT_FILE_DIRECTORY).toBeUndefined();
+    expect(env.WRANGLER_LOG_SANITIZE).toBe('true');
+  });
+
+  it('redacts the exact connection string AND URL userinfo passwords from propagated errors', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
+    const { run } = makeRunner([
+      {
+        // The create fails, ECHOING the connection string (verbatim AND re-rendered).
+        match: /^hyperdrive create /,
+        reply: () =>
+          fail(
+            '',
+            `X [ERROR] could not connect using ${conn} ` +
+              `(also tried mysql://dbuser:sup3r-secret@db.example.com/app)`,
+          ),
+      },
+    ]);
+    let thrown: Error | undefined;
+    try {
+      await provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
+        },
+        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+      );
+    } catch (error) {
+      thrown = error as Error;
+    }
+    expect(thrown).toBeDefined();
+    // The password never appears — neither via the verbatim echo nor the re-rendered URL.
+    expect(thrown!.message).not.toContain('sup3r-secret');
+    expect(thrown!.message).not.toContain(conn);
+    expect(thrown!.message).toContain('[REDACTED]');
+  });
+
+  it('a seam rejecting a password-bearing plain STRING is redacted before propagation', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
+    const run: RunWrangler = provisionOperationFixture(() =>
+      Promise.reject(`hyperdrive create failed for ${conn}`),
+    );
+    let thrown: unknown;
+    try {
+      await provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
+        },
+        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+      );
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toBeInstanceOf(Error);
+    expect((thrown as Error).message).not.toContain('sup3r-secret');
+    expect((thrown as Error).message).not.toContain(conn);
+    expect((thrown as Error).message).toContain('[REDACTED]');
+  });
+
+  it('a QUARANTINE rejection keeps its identity/metadata while its message is redacted', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
+    const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
+    const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
+    const quarantineError = new WranglerQuarantineError(
+      54321,
+      `kill failed while running hyperdrive create --connection-string=${conn}`,
+    );
+    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
+    let thrown: unknown;
+    try {
+      await provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
+        },
+        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
+      );
+    } catch (error) {
+      thrown = error;
+    }
+    // The same object propagates, so the provision still recognizes it and retains the lock.
+    expect(thrown).toBe(quarantineError);
+    expect((thrown as WranglerQuarantineError).pid).toBe(54321);
+    expect((thrown as Error).message).not.toContain('sup3r-secret');
+    expect((thrown as Error).message).toContain('[REDACTED]');
+    expect(existsSync(lockMutex)).toBe(true);
+    // Cleanup the retained mutex + sidecar for later tests.
+    rmSync(lockMutex, { recursive: true, force: true });
+    rmSync(sidecar, { force: true });
+  });
+
+  it('a lister rejecting a plain STRING is redacted in the warning', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const warns: Array<string> = [];
+    const { run } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: {
+            binding: 'HYPERDRIVE',
+            name: 'myapp-hd',
+            connectionString: 'postgres://u:leaky-pass@h/db',
+          },
+        },
+        {
+          runWrangler: run,
+          log: { info: () => {}, warn: (msg) => warns.push(msg) },
+          listHyperdriveConfigs: () =>
+            Promise.reject('fetch failed for postgres://u:leaky-pass@h/db'),
+        },
+      ),
+    ).rejects.toThrow(/cannot verify/);
+    const listerWarn = warns.find((w) => w.includes('existence check'));
+    expect(listerWarn).toBeDefined();
+    expect(listerWarn).not.toContain('leaky-pass');
+    expect(listerWarn).toContain('[REDACTED]');
+  });
+
+  it('redacts a userinfo password from the Hyperdrive lister failure warning', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const warns: Array<string> = [];
+    const { run } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: {
+            binding: 'HYPERDRIVE',
+            name: 'myapp-hd',
+            connectionString: 'postgres://u:leaky-pass@h/db',
+          },
+        },
+        {
+          runWrangler: run,
+          log: { info: () => {}, warn: (msg) => warns.push(msg) },
+          listHyperdriveConfigs: async () => {
+            throw new Error('fetch failed for postgres://u:leaky-pass@h/db');
+          },
+        },
+      ),
+    ).rejects.toThrow(/cannot verify/);
+    const listerWarn = warns.find((w) => w.includes('existence check'));
+    expect(listerWarn).toBeDefined();
+    expect(listerWarn).not.toContain('leaky-pass');
+    expect(listerWarn).toContain('[REDACTED]');
+  });
+});
+
+describe('assertNoTransportRedirectInProjectDotenv — the files and keys wrangler loads', () => {
+  const redirect = 'CLOUDFLARE_API_BASE_URL=https://api.staging.cloudflare.com/client/v4\n';
+
+  type ProjectFiles = { name: string; files: Record<string, string> };
+
+  function writeProjectFiles(files: Record<string, string>): void {
+    setup(JSON.stringify({ name: 'app' }));
+    for (const [file, content] of Object.entries(files)) {
+      writeFileSync(join(tmpDir, file), content);
+    }
+  }
+
+  it.each<ProjectFiles & { error: RegExp }>([
+    {
+      name: 'WRANGLER_OUTPUT_FILE_DIRECTORY in .env',
+      files: { '.env': 'WRANGLER_OUTPUT_FILE_DIRECTORY=/tmp/wrangler-out\n' },
+      error: /refusing to provision.*\.env.*WRANGLER_OUTPUT_FILE_DIRECTORY.*session diagnostics/s,
+    },
+    {
+      name: 'WRANGLER_OUTPUT_FILE_PATH in .env.local',
+      files: { '.env.local': 'WRANGLER_OUTPUT_FILE_PATH=/tmp/out.json\n' },
+      error: /WRANGLER_OUTPUT_FILE_PATH/,
+    },
+    {
+      name: 'an export-prefixed redirect in .env',
+      files: { '.env': `export ${redirect}` },
+      error: /refusing to provision.*\.env.*CLOUDFLARE_API_BASE_URL.*redirect/s,
+    },
+    {
+      name: 'a redirect in .env.',
+      files: { '.env.': redirect },
+      error: /refusing to provision.*"\.env\.".*CLOUDFLARE_API_BASE_URL.*redirect/s,
+    },
+    {
+      name: 'a redirect in .env..local',
+      files: { '.env..local': redirect },
+      error: /refusing to provision.*"\.env\.\.local".*redirect/s,
+    },
+    {
+      name: 'a redirect in .dev.vars.',
+      files: { '.dev.vars.': redirect },
+      error: /refusing to provision.*"\.dev\.vars\.".*CLOUDFLARE_API_BASE_URL/s,
+    },
+    {
+      name: 'a redirect in .dev.vars when .dev.vars. is absent',
+      files: { '.dev.vars': redirect },
+      error: /refusing to provision.*"\.dev\.vars".*CLOUDFLARE_API_BASE_URL/s,
+    },
+  ])('rejects $name', ({ files, error }) => {
+    writeProjectFiles(files);
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir)).toThrow(error);
+  });
+
+  it.each<ProjectFiles>([
+    {
+      name: 'a .env with only unrelated vars',
+      files: { '.env': 'export DATABASE_URL=postgres://localhost/app\nFOO=bar\n' },
+    },
+    // Wrangler never loads `.dev.vars.local`.
+    { name: 'a redirect in .dev.vars.local', files: { '.dev.vars.local': redirect } },
+    // Wrangler reads `.dev.vars` only when `.dev.vars.` is absent.
+    {
+      name: 'a redirect in .dev.vars when .dev.vars. exists',
+      files: { '.dev.vars.': 'SOME_APP_SECRET=benign\n', '.dev.vars': redirect },
+    },
+  ])('allows $name', ({ files }) => {
+    writeProjectFiles(files);
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir)).not.toThrow();
+  });
+
+  it('dev-vars keys are case-SENSITIVE on every platform — a mixed-case spelling never trips the fence', () => {
+    // `tryLoadDotDevDotVars` parses via `dotenv.parse` into a PLAIN object;
+    // `caseInsensitiveEnv` applies only to wrangler's `loadDotEnv` (.env family). A
+    // mixed-case key in dev-vars is a DIFFERENT key for wrangler even on win32.
+    setup(JSON.stringify({ name: 'app' }));
+    writeFileSync(join(tmpDir, '.dev.vars'), 'cloudflare_api_base_url=https://evil.example\n');
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).not.toThrow();
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).not.toThrow();
+    // The EXACT spelling still trips it everywhere.
+    writeFileSync(join(tmpDir, '.dev.vars'), 'CLOUDFLARE_API_BASE_URL=https://evil.example\n');
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).toThrow(/\.dev\.vars/);
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).toThrow(/\.dev\.vars/);
+  });
+
+  it('compares variable names case-insensitively on win32 (wrangler loads dotenv into a caseInsensitiveEnv there)', () => {
+    setup(JSON.stringify({ name: 'app' }));
+    writeFileSync(join(tmpDir, '.env'), 'cloudflare_api_base_url=https://evil.example\n');
+    // Simulated win32: the mixed-case key IS the transport var (case-insensitive env).
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).toThrow(
+      /refusing to provision.*\.env/s,
+    );
+    // POSIX: env vars are case-sensitive — the lowercase key is a different variable.
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).not.toThrow();
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'linux')).not.toThrow();
+  });
+
+  it('the win32 case rule also covers the output-file sinks', () => {
+    setup(JSON.stringify({ name: 'app' }));
+    writeFileSync(join(tmpDir, '.env'), 'Wrangler_Output_File_Path=/tmp/out.json\n');
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).toThrow(
+      /session diagnostics/,
+    );
+    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).not.toThrow();
+  });
+});
+
+describe('provisionEnv — win32 case-insensitive credential scrub', () => {
+  const MIXED_CASE_KEYS = [
+    'Wrangler_Output_File_Path',
+    'wrangler_output_file_directory',
+    'cloudflare_api_base_url',
+    'Cf_Api_Base_Url',
+    'Cloudflare_Env',
+    'cf_access_client_id',
+    'Cf_Access_Client_Secret',
+    // A mixed-case 'false' must not shadow the pinned value.
+    'Wrangler_Log_Sanitize',
+  ] as const;
+
+  beforeEach(() => {
+    for (const key of MIXED_CASE_KEYS) {
+      vi.stubEnv(key, key === 'Wrangler_Log_Sanitize' ? 'false' : 'ambient-value');
+    }
+  });
+
+  it('on win32, EVERY case-insensitive spelling of every scrubbed key set is removed before pinning', () => {
+    const env = provisionEnv({
+      accountId: 'acct',
+      apiBaseUrl: 'https://api.cloudflare.com/client/v4',
+      platform: 'win32',
+    });
+    // A win32 child reads environment keys case-insensitively.
+    for (const key of MIXED_CASE_KEYS) {
+      expect(env[key]).toBeUndefined();
+    }
+    expect(env.WRANGLER_LOG_SANITIZE).toBe('true');
+    expect(env.CLOUDFLARE_API_BASE_URL).toBe('https://api.cloudflare.com/client/v4');
+    expect(env.CLOUDFLARE_ACCOUNT_ID).toBe('acct');
+  });
+
+  it('on POSIX, mixed-case spellings are DIFFERENT variables and survive (exact-case scrub only)', () => {
+    const env = provisionEnv({ accountId: 'acct', platform: 'linux' });
+    expect(env.Wrangler_Output_File_Path).toBe('ambient-value');
+    expect(env.cloudflare_api_base_url).toBe('ambient-value');
+    expect(env.WRANGLER_LOG_SANITIZE).toBe('true');
+  });
+});
+
+describe('provisionCloudflareResources — read-first stored-name identity', () => {
+  it('D1: a stored database_name DIFFERENT from the desired name fails closed (no wrangler call, no reuse)', async () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'other-db', database_id: uuid('other') }],
+      }),
+    );
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(
+      /D1 binding "DB".*stores database_name "other-db".*wants database "myapp-db".*contradicts the desired name/s,
+    );
+    // Fail closed — no discovery/create, config untouched.
+    expect(calls).toEqual([]);
+    expect((readConfig().d1_databases as Array<Record<string, unknown>>)[0].database_id).toBe(
+      uuid('other'),
+    );
+  });
+
+  it('D1: an entry with a real id but NO database_name keeps ID-only reuse', async () => {
+    setup(JSON.stringify({ d1_databases: [{ binding: 'DB', database_id: uuid('db1') }] }));
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([]);
+    expect(result.resources[0].action).toBe('reused');
+    expect(result.resources[0].id).toBe(uuid('db1'));
+  });
+
+  it('R2: a stored bucket_name DIFFERENT from the desired name fails closed (contradiction, never silent reuse)', async () => {
+    setup(
+      JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'someone-elses-bucket' }] }),
+    );
+    const { run, calls } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(
+      /R2 binding "STORAGE".*stores bucket_name "someone-elses-bucket".*wants bucket "myapp-uploads".*contradicts the desired bucket/s,
+    );
+    expect(calls).toEqual([]);
+  });
+
+  it('R2: the `default` placeholder bucket_name still takes the discovery path (not a contradiction)', async () => {
+    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }] }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^r2 bucket info /,
+        reply: () => fail('', 'X [ERROR] The specified bucket does not exist [code: 10006]'),
+      },
+      {
+        match: /^r2 bucket create /,
+        reply: () => {
+          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'myapp-uploads' });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(true);
+    expect(result.resources[0].action).toBe('created');
+  });
+
+  it('R2: a desired bucket named default reuses the matching stored bucket', async () => {
+    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }] }));
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'default' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(result.resources[0]).toMatchObject({ kind: 'r2', name: 'default', action: 'reused' });
+    expect(calls).toEqual([]);
+  });
+});
+
+describe('provisionCloudflareResources — per-resource placeholder rules', () => {
+  it('R2: a stored bucket_name of "local" is a REAL name — a different desired bucket fails closed (no silent rewrite)', async () => {
+    // Only "default" is R2's placeholder; "local" is a real bucket name.
+    setup(
+      JSON.stringify({
+        account_id: 'acct',
+        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'local' }],
+      }),
+    );
+    const { run, calls } = makeRunner([
+      { match: /^r2 bucket info /, reply: () => ok(JSON.stringify({ name: 'myapp-storage' })) },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-storage' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(
+      /R2 binding "STORAGE".*stores.*bucket_name "local".*wants bucket "myapp-storage".*contradicts/s,
+    );
+    // Fail closed: no discovery/create, stored entry untouched.
+    expect(calls).toEqual([]);
+    expect((readConfig().r2_buckets as Array<Record<string, unknown>>)[0].bucket_name).toBe(
+      'local',
+    );
+  });
+
+  it('R2: a stored bucket_name of "local" EQUAL to the desired bucket is reused (real name, no wrangler call)', async () => {
+    setup(
+      JSON.stringify({
+        account_id: 'acct',
+        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'local' }],
+      }),
+    );
+    const { run, calls } = makeRunner([]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'local' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(calls).toEqual([]);
+    expect(result.resources[0]).toEqual({
+      kind: 'r2',
+      binding: 'STORAGE',
+      name: 'local',
+      action: 'reused',
+    });
+  });
+
+  it('R2: a bucket genuinely named "default" is created + verified via the remote probe (no false postcondition failure)', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    let created = false;
+    const { run, calls } = makeRunner([
+      {
+        match: /^r2 bucket info /,
+        reply: () =>
+          created
+            ? ok(JSON.stringify({ name: 'default' }))
+            : fail('', 'X [ERROR] The specified bucket does not exist. [code: 10006]'),
+      },
+      {
+        match: /^r2 bucket create /,
+        reply: () => {
+          created = true;
+          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'default' });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'default' } },
+      { runWrangler: run, log: silentLog },
+    );
+    // A created `default` bucket is verified by the remote probe, not the placeholder rule.
+    expect(result.resources[0]).toEqual({
+      kind: 'r2',
+      binding: 'STORAGE',
+      name: 'default',
+      action: 'created',
+    });
+    const infoCalls = calls.filter((c) => isCall(c, 'r2', 'bucket', 'info'));
+    expect(infoCalls.length).toBe(2); // the absence probe + the post-create verify probe
+  });
+
+  it('R2: a masked-killed create of a bucket named "default" fails closed when the verify probe cannot confirm it', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const { run } = makeRunner([
+      {
+        // Absence first, and STILL absent on the verify probe (the create was masked).
+        match: /^r2 bucket info /,
+        reply: () => fail('', 'X [ERROR] The specified bucket does not exist. [code: 10006]'),
+      },
+      {
+        // The create "succeeds" (exit 0) and even writes the entry — but for the name
+        // `default` that entry is indistinguishable from the local-dev placeholder.
+        match: /^r2 bucket create /,
+        reply: () => {
+          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'default' });
+          return ok();
+        },
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'default' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/did not confirm the bucket exists/);
+  });
+});
+
+describe('provisionCloudflareResources — D1 whole-list alias reconciliation', () => {
+  it('a NON-target member with a valid uuid but a CONFLICTING/malformed database_id rejects the WHOLE list (no create)', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        // A member whose `uuid` alone is valid must not count as proof of absence.
+        match: /^d1 list --json/,
+        reply: () =>
+          ok(JSON.stringify([{ name: 'other-db', uuid: uuid('other'), database_id: 'bogus' }])),
+      },
+      { match: /^d1 create /, reply: () => ok() },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/no valid id.*agreeing on one id/s);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+
+  it('a NON-target member with TWO valid but DISAGREEING alias UUIDs rejects the whole list (no create)', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () =>
+          ok(
+            JSON.stringify([
+              { name: 'other-db', uuid: uuid('alias-a'), database_id: uuid('alias-b') },
+            ]),
+          ),
+      },
+      { match: /^d1 create /, reply: () => ok() },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/no valid id/);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+
+  it('a member with AGREEING aliases (uuid === database_id) passes the gate; absence stays authoritative', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const { run } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () =>
+          ok(JSON.stringify([{ name: 'other-db', uuid: uuid('same'), database_id: uuid('same') }])),
+      },
+      {
+        match: /^d1 create /,
+        reply: () => {
+          simulateUpdateConfig('d1_databases', {
+            binding: 'DB',
+            database_name: 'myapp-db',
+            database_id: uuid('mine'),
+          });
+          return ok();
+        },
+      },
+    ]);
+    const result = await provisionCloudflareResources(
+      tmpDir,
+      wranglerPath,
+      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+      { runWrangler: run, log: silentLog },
+    );
+    expect(result.resources[0].action).toBe('created');
+  });
+
+  it('the TARGET member with a non-string secondary alias (uuid: 123) fails closed as ambiguous — never adopted', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    const { run, calls } = makeRunner([
+      {
+        match: /^d1 list --json/,
+        reply: () => ok(JSON.stringify([{ name: 'myapp-db', database_id: uuid('db'), uuid: 123 }])),
+      },
+    ]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: run, log: silentLog },
+      ),
+    ).rejects.toThrow(/no valid id/);
+    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
+  });
+});
+
+describe('checkCloudflareProvisionDrift — id-drift vs the committed wrangler config', () => {
+  it('reports every desired id-bearing resource as missing when the config file is absent', () => {
+    rmSync(tmpDir, { recursive: true, force: true });
+    mkdirSync(tmpDir, { recursive: true });
+    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
+      d1: { binding: 'DB', name: 'myapp-db' },
+      kvNamespaces: [
+        { binding: 'KV', title: 'myapp-kv' },
+        { binding: 'ISR_CACHE', title: 'myapp-isr-cache' },
+      ],
+      r2: { binding: 'STORAGE', bucketName: 'myapp-storage' },
+      queues: ['jobs'],
+      hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hyperdrive', connectionString: '' },
+    });
+    // Queues are name-bearing, not id-bearing → excluded from the id-drift check.
+    expect(missing.map((m) => m.binding).sort()).toEqual([
+      'DB',
+      'HYPERDRIVE',
+      'ISR_CACHE',
+      'KV',
+      'STORAGE',
+    ]);
+  });
+
+  it('treats placeholder ids (local / default) as NOT provisioned', () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
+        kv_namespaces: [{ binding: 'ISR_CACHE', id: 'local' }],
+        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }],
+      }),
+    );
+    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
+      d1: { binding: 'DB', name: 'myapp-db' },
+      kvNamespaces: [{ binding: 'ISR_CACHE', title: 'myapp-isr-cache' }],
+      r2: { binding: 'STORAGE', bucketName: 'myapp-storage' },
+      queues: [],
+    });
+    expect(missing.map((m) => m.kind).sort()).toEqual(['d1', 'kv', 'r2']);
+  });
+
+  it('accepts a stored R2 bucket named default when that is the desired bucket', () => {
+    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }] }));
+    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
+      ...emptyDesired,
+      r2: { binding: 'STORAGE', bucketName: 'default' },
+    });
+    expect(missing).toEqual([]);
+  });
+
+  it('reports NO drift when every desired resource has a real id', () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db') }],
+        kv_namespaces: [
+          { binding: 'KV', id: hex32('kv') },
+          { binding: 'ISR_CACHE', id: hex32('isr') },
+        ],
+        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'myapp-storage' }],
+        hyperdrive: [{ binding: 'HYPERDRIVE', id: hex32('hd') }],
+      }),
+    );
+    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
+      d1: { binding: 'DB', name: 'myapp-db' },
+      kvNamespaces: [
+        { binding: 'KV', title: 'myapp-kv' },
+        { binding: 'ISR_CACHE', title: 'myapp-isr-cache' },
+      ],
+      r2: { binding: 'STORAGE', bucketName: 'myapp-storage' },
+      queues: [],
+      hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hyperdrive', connectionString: '' },
+    });
+    expect(missing).toEqual([]);
+  });
+
+  it('flags only the newly-desired resource when the rest are already provisioned', () => {
+    setup(
+      JSON.stringify({
+        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db') }],
+        // ISR_CACHE not yet declared — routes just started using `revalidate`.
+      }),
+    );
+    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
+      d1: { binding: 'DB', name: 'myapp-db' },
+      kvNamespaces: [{ binding: 'ISR_CACHE', title: 'myapp-isr-cache' }],
+      queues: [],
+    });
+    expect(missing).toEqual([{ binding: 'ISR_CACHE', kind: 'kv', name: 'myapp-isr-cache' }]);
+  });
+});
diff --git a/packages/void/test/unit/provision-runner-signals.test.ts b/packages/void/test/unit/provision-runner-signals.test.ts
index 262ebeb96..3574fd2d1 100644
--- a/packages/void/test/unit/provision-runner-signals.test.ts
+++ b/packages/void/test/unit/provision-runner-signals.test.ts
@@ -1,3 +1,856 @@
-import { runProvisionTestShard } from './provision-test-shard.ts';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vite-plus/test';
+import {
+  acquireProvisionLock,
+  createDefaultRunWrangler,
+  normalizeRunWranglerResult,
+  WranglerQuarantineError,
+} from '../../src/cli/provision.ts';
+import { waitForDead } from './provision-fixtures.ts';
 
-await runProvisionTestShard('runner-signals');
+describe('normalizeRunWranglerResult — signal / spawn-error handling', () => {
+  it('treats a SIGTERM-killed child (status null, signal set) as FAILURE, not success', () => {
+    const r = normalizeRunWranglerResult({
+      stdout: '',
+      stderr: '',
+      status: null,
+      signal: 'SIGTERM',
+    });
+    expect(r.status).not.toBe(0);
+    expect(r.stderr).toContain('SIGTERM');
+  });
+
+  it('treats a spawn error as FAILURE and surfaces its message', () => {
+    const r = normalizeRunWranglerResult({
+      status: null,
+      error: new Error('spawn wrangler ENOENT'),
+    });
+    expect(r.status).not.toBe(0);
+    expect(r.stderr).toContain('ENOENT');
+  });
+
+  it('passes a clean exit through unchanged (0 stays success, a real non-zero is preserved)', () => {
+    expect(normalizeRunWranglerResult({ status: 0, stdout: 'ok' }).status).toBe(0);
+    expect(normalizeRunWranglerResult({ status: 2, stderr: 'boom' }).status).toBe(2);
+  });
+
+  it('carries structured signal/error provenance', () => {
+    const killed = normalizeRunWranglerResult({ status: null, signal: 'SIGTERM' });
+    expect(killed.signal).toBe('SIGTERM');
+    expect(killed.error).toBeNull();
+    const errored = normalizeRunWranglerResult({ status: null, error: new Error('ENOENT') });
+    expect(errored.error).toContain('ENOENT');
+    const clean = normalizeRunWranglerResult({ status: 0, stdout: 'ok' });
+    expect(clean.signal).toBeNull();
+    expect(clean.error).toBeNull();
+  });
+});
+
+// Windows cannot deliver a signal to another process: libuv maps it to `TerminateProcess`,
+// which runs no handler. Tests that signal a real parent process are POSIX-only.
+const WINDOWS_NO_SIGNALS = 'signal delivery to another process is POSIX-only (see note above)';
+
+async function waitForPid(pidFile: string, timeoutMs: number): Promise<number | undefined> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(pidFile)) {
+      const raw = readFileSync(pidFile, 'utf-8');
+      if (raw.length > 0) {
+        return Number(raw);
+      }
+    }
+    await new Promise((r) => setTimeout(r, 25));
+  }
+  return undefined;
+}
+
+describe('createDefaultRunWrangler — normal close confirms the whole GROUP', () => {
+  const GROUP_CLOSE_TMP = join(import.meta.dirname, '.tmp-group-close');
+  beforeEach(() => {
+    rmSync(GROUP_CLOSE_TMP, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
+    mkdirSync(GROUP_CLOSE_TMP, { recursive: true });
+  });
+  afterEach(() => {
+    // Windows may retain the exited child's cwd handle briefly after the
+    // liveness assertion passes. Retry removal without weakening that assertion.
+    rmSync(GROUP_CLOSE_TMP, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
+  });
+
+  it('an exit-0 leader that leaves a SAME-GROUP grandchild alive: the runner resolves only after the group is dead', async () => {
+    // `close` fires when the leader exits, but a same-group grandchild can outlive it.
+    const gcPidFile = join(GROUP_CLOSE_TMP, 'gc.pid');
+    const gc = join(GROUP_CLOSE_TMP, 'gc.cjs');
+    writeFileSync(
+      gc,
+      `require('fs').writeFileSync(${JSON.stringify(gcPidFile)}, String(process.pid));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const leader = join(GROUP_CLOSE_TMP, 'leader.cjs');
+    writeFileSync(
+      leader,
+      `const { spawn } = require('child_process');\n` +
+        `const fs = require('fs');\n` +
+        // Same process group (not detached), but its OWN stdio — so the leader's exit
+        // fires `close` while the grandchild lives on in the group.
+        `const c = spawn(process.execPath, [${JSON.stringify(gc)}], { stdio: 'ignore' });\n` +
+        `c.unref();\n` +
+        `setInterval(() => {\n` +
+        `  if (fs.existsSync(${JSON.stringify(gcPidFile)})) { console.log(JSON.stringify({ operationResult: 1 })); process.exit(0); }\n` +
+        `}, 10);\n`,
+    );
+    const run = createDefaultRunWrangler(GROUP_CLOSE_TMP, {
+      launcher: [process.execPath, leader],
+      timeoutMs: 30_000,
+    });
+    const result = await run({ type: 'd1.list' }, { accountId: 'acct' });
+    // The clean exit is reported only after the grandchild was reaped.
+    expect(result.status).toBe(0);
+    expect(result.signal).toBeNull();
+    const gcPid = Number(readFileSync(gcPidFile, 'utf-8'));
+    expect(Number.isInteger(gcPid)).toBe(true);
+    let alive = true;
+    try {
+      process.kill(gcPid, 0);
+    } catch {
+      alive = false;
+    }
+    try {
+      process.kill(gcPid, 'SIGKILL'); // never leak on assertion failure
+    } catch {
+      // already gone
+    }
+    expect(alive).toBe(false);
+  }, 15_000);
+});
+
+describe('createDefaultRunWrangler — signal-path kill failure quarantines the lock (child-process)', () => {
+  const SIGNAL_KILL_TMP = join(import.meta.dirname, '.tmp-signal-kill');
+  beforeEach(() => {
+    rmSync(SIGNAL_KILL_TMP, { recursive: true, force: true });
+    mkdirSync(SIGNAL_KILL_TMP, { recursive: true });
+  });
+  afterEach(() => {
+    rmSync(SIGNAL_KILL_TMP, { recursive: true, force: true });
+  });
+
+  it('SIGTERM + an injected kill FAILURE: the parent dies with mutex + sidecar RETAINED; the gate blocks until the child dies', async (ctx) => {
+    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
+    // After a failed kill the parent must quarantine before re-raising; otherwise
+    // proper-lockfile's exit hook removes the lock while the child still runs.
+    const appRoot = join(SIGNAL_KILL_TMP, 'app');
+    const pidFile = join(SIGNAL_KILL_TMP, 'child.pid');
+    const hungCli = join(SIGNAL_KILL_TMP, 'hung.cjs');
+    writeFileSync(
+      hungCli,
+      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
+        `process.on('SIGTERM', () => {});\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const parentScript = join(SIGNAL_KILL_TMP, 'parent.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      parentScript,
+      `import { mkdirSync, writeFileSync } from 'node:fs';\n` +
+        `import { join } from 'node:path';\n` +
+        `import { provisionCloudflareResources, createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
+        `const root = ${JSON.stringify(appRoot)};\n` +
+        `mkdirSync(root, { recursive: true });\n` +
+        `const cfg = join(root, 'wrangler.jsonc');\n` +
+        `writeFileSync(cfg, JSON.stringify({ name: 'app', account_id: 'acct' }));\n` +
+        `const runner = createDefaultRunWrangler(root, {\n` +
+        `  launcher: [process.execPath, ${JSON.stringify(hungCli)}, ${JSON.stringify(pidFile)}],\n` +
+        `  killProcessGroup: () => {\n` +
+        `    throw Object.assign(new Error('EPERM: operation not permitted'), { code: 'EPERM' });\n` +
+        `  },\n` +
+        `});\n` +
+        `provisionCloudflareResources(root, cfg, { kvNamespaces: [], queues: [], d1: { binding: 'DB', name: 'myapp-db' } }, {\n` +
+        `  runWrangler: runner,\n` +
+        `  log: { info: () => {}, warn: () => {} },\n` +
+        `}).then(\n` +
+        `  () => console.log('RESOLVED'),\n` +
+        `  (e) => console.log('REJECTED:' + e.message),\n` +
+        `);\n`,
+    );
+    const { spawn } = await import('node:child_process');
+    const parent = spawn(process.execPath, [parentScript], {
+      cwd: SIGNAL_KILL_TMP,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let childPid: number | undefined;
+    try {
+      // The hung child wrote its pid, so the provision holds the lock.
+      childPid = await waitForPid(pidFile, 10_000);
+      expect(childPid).toBeDefined();
+      parent.kill('SIGTERM');
+      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
+        parent.on('exit', (code, sig) => res([code, sig]));
+      });
+      expect(signal).toBe('SIGTERM');
+      // The quarantine ran before the re-raise, so the exit sweep left the lock on disk.
+      const cfgReal = realpathSync(join(appRoot, 'wrangler.jsonc'));
+      const lockMutex = `${cfgReal}.void-provision.lock.lock`;
+      const sidecar = `${cfgReal}.void-provision.lock.quarantine.json`;
+      expect(existsSync(lockMutex)).toBe(true);
+      expect(existsSync(sidecar)).toBe(true);
+      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
+      expect(recorded.pid).toBe(childPid);
+      expect(String(recorded.reason)).toMatch(/SIGTERM/);
+      // The child is still alive, so the gate fails closed even on a stale mutex.
+      expect(() => process.kill(childPid!, 0)).not.toThrow();
+      const old = new Date(Date.now() - 3_600_000);
+      utimesSync(lockMutex, old, old);
+      await expect(acquireProvisionLock(cfgReal, { stale: 2_000, retries: 0 })).rejects.toThrow(
+        /QUARANTINED/,
+      );
+      // Kill the recorded group; the next acquisition clears the quarantine + proceeds.
+      try {
+        process.kill(-childPid!, 'SIGKILL');
+      } catch {
+        process.kill(childPid!, 'SIGKILL');
+      }
+      expect(await waitForDead(childPid!, 5_000)).toBe(true);
+      const lock = await acquireProvisionLock(cfgReal, { stale: 2_000, retries: 5 });
+      expect(existsSync(sidecar)).toBe(false);
+      await lock.release();
+      expect(existsSync(lockMutex)).toBe(false);
+    } finally {
+      // Never leak processes, even on assertion failure.
+      try {
+        parent.kill('SIGKILL');
+      } catch {
+        // already gone
+      }
+      if (childPid !== undefined) {
+        try {
+          process.kill(childPid, 'SIGKILL');
+        } catch {
+          // already gone
+        }
+      }
+    }
+  }, 30_000);
+});
+
+describe('createDefaultRunWrangler — ONE signal coordinator: repeated signals coalesced, teardown bounded, spawns rejected', () => {
+  const COORDINATOR_TMP = join(import.meta.dirname, '.tmp-signal-coordinator');
+  beforeEach(() => {
+    rmSync(COORDINATOR_TMP, { recursive: true, force: true });
+    mkdirSync(COORDINATOR_TMP, { recursive: true });
+  });
+  afterEach(() => {
+    rmSync(COORDINATOR_TMP, { recursive: true, force: true });
+  });
+
+  it('a SECOND concurrently-active wrangler child is rejected PRE-SPAWN (at most one registrant)', async () => {
+    // Calls within a provision are sequential and one provision runs per process, so a
+    // second active child is a caller bug.
+    const slowChild = join(COORDINATOR_TMP, 'slow-child.cjs');
+    writeFileSync(
+      slowChild,
+      `setTimeout(() => { console.log(JSON.stringify({ operationResult: 1 })); process.exit(0); }, 400);\n`,
+    );
+    const runA = createDefaultRunWrangler(COORDINATOR_TMP, {
+      launcher: [process.execPath, slowChild],
+      timeoutMs: 30_000,
+    });
+    const first = runA({ type: 'd1.list' }, { accountId: 'acct' });
+    await new Promise((r) => setTimeout(r, 80)); // A's child is alive and registered
+    const runB = createDefaultRunWrangler(COORDINATOR_TMP, {
+      launcher: [process.execPath, slowChild],
+      timeoutMs: 30_000,
+    });
+    await expect(runB({ type: 'd1.list' }, { accountId: 'acct' })).rejects.toThrow(
+      /another wrangler child is already active in this process/,
+    );
+    // The first runner is unaffected and settles cleanly.
+    const result = await first;
+    expect(result.status).toBe(0);
+    expect(result.signal).toBeNull();
+  }, 15_000);
+
+  it('permits two immutable Worker uploads while rejecting a third upload or traffic mutation', async () => {
+    const slowChild = join(COORDINATOR_TMP, 'parallel-upload.cjs');
+    writeFileSync(
+      slowChild,
+      `setTimeout(() => { console.log(JSON.stringify({ operationResult: 1 })); process.exit(0); }, 400);\n`,
+    );
+    const spawned: Array<number | undefined> = [];
+    const run = createDefaultRunWrangler(COORDINATOR_TMP, {
+      launcher: [process.execPath, slowChild],
+      onSpawnedChild: (child) => spawned.push(child.pid),
+      parallelWorkerUpload: true,
+      timeoutMs: 30_000,
+    });
+    const first = run({ type: 'versions.upload' }, { accountId: 'acct' });
+    const second = run({ type: 'versions.upload' }, { accountId: 'acct' });
+    expect(spawned).toHaveLength(2);
+    await expect(run({ type: 'versions.upload' }, { accountId: 'acct' })).rejects.toThrow(
+      /another wrangler child is already active in this process/,
+    );
+    await expect(
+      run({ type: 'versions.deploy', versions: [] }, { accountId: 'acct' }),
+    ).rejects.toThrow(/another wrangler child is already active in this process/);
+    expect(spawned).toHaveLength(2);
+    expect((await Promise.all([first, second])).map((result) => result.status)).toEqual([0, 0]);
+    expect(
+      (await run({ type: 'versions.deploy', versions: [] }, { accountId: 'acct' })).status,
+    ).toBe(0);
+  }, 15_000);
+
+  it('confirms both parallel upload process groups have exited before forwarding SIGTERM', async (ctx) => {
+    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
+    const pidFiles = [join(COORDINATOR_TMP, 'upload-a.pid'), join(COORDINATOR_TMP, 'upload-b.pid')];
+    const childScript = join(COORDINATOR_TMP, 'upload-slow-exit.cjs');
+    writeFileSync(
+      childScript,
+      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
+        `process.on('SIGTERM', () => setTimeout(() => process.exit(0), 500));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const parentScript = join(COORDINATOR_TMP, 'parallel-upload-parent.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      parentScript,
+      `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
+        pidFiles
+          .map(
+            (pidFile) =>
+              `createDefaultRunWrangler(process.cwd(), { launcher: [process.execPath, ${JSON.stringify(childScript)}, ${JSON.stringify(pidFile)}], parallelWorkerUpload: true })({ type: 'versions.upload' }, { accountId: 'acct' }).catch(() => {});\n`,
+          )
+          .join(''),
+    );
+    const { spawn } = await import('node:child_process');
+    const parent = spawn(process.execPath, [parentScript], {
+      cwd: COORDINATOR_TMP,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const pids: Array<number> = [];
+    try {
+      for (const file of pidFiles) {
+        const pid = await waitForPid(file, 10_000);
+        expect(pid).toBeDefined();
+        pids.push(pid!);
+      }
+      parent.kill('SIGTERM');
+      const signal = await new Promise<NodeJS.Signals | null>((resolve) => {
+        parent.on('exit', (_code, received) => resolve(received));
+      });
+      expect(signal).toBe('SIGTERM');
+      for (const pid of pids) {
+        expect(() => process.kill(pid, 0)).toThrow();
+      }
+    } finally {
+      parent.kill('SIGKILL');
+      for (const pid of pids) {
+        try {
+          process.kill(pid, 'SIGKILL');
+        } catch {
+          // already gone
+        }
+      }
+    }
+  }, 20_000);
+
+  it('one SIGTERM (+ a repeat mid-teardown) is coalesced: the parent re-raises only after the group is dead', async (ctx) => {
+    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
+    // The handler stays installed through the teardown, so a repeated signal cannot take
+    // Node's default action and kill the parent while the child is alive.
+    const pidFile = join(COORDINATOR_TMP, 'a.pid');
+    const childScript = join(COORDINATOR_TMP, 'slow-exit-child.cjs');
+    writeFileSync(
+      childScript,
+      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
+        `process.on('SIGTERM', () => setTimeout(() => process.exit(0), 600));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const parentScript = join(COORDINATOR_TMP, 'parent.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      parentScript,
+      `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
+        `const runA = createDefaultRunWrangler(process.cwd(), {\n` +
+        `  launcher: [process.execPath, ${JSON.stringify(childScript)}, ${JSON.stringify(pidFile)}],\n` +
+        `});\n` +
+        `runA({ type: 'd1.list' }, { accountId: 'acct' }).then(\n` +
+        `  (r) => console.log('A-settled', r.status, r.signal),\n` +
+        `  (e) => console.log('A-rejected', e.message),\n` +
+        `);\n`,
+    );
+    const { spawn } = await import('node:child_process');
+    const parent = spawn(process.execPath, [parentScript], {
+      cwd: COORDINATOR_TMP,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let pid: number | undefined;
+    try {
+      pid = await waitForPid(pidFile, 10_000);
+      expect(pid).toBeDefined();
+      parent.kill('SIGTERM');
+      // The repeat lands mid-teardown, while the child is still alive.
+      setTimeout(() => {
+        try {
+          parent.kill('SIGTERM');
+        } catch {
+          // parent already gone (that itself would fail the assertions below)
+        }
+      }, 120);
+      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
+        parent.on('exit', (code, sig) => res([code, sig]));
+      });
+      expect(signal).toBe('SIGTERM');
+      // The slow child was already dead when the parent exited.
+      let alive = true;
+      try {
+        process.kill(pid!, 0);
+      } catch {
+        alive = false;
+      }
+      expect(alive).toBe(false);
+    } finally {
+      try {
+        parent.kill('SIGKILL');
+      } catch {
+        // already gone
+      }
+      if (pid !== undefined) {
+        try {
+          process.kill(pid, 'SIGKILL');
+        } catch {
+          // already gone
+        }
+      }
+    }
+  }, 20_000);
+
+  it('a spawn attempted AFTER teardown began is rejected fast (no child spawned, teardown unaffected)', async (ctx) => {
+    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
+    const pidFile = join(COORDINATOR_TMP, 'c.pid');
+    const childScript = join(COORDINATOR_TMP, 'slow-exit-child2.cjs');
+    writeFileSync(
+      childScript,
+      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
+        `process.on('SIGTERM', () => setTimeout(() => process.exit(0), 400));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const outcomeFile = join(COORDINATOR_TMP, 'late-spawn-outcome.txt');
+    const parentScript = join(COORDINATOR_TMP, 'parent-spawn-mid-teardown.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      parentScript,
+      `import { writeFileSync } from 'node:fs';\n` +
+        `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
+        `const run = createDefaultRunWrangler(process.cwd(), {\n` +
+        `  launcher: [process.execPath, ${JSON.stringify(childScript)}, ${JSON.stringify(pidFile)}],\n` +
+        `});\n` +
+        `run({ type: 'd1.list' }, { accountId: 'acct' }).catch(() => {});\n` +
+        // A once-listener cannot swallow the later re-raise. The outcome is written
+        // synchronously so the re-raised signal cannot lose it.
+        `process.once('SIGTERM', () => {\n` +
+        `  setTimeout(() => {\n` +
+        `    run({ type: 'd1.list' }, { accountId: 'acct' }).then(\n` +
+        `      () => writeFileSync(${JSON.stringify(outcomeFile)}, 'LATE-SPAWN-ALLOWED'),\n` +
+        `      (e) => writeFileSync(${JSON.stringify(outcomeFile)}, 'LATE-SPAWN-REJECTED:' + e.message),\n` +
+        `    );\n` +
+        `  }, 50);\n` +
+        `});\n`,
+    );
+    const { spawn } = await import('node:child_process');
+    const parent = spawn(process.execPath, [parentScript], {
+      cwd: COORDINATOR_TMP,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let pid: number | undefined;
+    try {
+      pid = await waitForPid(pidFile, 10_000);
+      expect(pid).toBeDefined();
+      parent.kill('SIGTERM');
+      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
+        parent.on('exit', (code, sig) => res([code, sig]));
+      });
+      expect(signal).toBe('SIGTERM');
+      const outcome = readFileSync(outcomeFile, 'utf-8');
+      expect(outcome).toContain('LATE-SPAWN-REJECTED:');
+      expect(outcome).toMatch(/refusing to spawn wrangler.*fatal SIGTERM.*terminating/s);
+    } finally {
+      try {
+        parent.kill('SIGKILL');
+      } catch {
+        // already gone
+      }
+      if (pid !== undefined) {
+        try {
+          process.kill(pid, 'SIGKILL');
+        } catch {
+          // already gone
+        }
+      }
+    }
+  }, 20_000);
+
+  it('the coordinator-WIDE deadline bounds an unconfirmable teardown (quarantine + re-raise, never a wedge)', async (ctx) => {
+    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
+    // The child never dies and the runner would wait 60s, so only the 800ms teardown
+    // deadline can quarantine it and re-raise.
+    const pidFile = join(COORDINATOR_TMP, 'd.pid');
+    const hangScript = join(COORDINATOR_TMP, 'hang-child.cjs');
+    writeFileSync(
+      hangScript,
+      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
+        `process.on('SIGTERM', () => {});\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const parentScript = join(COORDINATOR_TMP, 'parent-deadline.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      parentScript,
+      `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
+        `const run = createDefaultRunWrangler(process.cwd(), {\n` +
+        `  launcher: [process.execPath, ${JSON.stringify(hangScript)}, ${JSON.stringify(pidFile)}],\n` +
+        `  confirmKillGraceMs: 60_000,\n` +
+        `  signalTeardownDeadlineMs: 800,\n` +
+        `  killProcessGroup: () => {},\n` + // claims success, kills nothing
+        `});\n` +
+        `run({ type: 'd1.list' }, { accountId: 'acct' }).catch(() => {});\n`,
+    );
+    const { spawn } = await import('node:child_process');
+    const parent = spawn(process.execPath, [parentScript], {
+      cwd: COORDINATOR_TMP,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let pid: number | undefined;
+    try {
+      pid = await waitForPid(pidFile, 10_000);
+      expect(pid).toBeDefined();
+      const killedAt = Date.now();
+      parent.kill('SIGTERM');
+      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
+        parent.on('exit', (code, sig) => res([code, sig]));
+      });
+      const elapsed = Date.now() - killedAt;
+      expect(signal).toBe('SIGTERM');
+      expect(elapsed).toBeGreaterThanOrEqual(700);
+      expect(elapsed).toBeLessThan(15_000);
+      // The child is still alive, so the teardown ended through the deadline's quarantine.
+      expect(() => process.kill(pid!, 0)).not.toThrow();
+    } finally {
+      try {
+        parent.kill('SIGKILL');
+      } catch {
+        // already gone
+      }
+      if (pid !== undefined) {
+        try {
+          process.kill(-pid, 'SIGKILL');
+        } catch {
+          try {
+            process.kill(pid, 'SIGKILL');
+          } catch {
+            // already gone
+          }
+        }
+      }
+    }
+  }, 20_000);
+});
+
+describe('createDefaultRunWrangler — post-spawn child `error` events confirm/quarantine', () => {
+  const POST_SPAWN_TMP = join(import.meta.dirname, '.tmp-post-spawn-error');
+  const spawnedChildren = new Set<import('node:child_process').ChildProcess>();
+  beforeEach(() => {
+    rmSync(POST_SPAWN_TMP, { recursive: true, force: true });
+    mkdirSync(POST_SPAWN_TMP, { recursive: true });
+  });
+  afterEach(async () => {
+    // A test deadline can interrupt the assertion before the runner's deadline.
+    // Wait for actual close before removing a directory a Windows child uses as cwd.
+    for (const child of spawnedChildren) {
+      const closed = new Promise<void>((resolve) => child.once('close', () => resolve()));
+      child.kill('SIGKILL');
+      await closed;
+    }
+    rmSync(POST_SPAWN_TMP, { recursive: true, force: true });
+  });
+
+  function createRunner(options: NonNullable<Parameters<typeof createDefaultRunWrangler>[1]>) {
+    return createDefaultRunWrangler(POST_SPAWN_TMP, {
+      ...options,
+      onSpawnedChild: (child) => {
+        spawnedChildren.add(child);
+        child.once('close', () => spawnedChildren.delete(child));
+        options.onSpawnedChild?.(child);
+      },
+    });
+  }
+
+  function writeHangScript(path: string): void {
+    // Ignores SIGTERM; only the machine's SIGKILL can end it.
+    writeFileSync(
+      path,
+      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
+        `process.on('SIGTERM', () => {});\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+  }
+
+  function reapPidFile(pidFile: string): number | undefined {
+    if (!existsSync(pidFile)) {
+      return undefined;
+    }
+    const pid = Number(readFileSync(pidFile, 'utf-8'));
+    try {
+      process.kill(-pid, 'SIGKILL');
+    } catch {
+      try {
+        process.kill(pid, 'SIGKILL');
+      } catch {
+        // already gone
+      }
+    }
+    return pid;
+  }
+
+  function injectErrorAfterChildStarts(
+    child: import('node:child_process').ChildProcess,
+    pidFile: string,
+    message: string,
+  ): void {
+    // A fixed delay can fire before Node loads the child script on a busy runner.
+    // Wait until the child has written its PID so this is truly a post-spawn error.
+    void (async () => {
+      const deadline = Date.now() + 5_000;
+      while (!existsSync(pidFile) && Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+      child.emit('error', new Error(message));
+    })();
+  }
+
+  it('pre-spawn ENOENT still settles directly as a hard failure (the one carve-out: no pid, nothing to confirm)', async () => {
+    const run = createRunner({
+      launcher: [join(POST_SPAWN_TMP, 'no-such-wrangler-binary')],
+    });
+    const result = await run(
+      {
+        type: 'hyperdrive.create',
+        name: 'missing-launcher-db',
+        binding: 'HYPERDRIVE',
+        configPath: 'literal config.jsonc',
+      },
+      { accountId: 'acct', input: 'postgres://user:secret@localhost/db' },
+    );
+    expect(result.status).toBe(1);
+    expect(result.error).toContain('ENOENT');
+    expect(result.signal).toBeNull();
+  });
+
+  it('an early closed stdin rejects a buffered success envelope and confirms child termination', async (ctx) => {
+    // A live Node process on Windows keeps inherited pipe handles after closing fd 0.
+    // The peer-exit and Writable-error tests below cover Windows.
+    ctx.skip(
+      process.platform === 'win32',
+      'closing a live child stdin descriptor does not close inherited Windows pipe handles',
+    );
+    const script = join(POST_SPAWN_TMP, 'closed-stdin.cjs');
+    const pidFile = join(POST_SPAWN_TMP, 'closed-stdin.pid');
+    writeFileSync(
+      script,
+      `const fs = require('fs');\n` +
+        `fs.writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
+        `fs.writeSync(1, JSON.stringify({ operationResult: 1, data: { id: 'provider-id' } }));\n` +
+        `fs.closeSync(0);\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const run = createRunner({
+      launcher: [process.execPath, script],
+      timeoutMs: 30_000,
+    });
+    try {
+      const result = await run(
+        {
+          type: 'hyperdrive.create',
+          name: 'closed-stdin-db',
+          binding: 'HYPERDRIVE',
+          configPath: 'literal config.jsonc',
+        },
+        { accountId: 'acct', input: 'x'.repeat(2 * 1024 * 1024) },
+      );
+      expect(result.status).toBe(1);
+      expect(result.signal).toBe('SIGKILL');
+      expect(result.stderr).toMatch(/EPIPE|broken pipe/i);
+      expect(result.stdout).toContain('"operationResult":1');
+      expect(result.data).toBeUndefined();
+      const pid = Number(readFileSync(pidFile, 'utf-8'));
+      expect(() => process.kill(pid, 0)).toThrow();
+    } finally {
+      reapPidFile(pidFile);
+    }
+  }, 15_000);
+
+  it('a provider exiting after reporting success rejects unread stdin through its real pipe error', async () => {
+    const script = join(POST_SPAWN_TMP, 'exited-stdin.cjs');
+    const pidFile = join(POST_SPAWN_TMP, 'exited-stdin.pid');
+    writeFileSync(
+      script,
+      `const fs = require('fs');\n` +
+        `fs.writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
+        `fs.writeSync(1, JSON.stringify({ operationResult: 1, data: { id: 'provider-id' } }));\n` +
+        // Exit closes every inherited handle on Windows as well as POSIX. The
+        // oversized unread input is still pending, so the parent gets a real
+        // closed-pipe error (write EOF on Windows, EPIPE on POSIX).
+        `process.exit(0);\n`,
+    );
+    let observedOutput = '';
+    let childClosed = Promise.resolve();
+    const run = createRunner({
+      launcher: [process.execPath, script],
+      timeoutMs: 30_000,
+      onSpawnedChild: (child) => {
+        child.stdout!.on('data', (chunk: string) => {
+          observedOutput += chunk;
+        });
+        childClosed = new Promise<void>((resolve) => child.once('close', () => resolve()));
+      },
+    });
+    let result: Awaited<ReturnType<typeof run>> | undefined;
+    let failure: unknown;
+    try {
+      result = await run(
+        {
+          type: 'hyperdrive.create',
+          name: 'exited-stdin-db',
+          binding: 'HYPERDRIVE',
+          configPath: 'literal config.jsonc',
+        },
+        { accountId: 'acct', input: 'x'.repeat(2 * 1024 * 1024) },
+      );
+    } catch (error) {
+      failure = error;
+    }
+    if (failure !== undefined) {
+      // macOS can return EPERM when signalling an already-exiting process group.
+      // The runner must quarantine that unconfirmed group, never trust its output.
+      expect(failure).toBeInstanceOf(WranglerQuarantineError);
+      expect((failure as Error).message).toMatch(
+        /post-spawn child error \(.*EPIPE.*\).*failed process-group kill/s,
+      );
+    } else {
+      expect(result!.status).toBe(1);
+      // The stdin error owns termination even if exit 0 is concurrently observed.
+      expect(result!.signal).toBe('SIGKILL');
+      expect(result!.stderr).toMatch(
+        process.platform === 'win32' ? /write EOF|EPIPE|broken pipe/i : /EPIPE|broken pipe/i,
+      );
+      expect(result!.stdout).toContain('"operationResult":1');
+      expect(result!.data).toBeUndefined();
+    }
+    expect(observedOutput).toContain('"operationResult":1');
+    await childClosed;
+    const pid = Number(readFileSync(pidFile, 'utf-8'));
+    expect(() => process.kill(pid, 0)).toThrow();
+  }, 15_000);
+
+  it('a stdin Writable error rejects buffered success only after the child is confirmed dead', async () => {
+    const script = join(POST_SPAWN_TMP, 'stdin-error.cjs');
+    const pidFile = join(POST_SPAWN_TMP, 'stdin-error.pid');
+    writeFileSync(
+      script,
+      `const fs = require('fs');\n` +
+        `fs.writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
+        `fs.writeSync(1, JSON.stringify({ operationResult: 1, data: { id: 'provider-id' } }));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const run = createRunner({
+      launcher: [process.execPath, script],
+      timeoutMs: 30_000,
+      onSpawnedChild: (child) => {
+        child.stdout!.once('data', () => {
+          // Drive Node's real Writable error event after the runner buffered success.
+          // This separately covers the error path regardless of platform pipe behavior.
+          child.stdin!.destroy(Object.assign(new Error('write EPIPE'), { code: 'EPIPE' }));
+        });
+      },
+    });
+    const result = await run(
+      {
+        type: 'hyperdrive.create',
+        name: 'stdin-error-db',
+        binding: 'HYPERDRIVE',
+        configPath: 'literal config.jsonc',
+      },
+      { accountId: 'acct', input: 'x'.repeat(2 * 1024 * 1024) },
+    );
+    expect(result.status).toBe(1);
+    expect(result.signal).toBe('SIGKILL');
+    expect(result.stderr).toContain('write EPIPE');
+    expect(result.stdout).toContain('"operationResult":1');
+    expect(result.data).toBeUndefined();
+    const pid = Number(readFileSync(pidFile, 'utf-8'));
+    expect(() => process.kill(pid, 0)).toThrow();
+  }, 15_000);
+
+  it('an injected POST-spawn `error` routes through the termination machine: the group is DEAD before the promise settles', async () => {
+    const pidFile = join(POST_SPAWN_TMP, 'child.pid');
+    const hang = join(POST_SPAWN_TMP, 'hang.cjs');
+    writeHangScript(hang);
+    const run = createRunner({
+      launcher: [process.execPath, hang, pidFile],
+      timeoutMs: 30_000,
+      onSpawnedChild: (child) => {
+        injectErrorAfterChildStarts(child, pidFile, 'injected kill-delivery failure');
+      },
+    });
+    const result = await run({ type: 'd1.list' }, { accountId: 'acct' });
+    expect(result.status).toBe(1);
+    expect(result.signal).toBe('SIGKILL');
+    expect(result.stderr).toContain('injected kill-delivery failure');
+    // The hung child was reaped before the promise settled.
+    const pid = Number(readFileSync(pidFile, 'utf-8'));
+    let alive = true;
+    try {
+      process.kill(pid, 0);
+    } catch {
+      alive = false;
+    }
+    reapPidFile(pidFile); // never leak on assertion failure
+    expect(alive).toBe(false);
+  }, 15_000);
+
+  it('a POST-spawn `error` + a FAILED group kill QUARANTINES (rejects; the caller retains the lock)', async () => {
+    const pidFile = join(POST_SPAWN_TMP, 'child2.pid');
+    const hang = join(POST_SPAWN_TMP, 'hang2.cjs');
+    writeHangScript(hang);
+    const run = createRunner({
+      launcher: [process.execPath, hang, pidFile],
+      timeoutMs: 30_000,
+      killProcessGroup: () => {
+        throw Object.assign(new Error('EPERM: operation not permitted'), { code: 'EPERM' });
+      },
+      onSpawnedChild: (child) => {
+        injectErrorAfterChildStarts(child, pidFile, 'injected post-spawn failure');
+      },
+    });
+    let thrown: unknown;
+    try {
+      await run({ type: 'd1.list' }, { accountId: 'acct' });
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toBeInstanceOf(WranglerQuarantineError);
+    expect((thrown as Error).message).toMatch(
+      /post-spawn child error \(injected post-spawn failure\).*could not be signalled|post-spawn child error \(injected post-spawn failure\).*failed process-group kill/s,
+    );
+    // The child is still alive; reap it and confirm it is gone.
+    const pid = reapPidFile(pidFile);
+    expect(pid).toBeDefined();
+    expect(await waitForDead(pid!, 5_000)).toBe(true);
+  }, 15_000);
+});
diff --git a/packages/void/test/unit/provision-runner-timeouts.test.ts b/packages/void/test/unit/provision-runner-timeouts.test.ts
index bc88667d6..234a06acd 100644
--- a/packages/void/test/unit/provision-runner-timeouts.test.ts
+++ b/packages/void/test/unit/provision-runner-timeouts.test.ts
@@ -1,3 +1,417 @@
-import { runProvisionTestShard } from './provision-test-shard.ts';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vite-plus/test';
+import {
+  createDefaultRunWrangler,
+  isAlreadyGoneKillError,
+  WranglerQuarantineError,
+} from '../../src/cli/provision.ts';
+import {
+  emptyDesired,
+  makeRunner,
+  provisionCloudflareResources,
+  silentLog,
+  useProvisionTestDir,
+  waitForDead,
+} from './provision-fixtures.ts';
 
-await runProvisionTestShard('runner-timeouts');
+const { tmpDir, wranglerPath, setup } = useProvisionTestDir('runner-timeouts');
+
+describe('createDefaultRunWrangler — hard timeout kills the REAL process', () => {
+  const TIMEOUT_TMP = join(import.meta.dirname, '.tmp-timeout-kill');
+  beforeEach(() => {
+    rmSync(TIMEOUT_TMP, { recursive: true, force: true });
+    mkdirSync(TIMEOUT_TMP, { recursive: true });
+  });
+  afterEach(() => {
+    rmSync(TIMEOUT_TMP, { recursive: true, force: true });
+  });
+
+  it('a DIRECT hung CLI is SIGKILLed and the runner REJECTS-as-hard-failure within the timeout', async () => {
+    // A direct CLI entry that ignores SIGTERM and hangs forever.
+    const hungCli = join(TIMEOUT_TMP, 'hung-cli.cjs');
+    writeFileSync(
+      hungCli,
+      `process.on('SIGTERM', () => {});\n` + `setInterval(() => {}, 1 << 30);\n`,
+    );
+    let pid: number | undefined;
+    const run = createDefaultRunWrangler(TIMEOUT_TMP, {
+      launcher: [process.execPath, hungCli],
+      onSpawnedChild: (child) => {
+        pid = child.pid;
+      },
+      timeoutMs: 400,
+    });
+    const start = Date.now();
+    const result = await run({ type: 'd1.list' }, { accountId: 'acct' });
+    const elapsed = Date.now() - start;
+    // A loose bound: the 400ms timer can fire late on a busy machine.
+    expect(elapsed).toBeLessThan(15_000);
+    expect(result.signal).toBe('SIGKILL');
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toMatch(/exceeded the 400ms command timeout/);
+    // The SIGKILL reached the real CLI.
+    expect(pid).toBeTypeOf('number');
+    expect(await waitForDead(pid!, 10_000)).toBe(true);
+  }, 20_000);
+
+  it('a WRAPPER that re-spawns a hung grandchild: runner still settles in time AND the grandchild is reaped', async () => {
+    // A `bin/wrangler.js`-style wrapper forwards only SIGTERM and reports a signal death as
+    // exit 0, while its grandchild holds the pipes open. Only a process-group kill ends it.
+    const gcPidFile = join(TIMEOUT_TMP, 'grandchild.pid');
+    const grandchild = join(TIMEOUT_TMP, 'grandchild.cjs');
+    writeFileSync(
+      grandchild,
+      `require('fs').writeFileSync(${JSON.stringify(gcPidFile)}, String(process.pid));\n` +
+        `process.on('SIGTERM', () => {});\n` + // ignore the wrapper's forwarded SIGTERM
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    const wrapper = join(TIMEOUT_TMP, 'wrapper.cjs');
+    writeFileSync(
+      wrapper,
+      `const { spawn } = require('child_process');\n` +
+        // A spawn can fail with EAGAIN under load. Retry, and keep the wrapper alive so the
+        // timeout path still runs instead of a normal close.
+        `let child;\n` +
+        `function launch() {\n` +
+        `  try {\n` +
+        `    child = spawn(process.execPath, [${JSON.stringify(grandchild)}], { stdio: ['inherit','inherit','inherit'] });\n` +
+        `    child.on('error', () => { child = undefined; setTimeout(launch, 50); });\n` +
+        `    child.on('exit', (code) => process.exit(code === null ? 0 : code));\n` + // mask signal death as exit 0
+        `  } catch { setTimeout(launch, 50); }\n` +
+        `}\n` +
+        `launch();\n` +
+        `process.on('SIGTERM', () => { if (child) child.kill(); });\n` + // forward only SIGTERM (default)
+        `process.on('SIGINT', () => { if (child) child.kill(); });\n` +
+        `setInterval(() => {}, 1 << 30);\n`, // keep the wrapper alive until the group is killed
+    );
+    const run = createDefaultRunWrangler(TIMEOUT_TMP, {
+      launcher: [process.execPath, wrapper],
+      // Long enough for the wrapper and grandchild to start under load.
+      timeoutMs: 1_500,
+    });
+    const start = Date.now();
+    const result = await run({ type: 'd1.list' }, { accountId: 'acct' });
+    const elapsed = Date.now() - start;
+    expect(elapsed).toBeLessThan(20_000);
+    expect(result.signal).toBe('SIGKILL');
+    expect(result.status).not.toBe(0);
+    // The process-group kill reaped the grandchild too.
+    const gcPid = Number(readFileSync(gcPidFile, 'utf-8'));
+    expect(Number.isInteger(gcPid)).toBe(true);
+    expect(await waitForDead(gcPid, 10_000)).toBe(true);
+  }, 25_000);
+});
+
+describe('withListerDeadline — the deadline holds in a real process', () => {
+  const LISTER_DEADLINE_TMP = join(import.meta.dirname, '.tmp-lister-deadline');
+  beforeEach(() => {
+    rmSync(LISTER_DEADLINE_TMP, { recursive: true, force: true });
+    mkdirSync(LISTER_DEADLINE_TMP, { recursive: true });
+  });
+  afterEach(() => {
+    rmSync(LISTER_DEADLINE_TMP, { recursive: true, force: true });
+  });
+
+  it('a never-settling lister REJECTS after the deadline — the process does NOT exit 0 early, lock released', async () => {
+    // Nothing else keeps the event loop alive while the lister hangs, and Vitest's own
+    // handles would hide that, so this runs in a separate process.
+    const appRoot = join(LISTER_DEADLINE_TMP, 'app');
+    const probe = join(LISTER_DEADLINE_TMP, 'probe.mjs');
+    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
+    writeFileSync(
+      probe,
+      `import { mkdirSync, writeFileSync } from 'node:fs';\n` +
+        `import { join } from 'node:path';\n` +
+        `import { provisionCloudflareResources } from ${JSON.stringify(provisionUrl)};\n` +
+        `const root = ${JSON.stringify(appRoot)};\n` +
+        `mkdirSync(root, { recursive: true });\n` +
+        `const cfg = join(root, 'wrangler.jsonc');\n` +
+        `writeFileSync(cfg, JSON.stringify({ name: 'app', account_id: 'acct' }));\n` +
+        `provisionCloudflareResources(root, cfg, {\n` +
+        `  kvNamespaces: [],\n` +
+        `  queues: [],\n` +
+        `  hyperdrive: { binding: 'HYPERDRIVE', name: 'probe-hd', connectionString: 'postgres://u:pw@h/db' },\n` +
+        `}, {\n` +
+        `  runWrangler: () => ({ stdout: '', stderr: '', status: 0 }),\n` +
+        `  listHyperdriveConfigs: () => new Promise(() => {}),\n` +
+        `  listTimeoutMs: 500,\n` +
+        `  log: { info: () => {}, warn: (m) => console.log('WARN:' + m) },\n` +
+        `}).then(\n` +
+        `  () => console.log('RESOLVED'),\n` +
+        `  (err) => { console.log('REJECTED:' + err.message); process.exitCode = 7; },\n` +
+        `);\n`,
+    );
+    const { spawn } = await import('node:child_process');
+    const child = spawn(process.execPath, [probe], {
+      cwd: LISTER_DEADLINE_TMP,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    child.stdout.setEncoding('utf-8');
+    child.stdout.on('data', (chunk: string) => {
+      stdout += chunk;
+    });
+    const killTimer = setTimeout(() => child.kill('SIGKILL'), 15_000);
+    try {
+      const [code, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
+        child.on('close', (c, s) => res([c, s]));
+      });
+      expect(signal).toBeNull();
+      expect(code).toBe(7);
+      expect(stdout).toContain('exceeded the 500ms deadline');
+      expect(stdout).toContain('REJECTED:');
+      expect(stdout).not.toContain('RESOLVED');
+      expect(existsSync(join(appRoot, 'wrangler.jsonc.void-provision.lock.lock'))).toBe(false);
+    } finally {
+      clearTimeout(killTimer);
+      try {
+        child.kill('SIGKILL');
+      } catch {
+        // already gone
+      }
+    }
+  }, 20_000);
+});
+
+describe('provisionCloudflareResources — Hyperdrive lister deadline', () => {
+  it('the deadline signal is aborted when the deadline fires (so a real fetch would cancel)', async () => {
+    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
+    let capturedSignal: AbortSignal | undefined;
+    const { run } = makeRunner([]);
+    await expect(
+      provisionCloudflareResources(
+        tmpDir,
+        wranglerPath,
+        {
+          ...emptyDesired,
+          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
+        },
+        {
+          runWrangler: run,
+          log: silentLog,
+          listHyperdriveConfigs: (ctx) => {
+            capturedSignal = ctx.signal;
+            return new Promise<never>(() => {});
+          },
+          listTimeoutMs: 150,
+        },
+      ),
+    ).rejects.toThrow(/cannot verify/);
+    expect(capturedSignal?.aborted).toBe(true);
+  }, 10_000);
+});
+
+describe('createDefaultRunWrangler — confirmed child termination + kill classification', () => {
+  // A unique directory per test: a pid file left by another run may name a reused pid.
+  let killClassifyTmp = '';
+  // Windows keeps a dead child's cwd and files busy for a moment, so retry the removal. A
+  // leftover fails the test only while a recorded pid is still alive. Never kill by pid here.
+  const rmTmp = (): void => {
+    if (killClassifyTmp === '') {
+      return;
+    }
+    try {
+      rmSync(killClassifyTmp, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
+      return;
+    } catch (error) {
+      const left = existsSync(killClassifyTmp) ? readdirSync(killClassifyTmp) : [];
+      const live = left
+        .filter((entry) => entry.endsWith('.pid'))
+        .map((entry) => Number(readFileSync(join(killClassifyTmp, entry), 'utf-8').trim()))
+        .filter((pid) => {
+          try {
+            process.kill(pid, 0);
+            return true;
+          } catch {
+            return false;
+          }
+        });
+      const detail =
+        `${(error as Error).message}\n` +
+        `  entries remaining: ${left.length > 0 ? left.join(', ') : '(none)'}\n` +
+        `  recorded pids still resolving to a live process: ${live.length > 0 ? live.join(', ') : 'none'}`;
+      if (live.length > 0) {
+        throw new Error(`could not remove ${killClassifyTmp}: ${detail}`);
+      }
+      // Nothing of ours is running, so warn instead of failing on temp-file cleanup.
+      console.warn(`warn: leaving ${killClassifyTmp} behind — ${detail}`);
+    }
+  };
+  beforeEach(() => {
+    killClassifyTmp = mkdtempSync(join(import.meta.dirname, '.tmp-kill-classify-'));
+  });
+  afterEach(() => {
+    rmTmp();
+  });
+
+  it('isAlreadyGoneKillError: ESRCH → true (already gone), any other code → false (real failure)', () => {
+    expect(isAlreadyGoneKillError(Object.assign(new Error('x'), { code: 'ESRCH' }))).toBe(true);
+    expect(isAlreadyGoneKillError(Object.assign(new Error('x'), { code: 'EPERM' }))).toBe(false);
+    expect(isAlreadyGoneKillError(new Error('x'))).toBe(false);
+    expect(isAlreadyGoneKillError(null)).toBe(false);
+  });
+
+  it('a REAL kill failure (EPERM) on timeout QUARANTINES: the runner REJECTS, never settle-and-release', async () => {
+    const pidFile = join(killClassifyTmp, 'cli.pid');
+    const hungCli = join(killClassifyTmp, 'hung.cjs');
+    writeFileSync(
+      hungCli,
+      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    let spawnedPid: number | undefined;
+    const run = createDefaultRunWrangler(killClassifyTmp, {
+      launcher: [process.execPath, hungCli],
+      onSpawnedChild: (child) => {
+        spawnedPid = child.pid;
+      },
+      timeoutMs: 300,
+      // Simulate a kill that FAILS for a non-ESRCH reason (the child is still alive).
+      killProcessGroup: () => {
+        throw Object.assign(new Error('EPERM: operation not permitted'), { code: 'EPERM' });
+      },
+    });
+    // The child may still run, so the runner rejects: resolving would let the caller release
+    // the lock under a live child.
+    let rejected: unknown;
+    try {
+      await run({ type: 'd1.list' }, { accountId: 'acct' });
+    } catch (error) {
+      rejected = error;
+    }
+    expect(rejected).toBeInstanceOf(WranglerQuarantineError);
+    const err = rejected as WranglerQuarantineError;
+    expect(err.quarantine).toBe(true);
+    expect(err.message).toMatch(/could not be killed: EPERM/);
+    expect(err.message).toMatch(/intentionally RETAINED/);
+    expect(err.message).toMatch(/pid \d+/);
+    // The child is still alive; prove it, then clean up.
+    const pid = spawnedPid!;
+    expect(pid).toBeTypeOf('number');
+    expect(() => process.kill(pid, 0)).not.toThrow();
+    try {
+      process.kill(pid, 'SIGKILL');
+    } catch {
+      // already gone
+    }
+    expect(await waitForDead(pid, 10_000)).toBe(true);
+  }, 15_000);
+
+  it('an unconfirmable termination (grace expiry, child still alive) QUARANTINES too', async () => {
+    const pidFile = join(killClassifyTmp, 'cli3.pid');
+    const hungCli = join(killClassifyTmp, 'hung3.cjs');
+    writeFileSync(
+      hungCli,
+      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    let spawnedPid: number | undefined;
+    const run = createDefaultRunWrangler(killClassifyTmp, {
+      launcher: [process.execPath, hungCli],
+      onSpawnedChild: (child) => {
+        spawnedPid = child.pid;
+      },
+      timeoutMs: 250,
+      confirmKillGraceMs: 500,
+      // A killer that CLAIMS success but kills nothing: the group stays alive, so
+      // close/group-gone can never both be confirmed → quarantine at the grace expiry.
+      killProcessGroup: () => {},
+    });
+    let rejected: unknown;
+    try {
+      await run({ type: 'd1.list' }, { accountId: 'acct' });
+    } catch (error) {
+      rejected = error;
+    }
+    expect(rejected).toBeInstanceOf(WranglerQuarantineError);
+    expect((rejected as Error).message).toMatch(/could not be confirmed terminated within 500ms/);
+    expect((rejected as Error).message).toMatch(/intentionally RETAINED/);
+    // Clean up the real child the fake killer left alive.
+    const pid = spawnedPid!;
+    expect(pid).toBeTypeOf('number');
+    try {
+      process.kill(pid, 'SIGKILL');
+    } catch {
+      // already gone
+    }
+    expect(await waitForDead(pid, 10_000)).toBe(true);
+  }, 15_000);
+
+  it('an ESRCH kill (already gone) is treated as SUCCESS — settles as the timeout hard-failure, no kill-error text', async () => {
+    const pidFile = join(killClassifyTmp, 'cli2.pid');
+    const hungCli = join(killClassifyTmp, 'hung2.cjs');
+    writeFileSync(
+      hungCli,
+      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    let spawnedPid: number | undefined;
+    const run = createDefaultRunWrangler(killClassifyTmp, {
+      launcher: [process.execPath, hungCli],
+      onSpawnedChild: (child) => {
+        spawnedPid = child.pid;
+      },
+      timeoutMs: 300,
+      // Kill FOR REAL, then report ESRCH (the child exited in the race window) → treated as gone.
+      killProcessGroup: (target, signal) => {
+        process.kill(target, signal);
+        throw Object.assign(new Error('ESRCH: no such process'), { code: 'ESRCH' });
+      },
+    });
+    const result = await run({ type: 'd1.list' }, { accountId: 'acct' });
+    expect(result.signal).toBe('SIGKILL');
+    expect(result.status).not.toBe(0);
+    // ESRCH is NOT a kill failure — no "could not be killed" surfaced.
+    expect(result.stderr).not.toMatch(/could not be killed/);
+    expect(result.error).toBeNull();
+    const pid = spawnedPid!;
+    expect(pid).toBeTypeOf('number');
+    expect(await waitForDead(pid, 10_000)).toBe(true);
+  }, 15_000);
+
+  it('lock is released only AFTER confirmed child termination: a hung wrangler → provision rejects, child dead, mutex gone', async () => {
+    const cfgDir = join(killClassifyTmp, 'app');
+    mkdirSync(cfgDir, { recursive: true });
+    const cfgPath = join(cfgDir, 'wrangler.jsonc');
+    writeFileSync(cfgPath, JSON.stringify({ name: 'app', account_id: 'acct' }));
+    const pidFile = join(killClassifyTmp, 'prov-cli.pid');
+    const hungCli = join(killClassifyTmp, 'prov-hung.cjs');
+    writeFileSync(
+      hungCli,
+      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
+        `process.on('SIGTERM', () => {});\n` +
+        `setInterval(() => {}, 1 << 30);\n`,
+    );
+    let spawnedPid: number | undefined;
+    const runner = createDefaultRunWrangler(cfgDir, {
+      launcher: [process.execPath, hungCli],
+      onSpawnedChild: (child) => {
+        spawnedPid = child.pid;
+      },
+      timeoutMs: 400,
+    });
+    const lockMutex = `${realpathSync(cfgPath)}.void-provision.lock.lock`;
+    await expect(
+      provisionCloudflareResources(
+        cfgDir,
+        cfgPath,
+        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
+        { runWrangler: runner, log: silentLog },
+      ),
+    ).rejects.toThrow(/d1 list.*(failed|timeout)/s);
+    const pid = spawnedPid!;
+    expect(pid).toBeTypeOf('number');
+    expect(await waitForDead(pid, 5_000)).toBe(true);
+    expect(existsSync(lockMutex)).toBe(false);
+  }, 15_000);
+});
diff --git a/packages/void/test/unit/provision-test-shard.ts b/packages/void/test/unit/provision-test-shard.ts
deleted file mode 100644
index 1d77f6a2e..000000000
--- a/packages/void/test/unit/provision-test-shard.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-export type ProvisionTestShard =
-  | 'resources'
-  | 'locking'
-  | 'lock-durability'
-  | 'lock-recovery'
-  | 'runner-signals'
-  | 'runner-timeouts';
-
-const shardKey = '__voidProvisionTestShard';
-type ProvisionTestGlobal = typeof globalThis &
-  Record<typeof shardKey, ProvisionTestShard | undefined>;
-
-export async function runProvisionTestShard(shard: ProvisionTestShard): Promise<void> {
-  (globalThis as ProvisionTestGlobal)[shardKey] = shard;
-  await import('./provision.cases.ts');
-}
-
-export function getProvisionTestShard(): ProvisionTestShard {
-  const shard = (globalThis as ProvisionTestGlobal)[shardKey];
-  if (!shard) {
-    throw new Error('Provision test cases must be loaded through a shard entrypoint');
-  }
-  return shard;
-}
diff --git a/packages/void/test/unit/provision.cases.ts b/packages/void/test/unit/provision.cases.ts
deleted file mode 100644
index a7bb59a90..000000000
--- a/packages/void/test/unit/provision.cases.ts
+++ /dev/null
@@ -1,8369 +0,0 @@
-import {
-  existsSync,
-  mkdir,
-  mkdirSync,
-  mkdtempSync,
-  readdirSync,
-  readFileSync,
-  realpath,
-  realpathSync,
-  rmdir,
-  rmdirSync,
-  rmSync,
-  stat,
-  symlinkSync,
-  utimes,
-  utimesSync,
-  writeFileSync,
-} from 'node:fs';
-import { join } from 'node:path';
-import { types as nodeUtilTypes } from 'node:util';
-import { parse as parseJsoncRaw } from 'jsonc-parser';
-import { toSlash } from 'pathslash';
-import { afterEach, beforeEach, describe as vitestDescribe, expect, it } from 'vite-plus/test';
-import type { CloudflareOperation } from '../../../deploy-cloudflare/src/operations.ts';
-import {
-  operationFixtureArgs,
-  operationFixtureRequest,
-  operationFixtureResult,
-} from '../../../deploy-cloudflare/test/operation-fixture.ts';
-import { encodeCloudflareOperation } from '../../src/cli/cloudflare-process.ts';
-import {
-  acquireProvisionLock,
-  assertNoTransportRedirectInProjectDotenv,
-  checkCloudflareProvisionDrift,
-  createDefaultRunWrangler,
-  enableD1ReadReplicationViaApi,
-  isAlreadyGoneKillError,
-  normalizeRunWranglerResult,
-  provisionCloudflareResources as provisionCloudflareResourcesImpl,
-  provisionEnv,
-  resolveProperLockfileKey,
-  resolvePinnedApiBaseUrl,
-  WranglerQuarantineError,
-  type DesiredResourceSet,
-  type ProvisionOptions,
-  type RunWrangler,
-  type RunWranglerResult,
-} from '../../src/cli/provision.ts';
-import { materializeCloudflareConfig } from '../../src/cloudflare-config.ts';
-import { getProvisionTestShard, type ProvisionTestShard } from './provision-test-shard.ts';
-
-const activeTestShard = getProvisionTestShard();
-
-function shardForDescribe(name: string): ProvisionTestShard {
-  if (name.startsWith('normalizeRunWranglerResult')) {
-    return 'runner-signals';
-  }
-  if (name.startsWith('createDefaultRunWrangler')) {
-    return name.includes('hard timeout') || name.includes('confirmed child termination')
-      ? 'runner-timeouts'
-      : 'runner-signals';
-  }
-  if (name.startsWith('withListerDeadline') || name.includes('Hyperdrive lister deadline')) {
-    return 'runner-timeouts';
-  }
-  if (name.startsWith('acquireProvisionLock')) {
-    return name.includes('durable sidecar') || name.includes('sidecar DIRECTORY')
-      ? 'lock-durability'
-      : 'lock-recovery';
-  }
-  if (
-    name.includes('whole-provision cross-process lock') ||
-    name.includes('quarantine retains the whole-provision lock') ||
-    name.includes('dangling-symlink lock identity')
-  ) {
-    return 'locking';
-  }
-  return 'resources';
-}
-
-function describe(name: string, factory: () => void): void {
-  if (shardForDescribe(name) === activeTestShard) {
-    vitestDescribe(name, factory);
-  }
-}
-
-/**
- * A passthrough of proper-lockfile's callback-style fs seam (mkdir/stat/utimes/rmdir/
- * realpath + a sync rmdir). The unlock-failure test overrides `rmdir` on top of this.
- */
-const passthruFs = { mkdir, stat, utimes, rmdir, realpath, rmdirSync };
-
-const tmpDir = join(import.meta.dirname, `.tmp-provision-test-${activeTestShard}`);
-const wranglerPath = toSlash(join(tmpDir, 'wrangler.jsonc'));
-
-function setup(content: string): void {
-  rmSync(tmpDir, { recursive: true, force: true });
-  mkdirSync(tmpDir, { recursive: true });
-  writeFileSync(wranglerPath, content);
-}
-
-/**
- * The provisioner requires a resolvable Cloudflare account whenever `desired`
- * implies remote work (the boundary account fence), regardless of injected vs
- * default seams. Real deploys always have one (`CLOUDFLARE_ACCOUNT_ID` or a config
- * `account_id`); mirror that by pinning an ambient account for every test, so the
- * fence is satisfied without threading `accountId` through each call. Tests that
- * exercise the NO-account / reconciliation / different-account paths delete or
- * override it locally (and restore in their own finally / via `afterEach`).
- */
-const AMBIENT_ACCOUNT = 'ambient-test-account';
-let savedAmbientAccount: string | undefined;
-
-beforeEach(() => {
-  savedAmbientAccount = process.env.CLOUDFLARE_ACCOUNT_ID;
-  process.env.CLOUDFLARE_ACCOUNT_ID = AMBIENT_ACCOUNT;
-});
-
-afterEach(() => {
-  rmSync(tmpDir, { recursive: true, force: true });
-  if (savedAmbientAccount === undefined) {
-    delete process.env.CLOUDFLARE_ACCOUNT_ID;
-  } else {
-    process.env.CLOUDFLARE_ACCOUNT_ID = savedAmbientAccount;
-  }
-});
-
-function readConfig(): Record<string, unknown> {
-  return parseJsoncRaw(readFileSync(wranglerPath, 'utf-8')) as Record<string, unknown>;
-}
-
-/** Keep the established lock/race scenarios while provider calls use typed requests. */
-function provisionOperationFixture(
-  callback: (
-    args: Array<string>,
-    options: Parameters<RunWrangler>[1],
-  ) => RunWranglerResult | Promise<RunWranglerResult>,
-): RunWrangler {
-  return async (operation, options) => {
-    const args = operationFixtureArgs(operation);
-    if (operation.type === 'hyperdrive.create') {
-      args.splice(3, 0, '--connection-string=' + (options.input ?? ''));
-    }
-    const result = await callback(args, options);
-    const decoded = operationFixtureResult(result);
-    if (
-      operation.type === 'queues.info' &&
-      result.status !== 0 &&
-      result.stderr.includes('Queue "' + operation.name + '" does not exist.')
-    ) {
-      return { ...decoded, failure: 'not-found' };
-    }
-    return decoded;
-  };
-}
-
-/** A logger that swallows output (the default one prints to console). */
-const silentLog = { info: () => {}, warn: () => {} };
-
-type Handler = { match: RegExp; reply: (sub: string) => RunWranglerResult };
-
-/**
- * Build an injectable runWrangler stub that records every argv ARRAY. Handlers
- * match on the space-joined argv (regex convenience), but `calls` holds the exact
- * argv arrays so tests assert that untrusted values stay single, literal tokens.
- */
-function makeRunner(handlers: Array<Handler>): { run: RunWrangler; calls: Array<Array<string>> } {
-  const calls: Array<Array<string>> = [];
-  const run: RunWrangler = provisionOperationFixture((args) => {
-    calls.push(args);
-    const sub = args.join(' ');
-    for (const handler of handlers) {
-      if (handler.match.test(sub)) {
-        return handler.reply(sub);
-      }
-    }
-    return { stdout: '', stderr: '', status: 0 };
-  });
-  return { run, calls };
-}
-
-/** True when an argv array is a `wrangler <a> <b> …` invocation of a given kind. */
-function isCall(argv: Array<string>, ...prefix: Array<string>): boolean {
-  return prefix.every((token, i) => argv[i] === token);
-}
-
-const ok = (stdout = ''): RunWranglerResult => ({ stdout, stderr: '', status: 0 });
-const fail = (stdout: string, stderr = ''): RunWranglerResult => ({ stdout, stderr, status: 1 });
-
-// Valid-FORMAT synthetic ids for fixtures. The validators require REAL shapes:
-// D1 database_id is a hyphenated UUID; KV + Hyperdrive ids are 32-char lowercase hex.
-// ASCII-hex of the seed, zero-padded to 32 — deterministic, distinct, and ORDER-PRESERVING
-// on equal-length seeds (so lexicographic tie-break assertions stay valid).
-function hex32(seed: string): string {
-  const raw = Buffer.from(seed, 'utf8').toString('hex').slice(0, 32);
-  return (raw + '0'.repeat(32)).slice(0, 32);
-}
-function uuid(seed: string): string {
-  const h = hex32(seed);
-  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
-}
-
-/** Mimic `wrangler <res> create --update-config`: upsert a binding entry by binding. */
-function simulateUpdateConfig(
-  field: string,
-  entry: Record<string, unknown>,
-  path = wranglerPath,
-): void {
-  const cfg = parseJsoncRaw(readFileSync(path, 'utf-8')) as Record<string, unknown>;
-  const list = Array.isArray(cfg[field]) ? (cfg[field] as Array<Record<string, unknown>>) : [];
-  const index = list.findIndex((e) => e.binding === entry.binding);
-  if (index >= 0) {
-    list[index] = { ...list[index], ...entry };
-  } else {
-    list.push(entry);
-  }
-  cfg[field] = list;
-  writeFileSync(path, `${JSON.stringify(cfg, null, 2)}\n`);
-}
-
-const emptyDesired: DesiredResourceSet = { kvNamespaces: [], queues: [] };
-
-// Resource tests inject Wrangler transport; keep their remote D1 update local too.
-// Tests of the actual API path call the implementation directly.
-function provisionCloudflareResources(
-  ...args: Parameters<typeof provisionCloudflareResourcesImpl>
-): ReturnType<typeof provisionCloudflareResourcesImpl> {
-  const [root, configPath, desired, opts] = args;
-  const replicationStub: ProvisionOptions['enableD1ReadReplication'] = async () => {};
-  return provisionCloudflareResourcesImpl(root, configPath, desired, {
-    ...opts,
-    enableD1ReadReplication:
-      opts?.enableD1ReadReplication ?? (opts?.runWrangler ? replicationStub : undefined),
-  });
-}
-
-describe('D1 read-replication API', () => {
-  it('uses the pinned account and endpoint with an authenticated update', async () => {
-    const requests: Array<{ url: string; init: RequestInit }> = [];
-    await enableD1ReadReplicationViaApi(
-      {
-        accountId: 'account-one',
-        apiBaseUrl: 'https://api.example.test/client/v4',
-        databaseId: uuid('db1'),
-      },
-      'token-one',
-      async (url, init) => {
-        requests.push({ url: String(url), init: init! });
-        return Response.json({ success: true });
-      },
-    );
-
-    expect(requests).toHaveLength(1);
-    expect(requests[0].url).toBe(
-      `https://api.example.test/client/v4/accounts/account-one/d1/database/${uuid('db1')}`,
-    );
-    expect(requests[0].init.method).toBe('PUT');
-    expect(requests[0].init.headers).toEqual({
-      Authorization: 'Bearer token-one',
-      'Content-Type': 'application/json',
-    });
-    expect(requests[0].init.body).toBe(JSON.stringify({ read_replication: { mode: 'auto' } }));
-  });
-
-  it('fails closed when Cloudflare rejects the replication update', async () => {
-    const update = enableD1ReadReplicationViaApi(
-      {
-        accountId: 'account-one',
-        apiBaseUrl: 'https://api.example.test/client/v4',
-        databaseId: uuid('db1'),
-      },
-      'secret-token',
-      async () => Response.json({ success: false }, { status: 403 }),
-    );
-
-    await expect(update).rejects.toThrow(/D1 Edit permission/);
-  });
-});
-
-describe('provisionCloudflareResources — typed operations', () => {
-  it('sends a Hyperdrive connection only through stdin while literal public targets stay structured', async () => {
-    setup('{}');
-    const connection = 'postgres://user:synthetic-password@host/database';
-    const operations: Array<CloudflareOperation> = [];
-    const inputs: Array<string | undefined> = [];
-    const run: RunWrangler = (operation, options) => {
-      operations.push(operation);
-      inputs.push(options.input);
-      simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('typed') });
-      return ok();
-    };
-    await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { name: 'typed-hd', binding: 'HYPERDRIVE', connectionString: connection },
-      },
-      { runWrangler: run, listHyperdriveConfigs: async () => [], log: silentLog },
-    );
-    expect(operations).toEqual([
-      {
-        type: 'hyperdrive.create',
-        name: 'typed-hd',
-        binding: 'HYPERDRIVE',
-        configPath: wranglerPath,
-      },
-    ]);
-    expect(inputs).toEqual([connection]);
-    expect(JSON.stringify(operations)).not.toContain('synthetic-password');
-    const encoded = encodeCloudflareOperation(operations[0]!);
-    expect(encoded).toHaveLength(1);
-    expect(encoded.join(' ')).not.toContain('synthetic-password');
-    expect(JSON.parse(encoded[0]!)).toEqual(operations[0]);
-  });
-
-  it('adopts structured Queue identity despite misleading human prose', async () => {
-    setup('{}');
-    const operations: Array<CloudflareOperation> = [];
-    const run: RunWrangler = (operation) => {
-      operations.push(operation);
-      return {
-        status: 0,
-        stdout: 'Queue "typed-jobs" does not exist.',
-        stderr: '',
-        data: { name: 'typed-jobs' },
-      };
-    };
-    await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, queues: ['typed-jobs'] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(operations).toEqual([
-      { type: 'queues.info', name: 'typed-jobs', configPath: wranglerPath },
-    ]);
-  });
-
-  it('creates a Queue from a structured not-found result and verifies the new identity', async () => {
-    setup('{}');
-    const operations: Array<CloudflareOperation> = [];
-    let created = false;
-    const run: RunWrangler = (operation) => {
-      operations.push(operation);
-      if (operation.type === 'queues.create') {
-        created = true;
-        return ok();
-      }
-      return created
-        ? { ...ok(), data: { name: 'typed-jobs' } }
-        : { status: 1, stdout: '', stderr: 'Provider presentation changed.', failure: 'not-found' };
-    };
-    await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, queues: ['typed-jobs'] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(operations.map((operation) => operation.type)).toEqual([
-      'queues.info',
-      'queues.create',
-      'queues.info',
-    ]);
-  });
-
-  it('rejects signal provenance even when structured D1 data looks valid', async () => {
-    setup('{}');
-    const run: RunWrangler = () => ({
-      status: 0,
-      stdout: '',
-      stderr: '',
-      data: [],
-      signal: 'SIGTERM',
-    });
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { name: 'typed-db', binding: 'DB' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/SIGTERM|failed|invalid/);
-  });
-});
-
-describe('provisionCloudflareResources — read-first', () => {
-  it('enables D1 replication for a reused database before continuing the deploy', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
-      }),
-    );
-    const enabled: Array<unknown> = [];
-    const { run } = makeRunner([]);
-
-    await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      {
-        runWrangler: run,
-        log: silentLog,
-        enableD1ReadReplication: async (context: unknown) => {
-          enabled.push(context);
-        },
-      },
-    );
-
-    expect(enabled).toEqual([
-      {
-        databaseId: uuid('db1'),
-        accountId: AMBIENT_ACCOUNT,
-        apiBaseUrl: 'https://api.cloudflare.com/client/v4',
-      },
-    ]);
-  });
-
-  it('does not skip replication when the Wrangler runner is injected', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
-      }),
-    );
-    const requests: Array<string> = [];
-    const originalFetch = globalThis.fetch;
-    globalThis.fetch = async (input) => {
-      requests.push(String(input));
-      return Response.json({ success: true });
-    };
-    try {
-      const { run } = makeRunner([]);
-      await provisionCloudflareResourcesImpl(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, apiToken: 'test-token', log: silentLog },
-      );
-      expect(requests).toEqual([
-        `https://api.cloudflare.com/client/v4/accounts/${AMBIENT_ACCOUNT}/d1/database/${uuid('db1')}`,
-      ]);
-    } finally {
-      globalThis.fetch = originalFetch;
-    }
-  });
-
-  it('skips D1 create when the binding already has a real database_id (records reused, no wrangler call)', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    // Read-first: no wrangler invocation at all (migrations_dir is filled via the writer).
-    expect(calls).toEqual([]);
-    expect(result.resources).toEqual([
-      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'reused', id: uuid('db1') },
-    ]);
-  });
-
-  it('does NOT treat a placeholder database_id ("local") as real — proceeds to provision', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
-      }),
-    );
-    const { run, calls } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('created'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls[0]).toEqual(['d1', 'list', '--json', '-c', wranglerPath, '--env=']);
-    expect(result.resources[0].action).toBe('created');
-  });
-});
-
-describe('provisionCloudflareResources — argv injection safety', () => {
-  it('passes a Hyperdrive connection string with shell metacharacters as ONE literal argv element', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    // & $ ; and a space would all split/inject under a shell — must stay one token.
-    const conn = 'postgres://u:p@h/db?sslmode=require&opt=$X;DROP TABLE t';
-    const { run, calls } = makeRunner([
-      {
-        match: /^hyperdrive create /,
-        reply: () => {
-          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('newhd') });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-      },
-      { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-    );
-    const createCall = calls.find((c) => isCall(c, 'hyperdrive', 'create'));
-    expect(createCall).toEqual([
-      'hyperdrive',
-      'create',
-      'myapp-hd',
-      `--connection-string=${conn}`,
-      '--binding',
-      'HYPERDRIVE',
-      '--update-config',
-      '-c',
-      wranglerPath,
-      '--env=',
-    ]);
-    // The whole connection string (with & $ ; and a space) is a SINGLE element.
-    expect(createCall!.filter((t) => t.includes('DROP TABLE t'))).toHaveLength(1);
-    expect(result.resources[0].action).toBe('created');
-  });
-
-  it('passes a config path containing spaces as ONE literal argv element (no shell splitting)', async () => {
-    const spacedDir = join(import.meta.dirname, '.tmp provision space');
-    const spacedPath = join(spacedDir, 'wrangler.jsonc');
-    rmSync(spacedDir, { recursive: true, force: true });
-    mkdirSync(spacedDir, { recursive: true });
-    writeFileSync(spacedPath, JSON.stringify({ name: 'app' }));
-    try {
-      const { run, calls } = makeRunner([
-        { match: /^d1 list --json/, reply: () => ok('[]') },
-        {
-          match: /^d1 create /,
-          reply: () => {
-            simulateUpdateConfig(
-              'd1_databases',
-              { binding: 'DB', database_name: 'myapp-db', database_id: uuid('created') },
-              spacedPath,
-            );
-            return ok();
-          },
-        },
-      ]);
-      const result = await provisionCloudflareResources(
-        spacedDir,
-        spacedPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      );
-      const createCall = calls.find((c) => isCall(c, 'd1', 'create'));
-      expect(spacedPath).toContain(' ');
-      // The spaced path is the FINAL single element (a shell would have split it).
-      expect(createCall).toEqual([
-        'd1',
-        'create',
-        'myapp-db',
-        '--binding',
-        'DB',
-        '--update-config',
-        '-c',
-        toSlash(spacedPath),
-        '--env=',
-      ]);
-      expect(result.resources[0].action).toBe('created');
-    } finally {
-      rmSync(spacedDir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe('provisionCloudflareResources — config discovery (fail closed, single file)', () => {
-  it('reads a BOM-prefixed config correctly — ids found, no re-provision', async () => {
-    setup(
-      '' +
-        JSON.stringify({
-          d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
-        }),
-    );
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    // A BOM must NOT defeat read-first (a fail-open-to-{} parse would re-provision).
-    expect(calls.some((c) => c[0] === 'd1')).toBe(false);
-    expect(result.resources[0]).toMatchObject({ kind: 'd1', action: 'reused', id: uuid('db1') });
-    // BOM survives the writer's migrations_dir fill.
-    expect(readFileSync(wranglerPath, 'utf-8').charCodeAt(0)).toBe(0xfeff);
-  });
-
-  it('fails closed on a malformed root config — throws, no wrangler calls, no write', async () => {
-    const malformed = '{ "name": "x" "d1_databases": [] }'; // missing comma
-    setup(malformed);
-    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/not valid JSON/);
-    expect(calls).toEqual([]);
-    expect(readFileSync(wranglerPath, 'utf-8')).toBe(malformed);
-  });
-
-  it('reads and writes the SAME single resolved file when both wrangler.json and wrangler.jsonc exist', async () => {
-    rmSync(tmpDir, { recursive: true, force: true });
-    mkdirSync(tmpDir, { recursive: true });
-    const jsoncPath = join(tmpDir, 'wrangler.jsonc');
-    const jsonPath = join(tmpDir, 'wrangler.json');
-    // The caller pins wrangler.json; the OLD writer rediscovered .jsonc → split-brain.
-    writeFileSync(jsonPath, JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
-    writeFileSync(jsoncPath, JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
-    const { run } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      jsonPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.configPath).toBe(toSlash(jsonPath));
-    // The adopted id landed in the passed file (wrangler.json) — NOT split into .jsonc.
-    const jsonAfter = parseJsoncRaw(readFileSync(jsonPath, 'utf-8')) as Record<string, unknown>;
-    expect((jsonAfter.kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe(hex32('kv'));
-    // wrangler.jsonc is untouched (still the placeholder).
-    const jsoncAfter = parseJsoncRaw(readFileSync(jsoncPath, 'utf-8')) as Record<string, unknown>;
-    expect((jsoncAfter.kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe('local');
-  });
-});
-
-describe('provisionCloudflareResources — D1', () => {
-  it('creates a missing D1 with --update-config then writes migrations_dir', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('created'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['d1', 'list', '--json', '-c', wranglerPath, '--env='],
-      [
-        'd1',
-        'create',
-        'myapp-db',
-        '--binding',
-        'DB',
-        '--update-config',
-        '-c',
-        wranglerPath,
-        '--env=',
-      ],
-    ]);
-    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
-    expect(d1).toEqual([
-      {
-        binding: 'DB',
-        database_name: 'myapp-db',
-        database_id: uuid('created'),
-        migrations_dir: './db/migrations',
-      },
-    ]);
-    expect(result.resources).toEqual([
-      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'created' },
-    ]);
-  });
-
-  it('repairs a missing migrations_dir on the read-first reused path (retry convergence, no duplicate D1)', async () => {
-    // Simulates a prior run that created the D1 (real id written) then crashed
-    // before migrations_dir. The retry takes read-first → reused and must still
-    // fill migrations_dir — without re-creating (no duplicate D1).
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]); // read-first — no create, no list
-    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
-    expect(d1).toHaveLength(1); // no duplicate D1 minted
-    expect(d1[0]).toEqual({
-      binding: 'DB',
-      database_name: 'myapp-db',
-      database_id: uuid('db1'),
-      migrations_dir: './db/migrations',
-    });
-    expect(result.resources).toEqual([
-      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'reused', id: uuid('db1') },
-    ]);
-  });
-
-  it('adopts an existing D1 found in the account (list hit) — no create, writes id + migrations_dir', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
-      }),
-    );
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () => ok(JSON.stringify([{ uuid: uuid('existing'), name: 'myapp-db' }])),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([['d1', 'list', '--json', '-c', wranglerPath, '--env=']]);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
-    expect(d1).toEqual([
-      {
-        binding: 'DB',
-        database_name: 'myapp-db',
-        database_id: uuid('existing'),
-        migrations_dir: './db/migrations',
-      },
-    ]);
-    expect(result.resources).toEqual([
-      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'adopted', id: uuid('existing') },
-    ]);
-  });
-
-  it('treats a create-time 7502 (already exists) as adopt — captures the id via d1 info', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
-      }),
-    );
-    const { run, calls } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => fail('', 'X [ERROR] A database with that name already exists [code: 7502]'),
-      },
-      {
-        match: /^d1 info myapp-db --json/,
-        reply: () => ok(JSON.stringify({ uuid: uuid('raced'), name: 'myapp-db' })),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['d1', 'list', '--json', '-c', wranglerPath, '--env='],
-      [
-        'd1',
-        'create',
-        'myapp-db',
-        '--binding',
-        'DB',
-        '--update-config',
-        '-c',
-        wranglerPath,
-        '--env=',
-      ],
-      ['d1', 'info', 'myapp-db', '--json', '-c', wranglerPath, '--env='],
-    ]);
-    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
-    expect(d1[0]).toMatchObject({ binding: 'DB', database_id: uuid('raced') });
-    expect(result.resources[0]).toEqual({
-      kind: 'd1',
-      binding: 'DB',
-      name: 'myapp-db',
-      action: 'adopted',
-      id: uuid('raced'),
-    });
-  });
-
-  it('throws on a non-7502 create failure', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/d1 create myapp-db.*failed/s);
-  });
-});
-
-describe('provisionCloudflareResources — D1 discovery gate + strict validation', () => {
-  const d1Desired: DesiredResourceSet = {
-    ...emptyDesired,
-    d1: { binding: 'DB', name: 'myapp-db' },
-  };
-
-  it('fails closed (no create) when `d1 list` exits non-zero', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
-        runWrangler: run,
-        log: silentLog,
-      }),
-    ).rejects.toThrow(/d1 list.*failed/s);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-    expect(readConfig().d1_databases).toBeUndefined();
-  });
-
-  it('fails closed (no create) on a SIGTERM-killed `d1 list` (normalized to non-zero)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const killed = normalizeRunWranglerResult({
-      stdout: '',
-      stderr: '',
-      status: null,
-      signal: 'SIGTERM',
-    });
-    const { run, calls } = makeRunner([{ match: /^d1 list --json/, reply: () => killed }]);
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
-        runWrangler: run,
-        log: silentLog,
-      }),
-    ).rejects.toThrow(/d1 list.*failed/s);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('fails closed (no create) on a spawn-error `d1 list` (normalized to non-zero)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const errored = normalizeRunWranglerResult({
-      status: null,
-      error: new Error('spawn wrangler ENOENT'),
-    });
-    const { run, calls } = makeRunner([{ match: /^d1 list --json/, reply: () => errored }]);
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
-        runWrangler: run,
-        log: silentLog,
-      }),
-    ).rejects.toThrow(/d1 list.*failed/s);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('fails closed (no create) when `d1 list` returns truncated JSON (status 0)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[{ "uuid": "a", "name": "myapp-db"') },
-    ]);
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
-        runWrangler: run,
-        log: silentLog,
-      }),
-    ).rejects.toThrow(/did not return a JSON array/);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('fails closed (no create) when a `d1 list` member is malformed — even when it IS the target name', async () => {
-    // The target-named member carries NO id → it must NOT be filtered to a false
-    // "absent" that mints a duplicate D1.
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok(JSON.stringify([{ name: 'myapp-db' }])) },
-    ]);
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
-        runWrangler: run,
-        log: silentLog,
-      }),
-    ).rejects.toThrow(/D1 database named "myapp-db" with no valid id/);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('fails closed (no adopt/write) when the collision `d1 info` exits non-zero', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      { match: /^d1 create /, reply: () => fail('', 'X [ERROR] already exists [code: 7502]') },
-      {
-        match: /^d1 info myapp-db --json/,
-        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, d1Desired, {
-        runWrangler: run,
-        log: silentLog,
-      }),
-    ).rejects.toThrow(/d1 info myapp-db.*failed/s);
-    // The 7502 create wrote nothing, and the failed info produced no adopt/write.
-    expect(readConfig().d1_databases).toBeUndefined();
-  });
-});
-
-describe('provisionCloudflareResources — KV', () => {
-  it('retains a created namespace when typed config is materialized again', async () => {
-    setup('{}');
-    rmSync(wranglerPath);
-    writeFileSync(
-      join(tmpDir, 'void.config.ts'),
-      `export default { cloudflare: { name: 'app', account_id: '${AMBIENT_ACCOUNT}' } };\n`,
-    );
-    const generatedPath = materializeCloudflareConfig(tmpDir);
-    const namespaceId = hex32('newkv');
-    const { run } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      {
-        match: /^kv namespace create /,
-        reply: () => {
-          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: namespaceId }, generatedPath);
-          return ok();
-        },
-      },
-    ]);
-
-    await provisionCloudflareResources(
-      tmpDir,
-      generatedPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'app-kv' }] },
-      { runWrangler: run, log: silentLog },
-    );
-
-    const lock = JSON.parse(readFileSync(join(tmpDir, 'void.lock.json'), 'utf8')) as {
-      resolved: { kv_namespaces: Array<{ binding: string; id: string }> };
-    };
-    expect(lock.resolved.kv_namespaces).toEqual([{ binding: 'KV', id: namespaceId }]);
-    materializeCloudflareConfig(tmpDir);
-    const generated = parseJsoncRaw(readFileSync(generatedPath, 'utf8')) as Record<string, unknown>;
-    expect(generated.kv_namespaces).toEqual([{ binding: 'KV', id: namespaceId }]);
-  });
-
-  it('adopts when the namespace list shows a title match (writes id, no create)', async () => {
-    setup(JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([['kv', 'namespace', 'list', '-c', wranglerPath, '--env=']]);
-    const kv = readConfig().kv_namespaces as Array<Record<string, unknown>>;
-    expect(kv).toEqual([{ binding: 'KV', id: hex32('kv') }]);
-    expect(result.resources).toEqual([
-      { kind: 'kv', binding: 'KV', name: 'myapp-kv', action: 'adopted', id: hex32('kv') },
-    ]);
-  });
-
-  it('creates when the namespace list is empty', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      {
-        match: /^kv namespace create /,
-        reply: () => {
-          simulateUpdateConfig('kv_namespaces', { binding: 'ISR_CACHE', id: hex32('newkv') });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'ISR_CACHE', title: 'myapp-isr' }] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['kv', 'namespace', 'list', '-c', wranglerPath, '--env='],
-      [
-        'kv',
-        'namespace',
-        'create',
-        'myapp-isr',
-        '--binding',
-        'ISR_CACHE',
-        '--update-config',
-        '-c',
-        wranglerPath,
-        '--env=',
-      ],
-    ]);
-    expect(result.resources).toEqual([
-      { kind: 'kv', binding: 'ISR_CACHE', name: 'myapp-isr', action: 'created' },
-    ]);
-  });
-
-  it('fails closed (no create) when `kv namespace list` exits non-zero', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/kv namespace list.*failed/s);
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
-  });
-
-  it('fails closed (no create) when `kv namespace list` returns non-JSON output', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('not a json list at all') },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/did not return a JSON array/);
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
-  });
-
-  it('fails closed (no create) when `kv namespace list` output is truncated', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('[{ "id": "a", "title": "myapp-kv"') },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/did not return a JSON array/);
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
-  });
-
-  it('picks the lexicographically-smallest id and warns on multiple title matches', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const warnings: Array<string> = [];
-    const { run } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () =>
-          ok(
-            JSON.stringify([
-              { id: hex32('zzz'), title: 'myapp-kv' },
-              { id: hex32('aaa'), title: 'myapp-kv' },
-              { id: hex32('mmm'), title: 'other' },
-            ]),
-          ),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-      { runWrangler: run, log: { info: () => {}, warn: (m) => warnings.push(m) } },
-    );
-    // hex32 is order-preserving on equal-length seeds, so hex32('aaa') < hex32('zzz').
-    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: hex32('aaa') });
-    expect((readConfig().kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe(hex32('aaa'));
-    expect(
-      warnings.some((w) => w.includes('multiple KV namespaces') && w.includes(hex32('aaa'))),
-    ).toBe(true);
-  });
-
-  it('provisions each KV binding independently (ISR_CACHE + app KV)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      {
-        match: /^kv namespace create /,
-        reply: (sub) => {
-          const binding = sub.includes('ISR_CACHE') ? 'ISR_CACHE' : 'KV';
-          simulateUpdateConfig('kv_namespaces', { binding, id: hex32(binding) });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        kvNamespaces: [
-          { binding: 'KV', title: 'myapp-kv' },
-          { binding: 'ISR_CACHE', title: 'myapp-isr' },
-        ],
-      },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources.map((r) => r.action)).toEqual(['created', 'created']);
-    const kv = readConfig().kv_namespaces as Array<Record<string, unknown>>;
-    expect(kv.map((e) => e.binding).sort()).toEqual(['ISR_CACHE', 'KV']);
-    expect(calls.filter((c) => isCall(c, 'kv', 'namespace', 'create'))).toHaveLength(2);
-  });
-});
-
-describe('provisionCloudflareResources — account_id', () => {
-  it('writes top-level account_id via the writer when provided', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([]);
-    const result = await provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
-      runWrangler: run,
-      accountId: 'acc-123',
-      log: silentLog,
-    });
-    expect(readConfig().account_id).toBe('acc-123');
-    expect(result.accountIdWritten).toBe(true);
-  });
-
-  it('does not write account_id when not provided (and none resolvable)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    // Truly no account anywhere: clear the ambient the harness pins. emptyDesired
-    // implies NO remote work, so the fence does not fire and nothing is persisted.
-    const prev = process.env.CLOUDFLARE_ACCOUNT_ID;
-    delete process.env.CLOUDFLARE_ACCOUNT_ID;
-    try {
-      const { run } = makeRunner([]);
-      const result = await provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
-        runWrangler: run,
-        log: silentLog,
-      });
-      expect(readConfig().account_id).toBeUndefined();
-      expect(result.accountIdWritten).toBe(false);
-    } finally {
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = prev;
-      }
-    }
-  });
-});
-
-describe('provisionCloudflareResources — idempotent re-run', () => {
-  it('a second run after adoption is a read-first no-op (byte-identical config, no wrangler calls)', async () => {
-    setup(JSON.stringify({ kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
-    const first = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
-      },
-    ]);
-    const desired: DesiredResourceSet = {
-      ...emptyDesired,
-      kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
-    };
-    await provisionCloudflareResources(tmpDir, wranglerPath, desired, {
-      runWrangler: first.run,
-      log: silentLog,
-    });
-    const afterFirst = readFileSync(wranglerPath, 'utf-8');
-
-    const second = makeRunner([]);
-    const result = await provisionCloudflareResources(tmpDir, wranglerPath, desired, {
-      runWrangler: second.run,
-      log: silentLog,
-    });
-    expect(second.calls).toEqual([]);
-    expect(result.resources).toEqual([
-      { kind: 'kv', binding: 'KV', name: 'myapp-kv', action: 'reused', id: hex32('kv') },
-    ]);
-    expect(readFileSync(wranglerPath, 'utf-8')).toBe(afterFirst);
-  });
-});
-
-describe('provisionCloudflareResources — R2', () => {
-  it('reuses when the bucket_name is already real (no wrangler call)', async () => {
-    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'myapp-uploads' }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources).toEqual([
-      { kind: 'r2', binding: 'STORAGE', name: 'myapp-uploads', action: 'reused' },
-    ]);
-  });
-
-  it('adopts an existing bucket via `r2 bucket info` (status 0) — writes the entry, no create', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info myapp-uploads --json/,
-        reply: () => ok(JSON.stringify({ name: 'myapp-uploads', created: 'x' })),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['r2', 'bucket', 'info', 'myapp-uploads', '--json', '-c', wranglerPath, '--env='],
-    ]);
-    expect(readConfig().r2_buckets).toEqual([{ binding: 'STORAGE', bucket_name: 'myapp-uploads' }]);
-    expect(result.resources).toEqual([
-      { kind: 'r2', binding: 'STORAGE', name: 'myapp-uploads', action: 'adopted' },
-    ]);
-  });
-
-  it('creates the bucket when `r2 bucket info` reports it does not exist', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'X [ERROR] The specified bucket does not exist [code: 10006]'),
-      },
-      {
-        match: /^r2 bucket create /,
-        reply: () => {
-          simulateUpdateConfig('r2_buckets', {
-            binding: 'STORAGE',
-            bucket_name: 'myapp-uploads',
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['r2', 'bucket', 'info', 'myapp-uploads', '--json', '-c', wranglerPath, '--env='],
-      [
-        'r2',
-        'bucket',
-        'create',
-        'myapp-uploads',
-        '--binding',
-        'STORAGE',
-        '--update-config',
-        '-c',
-        wranglerPath,
-        '--env=',
-      ],
-    ]);
-    expect(result.resources).toEqual([
-      { kind: 'r2', binding: 'STORAGE', name: 'myapp-uploads', action: 'created' },
-    ]);
-  });
-
-  it('creates the bucket on a confirmed not-found signal (CF code 10006)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () =>
-          fail('', 'X [ERROR] The bucket you tried to access is not present [code: 10006]'),
-      },
-      {
-        match: /^r2 bucket create /,
-        reply: () => {
-          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'myapp-uploads' });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(true);
-    expect(result.resources[0].action).toBe('created');
-  });
-
-  it('does NOT create on an R2 info failure that is not a confirmed not-found (auth/metrics) — surfaces the error', async () => {
-    // wrangler 4.131 `r2 bucket info` also runs a metrics/GraphQL query, so an
-    // EXISTING bucket can exit non-zero on an auth/metrics failure. The prior
-    // "auth error → create" behavior is REVERSED: never create on such a signal.
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/r2 bucket info myapp-uploads.*(failed|refusing)/s);
-    // No create attempted (the existing bucket must not be duplicated/errored on).
-    expect(calls).toEqual([
-      ['r2', 'bucket', 'info', 'myapp-uploads', '--json', '-c', wranglerPath, '--env='],
-    ]);
-  });
-});
-
-describe('provisionCloudflareResources — Hyperdrive', () => {
-  it('reuses when the hyperdrive binding already has a real id (no wrangler call)', async () => {
-    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: hex32('hd') }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-      },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources).toEqual([
-      {
-        kind: 'hyperdrive',
-        binding: 'HYPERDRIVE',
-        name: 'myapp-hd',
-        action: 'reused',
-        id: hex32('hd'),
-      },
-    ]);
-  });
-
-  it('adopts an existing Hyperdrive config found by name — writes id via the writer, no create', async () => {
-    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-      },
-      {
-        runWrangler: run,
-        log: silentLog,
-        listHyperdriveConfigs: async () => [
-          { id: hex32('other-hd'), name: 'someone-else' },
-          { id: hex32('existing'), name: 'myapp-hd' },
-        ],
-      },
-    );
-    // No wrangler create — existence via the injected REST seam, id via the writer.
-    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-    const hd = readConfig().hyperdrive as Array<Record<string, unknown>>;
-    expect(hd).toEqual([{ binding: 'HYPERDRIVE', id: hex32('existing') }]);
-    expect(result.resources).toEqual([
-      {
-        kind: 'hyperdrive',
-        binding: 'HYPERDRIVE',
-        name: 'myapp-hd',
-        action: 'adopted',
-        id: hex32('existing'),
-      },
-    ]);
-  });
-
-  it('creates the config when confirmed absent and a connection string is present', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^hyperdrive create /,
-        reply: () => {
-          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('newhd') });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: {
-          binding: 'HYPERDRIVE',
-          name: 'myapp-hd',
-          connectionString: 'postgres://u:p@h/db',
-        },
-      },
-      { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-    );
-    expect(calls).toEqual([
-      [
-        'hyperdrive',
-        'create',
-        'myapp-hd',
-        '--connection-string=postgres://u:p@h/db',
-        '--binding',
-        'HYPERDRIVE',
-        '--update-config',
-        '-c',
-        wranglerPath,
-        '--env=',
-      ],
-    ]);
-    expect(result.resources).toEqual([
-      { kind: 'hyperdrive', binding: 'HYPERDRIVE', name: 'myapp-hd', action: 'created' },
-    ]);
-  });
-
-  it('fails closed when existence is ambiguous (check throws) and a connection string is present — no create', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: {
-            binding: 'HYPERDRIVE',
-            name: 'myapp-hd',
-            connectionString: 'postgres://u:p@h/db',
-          },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => {
-            throw new Error('network down');
-          },
-        },
-      ),
-    ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
-    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-  });
-
-  it('still skips (structured, never creates) when a lister can look but finds nothing', async () => {
-    // A lister IS available, so this run COULD have adopted a same-named config; it
-    // just did not find one. Nothing can be minted without a connection string, so the
-    // structured skip — not a throw — remains the right report for that outcome.
-    setup(JSON.stringify({ name: 'app' }));
-    const warnings: Array<string> = [];
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-      },
-      {
-        accountId: 'acct',
-        runWrangler: run,
-        listHyperdriveConfigs: async () => [],
-        log: { info: () => {}, warn: (m) => warnings.push(m) },
-      },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources).toEqual([
-      {
-        kind: 'hyperdrive',
-        binding: 'HYPERDRIVE',
-        name: 'myapp-hd',
-        action: 'skipped',
-        reason: 'no connection string provided',
-      },
-    ]);
-    expect(warnings.some((w) => w.includes('skipping Hyperdrive'))).toBe(true);
-  });
-
-  it('adopts a same-named config with NO connection string (adoption never needs one)', async () => {
-    // Guards the stringless fail-closed fence from over-reaching: a run with no
-    // connection string whose lister DOES find a match must still adopt, not throw.
-    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-      },
-      {
-        accountId: 'acct',
-        runWrangler: run,
-        listHyperdriveConfigs: async () => [{ id: hex32('adopted'), name: 'myapp-hd' }],
-        log: silentLog,
-      },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources).toEqual([
-      {
-        kind: 'hyperdrive',
-        binding: 'HYPERDRIVE',
-        name: 'myapp-hd',
-        action: 'adopted',
-        id: hex32('adopted'),
-      },
-    ]);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Hyperdrive needs a Cloudflare API token for its existence check, because
-// wrangler exposes no machine-readable Hyperdrive list. `wrangler login` (OAuth)
-// covers every OTHER resource, so the missing token has to be reported UP FRONT
-// with the exact remedy — not discovered after D1/KV/R2 were already created.
-// ---------------------------------------------------------------------------
-
-describe('provisionCloudflareResources — Hyperdrive API token requirement', () => {
-  let savedToken: string | undefined;
-  beforeEach(() => {
-    savedToken = process.env.CLOUDFLARE_API_TOKEN;
-    delete process.env.CLOUDFLARE_API_TOKEN;
-  });
-  afterEach(() => {
-    if (savedToken === undefined) {
-      delete process.env.CLOUDFLARE_API_TOKEN;
-    } else {
-      process.env.CLOUDFLARE_API_TOKEN = savedToken;
-    }
-  });
-
-  it('fails with an actionable token error BEFORE any account mutation when the config has no id', async () => {
-    // A first-time Postgres provision under `wrangler login` (OAuth, no token): the
-    // Hyperdrive id is not in the config yet and there is no way to check the account,
-    // so the run must stop before the D1 database beside it is created.
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          d1: { binding: 'DB', name: 'myapp-db' },
-          hyperdrive: {
-            binding: 'HYPERDRIVE',
-            name: 'myapp-hd',
-            connectionString: 'postgres://u:p@h/db',
-          },
-        },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/CLOUDFLARE_API_TOKEN/);
-    // Nothing ran: no `d1 create`, no Hyperdrive call — the account is untouched.
-    expect(calls).toEqual([]);
-    // The config was not touched either (no account_id pin, no new entries).
-    expect(readConfig()).toEqual({ name: 'app' });
-  });
-
-  it('names the two remedies: export a token, or put an existing Hyperdrive id in the config', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([]);
-    const error = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: {
-          binding: 'HYPERDRIVE',
-          name: 'myapp-hd',
-          connectionString: 'postgres://u:p@h/db',
-        },
-      },
-      { runWrangler: run, log: silentLog },
-    ).catch((e: unknown) => e as Error);
-    expect(error).toBeInstanceOf(Error);
-    const message = (error as Error).message;
-    expect(message).toContain('CLOUDFLARE_API_TOKEN');
-    expect(message).toContain('Hyperdrive');
-    // Explains WHY a token is needed where `wrangler login` suffices elsewhere.
-    expect(message).toMatch(/no machine-readable/i);
-    // Remedy 2: create the config yourself and paste its id into wrangler.jsonc.
-    expect(message).toContain(wranglerPath);
-    expect(message).toMatch(/wrangler login|OAuth/i);
-    // The connection string is never echoed into the error.
-    expect(message).not.toContain('postgres://');
-  });
-
-  it('proceeds with NO token when the Hyperdrive id is already in the config (no REST call)', async () => {
-    // The read-first path is pure config I/O: an already-provisioned Postgres app
-    // deploys fine under `wrangler login` alone.
-    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: hex32('hd') }] }));
-    const { run, calls } = makeRunner([]);
-    const fetchUrls: Array<string> = [];
-    const origFetch = globalThis.fetch;
-    globalThis.fetch = (async (url: string | URL) => {
-      fetchUrls.push(String(url));
-      throw new Error('the read-first path must not reach the network');
-    }) as typeof fetch;
-    let result;
-    try {
-      result = await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: {
-            binding: 'HYPERDRIVE',
-            name: 'myapp-hd',
-            connectionString: 'postgres://u:p@h/db',
-          },
-        },
-        { runWrangler: run, log: silentLog },
-      );
-    } finally {
-      globalThis.fetch = origFetch;
-    }
-    expect(fetchUrls).toEqual([]);
-    expect(calls).toEqual([]);
-    expect(result.resources).toEqual([
-      {
-        kind: 'hyperdrive',
-        binding: 'HYPERDRIVE',
-        name: 'myapp-hd',
-        action: 'reused',
-        id: hex32('hd'),
-      },
-    ]);
-  });
-
-  it('runs the existence check unchanged when a token IS resolvable', async () => {
-    process.env.CLOUDFLARE_API_TOKEN = 'ambient-tok';
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    const urls: Array<string> = [];
-    const origFetch = globalThis.fetch;
-    globalThis.fetch = (async (url: string | URL) => {
-      urls.push(String(url));
-      return new Response(
-        JSON.stringify({ success: true, result: [], result_info: { total_count: 0 } }),
-        { status: 200 },
-      );
-    }) as typeof fetch;
-    const { run, calls } = makeRunner([
-      {
-        match: /^hyperdrive create /,
-        reply: () => {
-          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('newhd') });
-          return ok();
-        },
-      },
-    ]);
-    let result;
-    try {
-      result = await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: {
-            binding: 'HYPERDRIVE',
-            name: 'myapp-hd',
-            connectionString: 'postgres://u:p@h/db',
-          },
-        },
-        { runWrangler: run, log: silentLog },
-      );
-    } finally {
-      globalThis.fetch = origFetch;
-    }
-    expect(urls[0]).toContain('/accounts/config-acct/hyperdrive/configs');
-    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(true);
-    expect(result.resources).toEqual([
-      { kind: 'hyperdrive', binding: 'HYPERDRIVE', name: 'myapp-hd', action: 'created' },
-    ]);
-  });
-
-  it('needs no token when a listHyperdriveConfigs seam is injected', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^hyperdrive create /,
-        reply: () => {
-          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('newhd') });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: {
-          binding: 'HYPERDRIVE',
-          name: 'myapp-hd',
-          connectionString: 'postgres://u:p@h/db',
-        },
-      },
-      { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-    );
-    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(true);
-    expect(result.resources).toEqual([
-      { kind: 'hyperdrive', binding: 'HYPERDRIVE', name: 'myapp-hd', action: 'created' },
-    ]);
-  });
-
-  it('fails closed on a MISSING connection string when nothing can look the account up', async () => {
-    // No connection string AND no token/lister → this run can neither create nor adopt,
-    // so its only reachable outcome is the structured `skipped`, which deploy treats as
-    // FATAL. Reaching that costs the user a half-provisioned account, so it stops here.
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/no DATABASE_URL to create it from/);
-    // Nothing ran: no wrangler call, so no resource was created before the rejection.
-    expect(calls).toEqual([]);
-  });
-
-  it('names DATABASE_URL and the manual adopt route, and does not suggest a dotenv file', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([]);
-    const err = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-      },
-      { runWrangler: run, log: silentLog },
-    ).catch((e: unknown) => e as Error);
-    expect(err).toBeInstanceOf(Error);
-    const message = (err as Error).message;
-    expect(message).toContain('DATABASE_URL');
-    expect(message).toContain('wrangler hyperdrive create');
-    expect(message).toContain('HYPERDRIVE');
-    // The remedy must point at the shell, never at a dotenv file — project-derived env
-    // is read only inside the build subprocess, and a shipped .env value would leak.
-    expect(message).toMatch(/shell/);
-    expect(message).toMatch(/NOT used here/);
-  });
-
-  it('fails closed BEFORE the account pin and before any other resource is created', async () => {
-    // The whole point of fencing early: a run that also wants KV/R2 must not create
-    // them (and must not stamp account_id) only to abort at the Hyperdrive block.
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
-          r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' },
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        { runWrangler: run, accountId: 'acct-A', log: silentLog },
-      ),
-    ).rejects.toThrow(/no DATABASE_URL to create it from/);
-    // No create seam was invoked at all — KV and R2 were never touched.
-    expect(calls).toEqual([]);
-    // …and the account was never pinned, so a retry under a different account is still free.
-    expect(readConfig().account_id).toBeUndefined();
-  });
-
-  it('a hyperdrive already provisioned with a real id needs neither a string nor a token', async () => {
-    // The read-first path is pure config I/O — the stringless fence must not touch it.
-    setup(JSON.stringify({ hyperdrive: [{ binding: 'HYPERDRIVE', id: hex32('hd') }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-      },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources).toEqual([
-      {
-        kind: 'hyperdrive',
-        binding: 'HYPERDRIVE',
-        name: 'myapp-hd',
-        action: 'reused',
-        id: hex32('hd'),
-      },
-    ]);
-  });
-});
-
-describe('provisionCloudflareResources — Queues (resource only)', () => {
-  it('reuses a queue that `queues info` finds (no create, never writes queue config)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^queues info jobs/, reply: () => ok('Queue Name: jobs') },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, queues: ['jobs'] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([['queues', 'info', 'jobs', '-c', wranglerPath, '--env=']]);
-    expect(result.resources).toEqual([{ kind: 'queue', name: 'jobs', action: 'reused' }]);
-    // Task 4 must NOT write queue producer/consumer entries into the config.
-    expect(readConfig().queues).toBeUndefined();
-  });
-
-  it('creates a queue that `queues info` reports missing; verifies with a follow-up info probe', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    // After `queues create`, the provisioner RE-RUNS `queues info` and only
-    // records `created` if it now POSITIVELY confirms the queue (queues write no
-    // config, so this is the only backstop against a masked-signal create).
-    let created = false;
-    const { run, calls } = makeRunner([
-      {
-        match: /^queues info emails/,
-        reply: () =>
-          created ? ok('Queue Name: emails') : fail('', 'X [ERROR] Queue "emails" does not exist.'),
-      },
-      {
-        match: /^queues create emails/,
-        reply: () => {
-          created = true;
-          return ok('Created queue emails');
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, queues: ['emails'] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
-      ['queues', 'create', 'emails', '-c', wranglerPath, '--env='],
-      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
-    ]);
-    expect(result.resources).toEqual([{ kind: 'queue', name: 'emails', action: 'created' }]);
-    expect(readConfig().queues).toBeUndefined();
-  });
-
-  it('handles a mix of existing and missing queues', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    let created = false;
-    const { run, calls } = makeRunner([
-      { match: /^queues info jobs/, reply: () => ok('Queue Name: jobs') },
-      {
-        match: /^queues info emails/,
-        reply: () =>
-          created ? ok('Queue Name: emails') : fail('', 'Queue "emails" does not exist.'),
-      },
-      {
-        match: /^queues create emails/,
-        reply: () => {
-          created = true;
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, queues: ['jobs', 'emails'] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
-      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
-      ['queues', 'create', 'emails', '-c', wranglerPath, '--env='],
-      ['queues', 'info', 'emails', '-c', wranglerPath, '--env='],
-    ]);
-    expect(result.resources).toEqual([
-      { kind: 'queue', name: 'jobs', action: 'reused' },
-      { kind: 'queue', name: 'emails', action: 'created' },
-    ]);
-  });
-
-  it('throws (does NOT create) when `queues info` fails for a non-missing reason', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^queues info jobs/,
-        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, queues: ['jobs'] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/queues info jobs.*failed/s);
-    expect(calls.some((c) => isCall(c, 'queues', 'create'))).toBe(false);
-  });
-
-  it('does NOT create on a generic/unrelated "not found" (e.g. Account not found) — fails closed', async () => {
-    // The OLD broad `/not found|no such/` regex misread "Account not found" as
-    // queue absence and blindly created. It must fail closed instead.
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^queues info jobs/,
-        reply: () => fail('', 'X [ERROR] Account not found [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, queues: ['jobs'] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/queues info jobs.*failed/s);
-    expect(calls.some((c) => isCall(c, 'queues', 'create'))).toBe(false);
-  });
-
-  it('is name-aware: a "does not exist" for a DIFFERENT queue name is NOT absence for this one', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^queues info jobs/,
-        reply: () => fail('', 'X [ERROR] Queue "some-other-queue" does not exist.'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, queues: ['jobs'] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/queues info jobs.*failed/s);
-    expect(calls.some((c) => isCall(c, 'queues', 'create'))).toBe(false);
-  });
-
-  it('creates ONLY on the exact `Queue "<name>" does not exist` signal for THAT name', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    let created = false;
-    const { run, calls } = makeRunner([
-      {
-        match: /^queues info jobs/,
-        reply: () =>
-          created ? ok('Queue Name: jobs') : fail('', 'X [ERROR] Queue "jobs" does not exist.'),
-      },
-      {
-        match: /^queues create jobs/,
-        reply: () => {
-          created = true;
-          return ok('Created queue jobs');
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, queues: ['jobs'] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([
-      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
-      ['queues', 'create', 'jobs', '-c', wranglerPath, '--env='],
-      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
-    ]);
-    expect(result.resources).toEqual([{ kind: 'queue', name: 'jobs', action: 'created' }]);
-  });
-
-  it('fails closed when a masked-signal `queues create` (wrapper exit 0) did NOT create the queue', async () => {
-    // wrangler's bin wrapper maps a signal-killed inner CLI to exit 0. Queues write
-    // no config, so the ONLY backstop is the post-create verify probe: a create that
-    // reports clean 0 but whose follow-up `queues info` still does not confirm the
-    // queue must fail closed (never a false `created`).
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        // Both the initial probe AND the verify probe report the queue absent — the
-        // masked-kill create never actually created it.
-        match: /^queues info jobs/,
-        reply: () => fail('', 'X [ERROR] Queue "jobs" does not exist.'),
-      },
-      // A signal-killed inner CLI surfaced as a clean exit 0 by the wrapper.
-      { match: /^queues create jobs/, reply: () => ok('') },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, queues: ['jobs'] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/did not confirm the queue exists afterward/);
-    // The verify probe ran (info, create, info) but the queue was never recorded.
-    expect(calls).toEqual([
-      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
-      ['queues', 'create', 'jobs', '-c', wranglerPath, '--env='],
-      ['queues', 'info', 'jobs', '-c', wranglerPath, '--env='],
-    ]);
-  });
-});
-
-describe('provisionCloudflareResources — account reconciliation + config pin', () => {
-  it('fails closed BEFORE any wrangler/REST call when config account_id differs from opts.accountId', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    let restCalled = false;
-    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        {
-          runWrangler: run,
-          accountId: 'requested-acct',
-          log: silentLog,
-          listHyperdriveConfigs: async () => {
-            restCalled = true;
-            return [];
-          },
-        },
-      ),
-    ).rejects.toThrow(/account mismatch.*config-acct.*requested-acct/s);
-    // No wrangler call and no REST call happened before the fail-closed throw.
-    expect(calls).toEqual([]);
-    expect(restCalled).toBe(false);
-  });
-
-  it('persists account_id BEFORE any remote op so a later different-account retry fails closed', async () => {
-    // Run 1 under account A: D1 create writes a real id, THEN a later op fails.
-    setup(JSON.stringify({ name: 'app' }));
-    const run1 = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('createdA'),
-          });
-          return ok();
-        },
-      },
-      // A later op fails → the run throws AFTER the D1 id was already written.
-      {
-        match: /^queues info jobs/,
-        reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' }, queues: ['jobs'] },
-        { runWrangler: run1.run, accountId: 'acct-A', log: silentLog },
-      ),
-    ).rejects.toThrow(/queues info jobs.*failed/s);
-    // account_id was pinned to A UP FRONT (before D1), alongside the real D1 id.
-    const after1 = readConfig();
-    expect(after1.account_id).toBe('acct-A');
-    expect((after1.d1_databases as Array<Record<string, unknown>>)[0].database_id).toBe(
-      uuid('createdA'),
-    );
-
-    // Run 2 retries under account B → must fail closed at reconciliation with NO
-    // wrangler/REST calls (never rebinds account-A's D1 id under account B).
-    let restCalled = false;
-    const run2 = makeRunner([{ match: /.*/, reply: () => ok() }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' }, queues: ['jobs'] },
-        {
-          runWrangler: run2.run,
-          accountId: 'acct-B',
-          log: silentLog,
-          listHyperdriveConfigs: async () => {
-            restCalled = true;
-            return [];
-          },
-        },
-      ),
-    ).rejects.toThrow(/account mismatch.*acct-A.*acct-B/s);
-    expect(run2.calls).toEqual([]);
-    expect(restCalled).toBe(false);
-  });
-
-  it('passes -c <configPath> to EVERY wrangler invocation (list, info, create)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    let queueCreated = false;
-    const { run, calls } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('created'),
-          });
-          return ok();
-        },
-      },
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      {
-        match: /^kv namespace create /,
-        reply: () => {
-          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: hex32('newkv') });
-          return ok();
-        },
-      },
-      {
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'The specified bucket does not exist. [code: 10006]'),
-      },
-      {
-        match: /^r2 bucket create /,
-        reply: () => {
-          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'bucket-b' });
-          return ok();
-        },
-      },
-      {
-        match: /^queues info /,
-        reply: () =>
-          queueCreated ? ok('Queue Name: jobs') : fail('', 'Queue "jobs" does not exist.'),
-      },
-      {
-        match: /^queues create /,
-        reply: () => {
-          queueCreated = true;
-          return ok();
-        },
-      },
-    ]);
-    await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        d1: { binding: 'DB', name: 'myapp-db' },
-        kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
-        r2: { binding: 'STORAGE', bucketName: 'bucket-b' },
-        queues: ['jobs'],
-      },
-      { runWrangler: run, log: silentLog },
-    );
-    // Every wrangler argv threads the ONE resolved config via `-c <configPath>` AND
-    // the top-level `--env=` pin.
-    expect(calls.length).toBeGreaterThan(0);
-    for (const argv of calls) {
-      const i = argv.indexOf('-c');
-      expect(i).toBeGreaterThanOrEqual(0);
-      expect(argv[i + 1]).toBe(wranglerPath);
-      expect(argv[i + 2]).toBe('--env=');
-    }
-  });
-
-  it('the default Hyperdrive existence REST call targets the effective (config) account id', async () => {
-    setup(
-      JSON.stringify({
-        account_id: 'config-acct',
-        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
-      }),
-    );
-    const urls: Array<string> = [];
-    const origFetch = globalThis.fetch;
-    globalThis.fetch = (async (url: string | URL) => {
-      urls.push(String(url));
-      return new Response(
-        JSON.stringify({ success: true, result: [], result_info: { total_count: 0 } }),
-        { status: 200 },
-      );
-    }) as typeof fetch;
-    try {
-      const { run } = makeRunner([]);
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          // Empty connection string → skip AFTER the existence check, so ONLY the
-          // REST call runs (no create).
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        { runWrangler: run, apiToken: 'tok', log: silentLog },
-      );
-    } finally {
-      globalThis.fetch = origFetch;
-    }
-    expect(urls.length).toBeGreaterThan(0);
-    expect(urls[0]).toContain('/accounts/config-acct/hyperdrive/configs');
-    // Default (no ambient redirect) → public prod base.
-    expect(urls[0]).toMatch(/^https:\/\/api\.cloudflare\.com\/client\/v4\//);
-  });
-});
-
-describe('provisionCloudflareResources — pinned transport (one base for wrangler + REST)', () => {
-  it('resolvePinnedApiBaseUrl mirrors wrangler: default prod, direct override, staging, fedramp', () => {
-    expect(resolvePinnedApiBaseUrl({})).toBe('https://api.cloudflare.com/client/v4');
-    expect(resolvePinnedApiBaseUrl({ CLOUDFLARE_API_BASE_URL: 'https://api.example/v9' })).toBe(
-      'https://api.example/v9',
-    );
-    // Deprecated alias honored when the primary is absent.
-    expect(resolvePinnedApiBaseUrl({ CF_API_BASE_URL: 'https://cf.example/v4' })).toBe(
-      'https://cf.example/v4',
-    );
-    expect(resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: 'staging' })).toBe(
-      'https://api.staging.cloudflare.com/client/v4',
-    );
-    expect(resolvePinnedApiBaseUrl({ CLOUDFLARE_COMPLIANCE_REGION: 'fedramp_high' })).toBe(
-      'https://api.fed.cloudflare.com/client/v4',
-    );
-  });
-
-  it('the default Hyperdrive REST lister honors a pinned CLOUDFLARE_API_BASE_URL (not hardcoded prod)', async () => {
-    const prev = process.env.CLOUDFLARE_API_BASE_URL;
-    process.env.CLOUDFLARE_API_BASE_URL = 'https://api.staging.cloudflare.com/client/v4';
-    setup(
-      JSON.stringify({
-        account_id: 'config-acct',
-        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
-      }),
-    );
-    const urls: Array<string> = [];
-    const origFetch = globalThis.fetch;
-    globalThis.fetch = (async (url: string | URL) => {
-      urls.push(String(url));
-      return new Response(
-        JSON.stringify({ success: true, result: [], result_info: { total_count: 0 } }),
-        { status: 200 },
-      );
-    }) as typeof fetch;
-    try {
-      const { run } = makeRunner([]);
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        { runWrangler: run, apiToken: 'tok', log: silentLog },
-      );
-    } finally {
-      globalThis.fetch = origFetch;
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_API_BASE_URL;
-      } else {
-        process.env.CLOUDFLARE_API_BASE_URL = prev;
-      }
-    }
-    // The REST existence check hit the SAME pinned endpoint wrangler would (staging),
-    // not the hardcoded public-prod base.
-    expect(urls[0]).toMatch(/^https:\/\/api\.staging\.cloudflare\.com\/client\/v4\//);
-    expect(urls[0]).toContain('/accounts/config-acct/hyperdrive/configs');
-  });
-
-  it('the lister URL uses the pinned base with wrangler-EXACT concatenation (no trailing-slash trim)', async () => {
-    // wrangler 4.131's `performApiFetchBase` fetches
-    // `${getCloudflareApiBaseUrl(...)}${resource}${queryString}` with the direct env
-    // base used VERBATIM and the resource `/accounts/${accountId}/hyperdrive/configs`
-    // interpolated RAW. A base ending in `/` therefore yields `…//accounts/…` for
-    // wrangler; the lister must produce the SAME bytes (the old one-sided trim made the
-    // existence check and the create hit different endpoints on a custom proxy base).
-    const prev = process.env.CLOUDFLARE_API_BASE_URL;
-    const pinnedBase = 'https://proxy.example/api/'; // note the trailing slash
-    process.env.CLOUDFLARE_API_BASE_URL = pinnedBase;
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    const urls: Array<string> = [];
-    const origFetch = globalThis.fetch;
-    globalThis.fetch = (async (url: string | URL) => {
-      urls.push(String(url));
-      return new Response(
-        JSON.stringify({ success: true, result: [], result_info: { total_count: 0 } }),
-        { status: 200 },
-      );
-    }) as typeof fetch;
-    try {
-      const { run } = makeRunner([]);
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        { runWrangler: run, apiToken: 'tok', log: silentLog },
-      );
-    } finally {
-      globalThis.fetch = origFetch;
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_API_BASE_URL;
-      } else {
-        process.env.CLOUDFLARE_API_BASE_URL = prev;
-      }
-    }
-    // Byte-for-byte wrangler's concatenation: `${base}${resource}${queryString}` —
-    // the double slash included.
-    expect(urls[0]).toBe(
-      `${pinnedBase}/accounts/config-acct/hyperdrive/configs?page=1&per_page=100`,
-    );
-    expect(urls[0]).toContain('/api//accounts/');
-  });
-
-  it('the injected lister receives the pinned apiBaseUrl + a deadline AbortSignal in its transport context', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    let seen: { accountId: string; apiBaseUrl: string; signal: AbortSignal } | undefined;
-    const { run } = makeRunner([]);
-    await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-      },
-      {
-        runWrangler: run,
-        log: silentLog,
-        listHyperdriveConfigs: async (ctx) => {
-          seen = ctx;
-          return [];
-        },
-      },
-    );
-    expect(seen?.accountId).toBe('config-acct');
-    expect(seen?.apiBaseUrl).toBe('https://api.cloudflare.com/client/v4');
-    // The lister is handed the overall-deadline signal to thread into every fetch.
-    expect(seen?.signal).toBeInstanceOf(AbortSignal);
-  });
-
-  it('FAILS CLOSED when a project .env sets a transport-redirect var (no wrangler/REST)', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    // A repo .env that would redirect wrangler's transport on every command.
-    writeFileSync(
-      join(tmpDir, '.env'),
-      'CLOUDFLARE_API_BASE_URL=https://api.staging.cloudflare.com/client/v4\n',
-    );
-    let listerCalled = false;
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          d1: { binding: 'DB', name: 'myapp-db' },
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => {
-            listerCalled = true;
-            return [];
-          },
-        },
-      ),
-    ).rejects.toThrow(/refusing to provision.*\.env.*CLOUDFLARE_API_BASE_URL.*redirect/s);
-    // Failed closed BEFORE any remote work.
-    expect(calls.length).toBe(0);
-    expect(listerCalled).toBe(false);
-  });
-
-  it('does NOT fail on a benign project .env without transport-redirect vars', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.env'), 'DATABASE_URL=postgres://localhost/app\nFOO=bar\n');
-    const { run } = makeRunner([
-      { match: /^d1 list/, reply: () => ok('[]') },
-      {
-        match: /^d1 create/,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('db'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources).toEqual([
-      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'created' },
-    ]);
-  });
-});
-
-describe('provisionCloudflareResources — Hyperdrive discovery (pagination + fail closed)', () => {
-  function stubFetch(pages: Array<{ status?: number; body: unknown }>): {
-    restore: () => void;
-    urls: Array<string>;
-  } {
-    const urls: Array<string> = [];
-    const origFetch = globalThis.fetch;
-    let call = 0;
-    globalThis.fetch = (async (url: string | URL) => {
-      urls.push(String(url));
-      const page = pages[Math.min(call, pages.length - 1)];
-      call++;
-      return new Response(typeof page.body === 'string' ? page.body : JSON.stringify(page.body), {
-        status: page.status ?? 200,
-      });
-    }) as typeof fetch;
-    return {
-      restore: () => {
-        globalThis.fetch = origFetch;
-      },
-      urls,
-    };
-  }
-
-  it('follows result_info pagination and adopts a match found on page 2 (no create)', async () => {
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    const { restore, urls } = stubFetch([
-      {
-        body: {
-          success: true,
-          result: [{ id: hex32('p1a'), name: 'other-1' }],
-          result_info: { total_count: 2 },
-        },
-      },
-      {
-        body: {
-          success: true,
-          result: [{ id: hex32('p2hd'), name: 'myapp-hd' }],
-          result_info: { total_count: 2 },
-        },
-      },
-    ]);
-    try {
-      const { run, calls } = makeRunner([]);
-      const result = await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        { runWrangler: run, apiToken: 'tok', log: silentLog },
-      );
-      expect(urls.length).toBe(2); // both pages fetched
-      expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-      const hd = readConfig().hyperdrive as Array<Record<string, unknown>>;
-      expect(hd).toEqual([{ binding: 'HYPERDRIVE', id: hex32('p2hd') }]);
-      expect(result.resources[0]).toMatchObject({ action: 'adopted', id: hex32('p2hd') });
-    } finally {
-      restore();
-    }
-  });
-
-  it('fails closed on a non-2xx envelope (never treats it as absence, no create)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { restore } = stubFetch([{ status: 500, body: { success: false } }]);
-    try {
-      const { run, calls } = makeRunner([]);
-      await expect(
-        provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          {
-            ...emptyDesired,
-            hyperdrive: {
-              binding: 'HYPERDRIVE',
-              name: 'myapp-hd',
-              connectionString: 'postgres://x',
-            },
-          },
-          { runWrangler: run, apiToken: 'tok', log: silentLog },
-        ),
-      ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
-      expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-    } finally {
-      restore();
-    }
-  });
-
-  it('fails closed on success:false and on a malformed entry (missing id) — no create', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    // success:false first, then a malformed entry — both must fail closed.
-    for (const body of [
-      { success: false, result: [] },
-      { success: true, result: [{ name: 'myapp-hd' }], result_info: { total_count: 1 } },
-    ]) {
-      const { restore } = stubFetch([{ body }]);
-      try {
-        const { run, calls } = makeRunner([]);
-        await expect(
-          provisionCloudflareResources(
-            tmpDir,
-            wranglerPath,
-            {
-              ...emptyDesired,
-              hyperdrive: {
-                binding: 'HYPERDRIVE',
-                name: 'myapp-hd',
-                connectionString: 'postgres://x',
-              },
-            },
-            { runWrangler: run, apiToken: 'tok', log: silentLog },
-          ),
-        ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
-        expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-      } finally {
-        restore();
-      }
-    }
-  });
-
-  it('fails closed when two configs share the requested name (ambiguous) — no create', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => [
-            { id: hex32('hd-1'), name: 'myapp-hd' },
-            { id: hex32('hd-2'), name: 'myapp-hd' },
-          ],
-        },
-      ),
-    ).rejects.toThrow(/cannot adopt Hyperdrive config "myapp-hd".*share that name/s);
-    expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-  });
-
-  it('fails closed on malformed pagination (missing/premature-empty/duplicate/inconsistent) — never declares absence, no create', async () => {
-    // Each case would let the OLD loop stop early and declare "absent" without
-    // proving completeness → a same-named config on an unread page becomes a
-    // duplicate. All must fail closed BEFORE any create.
-    const cases: Array<Array<{ status?: number; body: unknown }>> = [
-      // 1. missing result_info.total_count metadata (cannot prove completeness)
-      [{ body: { success: true, result: [{ id: 'a', name: 'other' }] } }],
-      // 2. premature empty page before all configs are listed
-      [
-        {
-          body: {
-            success: true,
-            result: [{ id: 'a', name: 'other' }],
-            result_info: { total_count: 3 },
-          },
-        },
-        { body: { success: true, result: [], result_info: { total_count: 3 } } },
-      ],
-      // 3. repeated/duplicate id across pages (padding to satisfy a count)
-      [
-        {
-          body: {
-            success: true,
-            result: [{ id: 'a', name: 'x' }],
-            result_info: { total_count: 2 },
-          },
-        },
-        {
-          body: {
-            success: true,
-            result: [{ id: 'a', name: 'x' }],
-            result_info: { total_count: 2 },
-          },
-        },
-      ],
-      // 4. inconsistent total_count between pages
-      [
-        {
-          body: {
-            success: true,
-            result: [{ id: 'a', name: 'x' }],
-            result_info: { total_count: 2 },
-          },
-        },
-        {
-          body: {
-            success: true,
-            result: [{ id: 'b', name: 'y' }],
-            result_info: { total_count: 5 },
-          },
-        },
-      ],
-    ];
-    for (const pages of cases) {
-      setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-      const { restore } = stubFetch(pages);
-      try {
-        const { run, calls } = makeRunner([]);
-        await expect(
-          provisionCloudflareResources(
-            tmpDir,
-            wranglerPath,
-            {
-              ...emptyDesired,
-              hyperdrive: {
-                binding: 'HYPERDRIVE',
-                name: 'myapp-hd',
-                connectionString: 'postgres://x',
-              },
-            },
-            { runWrangler: run, apiToken: 'tok', log: silentLog },
-          ),
-        ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
-        expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-      } finally {
-        restore();
-      }
-    }
-  });
-});
-
-describe('provisionCloudflareResources — KV/R2 fail closed on schema-valid ambiguity', () => {
-  it('KV: fails closed (no create) when the target title matches but the entry has no id', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok(JSON.stringify([{ title: 'myapp-kv' }])) },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/namespace titled "myapp-kv" with no valid id/);
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
-  });
-
-  it('KV: fails closed (no create) when the list has a malformed member (null) — never filtered away', async () => {
-    // The OLD strict parser filtered `null` out, leaving a false "absent" match →
-    // duplicate. The malformed member must reject the WHOLE list instead.
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => ok(JSON.stringify([null, { id: 'other', title: 'someone-else' }])),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/malformed KV namespace entry/);
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
-  });
-
-  it('R2: does NOT adopt when `r2 bucket info` exits 0 but the payload names a different bucket', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () => ok(JSON.stringify({ name: 'a-different-bucket' })),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/did not identify the requested bucket/);
-    // Neither adopted nor created — the config is untouched.
-    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(false);
-    expect(readConfig().r2_buckets).toBeUndefined();
-  });
-});
-
-describe('normalizeRunWranglerResult — signal / spawn-error handling', () => {
-  it('treats a SIGTERM-killed child (status null, signal set) as FAILURE, not success', () => {
-    const r = normalizeRunWranglerResult({
-      stdout: '',
-      stderr: '',
-      status: null,
-      signal: 'SIGTERM',
-    });
-    expect(r.status).not.toBe(0);
-    expect(r.stderr).toContain('SIGTERM');
-  });
-
-  it('treats a spawn error as FAILURE and surfaces its message', () => {
-    const r = normalizeRunWranglerResult({
-      status: null,
-      error: new Error('spawn wrangler ENOENT'),
-    });
-    expect(r.status).not.toBe(0);
-    expect(r.stderr).toContain('ENOENT');
-  });
-
-  it('passes a clean exit through unchanged (0 stays success, a real non-zero is preserved)', () => {
-    expect(normalizeRunWranglerResult({ status: 0, stdout: 'ok' }).status).toBe(0);
-    expect(normalizeRunWranglerResult({ status: 2, stderr: 'boom' }).status).toBe(2);
-  });
-
-  it('carries structured signal/error provenance', () => {
-    const killed = normalizeRunWranglerResult({ status: null, signal: 'SIGTERM' });
-    expect(killed.signal).toBe('SIGTERM');
-    expect(killed.error).toBeNull();
-    const errored = normalizeRunWranglerResult({ status: null, error: new Error('ENOENT') });
-    expect(errored.error).toContain('ENOENT');
-    const clean = normalizeRunWranglerResult({ status: 0, stdout: 'ok' });
-    expect(clean.signal).toBeNull();
-    expect(clean.error).toBeNull();
-  });
-});
-
-describe('createDefaultRunWrangler — hard timeout kills the REAL process', () => {
-  const TIMEOUT_TMP = join(import.meta.dirname, '.tmp-timeout-kill');
-  beforeEach(() => {
-    rmSync(TIMEOUT_TMP, { recursive: true, force: true });
-    mkdirSync(TIMEOUT_TMP, { recursive: true });
-  });
-  afterEach(() => {
-    rmSync(TIMEOUT_TMP, { recursive: true, force: true });
-  });
-
-  /** Poll `process.kill(pid, 0)` until the pid is dead (ESRCH) or the deadline passes. */
-  async function waitForDead(pid: number, timeoutMs: number): Promise<boolean> {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      try {
-        process.kill(pid, 0); // still alive
-      } catch {
-        return true; // ESRCH → dead
-      }
-      await new Promise((r) => setTimeout(r, 50));
-    }
-    return false;
-  }
-
-  it('a DIRECT hung CLI is SIGKILLed and the runner REJECTS-as-hard-failure within the timeout', async () => {
-    // Simulate the post-fix launcher: a direct CLI entry (no wrapper) that ignores SIGTERM
-    // and hangs forever.
-    const hungCli = join(TIMEOUT_TMP, 'hung-cli.cjs');
-    writeFileSync(
-      hungCli,
-      `process.on('SIGTERM', () => {});\n` + // survives a plain SIGTERM (like the wrapper sends)
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    let pid: number | undefined;
-    const run = createDefaultRunWrangler(TIMEOUT_TMP, {
-      launcher: [process.execPath, hungCli],
-      onSpawnedChild: (child) => {
-        pid = child.pid;
-      },
-      timeoutMs: 400,
-    });
-    const start = Date.now();
-    const result = await run(operationFixtureRequest(['d1', 'list', '--json']), {
-      accountId: 'acct',
-    });
-    const elapsed = Date.now() - start;
-    // Settled in bounded time — the runner did NOT hang. The tight ceiling here is a
-    // load-tolerant sanity bound (the 400ms internal timer can be delayed on a busy
-    // machine); the real "did not hang forever" guard is the outer vitest timeout.
-    expect(elapsed).toBeLessThan(15_000);
-    // HARD failure: a non-null signal, folded to a non-zero status.
-    expect(result.signal).toBe('SIGKILL');
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toMatch(/exceeded the 400ms command timeout/);
-    // No lingering process — the SIGKILL reached the real CLI. Poll for the OUTCOME
-    // (dead pid) with a generous bound rather than racing a tight deadline.
-    expect(pid).toBeTypeOf('number');
-    expect(await waitForDead(pid!, 10_000)).toBe(true);
-  }, 20_000);
-
-  it('a WRAPPER that re-spawns a hung grandchild: runner still settles in time AND the grandchild is reaped', async () => {
-    // The exact scenario: a `bin/wrangler.js`-style wrapper that
-    // spawns an inner CLI with inherited stdio and forwards only SIGTERM (never SIGKILL),
-    // mapping a signal-killed child to exit 0. Pre-fix this defeated the timeout (the
-    // grandchild survived holding the pipes so `close` never fired). The runner now spawns
-    // the launcher in its OWN process group and SIGKILLs the WHOLE group on timeout, then
-    // settles immediately — so even a wrapper-plus-hung-grandchild rejects within the
-    // timeout with NO lingering process.
-    const gcPidFile = join(TIMEOUT_TMP, 'grandchild.pid');
-    const grandchild = join(TIMEOUT_TMP, 'grandchild.cjs');
-    writeFileSync(
-      grandchild,
-      `require('fs').writeFileSync(${JSON.stringify(gcPidFile)}, String(process.pid));\n` +
-        `process.on('SIGTERM', () => {});\n` + // ignore the wrapper's forwarded SIGTERM
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const wrapper = join(TIMEOUT_TMP, 'wrapper.cjs');
-    writeFileSync(
-      wrapper,
-      `const { spawn } = require('child_process');\n` +
-        // Under heavy full-suite fork pressure a single spawn can transiently fail
-        // (EAGAIN). Retry so the grandchild reliably establishes — otherwise the wrapper
-        // would exit early and the runner would settle via the NORMAL close path (signal
-        // null), making the timeout-kill assertion flake. On a hard failure keep the
-        // wrapper ALIVE so the runner's timeout+group-SIGKILL path is still exercised.
-        `let child;\n` +
-        `function launch() {\n` +
-        `  try {\n` +
-        `    child = spawn(process.execPath, [${JSON.stringify(grandchild)}], { stdio: ['inherit','inherit','inherit'] });\n` +
-        `    child.on('error', () => { child = undefined; setTimeout(launch, 50); });\n` +
-        `    child.on('exit', (code) => process.exit(code === null ? 0 : code));\n` + // mask signal death as exit 0
-        `  } catch { setTimeout(launch, 50); }\n` +
-        `}\n` +
-        `launch();\n` +
-        `process.on('SIGTERM', () => { if (child) child.kill(); });\n` + // forward only SIGTERM (default)
-        `process.on('SIGINT', () => { if (child) child.kill(); });\n` +
-        `setInterval(() => {}, 1 << 30);\n`, // keep the wrapper alive until the group is killed
-    );
-    const run = createDefaultRunWrangler(TIMEOUT_TMP, {
-      launcher: [process.execPath, wrapper],
-      // Generous internal timeout so the wrapper + grandchild reliably establish (and hang)
-      // before the timer fires even under load — the timeout-kill path is what we assert.
-      timeoutMs: 1_500,
-    });
-    const start = Date.now();
-    const result = await run(operationFixtureRequest(['d1', 'list', '--json']), {
-      accountId: 'acct',
-    });
-    const elapsed = Date.now() - start;
-    // Bounded settle (the vitest timeout is the real "did not hang" guard).
-    expect(elapsed).toBeLessThan(20_000);
-    expect(result.signal).toBe('SIGKILL');
-    expect(result.status).not.toBe(0);
-    // The grandchild wrote its pid, then must have been reaped by the process-group kill.
-    // Poll for the OUTCOME (dead pgid) with a generous, load-tolerant bound.
-    const gcPid = Number(readFileSync(gcPidFile, 'utf-8'));
-    expect(Number.isInteger(gcPid)).toBe(true);
-    expect(await waitForDead(gcPid, 10_000)).toBe(true);
-  }, 25_000);
-});
-
-describe('provisionCloudflareResources — account gate + env scrub', () => {
-  it('provisionEnv scrubs CLOUDFLARE_ENV + the CF Access token pair and pins the account', () => {
-    const saved: Record<string, string | undefined> = {};
-    const set = (k: string, v: string): void => {
-      saved[k] = process.env[k];
-      process.env[k] = v;
-    };
-    set('CLOUDFLARE_ENV', 'staging');
-    set('CF_ACCESS_CLIENT_ID', 'id');
-    set('CF_ACCESS_CLIENT_SECRET', 'secret');
-    set('CF_ACCESS_TOKEN', 'short-lived-user-jwt');
-    try {
-      const env = provisionEnv({ accountId: 'acct-X' });
-      // CLOUDFLARE_ENV would let wrangler select an env-specific account block.
-      expect(env.CLOUDFLARE_ENV).toBeUndefined();
-      expect(env.CF_ACCESS_CLIENT_ID).toBeUndefined();
-      expect(env.CF_ACCESS_CLIENT_SECRET).toBeUndefined();
-      expect(env.CF_ACCESS_TOKEN).toBeUndefined();
-      expect(env.CLOUDFLARE_ACCOUNT_ID).toBe('acct-X');
-    } finally {
-      for (const [k, v] of Object.entries(saved)) {
-        if (v === undefined) {
-          delete process.env[k];
-        } else {
-          process.env[k] = v;
-        }
-      }
-    }
-  });
-
-  it('provisionEnv scrubs EVERY transport-redirect var and pins the ONE resolved API base', () => {
-    const saved: Record<string, string | undefined> = {};
-    const set = (k: string, v: string): void => {
-      saved[k] = process.env[k];
-      process.env[k] = v;
-    };
-    // Ambient redirect vars that (via wrangler's per-command dotenv reload) could point the
-    // transport elsewhere — all must be scrubbed from the child env.
-    set('CLOUDFLARE_API_BASE_URL', 'https://evil.example');
-    set('CF_API_BASE_URL', 'https://evil2.example');
-    set('WRANGLER_API_ENVIRONMENT', 'staging');
-    set('CLOUDFLARE_COMPLIANCE_REGION', 'fedramp_high');
-    try {
-      const env = provisionEnv({
-        accountId: 'acct-X',
-        apiBaseUrl: 'https://api.cloudflare.com/client/v4',
-      });
-      expect(env.CF_API_BASE_URL).toBeUndefined();
-      expect(env.WRANGLER_API_ENVIRONMENT).toBeUndefined();
-      expect(env.CLOUDFLARE_COMPLIANCE_REGION).toBeUndefined();
-      // The ONE pinned base overrides any ambient/derived value.
-      expect(env.CLOUDFLARE_API_BASE_URL).toBe('https://api.cloudflare.com/client/v4');
-    } finally {
-      for (const [k, v] of Object.entries(saved)) {
-        if (v === undefined) {
-          delete process.env[k];
-        } else {
-          process.env[k] = v;
-        }
-      }
-    }
-  });
-
-  it('fails closed (no wrangler/REST) when no account is resolvable on the default path', async () => {
-    setup(JSON.stringify({ name: 'app' })); // no account_id
-    const prev = process.env.CLOUDFLARE_ACCOUNT_ID;
-    delete process.env.CLOUDFLARE_ACCOUNT_ID; // no ambient account either
-    try {
-      await expect(
-        provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-          // NO runWrangler injected, NO accountId → the DEFAULT (real) path.
-          { log: silentLog },
-        ),
-      ).rejects.toThrow(/no Cloudflare account is resolvable/);
-      // The gate throws BEFORE any wrangler subprocess / REST — nothing persisted.
-      expect(readConfig().d1_databases).toBeUndefined();
-      expect(readConfig().account_id).toBeUndefined();
-    } finally {
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = prev;
-      }
-    }
-  });
-
-  it('persists the AMBIENT account before remote work; a later different-account retry fails closed', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const prev = process.env.CLOUDFLARE_ACCOUNT_ID;
-    process.env.CLOUDFLARE_ACCOUNT_ID = 'ambient-A';
-    try {
-      // Run 1: ambient A (no opts.accountId). D1 create writes a real id, THEN a
-      // later op fails → the run throws AFTER account_id was pinned to A up front.
-      const run1 = makeRunner([
-        { match: /^d1 list --json/, reply: () => ok('[]') },
-        {
-          match: /^d1 create /,
-          reply: () => {
-            simulateUpdateConfig('d1_databases', {
-              binding: 'DB',
-              database_name: 'myapp-db',
-              database_id: uuid('createdA'),
-            });
-            return ok();
-          },
-        },
-        {
-          match: /^queues info jobs/,
-          reply: () => fail('', 'X [ERROR] Authentication error [code: 10000]'),
-        },
-      ]);
-      await expect(
-        provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' }, queues: ['jobs'] },
-          { runWrangler: run1.run, log: silentLog },
-        ),
-      ).rejects.toThrow(/queues info jobs.*failed/s);
-      const after1 = readConfig();
-      expect(after1.account_id).toBe('ambient-A');
-      expect((after1.d1_databases as Array<Record<string, unknown>>)[0].database_id).toBe(
-        uuid('createdA'),
-      );
-
-      // Run 2 retries under account B → reconciliation A≠B fails closed, NO
-      // wrangler/REST (never rebinds account-A's real D1 id under account B).
-      let restCalled = false;
-      const run2 = makeRunner([{ match: /.*/, reply: () => ok() }]);
-      await expect(
-        provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' }, queues: ['jobs'] },
-          {
-            runWrangler: run2.run,
-            accountId: 'acct-B',
-            log: silentLog,
-            listHyperdriveConfigs: async () => {
-              restCalled = true;
-              return [];
-            },
-          },
-        ),
-      ).rejects.toThrow(/account mismatch.*ambient-A.*acct-B/s);
-      expect(run2.calls).toEqual([]);
-      expect(restCalled).toBe(false);
-    } finally {
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = prev;
-      }
-    }
-  });
-});
-
-describe('provisionCloudflareResources — resource-name validation', () => {
-  const badNames = ['--help', '--config', '-h'];
-  const kinds: Array<{
-    label: RegExp;
-    desired: (name: string) => DesiredResourceSet;
-    createPrefix: Array<string>;
-  }> = [
-    {
-      // badNames all start with "-", so the universal option-injection guard fires FIRST
-      // with "refusing to pass an unsafe <label> name", before the grammar check.
-      label: /unsafe D1 database name/,
-      desired: (name) => ({ ...emptyDesired, d1: { binding: 'DB', name } }),
-      createPrefix: ['d1', 'create'],
-    },
-    {
-      label: /unsafe KV namespace name/,
-      desired: (name) => ({ ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: name }] }),
-      createPrefix: ['kv', 'namespace', 'create'],
-    },
-    {
-      label: /unsafe R2 bucket name/,
-      desired: (name) => ({ ...emptyDesired, r2: { binding: 'STORAGE', bucketName: name } }),
-      createPrefix: ['r2', 'bucket', 'create'],
-    },
-    {
-      label: /unsafe Hyperdrive config name/,
-      desired: (name) => ({
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name, connectionString: 'postgres://x' },
-      }),
-      createPrefix: ['hyperdrive', 'create'],
-    },
-    {
-      label: /unsafe queue name/,
-      desired: (name) => ({ ...emptyDesired, queues: [name] }),
-      createPrefix: ['queues', 'create'],
-    },
-  ];
-
-  it('rejects option-like names for EVERY resource kind before any wrangler call', async () => {
-    for (const bad of badNames) {
-      for (const kind of kinds) {
-        setup(JSON.stringify({ name: 'app' }));
-        const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-        await expect(
-          provisionCloudflareResources(tmpDir, wranglerPath, kind.desired(bad), {
-            runWrangler: run,
-            log: silentLog,
-            listHyperdriveConfigs: async () => [],
-          }),
-        ).rejects.toThrow(kind.label);
-        // No wrangler invocation at all — the name never reached argv.
-        expect(calls).toEqual([]);
-      }
-    }
-  });
-});
-
-describe('provisionCloudflareResources — signal-killed probe never authorizes create', () => {
-  it('queues: a SIGTERM-killed probe with buffered "does not exist" text fails closed (no create)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const killed = normalizeRunWranglerResult({
-      stdout: '',
-      stderr: 'X [ERROR] Queue "jobs" does not exist.',
-      status: null,
-      signal: 'SIGTERM',
-    });
-    const { run, calls } = makeRunner([{ match: /^queues info jobs/, reply: () => killed }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, queues: ['jobs'] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/queues info jobs.*failed/s);
-    expect(calls.some((c) => isCall(c, 'queues', 'create'))).toBe(false);
-  });
-
-  it('R2: a SIGTERM-killed probe with buffered 10006 text fails closed (no create)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const killed = normalizeRunWranglerResult({
-      stdout: '',
-      stderr: 'X [ERROR] The bucket is not present [code: 10006]',
-      status: null,
-      signal: 'SIGTERM',
-    });
-    const { run, calls } = makeRunner([{ match: /^r2 bucket info /, reply: () => killed }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/r2 bucket info myapp-uploads.*(failed|refusing)/s);
-    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(false);
-  });
-});
-
-describe('provisionCloudflareResources — create postcondition', () => {
-  it('KV: a create that reports success but writes NO id fails closed', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      // Success exit, but nothing written to config (simulates a killed child the
-      // wrapper masked as exit 0, or a silent partial create).
-      { match: /^kv namespace create /, reply: () => ok() },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(
-      /reported success but .* does not hold the expected KV namespace .*need a real id/s,
-    );
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(true);
-    expect(readConfig().kv_namespaces).toBeUndefined();
-  });
-
-  it('D1: a create that reports success but writes NO id fails closed', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      { match: /^d1 create /, reply: () => ok() },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(
-      /reported success but .* does not hold the expected D1 database .*need a real database_id/s,
-    );
-    expect(readConfig().d1_databases).toBeUndefined();
-  });
-
-  it('R2: a create that reports success but writes NO bucket fails closed', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'The specified bucket does not exist. [code: 10006]'),
-      },
-      { match: /^r2 bucket create /, reply: () => ok() },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(
-      /reported success but .* does not hold the expected R2 bucket .*need a real bucket_name/s,
-    );
-    expect(readConfig().r2_buckets).toBeUndefined();
-  });
-
-  it('Hyperdrive: a create that reports success but writes NO id fails closed', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([{ match: /^hyperdrive create /, reply: () => ok() }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-      ),
-    ).rejects.toThrow(
-      /reported success but .* does not hold the expected Hyperdrive config .*need a real id/s,
-    );
-    expect(readConfig().hyperdrive).toBeUndefined();
-  });
-});
-
-describe('provisionCloudflareResources — strict D1 identity', () => {
-  it('adopts (not create) a list member with uuid:"" but a valid database_id', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        // Empty-string uuid must NOT shadow the valid database_id.
-        reply: () =>
-          ok(JSON.stringify([{ uuid: '', database_id: uuid('realdb'), name: 'myapp-db' }])),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
-    expect(d1[0].database_id).toBe(uuid('realdb'));
-    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: uuid('realdb') });
-  });
-
-  it('fails closed when the target-named list member has conflicting non-empty ids (ambiguous)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () =>
-          ok(JSON.stringify([{ uuid: uuid('id-a'), database_id: uuid('id-b'), name: 'myapp-db' }])),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-      // The WHOLE-LIST alias reconciler now rejects the conflicting
-      // aliases before the claimant-level check even runs — same fail-closed outcome.
-    ).rejects.toThrow(/no valid id.*agreeing on one id/s);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('rejects a 7502-collision `d1 info` payload with an id but NO name (unverified) — no adopt', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      { match: /^d1 create /, reply: () => fail('', 'X [ERROR] already exists [code: 7502]') },
-      { match: /^d1 info myapp-db --json/, reply: () => ok(JSON.stringify({ database_id: 'x' })) },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/did not return a database with a matching name/);
-    expect(readConfig().d1_databases).toBeUndefined();
-  });
-
-  it('rejects a 7502-collision `d1 info` payload whose name MISMATCHES the request — no adopt', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      { match: /^d1 create /, reply: () => fail('', 'X [ERROR] already exists [code: 7502]') },
-      {
-        match: /^d1 info myapp-db --json/,
-        reply: () => ok(JSON.stringify({ database_id: 'x', name: 'a-different-db' })),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/did not return a database with a matching name/);
-    expect(readConfig().d1_databases).toBeUndefined();
-  });
-});
-
-describe('provisionCloudflareResources — top-level env pin via --env=', () => {
-  it('pins the top-level env on EVERY wrangler call even when CLOUDFLARE_ENV names a different env/account', async () => {
-    // wrangler 4.131 reloads a project `.env`/`.env.local` into process.env on every
-    // command, so a project `.env` with `CLOUDFLARE_ENV=staging` would reselect the
-    // `env.staging` block (and ITS account) for discovery/create even though
-    // `provisionEnv` deleted the var — while `--update-config` patches the TOP-LEVEL
-    // config, a cross-account/config split. The reliable pin is the explicit empty
-    // `--env=` on every argv: wrangler resolves `args.env ?? getCloudflareEnv()`, and
-    // an explicit empty `args.env` short-circuits the `??` so the reloaded
-    // CLOUDFLARE_ENV can never select a named env. Assert every call carries it and
-    // the pinned account stays the top-level one.
-    setup(JSON.stringify({ account_id: 'top-level-acct', name: 'app' }));
-    const prevEnv = process.env.CLOUDFLARE_ENV;
-    process.env.CLOUDFLARE_ENV = 'staging'; // as if repopulated from a project .env
-    try {
-      let created = false;
-      const { run, calls } = makeRunner([
-        { match: /^d1 list --json/, reply: () => ok('[]') },
-        {
-          match: /^d1 create /,
-          reply: () => {
-            simulateUpdateConfig('d1_databases', {
-              binding: 'DB',
-              database_name: 'myapp-db',
-              database_id: uuid('created'),
-            });
-            return ok();
-          },
-        },
-        {
-          match: /^queues info jobs/,
-          reply: () =>
-            created ? ok('Queue Name: jobs') : fail('', 'Queue "jobs" does not exist.'),
-        },
-        {
-          match: /^queues create jobs/,
-          reply: () => {
-            created = true;
-            return ok();
-          },
-        },
-      ]);
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' }, queues: ['jobs'] },
-        { runWrangler: run, log: silentLog },
-      );
-      // EVERY invocation forces top-level via the explicit empty `--env=` token, so
-      // discovery/create cannot drift to the staging env's account.
-      expect(calls.length).toBeGreaterThan(0);
-      for (const argv of calls) {
-        expect(argv).toContain('--env=');
-      }
-      // No cross-account drift: the top-level account remains pinned.
-      expect(readConfig().account_id).toBe('top-level-acct');
-    } finally {
-      if (prevEnv === undefined) {
-        delete process.env.CLOUDFLARE_ENV;
-      } else {
-        process.env.CLOUDFLARE_ENV = prevEnv;
-      }
-    }
-  });
-});
-
-describe('provisionCloudflareResources — boundary account fence', () => {
-  it('fails closed BEFORE any INJECTED seam call when no account is resolvable', async () => {
-    // The prior fence was gated on `!opts.runWrangler`, so an INJECTED runWrangler /
-    // Hyperdrive lister did remote work with no effective (persisted) account — a
-    // partial run under one account, retry under another with no reconciliation. The
-    // boundary fence now fires unconditionally.
-    setup(JSON.stringify({ name: 'app' })); // no account_id
-    const prev = process.env.CLOUDFLARE_ACCOUNT_ID;
-    delete process.env.CLOUDFLARE_ACCOUNT_ID; // no ambient account either
-    try {
-      let restCalled = false;
-      const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-      await expect(
-        provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          {
-            ...emptyDesired,
-            hyperdrive: {
-              binding: 'HYPERDRIVE',
-              name: 'myapp-hd',
-              connectionString: 'postgres://x',
-            },
-          },
-          {
-            runWrangler: run, // INJECTED — old fence skipped this path
-            log: silentLog,
-            listHyperdriveConfigs: async () => {
-              restCalled = true;
-              return [];
-            },
-          },
-        ),
-      ).rejects.toThrow(/no Cloudflare account is resolvable/);
-      // No wrangler call, no REST call, and nothing persisted — fence is at the boundary.
-      expect(calls).toEqual([]);
-      expect(restCalled).toBe(false);
-      expect(readConfig().account_id).toBeUndefined();
-    } finally {
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = prev;
-      }
-    }
-  });
-});
-
-describe('provisionCloudflareResources — absolute config path', () => {
-  it('resolves a RELATIVE rootWranglerPath against root (not cwd) so reads + wrangler ops target ONE file', async () => {
-    // root !== process.cwd(): a bare relative config path would make Node reads/writes
-    // resolve against cwd while the default wrangler (cwd: root) resolves `-c` against
-    // root — a split (inspect one file, create against another). The provisioner
-    // resolves the path to an ABSOLUTE one against `root` ONCE, up front.
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' })); // at tmpDir/wrangler.jsonc
-    const relPath = 'wrangler.jsonc'; // relative to root (tmpDir), NOT to process.cwd()
-    const abs = join(tmpDir, relPath);
-    const { run, calls } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir, // root — absolute, and different from process.cwd()
-      relPath, // RELATIVE config path
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-      { runWrangler: run, log: silentLog },
-    );
-    // Returned + threaded config path is the absolute resolution against root.
-    expect(result.configPath).toBe(toSlash(abs));
-    expect(calls.length).toBeGreaterThan(0);
-    for (const argv of calls) {
-      const i = argv.indexOf('-c');
-      expect(i).toBeGreaterThanOrEqual(0);
-      expect(argv[i + 1]).toBe(toSlash(abs)); // wrangler `-c` is the SAME absolute file
-    }
-    // The adopted id landed in root/wrangler.jsonc — the file Node read from too.
-    const after = parseJsoncRaw(readFileSync(abs, 'utf-8')) as Record<string, unknown>;
-    expect((after.kv_namespaces as Array<Record<string, unknown>>)[0].id).toBe(hex32('kv'));
-  });
-});
-
-describe('provisionCloudflareResources — one D1 normalizer', () => {
-  it('fails closed on CONFLICTING name aliases (name vs database_name) for the requested database', async () => {
-    // The exact scenario: a list member claims the requested name via `name` but its
-    // `database_name` disagrees. The old two-helper split SELECTED it by `name` yet
-    // normalized its identity under `database_name` — adopting a WRONG identity. The one
-    // normalizer rejects the conflict (fail closed, no adopt/create).
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () =>
-          ok(
-            JSON.stringify([
-              { name: 'myapp-db', database_name: 'other-db', database_id: uuid('the-id') },
-            ]),
-          ),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/ambiguous or empty id/);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-    expect(readConfig().d1_databases).toBeUndefined();
-  });
-
-  it('fails closed when TWO list entries both match the requested name (ambiguous)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () =>
-          ok(
-            JSON.stringify([
-              { name: 'myapp-db', database_id: uuid('id-1') },
-              { name: 'myapp-db', database_id: uuid('id-2') },
-            ]),
-          ),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/2 D1 databases named/);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('adopts the single unambiguous match (agreeing aliases + uuid) — no create', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () =>
-          ok(
-            JSON.stringify([{ name: 'myapp-db', database_name: 'myapp-db', uuid: uuid('theid') }]),
-          ),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: uuid('theid') });
-    const d1 = readConfig().d1_databases as Array<Record<string, unknown>>;
-    expect(d1[0].database_id).toBe(uuid('theid'));
-  });
-});
-
-describe('provisionCloudflareResources — transport account context', () => {
-  it('threads the reconciled account into EVERY wrangler call AND the Hyperdrive lister', async () => {
-    // Config pins the account → it is the reconciled effective account (config wins
-    // over the ambient CLOUDFLARE_ACCOUNT_ID). Every seam invocation must receive it.
-    setup(JSON.stringify({ account_id: 'reconciled-acct' }));
-    const seenRunAccounts: Array<string> = [];
-    const seenListAccounts: Array<string> = [];
-    const run: RunWrangler = provisionOperationFixture((args, opts) => {
-      seenRunAccounts.push(opts.accountId);
-      const sub = args.join(' ');
-      if (/^d1 list --json/.test(sub)) {
-        return ok('[]');
-      }
-      if (/^d1 create /.test(sub)) {
-        simulateUpdateConfig('d1_databases', {
-          binding: 'DB',
-          database_name: 'myapp-db',
-          database_id: uuid('dbid'),
-        });
-        return ok();
-      }
-      if (/^kv namespace list/.test(sub)) {
-        return ok('[]');
-      }
-      if (/^kv namespace create /.test(sub)) {
-        simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: hex32('kvid') });
-        return ok();
-      }
-      return ok();
-    });
-    await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        d1: { binding: 'DB', name: 'myapp-db' },
-        kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
-        // Empty connection string → only the existence check runs (no create), so the
-        // lister IS invoked and records the account it was called with.
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-      },
-      {
-        runWrangler: run,
-        log: silentLog,
-        listHyperdriveConfigs: async ({ accountId }) => {
-          seenListAccounts.push(accountId);
-          return [];
-        },
-      },
-    );
-    expect(seenRunAccounts.length).toBeGreaterThan(0);
-    for (const acct of seenRunAccounts) {
-      expect(acct).toBe('reconciled-acct');
-    }
-    expect(seenListAccounts).toEqual(['reconciled-acct']);
-  });
-});
-
-describe('provisionCloudflareResources — boundary duplicate-member guard', () => {
-  it('fails closed at entry on a config with duplicate kv_namespaces members — NO wrangler/REST calls', async () => {
-    // jsonc-parser.parse() (used by readRootConfig) silently resolves a duplicate to
-    // the LAST member, so without the boundary guard a `kv namespace create` could
-    // orphan or a reuse be false. The SAME strict detector the writer uses runs at the
-    // provisioner boundary — before account persistence, discovery, or any remote work.
-    setup(`{
-  "account_id": "acct",
-  "kv_namespaces": [{ "binding": "KV", "id": "aaa" }],
-  "kv_namespaces": [{ "binding": "KV", "id": "bbb" }]
-}`);
-    let restCalled = false;
-    const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => {
-            restCalled = true;
-            return [];
-          },
-        },
-      ),
-    ).rejects.toThrow(/duplicate key "kv_namespaces"/);
-    expect(calls).toEqual([]);
-    expect(restCalled).toBe(false);
-  });
-});
-
-describe('provisionCloudflareResources — Hyperdrive list validation at the caller', () => {
-  const hdDesired: DesiredResourceSet = {
-    ...emptyDesired,
-    hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-  };
-
-  function provisionWithInjectedList(list: Array<unknown>): Promise<unknown> {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-    return provisionCloudflareResources(tmpDir, wranglerPath, hdDesired, {
-      runWrangler: run,
-      log: silentLog,
-      // The injected lister LIES about its return type — the caller-side validator must
-      // reject the malformed shape at runtime rather than adopt an empty/garbage id.
-      listHyperdriveConfigs: async () => list as never,
-    });
-  }
-
-  it('fails closed on an injected entry with an EMPTY id — never adopts', async () => {
-    await expect(provisionWithInjectedList([{ id: '', name: 'myapp-hd' }])).rejects.toThrow(
-      /malformed config entry/,
-    );
-    expect(readConfig().hyperdrive).toBeUndefined();
-  });
-
-  it('fails closed on a non-object member', async () => {
-    await expect(provisionWithInjectedList([null])).rejects.toThrow(/malformed config entry/);
-    expect(readConfig().hyperdrive).toBeUndefined();
-  });
-
-  it('fails closed on a duplicate id across members', async () => {
-    await expect(
-      provisionWithInjectedList([
-        { id: hex32('dup'), name: 'other' },
-        { id: hex32('dup'), name: 'myapp-hd' },
-      ]),
-    ).rejects.toThrow(/duplicate config id/);
-    expect(readConfig().hyperdrive).toBeUndefined();
-  });
-
-  it('fails closed on 2 configs sharing the requested name (ambiguous)', async () => {
-    await expect(
-      provisionWithInjectedList([
-        { id: hex32('x'), name: 'myapp-hd' },
-        { id: hex32('y'), name: 'myapp-hd' },
-      ]),
-    ).rejects.toThrow(/share that name/);
-    expect(readConfig().hyperdrive).toBeUndefined();
-  });
-
-  it('fails closed on a NON-matching member with a malformed id (no create)', async () => {
-    // A member for a DIFFERENT config carries a bogus (non-hex) id. Previously this passed
-    // the whole-list gate (only the name-matched member was format-checked), so an ABSENT
-    // target authorized a blind create against a possibly-untrustworthy list. Now every
-    // member's id is format-validated up front → fail closed, NO create.
-    await expect(
-      provisionWithInjectedList([{ id: 'bogus', name: 'someone-else' }]),
-    ).rejects.toThrow(/malformed id "bogus".*32-character hex Hyperdrive id/s);
-    expect(readConfig().hyperdrive).toBeUndefined();
-  });
-
-  // A runtime null/undefined/non-array OUTER result must be treated as UNKNOWN
-  // (never coerced to "empty" = confirmed absence), so it fails closed BEFORE any
-  // create instead of authorizing a blind `hyperdrive create` on a same-named config.
-  for (const [label, bad] of [
-    ['null', null],
-    ['undefined', undefined],
-    ['a non-array object', { configs: [] }],
-    ['a string', 'nope'],
-  ] as const) {
-    it(`fails closed (no create) when the lister returns ${label}`, async () => {
-      setup(JSON.stringify({ account_id: 'acct' }));
-      const { run, calls } = makeRunner([{ match: /.*/, reply: () => ok() }]);
-      await expect(
-        provisionCloudflareResources(tmpDir, wranglerPath, hdDesired, {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => bad as never,
-        }),
-      ).rejects.toThrow(/cannot verify whether Hyperdrive config "myapp-hd"/);
-      // No blind create, and nothing written to the config.
-      expect(calls.some((c) => isCall(c, 'hyperdrive', 'create'))).toBe(false);
-      expect(readConfig().hyperdrive).toBeUndefined();
-    });
-  }
-});
-
-describe('provisionCloudflareResources — whole-list id-format gate (D1 + KV, before name filtering)', () => {
-  it('D1: a NON-matching list member with a malformed id fails the whole list closed (no create)', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run, calls } = makeRunner([
-      // A different database with a bogus (non-UUID) id. Target "myapp-db" is absent, but
-      // the untrustworthy member must reject the list rather than authorize a create.
-      {
-        match: /^d1 list --json/,
-        reply: () => ok(JSON.stringify([{ name: 'other', database_id: 'bogus' }])),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/no valid id/);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('KV: a NON-matching list member with a malformed id fails the whole list closed (no create)', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => ok(JSON.stringify([{ title: 'other', id: 'bogus' }])),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/no valid id/);
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(false);
-  });
-
-  it('D1: a well-formed non-matching member still allows the target to be created (absence is authoritative)', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () => ok(JSON.stringify([{ name: 'other', database_id: uuid('other') }])),
-      },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('mine'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources).toEqual([
-      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'created' },
-    ]);
-  });
-});
-
-describe('provisionCloudflareResources — strict duplicate-safe binding reader', () => {
-  it('read-first fails closed on DUPLICATE same-binding entries in the target field (not reused)', async () => {
-    // Two d1_databases entries share binding "DB" — the old first-match `.find()` would
-    // silently pick one and report `reused`. The strict reader fails closed.
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        d1_databases: [
-          { binding: 'DB', database_id: uuid('a'), database_name: 'myapp-db' },
-          { binding: 'DB', database_id: uuid('b'), database_name: 'myapp-db' },
-        ],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/binding "DB" is declared 2 times in "d1_databases"/);
-    // Failed closed before any wrangler call — never reused/created.
-    expect(calls.length).toBe(0);
-  });
-
-  it('read-first fails closed on a CROSS-TYPE collision (binding used by another field) — not reused', async () => {
-    // Binding "DB" is bound to BOTH a d1_databases entry AND a kv_namespaces entry — an
-    // undeployable config wrangler rejects. Reading the D1 entry must fail closed (via the
-    // reused Task-3 collision collector) rather than report `reused` on a broken config.
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        d1_databases: [{ binding: 'DB', database_id: uuid('a'), database_name: 'myapp-db' }],
-        kv_namespaces: [{ binding: 'DB', id: hex32('kv') }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/binding "DB" in "d1_databases" is also used by a KV Namespace binding/);
-    expect(calls.length).toBe(0);
-  });
-
-  it('read-first fails closed when a QUEUE PRODUCER collides with the binding (cross-type) — not reused', async () => {
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        kv_namespaces: [{ binding: 'CACHE', id: hex32('cache') }],
-        queues: { producers: [{ binding: 'CACHE', queue: 'jobs' }] },
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'CACHE', title: 'cache' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/binding "CACHE" in "kv_namespaces" is also used by a Queue binding/);
-    expect(calls.length).toBe(0);
-  });
-
-  it('reuses cleanly when the binding is unique across the worker (no false collision)', async () => {
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        d1_databases: [{ binding: 'DB', database_id: uuid('db'), database_name: 'myapp-db' }],
-        kv_namespaces: [{ binding: 'CACHE', id: hex32('cache') }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources).toEqual([
-      { kind: 'd1', binding: 'DB', name: 'myapp-db', action: 'reused', id: uuid('db') },
-    ]);
-    // Reused via read-first — no discovery/create.
-    expect(calls.some((c) => isCall(c, 'd1', 'list'))).toBe(false);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-});
-
-describe('provisionCloudflareResources — resource-specific create postcondition', () => {
-  it('R2: fails closed when create writes a DIFFERENT bucket_name than requested', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'The specified bucket does not exist. [code: 10006]'),
-      },
-      {
-        match: /^r2 bucket create /,
-        reply: () => {
-          // create "succeeds" but writes a DIFFERENT bucket than requested (a race /
-          // stale --update-config / wrong-account write). bucket_name IS the identity.
-          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'other-bucket' });
-          return ok();
-        },
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/does not hold the expected R2 bucket .*bucket_name === "myapp-uploads"/s);
-  });
-
-  it('D1: fails closed when create writes a real id but a MISMATCHED database_name', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'other-db',
-            database_id: 'real-id',
-          });
-          return ok();
-        },
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/does not hold the expected D1 database .*database_name === "myapp-db"/s);
-  });
-});
-
-describe('provisionCloudflareResources — resource-specific real-id validators', () => {
-  it('KV: an id of " " is NOT real — runs discovery instead of read-first reuse', async () => {
-    setup(JSON.stringify({ account_id: 'acct', kv_namespaces: [{ binding: 'KV', id: ' ' }] }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^kv namespace list/,
-        reply: () => ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }])),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'list'))).toBe(true);
-    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: hex32('kv') });
-  });
-
-  it('D1: an id of "xyz" is NOT real — runs discovery instead of read-first reuse', async () => {
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: 'xyz' }],
-      }),
-    );
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () => ok(JSON.stringify([{ name: 'myapp-db', database_id: uuid('db') }])),
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'd1', 'list'))).toBe(true);
-    expect(result.resources[0]).toMatchObject({ action: 'adopted', id: uuid('db') });
-  });
-
-  it('KV: create postcondition FAILS when --update-config wrote a non-hex id', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      {
-        match: /^kv namespace create/,
-        reply: () => {
-          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: 'not-a-real-id' });
-          return ok();
-        },
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/does not hold the expected KV namespace/);
-  });
-
-  it('D1: a correctly-formatted UUID is accepted as read-first reuse (no wrangler call)', async () => {
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db') }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources[0]).toMatchObject({ action: 'reused', id: uuid('db') });
-    expect(calls.some((c) => isCall(c, 'd1', 'list'))).toBe(false);
-  });
-});
-
-describe('provisionCloudflareResources — KV title grammar vs option-injection guard', () => {
-  it('accepts a KV title with spaces ("My Own Namespace") and passes it as ONE literal argv element', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run, calls } = makeRunner([
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      {
-        match: /^kv namespace create/,
-        reply: () => {
-          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: hex32('kv') });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'My Own Namespace' }] },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources[0]).toMatchObject({ kind: 'kv', action: 'created' });
-    const createCall = calls.find((c) => isCall(c, 'kv', 'namespace', 'create'));
-    expect(createCall).toContain('My Own Namespace'); // single token, not split on spaces
-  });
-
-  it('rejects a leading-"-" name for every resource kind before any wrangler call', async () => {
-    const desireds = [
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: '--help' }] },
-      { ...emptyDesired, d1: { binding: 'DB', name: '-x' } },
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: '-b' } },
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HD', name: '--config', connectionString: 'postgres://x' },
-      },
-      { ...emptyDesired, queues: ['-q'] },
-    ];
-    for (const desired of desireds) {
-      setup(JSON.stringify({ account_id: 'acct' }));
-      const { run, calls } = makeRunner([]);
-      await expect(
-        provisionCloudflareResources(tmpDir, wranglerPath, desired, {
-          runWrangler: run,
-          log: silentLog,
-        }),
-      ).rejects.toThrow(/unsafe|refusing to pass/);
-      expect(calls.length).toBe(0);
-    }
-  });
-
-  it('rejects an R2 bucket name with invalid characters (uppercase/underscore)', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'My_Bucket' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/invalid R2 bucket name/);
-    expect(calls.length).toBe(0);
-  });
-});
-
-describe('provisionCloudflareResources — queue name grammar (Cloudflare Queues)', () => {
-  const provisionQueue = (name: string): Promise<unknown> => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const { run, calls } = makeRunner([
-      { match: /^queues info /, reply: () => ok(`Queue Name: ${name}`) },
-    ]);
-    return provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, queues: [name] },
-      { runWrangler: run, log: silentLog },
-    ).then((r) => {
-      // Return the calls so accepted-name tests can assert wrangler was reached.
-      (r as { _calls?: unknown })._calls = calls;
-      return r;
-    });
-  };
-
-  // Underscores are NOT allowed; a trailing separator is NOT allowed; > 63 chars rejected.
-  for (const bad of ['jobs_v2', 'jobs_', 'jobs-', '_jobs', '-jobs', 'a'.repeat(64)]) {
-    it(`rejects the invalid queue name ${JSON.stringify(bad)} before any wrangler call`, async () => {
-      setup(JSON.stringify({ account_id: 'acct' }));
-      const { run, calls } = makeRunner([]);
-      await expect(
-        provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          { ...emptyDesired, queues: [bad] },
-          { runWrangler: run, log: silentLog },
-        ),
-      ).rejects.toThrow(/unsafe queue name|invalid queue name/);
-      expect(calls.length).toBe(0);
-    });
-  }
-
-  // Valid: single alphanumeric, 63 chars, and internal dashes.
-  for (const good of ['a', 'Q9', 'a'.repeat(63), 'jobs-v2', 'my-queue-1']) {
-    it(`accepts the valid queue name ${JSON.stringify(good)} (reaches wrangler)`, async () => {
-      const result = (await provisionQueue(good)) as {
-        resources: Array<{ kind: string; action: string }>;
-        _calls: Array<Array<string>>;
-      };
-      expect(result.resources).toEqual([{ kind: 'queue', name: good, action: 'reused' }]);
-      expect(result._calls.some((c) => isCall(c, 'queues', 'info'))).toBe(true);
-    });
-  }
-});
-
-describe('provisionCloudflareResources — whole-provision cross-process lock (proper-lockfile)', () => {
-  // proper-lockfile uses a synthetic adjacent identity without creating that pathname;
-  // the actual mutex is a `${target}.lock` DIRECTORY and is removed on release.
-  const lockTarget = `${wranglerPath}.void-provision.lock`;
-  const recoveryTarget = `${lockTarget}.recovery`;
-  const lockMutex = `${lockTarget}.lock`;
-  const recoveryMutex = `${recoveryTarget}.lock`;
-  const delay = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));
-
-  it('a SECOND in-process provision fails fast with a clear hard error (at most one per process)', async () => {
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    let createCalls = 0;
-    const run: RunWrangler = provisionOperationFixture((args) => {
-      if (isCall(args, 'hyperdrive', 'create')) {
-        createCalls++;
-        simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('hd-1') });
-        return ok();
-      }
-      return ok();
-    });
-    const desired = {
-      ...emptyDesired,
-      hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-    };
-    const opts = {
-      runWrangler: run,
-      log: silentLog,
-      // Keep the first provision ACTIVE long enough that the second demonstrably starts
-      // while it runs (the guard is taken synchronously at entry regardless).
-      listHyperdriveConfigs: async (): Promise<Array<never>> => {
-        await delay(60);
-        return [];
-      },
-    };
-    const first = provisionCloudflareResources(tmpDir, wranglerPath, desired, opts);
-    // The second provision starts while the first is active → the process-wide guard
-    // rejects it OUTRIGHT (no lock contention, no wrangler work, no config read).
-    await expect(provisionCloudflareResources(tmpDir, wranglerPath, desired, opts)).rejects.toThrow(
-      /a provision is already active in this process.*run provisions sequentially/s,
-    );
-    const result = await first;
-    expect(result.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
-    expect(createCalls).toBe(1);
-    // Mutex always released — no leak; and the slot freed: a THIRD (sequential) run works.
-    expect(existsSync(lockMutex)).toBe(false);
-    const third = await provisionCloudflareResources(tmpDir, wranglerPath, desired, opts);
-    expect(third.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('reused');
-    expect(createCalls).toBe(1);
-  });
-
-  it('leaves no persistent marker files and lets different app configs lock concurrently', async () => {
-    setup(JSON.stringify({ name: 'app-a' }));
-    const otherDir = join(tmpDir, 'other-app');
-    const otherConfig = join(otherDir, 'wrangler.jsonc');
-    const otherLockTarget = `${otherConfig}.void-provision.lock`;
-    const otherRecoveryTarget = `${otherLockTarget}.recovery`;
-    mkdirSync(otherDir, { recursive: true });
-    writeFileSync(otherConfig, JSON.stringify({ name: 'app-b' }));
-
-    const first = await acquireProvisionLock(wranglerPath, { retries: 0 });
-    const second = await acquireProvisionLock(otherConfig, { retries: 0 });
-    try {
-      // Both are held at once: lock identity is per canonical config, not machine-global.
-      expect(existsSync(lockMutex)).toBe(true);
-      expect(existsSync(`${otherLockTarget}.lock`)).toBe(true);
-      // Synthetic identities never materialize as empty files in either project.
-      expect(existsSync(lockTarget)).toBe(false);
-      expect(existsSync(recoveryTarget)).toBe(false);
-      expect(existsSync(otherLockTarget)).toBe(false);
-      expect(existsSync(otherRecoveryTarget)).toBe(false);
-    } finally {
-      await Promise.all([first.release(), second.release()]);
-    }
-
-    expect(existsSync(lockMutex)).toBe(false);
-    expect(existsSync(recoveryMutex)).toBe(false);
-    expect(existsSync(`${otherLockTarget}.lock`)).toBe(false);
-    expect(existsSync(`${otherRecoveryTarget}.lock`)).toBe(false);
-  });
-
-  it('two concurrent provisions in SEPARATE processes race — exactly ONE create, the other reuses, mutex released', async () => {
-    // With at most one provision per process, concurrent provisioning is a
-    // CROSS-process story by definition, so the serialization proof runs two REAL node
-    // processes racing the same config under the on-disk whole-provision lock.
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    const probe = join(tmpDir, 'race-probe.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      probe,
-      `import { readFileSync, writeFileSync } from 'node:fs';\n` +
-        `import { provisionCloudflareResources } from ${JSON.stringify(provisionUrl)};\n` +
-        `const cfgPath = ${JSON.stringify(wranglerPath)};\n` +
-        `const run = (args) => {\n` +
-        `  if (args.type === 'hyperdrive.create') {\n` +
-        `    const cfg = JSON.parse(readFileSync(cfgPath, 'utf-8'));\n` +
-        `    cfg.hyperdrive = [{ binding: 'HYPERDRIVE', id: process.argv[2] }];\n` +
-        `    writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));\n` +
-        `  }\n` +
-        `  return { stdout: '', stderr: '', status: 0 };\n` +
-        `};\n` +
-        `provisionCloudflareResources(${JSON.stringify(tmpDir)}, cfgPath, {\n` +
-        `  kvNamespaces: [],\n` +
-        `  queues: [],\n` +
-        `  hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },\n` +
-        `}, {\n` +
-        `  runWrangler: run,\n` +
-        `  log: { info: () => {}, warn: () => {} },\n` +
-        `  // Barrier: the winner holds the lock while LISTING, so the loser must block\n` +
-        `  // on the on-disk lock (proving the LOCK, not sequencing, serializes them).\n` +
-        `  listHyperdriveConfigs: () => new Promise((r) => setTimeout(() => r([]), 300)),\n` +
-        `}).then(\n` +
-        `  (res) => console.log('ACTION:' + res.resources.find((r) => r.kind === 'hyperdrive').action),\n` +
-        `  (err) => { console.log('REJECTED:' + err.message); process.exitCode = 7; },\n` +
-        `);\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const runChild = (id: string): Promise<{ code: number | null; stdout: string }> =>
-      new Promise((res) => {
-        const child = spawn(process.execPath, [probe, hex32(id)], {
-          cwd: tmpDir,
-          stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        let stdout = '';
-        child.stdout.setEncoding('utf-8');
-        child.stdout.on('data', (chunk: string) => {
-          stdout += chunk;
-        });
-        child.on('close', (code) => res({ code, stdout }));
-      });
-    const [a, b] = await Promise.all([runChild('hd-a'), runChild('hd-b')]);
-    expect(a.code).toBe(0);
-    expect(b.code).toBe(0);
-    const actions = [a.stdout, b.stdout].map((s) => s.match(/ACTION:(\w+)/)?.[1]).sort();
-    // Exactly one create; the loser's read-first (under the lock) reused the winner's id.
-    expect(actions).toEqual(['created', 'reused']);
-    // Mutex always released — no leak.
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 30_000);
-
-  it('recovers a STALE/abandoned lock (old mtime, crashed owner) and proceeds', async () => {
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    // Simulate a crashed owner's abandoned mutex dir whose mtime is well past the 120s
-    // stale window, so proper-lockfile compromises + steals it.
-    mkdirSync(lockMutex);
-    const old = new Date(Date.now() - 300_000);
-    utimesSync(lockMutex, old, old);
-    const { run } = makeRunner([
-      {
-        match: /^hyperdrive create /,
-        reply: () => {
-          simulateUpdateConfig('hyperdrive', { binding: 'HYPERDRIVE', id: hex32('hd-real') });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-      },
-      { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-    );
-    expect(result.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
-    expect(existsSync(lockMutex)).toBe(false);
-  });
-
-  it('always releases the lock even when the provision THROWS (no leak)', async () => {
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    const { run } = makeRunner([{ match: /^hyperdrive create /, reply: () => fail('', 'boom') }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-      ),
-    ).rejects.toThrow(/hyperdrive create myapp-hd.*failed/s);
-    expect(existsSync(lockMutex)).toBe(false);
-  });
-
-  it('acquireProvisionLock serializes — a second acquire waits until the first releases, then proceeds; release always frees it', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const first = await acquireProvisionLock(wranglerPath);
-    expect(existsSync(lockMutex)).toBe(true);
-    let secondAcquired = false;
-    const secondPromise = acquireProvisionLock(wranglerPath).then((lock) => {
-      secondAcquired = true;
-      return lock;
-    });
-    // While the first holds the lock the second cannot acquire (it retries/blocks).
-    await delay(60);
-    expect(secondAcquired).toBe(false);
-    await first.release();
-    const second = await secondPromise;
-    expect(secondAcquired).toBe(true);
-    // Release is idempotent and always frees the mutex.
-    await second.release();
-    await second.release();
-    expect(existsSync(lockMutex)).toBe(false);
-  });
-
-  it('a provision via a SYMLINK ALIAS contends on the SAME canonical lock and reuses the id written via the real path', async () => {
-    // A real config + a symlink alias to it. Both paths hit the SAME underlying file but
-    // via DIFFERENT lexical paths. Without realpath canonicalization each derives its
-    // own mutex dir (`<lexical>.void-provision.lock.lock`), so an alias provision would not
-    // contend on the real path's lock and both could create a duplicate. (Two
-    // provisions can no longer race in ONE process — the identity proof is that the
-    // alias provision blocks on the CANONICAL mutex, plus create-then-reuse across the
-    // two names on the one underlying file.)
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    const aliasName = 'wrangler.alias.jsonc';
-    symlinkSync(wranglerPath, join(tmpDir, aliasName));
-    // Sanity: the alias and the real config canonicalize to the same real file.
-    expect(realpathSync(join(tmpDir, aliasName))).toBe(realpathSync(wranglerPath));
-    let createCalls = 0;
-    const run: RunWrangler = provisionOperationFixture((args) => {
-      if (isCall(args, 'hyperdrive', 'create')) {
-        createCalls++;
-        simulateUpdateConfig('hyperdrive', {
-          binding: 'HYPERDRIVE',
-          id: hex32('hd-' + createCalls),
-        });
-        return ok();
-      }
-      return ok();
-    });
-    const makeProv = (
-      configArg: string,
-      retries?: number,
-    ): Promise<{ resources: Array<{ kind: string; action: string }> }> =>
-      provisionCloudflareResources(
-        tmpDir,
-        configArg,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => [],
-          ...(retries !== undefined ? { lockOptions: { retries } } : {}),
-        },
-      ) as Promise<{ resources: Array<{ kind: string; action: string }> }>;
-    // IDENTITY: while the CANONICAL lock is held, an alias-path provision cannot acquire
-    // (it resolves to the same mutex — pre-fix it would derive its own and proceed).
-    const held = await acquireProvisionLock(realpathSync(wranglerPath));
-    await expect(makeProv(aliasName, 0)).rejects.toThrow(/already being held/);
-    await held.release();
-    // One underlying file: a create via the REAL path is read-first-REUSED via the alias.
-    const a = await makeProv(wranglerPath);
-    const b = await makeProv(aliasName);
-    expect(a.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
-    expect(b.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('reused');
-    expect(createCalls).toBe(1);
-    // The single canonical mutex was released.
-    expect(existsSync(`${realpathSync(wranglerPath)}.void-provision.lock.lock`)).toBe(false);
-  });
-
-  it('a SECOND first-run under a different account fails closed on the persisted pin, no cross-account write', async () => {
-    // Neither run has a config account_id at start. The first run persists its own
-    // account and provisions; the second — reading the now-pinned config — fails closed
-    // on the A≠B mismatch BEFORE any create, so it never rebinds the winner's resources.
-    // (Two provisions can no longer race in ONE process — the guard rejects
-    // the second outright — so the reconciliation contract is proven sequentially; the
-    // cross-process serialization itself is proven by the child-process race test above.)
-    setup(JSON.stringify({ name: 'app' }));
-    const savedAmbient = process.env.CLOUDFLARE_ACCOUNT_ID;
-    delete process.env.CLOUDFLARE_ACCOUNT_ID; // force reconciliation via opts.accountId only
-    try {
-      const makeProv = (account: string): Promise<unknown> => {
-        const run: RunWrangler = provisionOperationFixture((args) => {
-          if (isCall(args, 'd1', 'list')) {
-            return ok('[]');
-          }
-          if (isCall(args, 'd1', 'create')) {
-            simulateUpdateConfig('d1_databases', {
-              binding: 'DB',
-              database_name: 'myapp-db',
-              database_id: uuid('db-' + account),
-            });
-            return ok();
-          }
-          return ok();
-        });
-        return provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-          {
-            runWrangler: run,
-            accountId: account,
-            log: silentLog,
-            listHyperdriveConfigs: async () => [],
-          },
-        );
-      };
-      await makeProv('acct-A');
-      await expect(makeProv('acct-B')).rejects.toThrow(/account mismatch/);
-      // The config stays pinned to the WINNER, with the winner's D1 id — no
-      // cross-account overwrite (the loser never ran a wrangler create).
-      const cfg = readConfig();
-      expect(cfg.account_id).toBe('acct-A');
-      const d1 = (cfg.d1_databases as Array<Record<string, unknown>>)[0];
-      expect(d1.database_id).toBe(uuid('db-acct-A'));
-      // Mutex released — no leak.
-      expect(existsSync(lockMutex)).toBe(false);
-    } finally {
-      if (savedAmbient === undefined) {
-        delete process.env.CLOUDFLARE_ACCOUNT_ID;
-      } else {
-        process.env.CLOUDFLARE_ACCOUNT_ID = savedAmbient;
-      }
-    }
-  });
-
-  it('a wrangler call blocking past a SHORT stale window does NOT let a second process steal the mutex (async heartbeat keeps it fresh)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', kv_namespaces: [{ binding: 'KV', id: 'local' }] }));
-    const run: RunWrangler = provisionOperationFixture(async (args) => {
-      if (isCall(args, 'kv', 'namespace', 'list')) {
-        // blocks (async) longer than the probe below, which is past the 2s stale window
-        await delay(2400);
-        return ok(JSON.stringify([{ id: hex32('kv'), title: 'myapp-kv' }]));
-      }
-      return ok();
-    });
-    const prov = provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }] },
-      { runWrangler: run, log: silentLog, lockOptions: { stale: 2000, update: 1000, retries: 0 } },
-    );
-    // 2.2s into the block — PAST the 2s stale window (proper-lockfile floors stale at 2000
-    // and update at 1000, so 2.2s is the minimum that proves freshness). If the async
-    // heartbeat did not keep the mutex fresh, a retries:0 acquire would STEAL it; it must
-    // be REFUSED instead.
-    await delay(2200);
-    await expect(acquireProvisionLock(wranglerPath, { stale: 2000, retries: 0 })).rejects.toThrow();
-    const result = await prov;
-    expect(result.resources[0]).toMatchObject({ kind: 'kv', action: 'adopted', id: hex32('kv') });
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 15000);
-
-  it('a genuine unlock failure REJECTS the provision (leaked mutex surfaced, not swallowed)', async () => {
-    setup(JSON.stringify({ account_id: 'acct' }));
-    const failingFs = {
-      ...passthruFs,
-      rmdir: (_p: string, cb: (e: Error | null) => void) =>
-        cb(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' })),
-    };
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
-        log: silentLog,
-        lockOptions: { fs: failingFs },
-      }),
-    ).rejects.toThrow(/failed to release the cross-process provision lock/);
-  });
-
-  it('a body failure COMBINED with an unlock failure surfaces BOTH (AggregateError)', async () => {
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    // rmdir fails → the mutex leaks on release; the body also fails (hyperdrive create).
-    const failingFs = {
-      ...passthruFs,
-      rmdir: (_p: string, cb: (e: Error | null) => void) =>
-        cb(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' })),
-    };
-    const { run } = makeRunner([
-      { match: /^hyperdrive create /, reply: () => fail('', 'boom-body') },
-    ]);
-    let caught: unknown;
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => [],
-          lockOptions: { fs: failingFs },
-        },
-      );
-    } catch (error) {
-      caught = error;
-    }
-    expect(caught).toBeInstanceOf(AggregateError);
-    const agg = caught as AggregateError;
-    const messages = agg.errors
-      .map((e) => (e instanceof Error ? e.message : String(e)))
-      .join(' || ');
-    // BOTH the body (hyperdrive create) error AND the leaked-mutex release error surface.
-    expect(messages).toMatch(/hyperdrive create myapp-hd.*failed.*boom-body/s);
-    expect(messages).toMatch(/failed to release the cross-process provision lock/);
-    // The primary body error is also preserved as `cause` for cause-walking loggers.
-    expect((agg.cause as Error).message).toMatch(/hyperdrive create/);
-  });
-});
-
-describe('provisionCloudflareResources — config compliance_region pins the transport', () => {
-  it('resolvePinnedApiBaseUrl honors the config compliance_region (fedramp) with no ambient override', () => {
-    // Config says fedramp_high, no CLOUDFLARE_COMPLIANCE_REGION ambient → the FedRAMP base.
-    expect(resolvePinnedApiBaseUrl({}, 'fedramp_high')).toBe(
-      'https://api.fed.cloudflare.com/client/v4',
-    );
-    // Config "public" → public base; absent config → public base.
-    expect(resolvePinnedApiBaseUrl({}, 'public')).toBe('https://api.cloudflare.com/client/v4');
-    expect(resolvePinnedApiBaseUrl({}, undefined)).toBe('https://api.cloudflare.com/client/v4');
-  });
-
-  it('resolvePinnedApiBaseUrl fails closed on a config-vs-ambient compliance_region conflict', () => {
-    expect(() =>
-      resolvePinnedApiBaseUrl({ CLOUDFLARE_COMPLIANCE_REGION: 'public' }, 'fedramp_high'),
-    ).toThrow(/conflicting values/);
-    // Equal on both sides is fine (no conflict).
-    expect(
-      resolvePinnedApiBaseUrl({ CLOUDFLARE_COMPLIANCE_REGION: 'fedramp_high' }, 'fedramp_high'),
-    ).toBe('https://api.fed.cloudflare.com/client/v4');
-  });
-
-  it('rejects an invalid config compliance_region value', () => {
-    expect(() => resolvePinnedApiBaseUrl({}, 'somewhere')).toThrow(
-      /one of "public" or "fedramp_high"/,
-    );
-  });
-
-  it('a fedramp config pins BOTH the wrangler child env AND the Hyperdrive REST lister to the .fed base', async () => {
-    const prev = process.env.CLOUDFLARE_COMPLIANCE_REGION;
-    delete process.env.CLOUDFLARE_COMPLIANCE_REGION; // no ambient override — config is authoritative
-    setup(
-      JSON.stringify({
-        account_id: 'config-acct',
-        compliance_region: 'fedramp_high',
-        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
-      }),
-    );
-    let seen: { apiBaseUrl: string } | undefined;
-    const calls: Array<Array<string>> = [];
-    const run: RunWrangler = provisionOperationFixture((args, opts) => {
-      calls.push(args);
-      // The wrangler child is pinned to the SAME base via its env transport context.
-      expect(opts.apiBaseUrl).toBe('https://api.fed.cloudflare.com/client/v4');
-      return { stdout: '', stderr: '', status: 0 };
-    });
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async (ctx) => {
-            seen = ctx;
-            return [];
-          },
-        },
-      );
-    } finally {
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_COMPLIANCE_REGION;
-      } else {
-        process.env.CLOUDFLARE_COMPLIANCE_REGION = prev;
-      }
-    }
-    expect(seen?.apiBaseUrl).toBe('https://api.fed.cloudflare.com/client/v4');
-  });
-
-  it('fails closed when the config compliance_region conflicts with an ambient CLOUDFLARE_COMPLIANCE_REGION', async () => {
-    const prev = process.env.CLOUDFLARE_COMPLIANCE_REGION;
-    process.env.CLOUDFLARE_COMPLIANCE_REGION = 'public';
-    setup(
-      JSON.stringify({
-        account_id: 'config-acct',
-        compliance_region: 'fedramp_high',
-        hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }],
-      }),
-    );
-    let listerCalled = false;
-    const { run } = makeRunner([]);
-    try {
-      await expect(
-        provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          {
-            ...emptyDesired,
-            hyperdrive: {
-              binding: 'HYPERDRIVE',
-              name: 'myapp-hd',
-              connectionString: 'postgres://x',
-            },
-          },
-          {
-            runWrangler: run,
-            log: silentLog,
-            listHyperdriveConfigs: async () => {
-              listerCalled = true;
-              return [];
-            },
-          },
-        ),
-      ).rejects.toThrow(/conflicting values/);
-    } finally {
-      if (prev === undefined) {
-        delete process.env.CLOUDFLARE_COMPLIANCE_REGION;
-      } else {
-        process.env.CLOUDFLARE_COMPLIANCE_REGION = prev;
-      }
-    }
-    // Failed closed before any remote work.
-    expect(listerCalled).toBe(false);
-  });
-});
-
-describe('provisionCloudflareResources — wrangler-exact base resolution order', () => {
-  it('an INVALID WRANGLER_API_ENVIRONMENT fails closed (wrangler assertOneOf) instead of pinning prod', () => {
-    // wrangler's env factory has choices ["production","staging"]; a present out-of-choices
-    // value (typo'd "stagng", or an empty string) throws — never silently public production.
-    expect(() => resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: 'stagng' })).toThrow(
-      /WRANGLER_API_ENVIRONMENT.*"production" or "staging".*"stagng"/s,
-    );
-    expect(() => resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: '' })).toThrow(
-      /WRANGLER_API_ENVIRONMENT/,
-    );
-    // An explicit "production" is a valid choice → the public base.
-    expect(resolvePinnedApiBaseUrl({ WRANGLER_API_ENVIRONMENT: 'production' })).toBe(
-      'https://api.cloudflare.com/client/v4',
-    );
-  });
-
-  it('an empty direct base override is honored AS-IS (presence + nullish semantics, like wrangler)', () => {
-    // wrangler: `getCloudflareApiBaseUrlFromEnv() ?? derived` — a PRESENT empty string is
-    // returned (nullish, not falsy, coalescing) and CLOUDFLARE_* presence beats CF_*.
-    expect(resolvePinnedApiBaseUrl({ CLOUDFLARE_API_BASE_URL: '' })).toBe('');
-    expect(
-      resolvePinnedApiBaseUrl({
-        CLOUDFLARE_API_BASE_URL: '',
-        CF_API_BASE_URL: 'https://cf.example',
-      }),
-    ).toBe('');
-    expect(resolvePinnedApiBaseUrl({ CF_API_BASE_URL: '' })).toBe('');
-  });
-
-  it('provisionEnv pins a resolved EMPTY base into the child env (presence, not truthiness)', () => {
-    const env = provisionEnv({ accountId: 'acct', apiBaseUrl: '' });
-    // The child wrangler must see the SAME (empty) override the ambient env carried — never
-    // a scrubbed env that would silently re-derive the default endpoint (split-brain).
-    expect(env.CLOUDFLARE_API_BASE_URL).toBe('');
-  });
-
-  it('a direct base + CONFLICTING compliance settings resolves to the direct base (no false reject)', () => {
-    // wrangler's `??` short-circuits past getComplianceRegionSubdomain when a direct base is
-    // present, so the env-vs-config conflict is never evaluated there.
-    expect(
-      resolvePinnedApiBaseUrl(
-        {
-          CLOUDFLARE_API_BASE_URL: 'https://direct.example',
-          CLOUDFLARE_COMPLIANCE_REGION: 'public',
-        },
-        'fedramp_high',
-      ),
-    ).toBe('https://direct.example');
-    // Same for an invalid STAGING selector — unread on the direct branch.
-    expect(
-      resolvePinnedApiBaseUrl({
-        CLOUDFLARE_API_BASE_URL: 'https://direct.example',
-        WRANGLER_API_ENVIRONMENT: 'stagng',
-      }),
-    ).toBe('https://direct.example');
-  });
-
-  it('the config compliance_region VALUE is still validated with a direct base present (wrangler config validation)', () => {
-    expect(() =>
-      resolvePinnedApiBaseUrl({ CLOUDFLARE_API_BASE_URL: 'https://direct.example' }, 'bogus'),
-    ).toThrow(/one of "public" or "fedramp_high"/);
-  });
-});
-
-describe('provisionCloudflareResources — Hyperdrive password never reaches wrangler diagnostics', () => {
-  it('provisionEnv scrubs the session-output sinks and PINS sanitized logging', () => {
-    const saved: Record<string, string | undefined> = {};
-    const set = (k: string, v: string): void => {
-      saved[k] = process.env[k];
-      process.env[k] = v;
-    };
-    set('WRANGLER_OUTPUT_FILE_PATH', '/tmp/wrangler-output.json');
-    set('WRANGLER_OUTPUT_FILE_DIRECTORY', '/tmp/wrangler-output');
-    set('WRANGLER_LOG_SANITIZE', 'false');
-    try {
-      const env = provisionEnv({ accountId: 'acct' });
-      // Output sinks would persist the raw argv (connection string password included).
-      expect(env.WRANGLER_OUTPUT_FILE_PATH).toBeUndefined();
-      expect(env.WRANGLER_OUTPUT_FILE_DIRECTORY).toBeUndefined();
-      // Sanitized logging is PINNED — an ambient `false` is never passed through.
-      expect(env.WRANGLER_LOG_SANITIZE).toBe('true');
-    } finally {
-      for (const [k, v] of Object.entries(saved)) {
-        if (v === undefined) {
-          delete process.env[k];
-        } else {
-          process.env[k] = v;
-        }
-      }
-    }
-  });
-
-  it('FAILS CLOSED when a project dotenv declares WRANGLER_OUTPUT_FILE_DIRECTORY (would resurrect the argv leak)', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.env'), 'WRANGLER_OUTPUT_FILE_DIRECTORY=/tmp/wrangler-out\n');
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(
-      /refusing to provision.*\.env.*WRANGLER_OUTPUT_FILE_DIRECTORY.*session diagnostics/s,
-    );
-    expect(calls.length).toBe(0);
-  });
-
-  it('FAILS CLOSED when a project dotenv declares WRANGLER_OUTPUT_FILE_PATH', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.env.local'), 'WRANGLER_OUTPUT_FILE_PATH=/tmp/out.json\n');
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/WRANGLER_OUTPUT_FILE_PATH/);
-    expect(calls.length).toBe(0);
-  });
-
-  it('redacts the exact connection string AND URL userinfo passwords from propagated errors', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
-    const { run } = makeRunner([
-      {
-        // The create fails, ECHOING the connection string (verbatim AND re-rendered).
-        match: /^hyperdrive create /,
-        reply: () =>
-          fail(
-            '',
-            `X [ERROR] could not connect using ${conn} ` +
-              `(also tried mysql://dbuser:sup3r-secret@db.example.com/app)`,
-          ),
-      },
-    ]);
-    let thrown: Error | undefined;
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-        },
-        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-      );
-    } catch (error) {
-      thrown = error as Error;
-    }
-    expect(thrown).toBeDefined();
-    // The password never appears — neither via the verbatim echo nor the re-rendered URL.
-    expect(thrown!.message).not.toContain('sup3r-secret');
-    expect(thrown!.message).not.toContain(conn);
-    expect(thrown!.message).toContain('[REDACTED]');
-  });
-
-  it('a seam rejecting a password-bearing plain STRING is redacted before propagation', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
-    // A rejecting runner is supported control flow; pre-fix only `instanceof Error`
-    // rejections were redacted, so this string propagated VERBATIM to the caller.
-    const run: RunWrangler = provisionOperationFixture(() =>
-      Promise.reject(`hyperdrive create failed for ${conn}`),
-    );
-    let thrown: unknown;
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-        },
-        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-      );
-    } catch (error) {
-      thrown = error;
-    }
-    expect(typeof thrown).toBe('string');
-    expect(thrown as string).not.toContain('sup3r-secret');
-    expect(thrown as string).not.toContain(conn);
-    expect(thrown as string).toContain('[REDACTED]');
-  });
-
-  it('an OBJECT rejection has its enumerable string fields (nested + arrays) redacted', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
-    const rejection = {
-      code: 'E_CREATE',
-      detail: `could not connect using ${conn}`,
-      attempts: [`first try: ${conn}`, { url: conn }],
-    };
-    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(rejection));
-    let thrown: unknown;
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-        },
-        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-      );
-    } catch (error) {
-      thrown = error;
-    }
-    // Identity preserved (redacted in place), every string field scrubbed.
-    expect(thrown).toBe(rejection);
-    expect(JSON.stringify(thrown)).not.toContain('sup3r-secret');
-    expect(JSON.stringify(thrown)).toContain('[REDACTED]');
-  });
-
-  it('a QUARANTINE rejection keeps its identity/metadata while its message is redacted', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-    const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-    const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
-    const quarantineError = new WranglerQuarantineError(
-      54321,
-      `kill failed while running hyperdrive create --connection-string=${conn}`,
-    );
-    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
-    let thrown: unknown;
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-        },
-        { runWrangler: run, log: silentLog, listHyperdriveConfigs: async () => [] },
-      );
-    } catch (error) {
-      thrown = error;
-    }
-    // The SAME object propagates (identity + pid metadata preserved — not rebuilt), so
-    // the provision-level quarantine handling still recognized it and RETAINED the lock.
-    expect(thrown).toBe(quarantineError);
-    expect((thrown as WranglerQuarantineError).pid).toBe(54321);
-    expect((thrown as Error).message).not.toContain('sup3r-secret');
-    expect((thrown as Error).message).toContain('[REDACTED]');
-    expect(existsSync(lockMutex)).toBe(true);
-    // Cleanup the retained mutex + sidecar for later tests.
-    rmSync(lockMutex, { recursive: true, force: true });
-    rmSync(sidecar, { force: true });
-  });
-
-  it('a lister rejecting a plain STRING is redacted in the warning', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const warns: Array<string> = [];
-    const { run } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: {
-            binding: 'HYPERDRIVE',
-            name: 'myapp-hd',
-            connectionString: 'postgres://u:leaky-pass@h/db',
-          },
-        },
-        {
-          runWrangler: run,
-          log: { info: () => {}, warn: (msg) => warns.push(msg) },
-          listHyperdriveConfigs: () =>
-            Promise.reject('fetch failed for postgres://u:leaky-pass@h/db'),
-        },
-      ),
-    ).rejects.toThrow(/cannot verify/);
-    const listerWarn = warns.find((w) => w.includes('existence check'));
-    expect(listerWarn).toBeDefined();
-    expect(listerWarn).not.toContain('leaky-pass');
-    expect(listerWarn).toContain('[REDACTED]');
-  });
-
-  it('redacts a userinfo password from the Hyperdrive lister failure warning', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const warns: Array<string> = [];
-    const { run } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: {
-            binding: 'HYPERDRIVE',
-            name: 'myapp-hd',
-            connectionString: 'postgres://u:leaky-pass@h/db',
-          },
-        },
-        {
-          runWrangler: run,
-          log: { info: () => {}, warn: (msg) => warns.push(msg) },
-          listHyperdriveConfigs: async () => {
-            throw new Error('fetch failed for postgres://u:leaky-pass@h/db');
-          },
-        },
-      ),
-    ).rejects.toThrow(/cannot verify/);
-    const listerWarn = warns.find((w) => w.includes('existence check'));
-    expect(listerWarn).toBeDefined();
-    expect(listerWarn).not.toContain('leaky-pass');
-    expect(listerWarn).toContain('[REDACTED]');
-  });
-});
-
-describe('provisionCloudflareResources — redaction carrier: frozen/nested payloads', () => {
-  const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
-  const hyperdriveDesired: DesiredResourceSet = {
-    ...emptyDesired,
-    hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-  };
-
-  async function provisionRejectingWith(rejection: unknown): Promise<unknown> {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(rejection));
-    let thrown: unknown;
-    try {
-      await provisionCloudflareResources(tmpDir, wranglerPath, hyperdriveDesired, {
-        runWrangler: run,
-        log: silentLog,
-        listHyperdriveConfigs: async () => [],
-      });
-    } catch (error) {
-      thrown = error;
-    }
-    expect(thrown).toBeDefined();
-    return thrown;
-  }
-
-  it('a FROZEN Error carrying the secret propagates as a sanitized carrier (no TypeError, no leak)', async () => {
-    // Pre-fix the in-place mutator threw `TypeError: Cannot assign to read only
-    // property 'message'` — and that TypeError's own message EMBEDDED the frozen
-    // error's secret-bearing text, so the redactor itself became the leak.
-    const frozen = Object.freeze(new Error(`connect failed using ${conn}`));
-    const thrown = await provisionRejectingWith(frozen);
-    expect(thrown).toBeInstanceOf(Error);
-    expect((thrown as Error).name).not.toBe('TypeError');
-    const rendered = `${(thrown as Error).message}\n${(thrown as Error).stack ?? ''}`;
-    expect(rendered).not.toContain('sup3r-secret');
-    expect(rendered).toContain('[REDACTED]');
-  });
-
-  it('a FROZEN WranglerQuarantineError still triggers quarantine handling (mutex retained, pid kept, message redacted)', async () => {
-    // Pre-fix the frozen-message assignment threw, REPLACING the quarantine rejection
-    // with a TypeError — classification lost, so the provision RELEASED the lock while
-    // the unconfirmed wrangler child could still be creating resources.
-    const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-    const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-    const frozen = new WranglerQuarantineError(
-      64231,
-      `kill failed while running hyperdrive create --connection-string=${conn}`,
-    );
-    Object.freeze(frozen);
-    const thrown = await provisionRejectingWith(frozen);
-    // Classification + pid metadata survive redaction (captured BEFORE the rebuild)…
-    expect((thrown as { quarantine?: boolean }).quarantine).toBe(true);
-    expect(thrown).toBeInstanceOf(WranglerQuarantineError);
-    expect((thrown as WranglerQuarantineError).pid).toBe(64231);
-    expect((thrown as Error).message).not.toContain('sup3r-secret');
-    expect((thrown as Error).message).toContain('[REDACTED]');
-    // …so the provision-level handling RETAINED the mutex and persisted the sidecar.
-    expect(existsSync(lockMutex)).toBe(true);
-    expect(existsSync(sidecar)).toBe(true);
-    const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
-    expect(recorded.pid).toBe(64231);
-    expect(String(recorded.reason)).not.toContain('sup3r-secret');
-    rmSync(lockMutex, { recursive: true, force: true });
-    rmSync(sidecar, { force: true });
-  });
-
-  it('a secret in the non-enumerable Error.cause is redacted (Object.keys missed it pre-fix)', async () => {
-    const rejection = new Error('outer wrapper failed', {
-      cause: new Error(`cause says ${conn}`),
-    });
-    const thrown = await provisionRejectingWith(rejection);
-    expect(thrown).toBe(rejection); // mutable graph → redacted in place, identity kept
-    const cause = (thrown as Error).cause as Error;
-    expect(cause.message).not.toContain('sup3r-secret');
-    expect(cause.message).toContain('[REDACTED]');
-  });
-
-  it('a secret in the non-enumerable AggregateError.errors is redacted', async () => {
-    const rejection = new AggregateError(
-      [new Error(`member says ${conn}`), `bare member with ${conn}`],
-      'aggregate outer',
-    );
-    const thrown = await provisionRejectingWith(rejection);
-    expect(thrown).toBe(rejection);
-    const members = (thrown as AggregateError).errors as Array<unknown>;
-    expect((members[0] as Error).message).not.toContain('sup3r-secret');
-    expect((members[0] as Error).message).toContain('[REDACTED]');
-    expect(members[1]).not.toContain('sup3r-secret');
-    expect(members[1]).toContain('[REDACTED]');
-  });
-
-  it('a FROZEN plain object (with a frozen nested array) never propagates unsanitized', async () => {
-    // Pre-fix the in-place assignments were silently swallowed by try/catch, so the
-    // frozen object propagated VERBATIM — connection string intact.
-    const frozen = Object.freeze({
-      code: 'E_CREATE',
-      note: `failed using ${conn}`,
-      attempts: Object.freeze([`first try: ${conn}`]),
-    });
-    const thrown = await provisionRejectingWith(frozen);
-    expect(thrown).not.toBe(frozen); // immutable → a sanitized fallback carrier
-    const rendered = JSON.stringify(thrown);
-    expect(rendered).not.toContain('sup3r-secret');
-    expect(rendered).toContain('[REDACTED]');
-    // Structure preserved for diagnostics.
-    expect((thrown as { code?: string }).code).toBe('E_CREATE');
-    expect(Array.isArray((thrown as { attempts?: unknown }).attempts)).toBe(true);
-  });
-
-  it('secrets inside Map values and Set members are redacted (internal slots, freeze-proof)', async () => {
-    const rejection = {
-      detail: new Map<string, unknown>([['url', `via ${conn}`]]),
-      seen: new Set<string>([`attempt ${conn}`]),
-    };
-    const thrown = await provisionRejectingWith(rejection);
-    expect(thrown).toBe(rejection);
-    expect((thrown as typeof rejection).detail.get('url')).not.toContain('sup3r-secret');
-    expect([...(thrown as typeof rejection).seen][0]).not.toContain('sup3r-secret');
-  });
-});
-
-describe('provisionCloudflareResources — hostile values: one no-throw boundary, inert carriers, quarantine-conservative', () => {
-  const conn = 'postgres://dbuser:sup3r-secret@db.example.com:5432/app';
-  const hyperdriveDesired: DesiredResourceSet = {
-    ...emptyDesired,
-    hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-  };
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-
-  async function provisionRejectingWith(rejection: unknown): Promise<unknown> {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(rejection));
-    let thrown: unknown;
-    try {
-      await provisionCloudflareResources(tmpDir, wranglerPath, hyperdriveDesired, {
-        runWrangler: run,
-        log: silentLog,
-        listHyperdriveConfigs: async () => [],
-      });
-    } catch (error) {
-      thrown = error;
-    }
-    expect(thrown).toBeDefined();
-    return thrown;
-  }
-
-  it('a throwing-trap Proxy carrying the secret → inert redacted carrier + QUARANTINE-conservative handling (no release, no leak)', async () => {
-    // Pre-fix `redactRejection` classified the ORIGINAL value before any boundary:
-    // `isQuarantineError`'s `instanceof` invoked this Proxy's getPrototypeOf trap, the
-    // redactor itself THREW the trap's secret-bearing error as the replacement
-    // rejection (classification lost), and the outer path RELEASED the mutex.
-    const hostile = new Proxy(
-      {},
-      {
-        get() {
-          throw new Error(`property trap leaking ${conn}`);
-        },
-        getPrototypeOf() {
-          throw new Error(`prototype trap leaking ${conn}`);
-        },
-        ownKeys() {
-          throw new Error(`ownKeys trap leaking ${conn}`);
-        },
-      },
-    );
-    const thrown = await provisionRejectingWith(hostile);
-    // An INERT fresh carrier — never the Proxy, never a trap error. (Compared via
-    // Object.is: handing the hostile proxy to an expect matcher would itself invoke
-    // its traps.)
-    expect(Object.is(thrown, hostile)).toBe(false);
-    expect(nodeUtilTypes.isProxy(thrown)).toBe(false);
-    expect(thrown).toBeInstanceOf(Error);
-    const rendered = `${(thrown as Error).message}\n${(thrown as Error).stack ?? ''}`;
-    expect(rendered).not.toContain('sup3r-secret');
-    expect(rendered).toMatch(/could not be safely inspected/);
-    // FAIL CLOSED AS QUARANTINE: the value resisted inspection, so it is treated as
-    // potentially-quarantine-bearing…
-    expect((thrown as { quarantine?: boolean }).quarantine).toBe(true);
-    // …and the provision RETAINED the mutex + persisted the sidecar (no release under
-    // a possibly-live child the hostile value could have been hiding).
-    expect(existsSync(lockMutex)).toBe(true);
-    expect(existsSync(sidecar)).toBe(true);
-    const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
-    expect(String(recorded.reason)).not.toContain('sup3r-secret');
-    rmSync(lockMutex, { recursive: true, force: true });
-    rmSync(sidecar, { force: true });
-  });
-
-  it('an accessor that re-mints the secret on later reads → inert carrier (the original is NEVER returned)', async () => {
-    // Pre-fix the in-place walker verified an accessor's CURRENT value and returned the
-    // ORIGINAL when it looked clean — a stateful getter then minted the secret on every
-    // read AFTER redaction (e.g. while being logged).
-    let reads = 0;
-    const rejection = {
-      code: 'E_STATEFUL',
-      get detail(): string {
-        reads += 1;
-        return reads === 1 ? 'first read looks clean' : `later read mints ${conn}`;
-      },
-    };
-    const thrown = await provisionRejectingWith(rejection);
-    expect(thrown).not.toBe(rejection); // accessor-bearing → inert fallback carrier
-    // The carrier holds a redacted SNAPSHOT as a plain data property: repeated reads
-    // can never re-mint the secret.
-    const first = (thrown as { detail?: unknown }).detail;
-    const second = (thrown as { detail?: unknown }).detail;
-    expect(first).toBe(second);
-    expect(String(first)).not.toContain('sup3r-secret');
-    expect(JSON.stringify(thrown)).not.toContain('sup3r-secret');
-    expect((thrown as { code?: string }).code).toBe('E_STATEFUL');
-  });
-
-  it('a benign (non-throwing) Proxy is still converted to an inert carrier, fully redacted', async () => {
-    const target = { note: `failed using ${conn}` };
-    const benignProxy = new Proxy(target, {});
-    const thrown = await provisionRejectingWith(benignProxy);
-    // Never the Proxy itself (its traps would run on every later read)…
-    expect(thrown).not.toBe(benignProxy);
-    expect(nodeUtilTypes.isProxy(thrown)).toBe(false);
-    // …and the copied data is redacted.
-    expect(JSON.stringify(thrown)).not.toContain('sup3r-secret');
-    expect(JSON.stringify(thrown)).toContain('[REDACTED]');
-  });
-
-  it('the Hyperdrive lister warning path never invokes an arbitrary toString (no coercion, no leak, no crash)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    let toStringInvoked = false;
-    const hostileRejection = {
-      message: 42, // non-string → the safe extractor must fall back, never coerce
-      toString(): string {
-        toStringInvoked = true;
-        throw new Error(`hostile toString leaking ${conn}`);
-      },
-    };
-    const warnings: Array<string> = [];
-    const { run } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: conn },
-        },
-        {
-          runWrangler: run,
-          log: { info: () => {}, warn: (msg) => warnings.push(msg) },
-          listHyperdriveConfigs: async () => {
-            throw hostileRejection;
-          },
-        },
-      ),
-    ).rejects.toThrow(/cannot verify whether Hyperdrive config/);
-    // The warning was logged from safely-extracted fields only.
-    expect(toStringInvoked).toBe(false);
-    const logged = warnings.join('\n');
-    expect(logged).toContain('Hyperdrive existence check for myapp-hd failed:');
-    expect(logged).toContain('could not be rendered safely');
-    expect(logged).not.toContain('sup3r-secret');
-    // The lister failure is an ordinary fail-closed path — the mutex was released.
-    expect(existsSync(lockMutex)).toBe(false);
-  });
-});
-
-describe('provisionCloudflareResources — dotenv fence file set + case rule are wrangler-exact', () => {
-  const redirect = 'CLOUDFLARE_API_BASE_URL=https://api.staging.cloudflare.com/client/v4\n';
-
-  it('`.dev.vars.local` no longer blocks — wrangler never loads that file', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.dev.vars.local'), redirect);
-    const { run } = makeRunner([
-      { match: /^d1 list/, reply: () => ok('[]') },
-      {
-        match: /^d1 create/,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('db'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources[0].action).toBe('created');
-  });
-
-  it('detects a redirect var in `.dev.vars.` (the empty-env dev-vars file wrangler probes FIRST)', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.dev.vars.'), redirect);
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/refusing to provision.*"\.dev\.vars\.".*CLOUDFLARE_API_BASE_URL/s);
-    expect(calls.length).toBe(0);
-  });
-
-  it('a benign `.dev.vars.` + a redirect var ONLY in `.dev.vars` is NOT rejected (wrangler never reads the fallback)', async () => {
-    // wrangler's `loadDotDevDotVars` probes `.dev.vars.` FIRST for the empty env and
-    // falls back to `.dev.vars` ONLY when the first is absent — exactly one file is
-    // ever parsed. Pre-fix the fence scanned BOTH, falsely rejecting this config.
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.dev.vars.'), 'SOME_APP_SECRET=benign\n');
-    writeFileSync(join(tmpDir, '.dev.vars'), redirect);
-    const { run } = makeRunner([
-      { match: /^d1 list/, reply: () => ok('[]') },
-      {
-        match: /^d1 create/,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('db'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources[0].action).toBe('created');
-  });
-
-  it('a redirect var in the SELECTED `.dev.vars` (no `.dev.vars.` present) IS rejected', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.dev.vars'), redirect);
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/refusing to provision.*"\.dev\.vars".*CLOUDFLARE_API_BASE_URL/s);
-    expect(calls.length).toBe(0);
-  });
-
-  it('dev-vars keys are case-SENSITIVE on every platform — a mixed-case spelling never trips the fence', () => {
-    // `tryLoadDotDevDotVars` parses via `dotenv.parse` into a PLAIN object;
-    // `caseInsensitiveEnv` applies only to wrangler's `loadDotEnv` (.env family). A
-    // mixed-case key in dev-vars is a DIFFERENT key for wrangler even on win32.
-    setup(JSON.stringify({ name: 'app' }));
-    writeFileSync(join(tmpDir, '.dev.vars'), 'cloudflare_api_base_url=https://evil.example\n');
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).not.toThrow();
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).not.toThrow();
-    // The EXACT spelling still trips it everywhere.
-    writeFileSync(join(tmpDir, '.dev.vars'), 'CLOUDFLARE_API_BASE_URL=https://evil.example\n');
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).toThrow(/\.dev\.vars/);
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).toThrow(/\.dev\.vars/);
-  });
-
-  it('compares variable names case-insensitively on win32 (wrangler loads dotenv into a caseInsensitiveEnv there)', () => {
-    setup(JSON.stringify({ name: 'app' }));
-    writeFileSync(join(tmpDir, '.env'), 'cloudflare_api_base_url=https://evil.example\n');
-    // Simulated win32: the mixed-case key IS the transport var (case-insensitive env).
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).toThrow(
-      /refusing to provision.*\.env/s,
-    );
-    // POSIX: env vars are case-sensitive — the lowercase key is a different variable.
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).not.toThrow();
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'linux')).not.toThrow();
-  });
-
-  it('the win32 case rule also covers the output-file sinks', () => {
-    setup(JSON.stringify({ name: 'app' }));
-    writeFileSync(join(tmpDir, '.env'), 'Wrangler_Output_File_Path=/tmp/out.json\n');
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'win32')).toThrow(
-      /session diagnostics/,
-    );
-    expect(() => assertNoTransportRedirectInProjectDotenv(tmpDir, 'darwin')).not.toThrow();
-  });
-});
-
-describe('provisionEnv — win32 case-insensitive credential scrub', () => {
-  const MIXED_CASE_KEYS = [
-    'Wrangler_Output_File_Path', // output sink — would persist the raw argv (password!)
-    'wrangler_output_file_directory',
-    'cloudflare_api_base_url', // transport redirect
-    'Cf_Api_Base_Url',
-    'Cloudflare_Env',
-    'cf_access_client_id', // CF Access token pair
-    'Cf_Access_Client_Secret',
-    'Wrangler_Log_Sanitize', // pinned key — a mixed-case 'false' must not shadow the pin
-  ] as const;
-
-  function withMixedCaseEnv<T>(fn: () => T): T {
-    const saved: Record<string, string | undefined> = {};
-    for (const key of MIXED_CASE_KEYS) {
-      saved[key] = process.env[key];
-      process.env[key] = key === 'Wrangler_Log_Sanitize' ? 'false' : 'ambient-value';
-    }
-    try {
-      return fn();
-    } finally {
-      for (const key of MIXED_CASE_KEYS) {
-        if (saved[key] === undefined) {
-          delete process.env[key];
-        } else {
-          process.env[key] = saved[key];
-        }
-      }
-    }
-  }
-
-  it('on win32, EVERY case-insensitive spelling of every scrubbed key set is removed before pinning', () => {
-    withMixedCaseEnv(() => {
-      const env = provisionEnv({
-        accountId: 'acct',
-        apiBaseUrl: 'https://api.cloudflare.com/client/v4',
-        platform: 'win32',
-      });
-      // No case variant of any scrubbed key survives — on win32 the child's process.env
-      // is case-insensitive, so `Wrangler_Output_File_Path` WOULD be read as
-      // WRANGLER_OUTPUT_FILE_PATH and wrangler would write the raw argv (with the
-      // Hyperdrive password) to disk.
-      for (const key of MIXED_CASE_KEYS) {
-        expect(env[key]).toBeUndefined();
-      }
-      // The canonical pins are present and unshadowed.
-      expect(env.WRANGLER_LOG_SANITIZE).toBe('true');
-      expect(env.CLOUDFLARE_API_BASE_URL).toBe('https://api.cloudflare.com/client/v4');
-      expect(env.CLOUDFLARE_ACCOUNT_ID).toBe('acct');
-    });
-  });
-
-  it('on POSIX, mixed-case spellings are DIFFERENT variables and survive (exact-case scrub only)', () => {
-    withMixedCaseEnv(() => {
-      const env = provisionEnv({ accountId: 'acct', platform: 'linux' });
-      // POSIX env vars are case-sensitive: these spellings are unrelated variables that
-      // wrangler never reads as the scrubbed keys — leave them alone.
-      expect(env.Wrangler_Output_File_Path).toBe('ambient-value');
-      expect(env.cloudflare_api_base_url).toBe('ambient-value');
-      // The canonical pins still apply.
-      expect(env.WRANGLER_LOG_SANITIZE).toBe('true');
-    });
-  });
-});
-
-describe('provisionCloudflareResources — read-first stored-name identity', () => {
-  it('D1: a stored database_name EQUAL to the desired name is reused (as before)', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db1') }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources[0]).toEqual({
-      kind: 'd1',
-      binding: 'DB',
-      name: 'myapp-db',
-      action: 'reused',
-      id: uuid('db1'),
-    });
-  });
-
-  it('D1: a stored database_name DIFFERENT from the desired name fails closed (no wrangler call, no reuse)', async () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'other-db', database_id: uuid('other') }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(
-      /D1 binding "DB".*stores database_name "other-db".*wants database "myapp-db".*contradicts the desired name/s,
-    );
-    // Fail closed — no discovery/create, config untouched.
-    expect(calls).toEqual([]);
-    expect((readConfig().d1_databases as Array<Record<string, unknown>>)[0].database_id).toBe(
-      uuid('other'),
-    );
-  });
-
-  it('D1: an entry with a real id but NO database_name keeps ID-only reuse', async () => {
-    setup(JSON.stringify({ d1_databases: [{ binding: 'DB', database_id: uuid('db1') }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources[0].action).toBe('reused');
-    expect(result.resources[0].id).toBe(uuid('db1'));
-  });
-
-  it('R2: a stored bucket_name EQUAL to the desired name is reused (as before)', async () => {
-    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'myapp-uploads' }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources[0].action).toBe('reused');
-  });
-
-  it('R2: a stored bucket_name DIFFERENT from the desired name fails closed (contradiction, never silent reuse)', async () => {
-    setup(
-      JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'someone-elses-bucket' }] }),
-    );
-    const { run, calls } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(
-      /R2 binding "STORAGE".*stores bucket_name "someone-elses-bucket".*wants bucket "myapp-uploads".*contradicts the desired bucket/s,
-    );
-    expect(calls).toEqual([]);
-  });
-
-  it('R2: the `default` placeholder bucket_name still takes the discovery path (not a contradiction)', async () => {
-    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }] }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'X [ERROR] The specified bucket does not exist [code: 10006]'),
-      },
-      {
-        match: /^r2 bucket create /,
-        reply: () => {
-          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'myapp-uploads' });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(true);
-    expect(result.resources[0].action).toBe('created');
-  });
-
-  it('R2: a desired bucket named default reuses the matching stored bucket', async () => {
-    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }] }));
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'default' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources[0]).toMatchObject({ kind: 'r2', name: 'default', action: 'reused' });
-    expect(calls).toEqual([]);
-  });
-});
-
-describe('provisionCloudflareResources — per-resource placeholder rules', () => {
-  it('R2: a stored bucket_name of "local" is a REAL name — a different desired bucket fails closed (no silent rewrite)', async () => {
-    // "local" is grammar-valid and is NOT R2's placeholder (only "default" is); the old
-    // shared check treated it as a placeholder, skipped the stored-name contradiction
-    // gate, and silently REWROTE the entry to the desired bucket.
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'local' }],
-      }),
-    );
-    const { run, calls } = makeRunner([
-      { match: /^r2 bucket info /, reply: () => ok(JSON.stringify({ name: 'myapp-storage' })) },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'myapp-storage' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(
-      /R2 binding "STORAGE".*stores.*bucket_name "local".*wants bucket "myapp-storage".*contradicts/s,
-    );
-    // Fail closed: no discovery/create, stored entry untouched.
-    expect(calls).toEqual([]);
-    expect((readConfig().r2_buckets as Array<Record<string, unknown>>)[0].bucket_name).toBe(
-      'local',
-    );
-  });
-
-  it('R2: a stored bucket_name of "local" EQUAL to the desired bucket is reused (real name, no wrangler call)', async () => {
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'local' }],
-      }),
-    );
-    const { run, calls } = makeRunner([]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'local' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls).toEqual([]);
-    expect(result.resources[0]).toEqual({
-      kind: 'r2',
-      binding: 'STORAGE',
-      name: 'local',
-      action: 'reused',
-    });
-  });
-
-  it('R2: a bucket genuinely named "default" is created + verified via the remote probe (no false postcondition failure)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    let created = false;
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () =>
-          created
-            ? ok(JSON.stringify({ name: 'default' }))
-            : fail('', 'X [ERROR] The specified bucket does not exist. [code: 10006]'),
-      },
-      {
-        match: /^r2 bucket create /,
-        reply: () => {
-          created = true;
-          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'default' });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'default' } },
-      { runWrangler: run, log: silentLog },
-    );
-    // Pre-fix the create postcondition rejected `default` as a placeholder and failed a
-    // successful create. Post-fix it verifies via the EXACT remote probe instead.
-    expect(result.resources[0]).toEqual({
-      kind: 'r2',
-      binding: 'STORAGE',
-      name: 'default',
-      action: 'created',
-    });
-    const infoCalls = calls.filter((c) => isCall(c, 'r2', 'bucket', 'info'));
-    expect(infoCalls.length).toBe(2); // the absence probe + the post-create verify probe
-  });
-
-  it('R2: a masked-killed create of a bucket named "default" fails closed when the verify probe cannot confirm it', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { run } = makeRunner([
-      {
-        // Absence first, and STILL absent on the verify probe (the create was masked).
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'X [ERROR] The specified bucket does not exist. [code: 10006]'),
-      },
-      {
-        // The create "succeeds" (exit 0) and even writes the entry — but for the name
-        // `default` that entry is indistinguishable from the local-dev placeholder.
-        match: /^r2 bucket create /,
-        reply: () => {
-          simulateUpdateConfig('r2_buckets', { binding: 'STORAGE', bucket_name: 'default' });
-          return ok();
-        },
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'default' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/did not confirm the bucket exists/);
-  });
-
-  it('D1/KV: the "local" placeholders still take the discovery path (unchanged)', async () => {
-    setup(
-      JSON.stringify({
-        account_id: 'acct',
-        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
-        kv_namespaces: [{ binding: 'KV', id: 'local' }],
-      }),
-    );
-    const { run, calls } = makeRunner([
-      { match: /^d1 list --json/, reply: () => ok('[]') },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('db'),
-          });
-          return ok();
-        },
-      },
-      { match: /^kv namespace list/, reply: () => ok('[]') },
-      {
-        match: /^kv namespace create /,
-        reply: () => {
-          simulateUpdateConfig('kv_namespaces', { binding: 'KV', id: hex32('kv') });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      {
-        ...emptyDesired,
-        d1: { binding: 'DB', name: 'myapp-db' },
-        kvNamespaces: [{ binding: 'KV', title: 'myapp-kv' }],
-      },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(true);
-    expect(calls.some((c) => isCall(c, 'kv', 'namespace', 'create'))).toBe(true);
-    expect(result.resources.map((r) => r.action)).toEqual(['created', 'created']);
-  });
-});
-
-describe('provisionCloudflareResources — D1 whole-list alias reconciliation', () => {
-  it('a NON-target member with a valid uuid but a CONFLICTING/malformed database_id rejects the WHOLE list (no create)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        // The exact repro: `uuid` alone validated under the old any-one-alias gate, and
-        // normalizeD1 returned `other` before reconciling — so this corrupt member
-        // authorized authoritative absence and a create.
-        match: /^d1 list --json/,
-        reply: () =>
-          ok(JSON.stringify([{ name: 'other-db', uuid: uuid('other'), database_id: 'bogus' }])),
-      },
-      { match: /^d1 create /, reply: () => ok() },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/no valid id.*agreeing on one id/s);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('a NON-target member with TWO valid but DISAGREEING alias UUIDs rejects the whole list (no create)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () =>
-          ok(
-            JSON.stringify([
-              { name: 'other-db', uuid: uuid('alias-a'), database_id: uuid('alias-b') },
-            ]),
-          ),
-      },
-      { match: /^d1 create /, reply: () => ok() },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/no valid id/);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-
-  it('a member with AGREEING aliases (uuid === database_id) passes the gate; absence stays authoritative', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { run } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () =>
-          ok(JSON.stringify([{ name: 'other-db', uuid: uuid('same'), database_id: uuid('same') }])),
-      },
-      {
-        match: /^d1 create /,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('mine'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources[0].action).toBe('created');
-  });
-
-  it('the TARGET member with a non-string secondary alias (uuid: 123) fails closed as ambiguous — never adopted', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^d1 list --json/,
-        reply: () => ok(JSON.stringify([{ name: 'myapp-db', database_id: uuid('db'), uuid: 123 }])),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/no valid id/);
-    expect(calls.some((c) => isCall(c, 'd1', 'create'))).toBe(false);
-  });
-});
-
-describe('provisionCloudflareResources — quarantine retains the whole-provision lock', () => {
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-
-  it('a quarantine rejection RETAINS the mutex (not released) and surfaces the quarantine error', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    // A runner whose child could not be confirmed dead — the default runner rejects
-    // with a quarantine error in that state; injecting the same rejection exercises the
-    // provision-level contract: NO release, mutex retained, error surfaced verbatim.
-    const quarantineError = new WranglerQuarantineError(43210, 'test: child unconfirmed');
-    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
-    let thrown: unknown;
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      );
-    } catch (error) {
-      thrown = error;
-    }
-    expect(thrown).toBe(quarantineError);
-    expect((thrown as Error).message).toMatch(/pid 43210/);
-    expect((thrown as Error).message).toMatch(/intentionally RETAINED/);
-    // THE crux: the mutex directory still exists — the lock was NOT released with a
-    // possibly-live wrangler child. (A non-quarantine failure releases it — see the
-    // whole-provision lock suite.)
-    expect(existsSync(lockMutex)).toBe(true);
-    // The quarantine ALSO persisted its owner metadata beside the lock,
-    // so later acquisitions gate on the recorded group instead of stealing by age.
-    const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-    expect(existsSync(sidecar)).toBe(true);
-    const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
-    expect(recorded.pid).toBe(43210);
-    expect(String(recorded.reason)).toMatch(/pid 43210/);
-    // Cleanup: remove the retained mutex + sidecar so later tests can lock again.
-    // quarantine() detached the lock from proper-lockfile's tracking, so no
-    // heartbeat/compromise callback fires after this removal.
-    rmSync(lockMutex, { recursive: true, force: true });
-    rmSync(sidecar, { force: true });
-  });
-
-  it('a NON-quarantine failure still releases the mutex (baseline)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { run } = makeRunner([{ match: /^d1 list/, reply: () => fail('', 'boom') }]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/d1 list.*failed/s);
-    expect(existsSync(lockMutex)).toBe(false);
-  });
-});
-
-/**
- * Windows cannot DELIVER a signal to another process. libuv maps SIGTERM/SIGINT/SIGKILL to
- * `TerminateProcess`, which destroys the target immediately WITHOUT running any handler in it,
- * and a synthetic Ctrl-C would need `GenerateConsoleCtrlEvent` (unreachable from Node). The
- * cases carrying this note drive a real child `node` parent with `kill('SIGTERM')` and then
- * assert on that parent's signal-teardown handler — work that only happens under POSIX signal
- * semantics.
- */
-const WINDOWS_NO_SIGNALS = 'signal delivery to another process is POSIX-only (see note above)';
-
-describe('createDefaultRunWrangler — parent-signal forwarding awaits confirmed teardown', () => {
-  const SIGNAL_TEARDOWN_TMP = join(import.meta.dirname, '.tmp-signal-teardown');
-  beforeEach(() => {
-    rmSync(SIGNAL_TEARDOWN_TMP, { recursive: true, force: true });
-    mkdirSync(SIGNAL_TEARDOWN_TMP, { recursive: true });
-  });
-  afterEach(() => {
-    rmSync(SIGNAL_TEARDOWN_TMP, { recursive: true, force: true });
-  });
-
-  it('SIGTERM to the parent: the child group is confirmed dead BEFORE the parent re-raises and exits', async (ctx) => {
-    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
-    // A REAL parent process (so the re-raise/exit is observable) runs the runner around a
-    // child that exits 250ms AFTER receiving the forwarded SIGTERM. Pre-fix the parent
-    // re-raised immediately — it was dead while the child lived on (proper-lockfile's exit
-    // hook would strip the mutex under a live child). Post-fix the parent awaits the
-    // confirmed teardown, so AT parent exit the child is deterministically gone.
-    const pidFile = join(SIGNAL_TEARDOWN_TMP, 'child.pid');
-    const childScript = join(SIGNAL_TEARDOWN_TMP, 'slow-exit-child.cjs');
-    writeFileSync(
-      childScript,
-      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
-        `process.on('SIGTERM', () => setTimeout(() => process.exit(0), 250));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const parentScript = join(SIGNAL_TEARDOWN_TMP, 'parent.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      parentScript,
-      `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
-        `const run = createDefaultRunWrangler(process.cwd(), {\n` +
-        `  launcher: [process.execPath, ${JSON.stringify(childScript)}, ${JSON.stringify(pidFile)}],\n` +
-        `});\n` +
-        `run({ type: 'd1.list' }, { accountId: 'acct' }).then(\n` +
-        `  (r) => console.log('runner-settled', r.status, r.signal),\n` +
-        `  (e) => console.log('runner-rejected', e.message),\n` +
-        `);\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const parent = spawn(process.execPath, [parentScript], {
-      cwd: SIGNAL_TEARDOWN_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let childPid: number | undefined;
-    try {
-      // Wait until the grandchild wrote its pid (it is alive and hanging).
-      const deadline = Date.now() + 10_000;
-      while (Date.now() < deadline) {
-        if (existsSync(pidFile)) {
-          const raw = readFileSync(pidFile, 'utf-8');
-          if (raw.length > 0) {
-            childPid = Number(raw);
-            break;
-          }
-        }
-        await new Promise((r) => setTimeout(r, 25));
-      }
-      expect(childPid).toBeDefined();
-      // Terminate the PARENT. It must forward to the child's group, await the CONFIRMED
-      // teardown (the child takes ~250ms to exit), and only then re-raise + die.
-      parent.kill('SIGTERM');
-      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
-        parent.on('exit', (code, sig) => res([code, sig]));
-      });
-      // The parent died of the re-raised SIGTERM (default action) — not exit 0.
-      expect(signal).toBe('SIGTERM');
-      // THE crux: at the moment the parent exited, the child was ALREADY dead. Pre-fix
-      // (immediate re-raise) the child would still be alive here for another ~250ms.
-      let childAlive = true;
-      try {
-        process.kill(childPid!, 0);
-      } catch {
-        childAlive = false;
-      }
-      expect(childAlive).toBe(false);
-    } finally {
-      // Belt + braces: never leak processes even on assertion failure.
-      try {
-        parent.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-      if (childPid !== undefined) {
-        try {
-          process.kill(childPid, 'SIGKILL');
-        } catch {
-          // already gone
-        }
-      }
-    }
-  }, 20_000);
-});
-
-describe('createDefaultRunWrangler — normal close confirms the whole GROUP', () => {
-  const GROUP_CLOSE_TMP = join(import.meta.dirname, '.tmp-group-close');
-  beforeEach(() => {
-    rmSync(GROUP_CLOSE_TMP, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
-    mkdirSync(GROUP_CLOSE_TMP, { recursive: true });
-  });
-  afterEach(() => {
-    // Windows may retain the exited child's cwd handle briefly after the
-    // liveness assertion passes. Retry removal without weakening that assertion.
-    rmSync(GROUP_CLOSE_TMP, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
-  });
-
-  it('an exit-0 leader that leaves a SAME-GROUP grandchild alive: the runner resolves only after the group is dead', async () => {
-    // Pre-fix, a normal `close` resolved IMMEDIATELY without probing the detached
-    // process group, so a surviving same-group grandchild (own stdio, so `close` fires
-    // at the leader's exit) kept running after the whole-provision lock was released.
-    const gcPidFile = join(GROUP_CLOSE_TMP, 'gc.pid');
-    const gc = join(GROUP_CLOSE_TMP, 'gc.cjs');
-    writeFileSync(
-      gc,
-      `require('fs').writeFileSync(${JSON.stringify(gcPidFile)}, String(process.pid));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const leader = join(GROUP_CLOSE_TMP, 'leader.cjs');
-    writeFileSync(
-      leader,
-      `const { spawn } = require('child_process');\n` +
-        `const fs = require('fs');\n` +
-        // Same process group (not detached), but its OWN stdio — so the leader's exit
-        // fires `close` while the grandchild lives on in the group.
-        `const c = spawn(process.execPath, [${JSON.stringify(gc)}], { stdio: 'ignore' });\n` +
-        `c.unref();\n` +
-        `setInterval(() => {\n` +
-        `  if (fs.existsSync(${JSON.stringify(gcPidFile)})) { console.log(JSON.stringify({ operationResult: 1 })); process.exit(0); }\n` +
-        `}, 10);\n`,
-    );
-    const run = createDefaultRunWrangler(GROUP_CLOSE_TMP, {
-      launcher: [process.execPath, leader],
-      timeoutMs: 30_000,
-    });
-    const result = await run(operationFixtureRequest(['d1', 'list', '--json']), {
-      accountId: 'acct',
-    });
-    // The leader's own clean exit is reported faithfully...
-    expect(result.status).toBe(0);
-    expect(result.signal).toBeNull();
-    // ...but ONLY once the whole group is confirmed dead: the surviving grandchild was
-    // reaped BEFORE the promise resolved (pre-fix it was still alive here).
-    const gcPid = Number(readFileSync(gcPidFile, 'utf-8'));
-    expect(Number.isInteger(gcPid)).toBe(true);
-    let alive = true;
-    try {
-      process.kill(gcPid, 0);
-    } catch {
-      alive = false;
-    }
-    try {
-      process.kill(gcPid, 'SIGKILL'); // belt + braces: never leak on assertion failure
-    } catch {
-      // already gone
-    }
-    expect(alive).toBe(false);
-  }, 15_000);
-});
-
-describe('acquireProvisionLock — quarantine sidecar gate', () => {
-  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-
-  async function waitForDead(pid: number, timeoutMs: number): Promise<boolean> {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        return true;
-      }
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    return false;
-  }
-
-  it('a quarantined mutex is NOT stealable by age while the recorded group lives (fail closed, sidecar atomic)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { spawn } = await import('node:child_process');
-    // A REAL live process group standing in for the unconfirmed wrangler child.
-    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1 << 30)'], {
-      detached: true,
-      stdio: 'ignore',
-    });
-    try {
-      const lock = await acquireProvisionLock(wranglerPath);
-      lock.quarantine({ pid: child.pid, reason: 'test quarantine (child unconfirmed)' });
-      // The sidecar is complete, valid JSON (atomic tmp+rename — a concurrent gate can
-      // never read partial JSON) with no temp-file leftovers.
-      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
-      expect(recorded).toMatchObject({
-        pid: child.pid,
-        // Windows has no process groups, so `writeQuarantineSidecar` records `null` there by
-        // design and the gate falls back to probing the plain pid.
-        pgid: process.platform === 'win32' ? null : child.pid,
-        reason: 'test quarantine (child unconfirmed)',
-      });
-      expect(typeof recorded.quarantinedAt).toBe('string');
-      expect(readdirSync(tmpDir).filter((f) => f.includes('.tmp-'))).toEqual([]);
-      expect(existsSync(lockMutex)).toBe(true);
-      // Age the retained mutex FAR past any stale window — pre-fix, proper-lockfile's
-      // mtime-stale path deleted + reacquired it here while the child group was alive.
-      const old = new Date(Date.now() - 3_600_000);
-      utimesSync(lockMutex, old, old);
-      await expect(
-        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
-      ).rejects.toThrow(
-        new RegExp(`QUARANTINED.*process group ${child.pid}.*test quarantine`, 's'),
-      );
-      // The gate did NOT clear the quarantine (the group still lives).
-      expect(existsSync(sidecar)).toBe(true);
-      expect(existsSync(lockMutex)).toBe(true);
-    } finally {
-      try {
-        process.kill(-child.pid!, 'SIGKILL');
-      } catch {
-        try {
-          child.kill('SIGKILL');
-        } catch {
-          // already gone
-        }
-      }
-    }
-    expect(await waitForDead(child.pid!, 10_000)).toBe(true);
-  }, 15_000);
-
-  it('once the recorded group is DEAD, the next acquisition clears the sidecar and proceeds', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const { spawn } = await import('node:child_process');
-    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1 << 30)'], {
-      detached: true,
-      stdio: 'ignore',
-    });
-    const lock = await acquireProvisionLock(wranglerPath);
-    lock.quarantine({ pid: child.pid, reason: 'test quarantine' });
-    try {
-      process.kill(-child.pid!, 'SIGKILL');
-    } catch {
-      child.kill('SIGKILL');
-    }
-    expect(await waitForDead(child.pid!, 10_000)).toBe(true);
-    // Backdate the retained mutex so proper-lockfile's ordinary stale lifecycle reclaims
-    // it promptly (the gate itself never removes the mutex directory by hand).
-    const old = new Date(Date.now() - 3_600_000);
-    utimesSync(lockMutex, old, old);
-    const second = await acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 5 });
-    // The gate probed the recorded group dead → cleared the sidecar → acquisition ran.
-    expect(existsSync(sidecar)).toBe(false);
-    await second.release();
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 15_000);
-
-  it('an unreadable/malformed sidecar FAILS CLOSED (cannot verify the recorded owner)', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    writeFileSync(sidecar, '{ not json');
-    await expect(acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 })).rejects.toThrow(
-      /QUARANTINED.*an unrecorded process/s,
-    );
-    expect(existsSync(sidecar)).toBe(true);
-  });
-});
-
-describe('acquireProvisionLock — the gate runs on EVERY attempt + post-acquire revalidation', () => {
-  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-
-  async function waitForDead(pid: number, timeoutMs: number): Promise<boolean> {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        return true;
-      }
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    return false;
-  }
-
-  async function spawnHang(): Promise<import('node:child_process').ChildProcess> {
-    const { spawn } = await import('node:child_process');
-    return spawn(process.execPath, ['-e', 'setInterval(() => {}, 1 << 30)'], {
-      detached: true,
-      stdio: 'ignore',
-    });
-  }
-
-  function reap(child: import('node:child_process').ChildProcess): void {
-    try {
-      process.kill(-child.pid!, 'SIGKILL');
-    } catch {
-      try {
-        child.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-    }
-  }
-
-  it('a waiter that started while the holder was HEALTHY fails closed when the holder quarantines mid-wait', async () => {
-    // The prior code gated ONCE before proper-lockfile's internal retry loop: this
-    // waiter passed that gate (holder healthy, no sidecar), kept retrying while the
-    // holder QUARANTINED (heartbeat detached), then stale-took the retained mutex
-    // without ever seeing the sidecar — acquiring while the recorded group was ALIVE.
-    setup(JSON.stringify({ name: 'app' }));
-    const holder = await acquireProvisionLock(wranglerPath, { stale: 2_000 });
-    const child = await spawnHang();
-    try {
-      const waiter = acquireProvisionLock(wranglerPath, {
-        stale: 2_000,
-        retries: { retries: 60, factor: 1, minTimeout: 150, maxTimeout: 150 },
-      });
-      // Let the waiter run a few healthy attempts first, THEN quarantine the holder.
-      await new Promise((r) => setTimeout(r, 400));
-      holder.quarantine({ pid: child.pid, reason: 'waiter crosses quarantine' });
-      // Post-fix the waiter's NEXT attempt re-runs the gate: sidecar + live group →
-      // fail closed (never a stale-take of the detached mutex).
-      await expect(waiter).rejects.toThrow(/QUARANTINED.*waiter crosses quarantine/s);
-      expect(existsSync(sidecar)).toBe(true);
-      expect(existsSync(lockMutex)).toBe(true);
-    } finally {
-      reap(child);
-    }
-    expect(await waitForDead(child.pid!, 5_000)).toBe(true);
-    rmSync(lockMutex, { recursive: true, force: true });
-    rmSync(sidecar, { force: true });
-  }, 15_000);
-
-  it('the same waiter PROCEEDS (sidecar cleared) once the recorded group is dead', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const holder = await acquireProvisionLock(wranglerPath, { stale: 2_000 });
-    const child = await spawnHang();
-    const waiter = acquireProvisionLock(wranglerPath, {
-      stale: 2_000,
-      retries: { retries: 80, factor: 1, minTimeout: 150, maxTimeout: 150 },
-    });
-    await new Promise((r) => setTimeout(r, 300));
-    // Kill the recorded group FIRST, then quarantine: the sidecar records an
-    // already-dead group, so the waiter's next gate deterministically probes it dead
-    // (quarantining a live child here would race the waiter's fail-closed gate).
-    reap(child);
-    expect(await waitForDead(child.pid!, 5_000)).toBe(true);
-    holder.quarantine({ pid: child.pid, reason: 'waiter proceeds once dead' });
-    // The waiter's next gate probes the recorded group DEAD → clears the sidecar →
-    // proper-lockfile's stale lifecycle then reclaims the heartbeat-less mutex.
-    const lock = await waiter;
-    expect(existsSync(sidecar)).toBe(false);
-    await lock.release();
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 15_000);
-
-  it('post-acquire REVALIDATION: a sidecar appearing DURING acquisition releases the fresh lock and fails closed', async () => {
-    // Simulates a holder quarantining between this attempt's gate and the mkdir that
-    // acquires the mutex: the fs seam's mkdir drops a sidecar recording a LIVE group
-    // just before creating the lock directory.
-    setup(JSON.stringify({ name: 'app' }));
-    const child = await spawnHang();
-    try {
-      const seamFs = {
-        ...passthruFs,
-        mkdir: (...args: Array<unknown>) => {
-          writeFileSync(
-            sidecar,
-            JSON.stringify({
-              pid: child.pid,
-              pgid: child.pid,
-              reason: 'appeared mid-acquisition',
-            }),
-          );
-          (passthruFs.mkdir as (...a: Array<unknown>) => void)(...args);
-        },
-      };
-      await expect(
-        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0, fs: seamFs }),
-      ).rejects.toThrow(/QUARANTINED.*appeared mid-acquisition/s);
-      // The freshly-acquired mutex was RELEASED on the failed revalidation (fail
-      // closed, no leak, no half-owned lock)…
-      expect(existsSync(lockMutex)).toBe(false);
-      // …and the sidecar remains for the next acquisition to gate on.
-      expect(existsSync(sidecar)).toBe(true);
-    } finally {
-      reap(child);
-    }
-    expect(await waitForDead(child.pid!, 5_000)).toBe(true);
-    rmSync(sidecar, { force: true });
-  });
-});
-
-describe('acquireProvisionLock — durable sidecar is a PRECONDITION for quarantine', () => {
-  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-  // Blocking the sidecar's TEMP path (a directory where the temp file goes) makes the
-  // durable write fail while leaving the sidecar path itself absent — exactly the
-  // fail-open shape (no durable marker lands anywhere).
-  const tmpBlocker = `${sidecar}.tmp-${process.pid}`;
-
-  // A provision-level quarantine whose DURABLE persistence fails arms a
-  // process-wide RETENTION WATCHDOG (a module singleton in provision.ts). It resolves
-  // ASYNCHRONOUSLY: it clears the mutex / writes the sidecar and THEN — one microtask
-  // later (`lock.release().then(resolveWatchdog)`) — frees the process-wide provision
-  // slot. Under full-suite load that trailing gap widens, so a test that only waited on
-  // the observable mutex/sidecar state could finish while the slot is still taken,
-  // tripping the NEXT test's entry guard ("a previous provision … still retaining its
-  // lock"). Deterministically drain any lingering watchdog before the next test: poll a
-  // benign provision on a THROWAWAY config path (the guard is process-wide, so the probe
-  // never touches this suite's lock files) until it gets PAST the slot guard — which
-  // happens exactly when the watchdog has resolved.
-  async function drainRetentionWatchdog(timeoutMs = 20_000): Promise<void> {
-    const probeDir = join(import.meta.dirname, '.tmp-provision-drain');
-    const probeCfg = join(probeDir, 'wrangler.jsonc');
-    const deadline = Date.now() + timeoutMs;
-    try {
-      for (;;) {
-        rmSync(probeDir, { recursive: true, force: true });
-        mkdirSync(probeDir, { recursive: true });
-        writeFileSync(probeCfg, JSON.stringify({ account_id: 'acct', name: 'drain' }));
-        let guardHeld = false;
-        try {
-          await provisionCloudflareResources(probeDir, probeCfg, emptyDesired, {
-            runWrangler: provisionOperationFixture(() => ok('[]')),
-            log: silentLog,
-          });
-        } catch (error) {
-          // Only the process-wide slot guard means the watchdog is STILL active; any other
-          // outcome (resolve, or an unrelated failure) means it has resolved → slot free.
-          guardHeld = /still retaining its lock|already active in this process/.test(
-            (error as Error).message,
-          );
-        }
-        if (!guardHeld) {
-          return;
-        }
-        if (Date.now() >= deadline) {
-          throw new Error('retention watchdog did not resolve within the drain window');
-        }
-        await new Promise((r) => setTimeout(r, 50));
-      }
-    } finally {
-      rmSync(probeDir, { recursive: true, force: true });
-    }
-  }
-
-  afterEach(async () => {
-    // Belt + braces: no retention watchdog may leak into the next test's provision guard.
-    await drainRetentionWatchdog();
-  });
-
-  it('a sidecar-write failure keeps the lock TRACKED (heartbeat running, NOT stealable) and throws a hard error', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const lock = await acquireProvisionLock(wranglerPath, { stale: 2_000 });
-    try {
-      mkdirSync(tmpBlocker);
-      expect(() => lock.quarantine({ pid: 99_999, reason: 'sidecar blocked' })).toThrow(
-        /intentionally STILL HELD/,
-      );
-      // No partial/durable marker landed…
-      expect(existsSync(sidecar)).toBe(false);
-      // …and the lock did NOT detach: wait past the stale window — the still-running
-      // heartbeat keeps the mtime fresh, so a contender sees a HELD lock. (Pre-fix the
-      // detached, heartbeat-less mutex aged stale here and was stolen while the
-      // recorded child lived.) 2.3s is just past proper-lockfile's 2000ms stale floor.
-      await new Promise((r) => setTimeout(r, 2_300));
-      await expect(
-        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
-      ).rejects.toThrow(/already being held/);
-    } finally {
-      rmSync(tmpBlocker, { recursive: true, force: true });
-      // Still tracked → release works normally and frees the mutex.
-      await lock.release();
-    }
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 15_000);
-
-  it('provision level: a persistence failure surfaces BOTH errors, arms the retention watchdog, and resolves by confirming the child DEAD (mutex released cleanly)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    // A REAL child that is already dead stands in for the unconfirmed wrangler group.
-    const { spawn } = await import('node:child_process');
-    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1 << 30)'], {
-      detached: true,
-      stdio: 'ignore',
-    });
-    const childPid = child.pid!;
-    try {
-      process.kill(-childPid, 'SIGKILL');
-    } catch {
-      child.kill('SIGKILL');
-    }
-    {
-      const deadline = Date.now() + 10_000;
-      let dead = false;
-      while (!dead && Date.now() < deadline) {
-        try {
-          process.kill(childPid, 0);
-        } catch {
-          dead = true;
-        }
-        await new Promise((r) => setTimeout(r, 25));
-      }
-      expect(dead).toBe(true);
-    }
-    const quarantineError = new WranglerQuarantineError(childPid, 'child unconfirmed');
-    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
-    let thrown: unknown;
-    try {
-      await provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        {
-          runWrangler: run,
-          log: silentLog,
-          lockOptions: {
-            stale: 2_000,
-            // PERSISTENT persistence failure — every attempt (including the watchdog's
-            // retries) fails, so only the death probe can resolve the retention.
-            dirDurability: {
-              fsyncSync: () => {
-                throw Object.assign(new Error('ENOSPC: no space left on device, fsync'), {
-                  code: 'ENOSPC',
-                });
-              },
-            },
-          },
-        },
-      );
-    } catch (error) {
-      thrown = error;
-    }
-    expect(thrown).toBeInstanceOf(AggregateError);
-    expect((thrown as AggregateError).message).toMatch(/intentionally still held/);
-    expect((thrown as AggregateError).errors[0]).toBe(quarantineError);
-    expect(String((thrown as AggregateError).errors[1])).toMatch(/could not persist/);
-    // Immediately after the rejection the mutex is still on disk, HELD (tracked) by
-    // this process — never released under the unconfirmed child…
-    expect(existsSync(lockMutex)).toBe(true);
-    expect(existsSync(sidecar)).toBe(false);
-    // …and the RETENTION WATCHDOG (armed by the failure) probes the recorded group,
-    // confirms it dead, and releases the mutex CLEANLY — no manual unlock needed. Generous
-    // bound: the watchdog's tick is a real timer, delayed under full-suite load.
-    const deadline = Date.now() + 15_000;
-    while (existsSync(lockMutex) && Date.now() < deadline) {
-      await new Promise((r) => setTimeout(r, 50));
-    }
-    expect(existsSync(lockMutex)).toBe(false);
-    expect(existsSync(sidecar)).toBe(false);
-    // The watchdog resolved — a fresh provision may start again (guard freed). Deterministically
-    // wait for the process-wide slot to clear first: the watchdog frees it one microtask AFTER
-    // the mutex is gone (`release().then(resolveWatchdog)`), and under load that gap widens, so
-    // asserting a fresh provision resolves without the drain would race the guard.
-    await drainRetentionWatchdog();
-    const { run: okRun } = makeRunner([{ match: /^d1 list/, reply: () => ok('[]') }]);
-    await expect(
-      provisionCloudflareResources(tmpDir, wranglerPath, emptyDesired, {
-        runWrangler: okRun,
-        log: silentLog,
-      }),
-    ).resolves.toBeDefined();
-  }, 30_000);
-
-  it('while the child LIVES, the watchdog retries persistence with backoff and detaches once it succeeds', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    const { spawn } = await import('node:child_process');
-    const live = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1 << 30)'], {
-      detached: true,
-      stdio: 'ignore',
-    });
-    let failPersistence = true;
-    const quarantineError = new WranglerQuarantineError(live.pid, 'live child');
-    const run: RunWrangler = provisionOperationFixture(() => Promise.reject(quarantineError));
-    try {
-      let thrown: unknown;
-      try {
-        await provisionCloudflareResources(
-          tmpDir,
-          wranglerPath,
-          { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-          {
-            runWrangler: run,
-            log: silentLog,
-            lockOptions: {
-              stale: 2_000,
-              dirDurability: {
-                fsyncSync: () => {
-                  if (failPersistence) {
-                    throw Object.assign(new Error('EIO: i/o error, fsync'), { code: 'EIO' });
-                  }
-                },
-              },
-            },
-          },
-        );
-      } catch (error) {
-        thrown = error;
-      }
-      expect(thrown).toBeInstanceOf(AggregateError);
-      expect(existsSync(lockMutex)).toBe(true);
-      expect(existsSync(sidecar)).toBe(false);
-      // The durability problem clears; the watchdog's next retry persists the sidecar
-      // and detaches the lock (mutex retained on disk behind the durable marker). Generous
-      // bound: the watchdog's retry is a real backoff timer, delayed under full-suite load.
-      failPersistence = false;
-      const deadline = Date.now() + 15_000;
-      while (!existsSync(sidecar) && Date.now() < deadline) {
-        await new Promise((r) => setTimeout(r, 50));
-      }
-      expect(existsSync(sidecar)).toBe(true);
-      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
-      expect(recorded.pid).toBe(live.pid);
-      expect(existsSync(lockMutex)).toBe(true); // retained, now safely detached
-      // The retained mutex is guarded by the sidecar: an acquirer fails closed on the
-      // live recorded group even with the mutex aged stale.
-      const old = new Date(Date.now() - 3_600_000);
-      utimesSync(lockMutex, old, old);
-      await expect(
-        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
-      ).rejects.toThrow(/QUARANTINED/);
-    } finally {
-      try {
-        process.kill(-live.pid!, 'SIGKILL');
-      } catch {
-        try {
-          live.kill('SIGKILL');
-        } catch {
-          // already gone
-        }
-      }
-      rmSync(lockMutex, { recursive: true, force: true });
-      rmSync(sidecar, { force: true });
-    }
-  }, 30_000);
-
-  it('the watchdog HOLDS the process at natural exit until the child dies, then releases and exits cleanly', async () => {
-    // THE repro: on persistence failure the provision rejects with the lock left
-    // TRACKED — and proper-lockfile's EXIT SWEEP removes every tracked mutex when the
-    // parent naturally exits, leaving the live child with NO mutex and NO sidecar.
-    // Post-fix a REFERENCED watchdog holds the (otherwise drained) process open,
-    // confirms the child's death, releases the mutex normally, and only then lets the
-    // process exit.
-    const WATCHDOG_EXIT_TMP = join(import.meta.dirname, '.tmp-watchdog-exit');
-    rmSync(WATCHDOG_EXIT_TMP, { recursive: true, force: true });
-    mkdirSync(WATCHDOG_EXIT_TMP, { recursive: true });
-    const appRoot = join(WATCHDOG_EXIT_TMP, 'app');
-    const probe = join(WATCHDOG_EXIT_TMP, 'probe.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      probe,
-      `import { mkdirSync, writeFileSync } from 'node:fs';\n` +
-        `import { spawn } from 'node:child_process';\n` +
-        `import { join } from 'node:path';\n` +
-        `import { provisionCloudflareResources, WranglerQuarantineError } from ${JSON.stringify(provisionUrl)};\n` +
-        `const root = ${JSON.stringify(appRoot)};\n` +
-        `mkdirSync(root, { recursive: true });\n` +
-        `const cfg = join(root, 'wrangler.jsonc');\n` +
-        `writeFileSync(cfg, JSON.stringify({ name: 'app', account_id: 'acct' }));\n` +
-        // A real detached child standing in for the unconfirmed wrangler group; it
-        // exits BY ITSELF after 700ms.
-        `const child = spawn(process.execPath, ['-e', 'setTimeout(() => process.exit(0), 700)'], { detached: true, stdio: 'ignore' });\n` +
-        `child.unref();\n` +
-        `const startedAt = Date.now();\n` +
-        `provisionCloudflareResources(root, cfg, { kvNamespaces: [], queues: [], d1: { binding: 'DB', name: 'myapp-db' } }, {\n` +
-        `  runWrangler: () => Promise.reject(new WranglerQuarantineError(child.pid, 'unconfirmed')),\n` +
-        `  log: { info: () => {}, warn: () => {} },\n` +
-        `  lockOptions: {\n` +
-        `    dirDurability: { fsyncSync: () => { throw Object.assign(new Error('ENOSPC'), { code: 'ENOSPC' }); } },\n` +
-        `  },\n` +
-        `}).then(\n` +
-        `  () => writeFileSync(join(root, 'outcome.txt'), 'RESOLVED'),\n` +
-        `  () => writeFileSync(join(root, 'outcome.txt'), 'REJECTED:' + (Date.now() - startedAt)),\n` +
-        `);\n` +
-        `process.on('exit', () => {\n` +
-        `  let childAlive = true;\n` +
-        `  try { process.kill(child.pid, 0); } catch { childAlive = false; }\n` +
-        `  writeFileSync(join(root, 'exit.txt'), JSON.stringify({ elapsed: Date.now() - startedAt, childAlive }));\n` +
-        `});\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const parent = spawn(process.execPath, [probe], {
-      cwd: WATCHDOG_EXIT_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stderr = '';
-    parent.stderr.setEncoding('utf-8');
-    parent.stderr.on('data', (chunk: string) => {
-      stderr += chunk;
-    });
-    const killTimer = setTimeout(() => parent.kill('SIGKILL'), 15_000);
-    try {
-      const [code, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
-        parent.on('close', (c, s) => res([c, s]));
-      });
-      clearTimeout(killTimer);
-      // The process exited NORMALLY (the watchdog resolved) — it was not killed.
-      expect(signal).toBeNull();
-      expect(code).toBe(0);
-      // The provision itself rejected fast (persistence failure)…
-      expect(readFileSync(join(appRoot, 'outcome.txt'), 'utf-8')).toContain('REJECTED:');
-      // …but the WATCHDOG held the process past the child's 700ms lifetime: at exit the
-      // child was confirmed dead and ≥ ~700ms had elapsed (pre-fix the loop drained and
-      // the process exited within milliseconds, sweeping the tracked mutex while the
-      // child lived).
-      const exitState = JSON.parse(readFileSync(join(appRoot, 'exit.txt'), 'utf-8')) as {
-        elapsed: number;
-        childAlive: boolean;
-      };
-      expect(exitState.childAlive).toBe(false);
-      expect(exitState.elapsed).toBeGreaterThanOrEqual(650);
-      // The retained state was surfaced loudly, naming the pid + lock path…
-      expect(stderr).toMatch(/RETAINED by this process/);
-      // …and the watchdog released the mutex cleanly after confirming death: no mutex,
-      // no sidecar left behind.
-      const cfgReal = realpathSync(join(appRoot, 'wrangler.jsonc'));
-      expect(existsSync(`${cfgReal}.void-provision.lock.lock`)).toBe(false);
-      expect(existsSync(`${cfgReal}.void-provision.lock.quarantine.json`)).toBe(false);
-    } finally {
-      clearTimeout(killTimer);
-      try {
-        parent.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-      rmSync(WATCHDOG_EXIT_TMP, { recursive: true, force: true });
-    }
-  }, 20_000);
-});
-
-describe('acquireProvisionLock — proper-lockfile registry key spelling', () => {
-  it('preserves the native separators used by proper-lockfile on each platform', () => {
-    const lockTarget = 'D:/a/void/void/wrangler.jsonc.void-provision.lock';
-
-    expect(resolveProperLockfileKey(lockTarget, 'win32')).toBe(
-      'D:\\a\\void\\void\\wrangler.jsonc.void-provision.lock',
-    );
-    expect(resolveProperLockfileKey('/tmp/void/wrangler.jsonc.void-provision.lock', 'linux')).toBe(
-      '/tmp/void/wrangler.jsonc.void-provision.lock',
-    );
-  });
-});
-
-describe('acquireProvisionLock — sidecar DIRECTORY durability failures propagate', () => {
-  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-
-  it('ENOSPC on the directory fsync is a PERSISTENCE FAILURE: no detach, lock stays tracked, hard error', async () => {
-    // Pre-fix ALL directory open/fsync/close failures were swallowed: on a real
-    // EIO/ENOSPC the code still detached the (now heartbeat-less) lock behind a sidecar
-    // whose DIRECTORY ENTRY could vanish on a crash — a stale-reclaimable mutex under a
-    // live child. Now only enumerated platform-unsupported codes are ignored.
-    setup(JSON.stringify({ name: 'app' }));
-    const lock = await acquireProvisionLock(wranglerPath, {
-      stale: 2_000,
-      dirDurability: {
-        fsyncSync: () => {
-          throw Object.assign(new Error('ENOSPC: no space left on device, fsync'), {
-            code: 'ENOSPC',
-          });
-        },
-      },
-    });
-    try {
-      expect(() => lock.quarantine({ pid: 42_424, reason: 'enospc' })).toThrow(
-        /could not persist quarantine metadata.*ENOSPC/s,
-      );
-      // The non-durable sidecar was rolled back (state matches "not persisted")…
-      expect(existsSync(sidecar)).toBe(false);
-      // …and the lock did NOT detach: past the stale window the still-running heartbeat
-      // keeps the mutex fresh, so a contender sees a HELD lock (no steal). 2.3s is just
-      // past proper-lockfile's 2000ms stale floor.
-      await new Promise((r) => setTimeout(r, 2_300));
-      await expect(
-        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
-      ).rejects.toThrow(/already being held/);
-    } finally {
-      // Still tracked → release works normally and frees the mutex.
-      await lock.release();
-    }
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 15_000);
-
-  it('a platform-unsupported code (EINVAL) is ignored — the quarantine still detaches behind the verified sidecar', async () => {
-    setup(JSON.stringify({ name: 'app' }));
-    const lock = await acquireProvisionLock(wranglerPath, {
-      stale: 2_000,
-      dirDurability: {
-        fsyncSync: () => {
-          throw Object.assign(new Error('EINVAL: invalid argument, fsync'), { code: 'EINVAL' });
-        },
-      },
-    });
-    lock.quarantine({ pid: 42_425, reason: 'einval' }); // must not throw
-    expect(existsSync(sidecar)).toBe(true);
-    expect(existsSync(lockMutex)).toBe(true); // retained (detached from the exit sweep)
-    await lock.release(); // no-op after a successful quarantine
-    expect(existsSync(lockMutex)).toBe(true);
-    rmSync(lockMutex, { recursive: true, force: true });
-    rmSync(sidecar, { force: true });
-  });
-});
-
-describe('acquireProvisionLock — recovery decisions are serialized + generation-verified', () => {
-  const sidecar = `${wranglerPath}.void-provision.lock.quarantine.json`;
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-  const recoveryTarget = `${wranglerPath}.void-provision.lock.recovery`;
-
-  async function waitForDead(pid: number, timeoutMs: number): Promise<boolean> {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        return true;
-      }
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    return false;
-  }
-
-  async function spawnHang(): Promise<import('node:child_process').ChildProcess> {
-    const { spawn } = await import('node:child_process');
-    return spawn(process.execPath, ['-e', 'setInterval(() => {}, 1 << 30)'], {
-      detached: true,
-      stdio: 'ignore',
-    });
-  }
-
-  async function deadPid(): Promise<number> {
-    const child = await spawnHang();
-    const pid = child.pid!;
-    try {
-      process.kill(-pid, 'SIGKILL');
-    } catch {
-      child.kill('SIGKILL');
-    }
-    expect(await waitForDead(pid, 5_000)).toBe(true);
-    return pid;
-  }
-
-  function reap(child: import('node:child_process').ChildProcess): void {
-    try {
-      process.kill(-child.pid!, 'SIGKILL');
-    } catch {
-      try {
-        child.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-    }
-  }
-
-  it('a held RECOVERY mutex blocks another acquirer from acting on the sidecar at all (decision serialized)', async () => {
-    // Pre-fix, recovery decisions (read → probe → clear) ran UNSERIALIZED: recoverer B
-    // could base its clear on a read that recoverer A had already invalidated. Now the
-    // WHOLE gate→probe→clear→acquire→revalidate protocol runs under one small recovery
-    // mutex, so while another recoverer holds it, no decision — not even the sidecar
-    // read — is acted upon.
-    setup(JSON.stringify({ name: 'app' }));
-    const pid = await deadPid();
-    writeFileSync(
-      sidecar,
-      JSON.stringify({ pid, pgid: pid, reason: 'dead group', generation: 'gen-stale' }),
-    );
-    const properLockfile = (await import('proper-lockfile')).default;
-    const releaseRecovery = await properLockfile.lock(recoveryTarget, {
-      stale: 6_000,
-      realpath: false,
-    });
-    try {
-      // The dead-group sidecar WOULD be cleared — but the recovery mutex is held, so
-      // the acquirer cannot even enter the decision (retries: 0 → fail fast).
-      await expect(acquireProvisionLock(wranglerPath, { retries: 0 })).rejects.toThrow(
-        /already being held/,
-      );
-      expect(existsSync(sidecar)).toBe(true); // the decision was NOT made
-    } finally {
-      await releaseRecovery();
-    }
-    // With the recovery mutex free the same acquirer clears the dead-group quarantine
-    // and proceeds.
-    const lock = await acquireProvisionLock(wranglerPath, { retries: 2 });
-    expect(existsSync(sidecar)).toBe(false);
-    await lock.release();
-    expect(existsSync(lockMutex)).toBe(false);
-  });
-
-  it("a stale recovery decision cannot delete a NEWER quarantine generation (B's decision detects S1; A's retained mutex stays protected)", async () => {
-    // THE scenario, injected deterministically at the one point the
-    // recovery mutex cannot serialize (a main-mutex holder's quarantine write): B
-    // inspects dead S0 (generation g0) and decides to clear; before its unlink, A's
-    // NEWER live-group quarantine S1 (generation g1) replaces the file. Pre-fix B
-    // unlinked the PATHNAME — deleting S1 — and A's retained heartbeat-less mutex was
-    // then stale-reclaimable under A's live child.
-    setup(JSON.stringify({ name: 'app' }));
-    const dead = await deadPid();
-    const live = await spawnHang();
-    try {
-      writeFileSync(
-        sidecar,
-        JSON.stringify({
-          pid: dead,
-          pgid: dead,
-          reason: 'S0 (dead group)',
-          generation: 'gen-first',
-        }),
-      );
-      // A's retained mutex: on disk, heartbeat-less, aged far past the stale window —
-      // exactly what B would stale-reclaim if its stale decision deleted S1.
-      mkdirSync(lockMutex);
-      const old = new Date(Date.now() - 3_600_000);
-      utimesSync(lockMutex, old, old);
-      const swapInNewerGeneration = (): void => {
-        writeFileSync(
-          sidecar,
-          JSON.stringify({
-            pid: live.pid,
-            pgid: live.pid,
-            reason: 'S1 (live group, newer quarantine)',
-            generation: 'gen-second',
-          }),
-        );
-      };
-      await expect(
-        acquireProvisionLock(wranglerPath, {
-          stale: 2_000,
-          retries: 0,
-          onBeforeQuarantineClear: swapInNewerGeneration,
-        }),
-      ).rejects.toThrow(/changed while this recovery decision was being made/);
-      // THE crux: S1 SURVIVES the stale decision…
-      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
-      expect(recorded.generation).toBe('gen-second');
-      expect(recorded.pid).toBe(live.pid);
-      // …and A's retained mutex was not touched, so the next acquisition gates on S1's
-      // LIVE group and fails closed instead of stale-reclaiming it.
-      expect(existsSync(lockMutex)).toBe(true);
-      await expect(
-        acquireProvisionLock(wranglerPath, { stale: 2_000, retries: 0 }),
-      ).rejects.toThrow(/QUARANTINED/);
-      expect(existsSync(lockMutex)).toBe(true);
-    } finally {
-      reap(live);
-    }
-    expect(await waitForDead(live.pid!, 5_000)).toBe(true);
-    rmSync(lockMutex, { recursive: true, force: true });
-    rmSync(sidecar, { force: true });
-  });
-});
-
-describe('createDefaultRunWrangler — signal-path kill failure quarantines the lock (child-process)', () => {
-  const SIGNAL_KILL_TMP = join(import.meta.dirname, '.tmp-signal-kill');
-  beforeEach(() => {
-    rmSync(SIGNAL_KILL_TMP, { recursive: true, force: true });
-    mkdirSync(SIGNAL_KILL_TMP, { recursive: true });
-  });
-  afterEach(() => {
-    rmSync(SIGNAL_KILL_TMP, { recursive: true, force: true });
-  });
-
-  async function waitForDead(pid: number, timeoutMs: number): Promise<boolean> {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        return true;
-      }
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    return false;
-  }
-
-  it('SIGTERM + an injected kill FAILURE: the parent dies with mutex + sidecar RETAINED; the gate blocks until the child dies', async (ctx) => {
-    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
-    // Pre-fix, the signal-forwarding path re-raised IMMEDIATELY on a non-ESRCH kill
-    // failure — the parent died, proper-lockfile's exit hook removed the still-tracked
-    // mutex, and the live wrangler child kept creating resources with NO lock on disk.
-    const appRoot = join(SIGNAL_KILL_TMP, 'app');
-    const pidFile = join(SIGNAL_KILL_TMP, 'child.pid');
-    const hungCli = join(SIGNAL_KILL_TMP, 'hung.cjs');
-    writeFileSync(
-      hungCli,
-      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
-        `process.on('SIGTERM', () => {});\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const parentScript = join(SIGNAL_KILL_TMP, 'parent.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      parentScript,
-      `import { mkdirSync, writeFileSync } from 'node:fs';\n` +
-        `import { join } from 'node:path';\n` +
-        `import { provisionCloudflareResources, createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
-        `const root = ${JSON.stringify(appRoot)};\n` +
-        `mkdirSync(root, { recursive: true });\n` +
-        `const cfg = join(root, 'wrangler.jsonc');\n` +
-        `writeFileSync(cfg, JSON.stringify({ name: 'app', account_id: 'acct' }));\n` +
-        `const runner = createDefaultRunWrangler(root, {\n` +
-        `  launcher: [process.execPath, ${JSON.stringify(hungCli)}, ${JSON.stringify(pidFile)}],\n` +
-        `  killProcessGroup: () => {\n` +
-        `    throw Object.assign(new Error('EPERM: operation not permitted'), { code: 'EPERM' });\n` +
-        `  },\n` +
-        `});\n` +
-        `provisionCloudflareResources(root, cfg, { kvNamespaces: [], queues: [], d1: { binding: 'DB', name: 'myapp-db' } }, {\n` +
-        `  runWrangler: runner,\n` +
-        `  log: { info: () => {}, warn: () => {} },\n` +
-        `}).then(\n` +
-        `  () => console.log('RESOLVED'),\n` +
-        `  (e) => console.log('REJECTED:' + e.message),\n` +
-        `);\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const parent = spawn(process.execPath, [parentScript], {
-      cwd: SIGNAL_KILL_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let childPid: number | undefined;
-    try {
-      // Wait until the hung "wrangler" wrote its pid (mid-provision, lock held).
-      const deadline = Date.now() + 10_000;
-      while (Date.now() < deadline) {
-        if (existsSync(pidFile)) {
-          const raw = readFileSync(pidFile, 'utf-8');
-          if (raw.length > 0) {
-            childPid = Number(raw);
-            break;
-          }
-        }
-        await new Promise((r) => setTimeout(r, 25));
-      }
-      expect(childPid).toBeDefined();
-      parent.kill('SIGTERM');
-      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
-        parent.on('exit', (code, sig) => res([code, sig]));
-      });
-      // The parent still dies of the re-raised SIGTERM (default action) — not exit 0.
-      expect(signal).toBe('SIGTERM');
-      // THE crux: at parent exit the mutex + sidecar are STILL ON DISK — quarantine ran
-      // BEFORE the re-raise, so proper-lockfile's exit sweep skipped the detached lock
-      // while the wrangler child is still alive.
-      const cfgReal = realpathSync(join(appRoot, 'wrangler.jsonc'));
-      const lockMutex = `${cfgReal}.void-provision.lock.lock`;
-      const sidecar = `${cfgReal}.void-provision.lock.quarantine.json`;
-      expect(existsSync(lockMutex)).toBe(true);
-      expect(existsSync(sidecar)).toBe(true);
-      const recorded = JSON.parse(readFileSync(sidecar, 'utf-8')) as Record<string, unknown>;
-      expect(recorded.pid).toBe(childPid);
-      expect(String(recorded.reason)).toMatch(/SIGTERM/);
-      // The child is genuinely still alive — and the gate FAILS CLOSED on it even
-      // with the mutex aged far past the stale window.
-      expect(() => process.kill(childPid!, 0)).not.toThrow();
-      const old = new Date(Date.now() - 3_600_000);
-      utimesSync(lockMutex, old, old);
-      await expect(acquireProvisionLock(cfgReal, { stale: 2_000, retries: 0 })).rejects.toThrow(
-        /QUARANTINED/,
-      );
-      // Kill the recorded group; the next acquisition clears the quarantine + proceeds.
-      try {
-        process.kill(-childPid!, 'SIGKILL');
-      } catch {
-        process.kill(childPid!, 'SIGKILL');
-      }
-      expect(await waitForDead(childPid!, 5_000)).toBe(true);
-      const lock = await acquireProvisionLock(cfgReal, { stale: 2_000, retries: 5 });
-      expect(existsSync(sidecar)).toBe(false);
-      await lock.release();
-      expect(existsSync(lockMutex)).toBe(false);
-    } finally {
-      // Belt + braces: never leak processes even on assertion failure.
-      try {
-        parent.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-      if (childPid !== undefined) {
-        try {
-          process.kill(childPid, 'SIGKILL');
-        } catch {
-          // already gone
-        }
-      }
-    }
-  }, 30_000);
-});
-
-describe('createDefaultRunWrangler — ONE signal coordinator: repeated signals coalesced, teardown bounded, spawns rejected', () => {
-  const COORDINATOR_TMP = join(import.meta.dirname, '.tmp-signal-coordinator');
-  beforeEach(() => {
-    rmSync(COORDINATOR_TMP, { recursive: true, force: true });
-    mkdirSync(COORDINATOR_TMP, { recursive: true });
-  });
-  afterEach(() => {
-    rmSync(COORDINATOR_TMP, { recursive: true, force: true });
-  });
-
-  async function waitForPid(pidFile: string, timeoutMs: number): Promise<number | undefined> {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      if (existsSync(pidFile)) {
-        const raw = readFileSync(pidFile, 'utf-8');
-        if (raw.length > 0) {
-          return Number(raw);
-        }
-      }
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    return undefined;
-  }
-
-  it('a SECOND concurrently-active wrangler child is rejected PRE-SPAWN (at most one registrant)', async () => {
-    // Within one provision every wrangler call is awaited sequentially, and at most one
-    // provision runs per process — so a second concurrently-active child is always a
-    // caller bug and is rejected fast, before any child is spawned.
-    const slowChild = join(COORDINATOR_TMP, 'slow-child.cjs');
-    writeFileSync(
-      slowChild,
-      `setTimeout(() => { console.log(JSON.stringify({ operationResult: 1 })); process.exit(0); }, 400);\n`,
-    );
-    const runA = createDefaultRunWrangler(COORDINATOR_TMP, {
-      launcher: [process.execPath, slowChild],
-      timeoutMs: 30_000,
-    });
-    const first = runA({ type: 'd1.list' }, { accountId: 'acct' });
-    await new Promise((r) => setTimeout(r, 80)); // A's child is alive and registered
-    const runB = createDefaultRunWrangler(COORDINATOR_TMP, {
-      launcher: [process.execPath, slowChild],
-      timeoutMs: 30_000,
-    });
-    await expect(runB({ type: 'd1.list' }, { accountId: 'acct' })).rejects.toThrow(
-      /another wrangler child is already active in this process/,
-    );
-    // The first runner is unaffected and settles cleanly.
-    const result = await first;
-    expect(result.status).toBe(0);
-    expect(result.signal).toBeNull();
-  }, 15_000);
-
-  it('permits two immutable Worker uploads while rejecting a third upload or traffic mutation', async () => {
-    const slowChild = join(COORDINATOR_TMP, 'parallel-upload.cjs');
-    writeFileSync(
-      slowChild,
-      `setTimeout(() => { console.log(JSON.stringify({ operationResult: 1 })); process.exit(0); }, 400);\n`,
-    );
-    const spawned: Array<number | undefined> = [];
-    const run = createDefaultRunWrangler(COORDINATOR_TMP, {
-      launcher: [process.execPath, slowChild],
-      onSpawnedChild: (child) => spawned.push(child.pid),
-      parallelWorkerUpload: true,
-      timeoutMs: 30_000,
-    });
-    const first = run(operationFixtureRequest(['versions', 'upload']), { accountId: 'acct' });
-    const second = run(operationFixtureRequest(['versions', 'upload']), { accountId: 'acct' });
-    expect(spawned).toHaveLength(2);
-    await expect(
-      run(operationFixtureRequest(['versions', 'upload']), { accountId: 'acct' }),
-    ).rejects.toThrow(/another wrangler child is already active in this process/);
-    await expect(
-      run(operationFixtureRequest(['versions', 'deploy']), { accountId: 'acct' }),
-    ).rejects.toThrow(/another wrangler child is already active in this process/);
-    expect(spawned).toHaveLength(2);
-    expect((await Promise.all([first, second])).map((result) => result.status)).toEqual([0, 0]);
-    expect(
-      (await run(operationFixtureRequest(['versions', 'deploy']), { accountId: 'acct' })).status,
-    ).toBe(0);
-  }, 15_000);
-
-  it('confirms both parallel upload process groups have exited before forwarding SIGTERM', async (ctx) => {
-    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
-    const pidFiles = [join(COORDINATOR_TMP, 'upload-a.pid'), join(COORDINATOR_TMP, 'upload-b.pid')];
-    const childScript = join(COORDINATOR_TMP, 'upload-slow-exit.cjs');
-    writeFileSync(
-      childScript,
-      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
-        `process.on('SIGTERM', () => setTimeout(() => process.exit(0), 500));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const parentScript = join(COORDINATOR_TMP, 'parallel-upload-parent.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      parentScript,
-      `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
-        pidFiles
-          .map(
-            (pidFile) =>
-              `createDefaultRunWrangler(process.cwd(), { launcher: [process.execPath, ${JSON.stringify(childScript)}, ${JSON.stringify(pidFile)}], parallelWorkerUpload: true })({ type: 'versions.upload' }, { accountId: 'acct' }).catch(() => {});\n`,
-          )
-          .join(''),
-    );
-    const { spawn } = await import('node:child_process');
-    const parent = spawn(process.execPath, [parentScript], {
-      cwd: COORDINATOR_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    const pids: Array<number> = [];
-    try {
-      for (const file of pidFiles) {
-        const pid = await waitForPid(file, 10_000);
-        expect(pid).toBeDefined();
-        pids.push(pid!);
-      }
-      parent.kill('SIGTERM');
-      const signal = await new Promise<NodeJS.Signals | null>((resolve) => {
-        parent.on('exit', (_code, received) => resolve(received));
-      });
-      expect(signal).toBe('SIGTERM');
-      for (const pid of pids) {
-        expect(() => process.kill(pid, 0)).toThrow();
-      }
-    } finally {
-      parent.kill('SIGKILL');
-      for (const pid of pids) {
-        try {
-          process.kill(pid, 'SIGKILL');
-        } catch {
-          // already gone
-        }
-      }
-    }
-  }, 20_000);
-
-  it('one SIGTERM (+ a repeat mid-teardown) is coalesced: the parent re-raises only after the group is dead', async (ctx) => {
-    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
-    // Previously, runners installed per-runner listeners that detached themselves at
-    // signal entry — a REPEATED signal during the bounded teardown took Node's default
-    // action, killing the parent with the child alive, every tracked mutex swept, and
-    // no sidecar. The ONE coordinator keeps its handler installed through the teardown,
-    // so the repeat is swallowed and the single re-raise fires only after confirmation.
-    const pidFile = join(COORDINATOR_TMP, 'a.pid');
-    const childScript = join(COORDINATOR_TMP, 'slow-exit-child.cjs');
-    writeFileSync(
-      childScript,
-      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
-        `process.on('SIGTERM', () => setTimeout(() => process.exit(0), 600));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const parentScript = join(COORDINATOR_TMP, 'parent.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      parentScript,
-      `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
-        `const runA = createDefaultRunWrangler(process.cwd(), {\n` +
-        `  launcher: [process.execPath, ${JSON.stringify(childScript)}, ${JSON.stringify(pidFile)}],\n` +
-        `});\n` +
-        `runA({ type: 'd1.list' }, { accountId: 'acct' }).then(\n` +
-        `  (r) => console.log('A-settled', r.status, r.signal),\n` +
-        `  (e) => console.log('A-rejected', e.message),\n` +
-        `);\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const parent = spawn(process.execPath, [parentScript], {
-      cwd: COORDINATOR_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let pid: number | undefined;
-    try {
-      pid = await waitForPid(pidFile, 10_000);
-      expect(pid).toBeDefined();
-      parent.kill('SIGTERM');
-      // The REPEATED signal lands mid-teardown (the child is still alive at 120ms).
-      // The coordinator's still-installed handler must coalesce it — no bypass.
-      setTimeout(() => {
-        try {
-          parent.kill('SIGTERM');
-        } catch {
-          // parent already gone (that itself would fail the assertions below)
-        }
-      }, 120);
-      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
-        parent.on('exit', (code, sig) => res([code, sig]));
-      });
-      // The parent died of the single re-raised SIGTERM (default action) — not exit 0.
-      expect(signal).toBe('SIGTERM');
-      // THE crux: at parent exit the (slow, 600ms) child is already dead — the repeat
-      // did not bypass the confirmation barrier.
-      let alive = true;
-      try {
-        process.kill(pid!, 0);
-      } catch {
-        alive = false;
-      }
-      expect(alive).toBe(false);
-    } finally {
-      // Belt + braces: never leak processes even on assertion failure.
-      try {
-        parent.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-      if (pid !== undefined) {
-        try {
-          process.kill(pid, 'SIGKILL');
-        } catch {
-          // already gone
-        }
-      }
-    }
-  }, 20_000);
-
-  it('a spawn attempted AFTER teardown began is rejected fast (no child spawned, teardown unaffected)', async (ctx) => {
-    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
-    const pidFile = join(COORDINATOR_TMP, 'c.pid');
-    const childScript = join(COORDINATOR_TMP, 'slow-exit-child2.cjs');
-    writeFileSync(
-      childScript,
-      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
-        `process.on('SIGTERM', () => setTimeout(() => process.exit(0), 400));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const outcomeFile = join(COORDINATOR_TMP, 'late-spawn-outcome.txt');
-    const parentScript = join(COORDINATOR_TMP, 'parent-spawn-mid-teardown.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      parentScript,
-      `import { writeFileSync } from 'node:fs';\n` +
-        `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
-        `const run = createDefaultRunWrangler(process.cwd(), {\n` +
-        `  launcher: [process.execPath, ${JSON.stringify(childScript)}, ${JSON.stringify(pidFile)}],\n` +
-        `});\n` +
-        `run({ type: 'd1.list' }, { accountId: 'acct' }).catch(() => {});\n` +
-        // A ONCE listener (consumed by the first SIGTERM, so it can never swallow the
-        // coordinator's later re-raise) schedules a mid-teardown spawn attempt. The
-        // outcome is written SYNCHRONOUSLY to a file so the re-raise death cannot lose it.
-        `process.once('SIGTERM', () => {\n` +
-        `  setTimeout(() => {\n` +
-        `    run({ type: 'd1.list' }, { accountId: 'acct' }).then(\n` +
-        `      () => writeFileSync(${JSON.stringify(outcomeFile)}, 'LATE-SPAWN-ALLOWED'),\n` +
-        `      (e) => writeFileSync(${JSON.stringify(outcomeFile)}, 'LATE-SPAWN-REJECTED:' + e.message),\n` +
-        `    );\n` +
-        `  }, 50);\n` +
-        `});\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const parent = spawn(process.execPath, [parentScript], {
-      cwd: COORDINATOR_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let pid: number | undefined;
-    try {
-      pid = await waitForPid(pidFile, 10_000);
-      expect(pid).toBeDefined();
-      parent.kill('SIGTERM');
-      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
-        parent.on('exit', (code, sig) => res([code, sig]));
-      });
-      // The teardown still completed with the single re-raise (child confirmed first)…
-      expect(signal).toBe('SIGTERM');
-      // …and the mid-teardown spawn was rejected outright — fail fast, no child, no
-      // fresh per-runner deadline joining the teardown.
-      const outcome = readFileSync(outcomeFile, 'utf-8');
-      expect(outcome).toContain('LATE-SPAWN-REJECTED:');
-      expect(outcome).toMatch(/refusing to spawn wrangler.*fatal SIGTERM.*terminating/s);
-    } finally {
-      try {
-        parent.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-      if (pid !== undefined) {
-        try {
-          process.kill(pid, 'SIGKILL');
-        } catch {
-          // already gone
-        }
-      }
-    }
-  }, 20_000);
-
-  it('the coordinator-WIDE deadline bounds an unconfirmable teardown (quarantine + re-raise, never a wedge)', async (ctx) => {
-    ctx.skip(process.platform === 'win32', WINDOWS_NO_SIGNALS);
-    // The runner's own confirmation window is 60s here and the child never dies (the
-    // injected group-killer claims success but kills nothing) — pre-fix `pending`
-    // stayed nonzero for the full 60s and the fatal signal was not re-raised. The
-    // coordinator-wide deadline (800ms) quarantines the pair and re-raises at the bound.
-    const pidFile = join(COORDINATOR_TMP, 'd.pid');
-    const hangScript = join(COORDINATOR_TMP, 'hang-child.cjs');
-    writeFileSync(
-      hangScript,
-      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
-        `process.on('SIGTERM', () => {});\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const parentScript = join(COORDINATOR_TMP, 'parent-deadline.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      parentScript,
-      `import { createDefaultRunWrangler } from ${JSON.stringify(provisionUrl)};\n` +
-        `const run = createDefaultRunWrangler(process.cwd(), {\n` +
-        `  launcher: [process.execPath, ${JSON.stringify(hangScript)}, ${JSON.stringify(pidFile)}],\n` +
-        `  confirmKillGraceMs: 60_000,\n` +
-        `  signalTeardownDeadlineMs: 800,\n` +
-        `  killProcessGroup: () => {},\n` + // claims success, kills nothing
-        `});\n` +
-        `run({ type: 'd1.list' }, { accountId: 'acct' }).catch(() => {});\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const parent = spawn(process.execPath, [parentScript], {
-      cwd: COORDINATOR_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let pid: number | undefined;
-    try {
-      pid = await waitForPid(pidFile, 10_000);
-      expect(pid).toBeDefined();
-      const killedAt = Date.now();
-      parent.kill('SIGTERM');
-      const [, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
-        parent.on('exit', (code, sig) => res([code, sig]));
-      });
-      const elapsed = Date.now() - killedAt;
-      // The parent died of the re-raised SIGTERM AT the coordinator-wide bound — the
-      // deadline was honored (≥ ~800ms) and nowhere near the 60s runner window
-      // (pre-fix `pending` stayed nonzero for the full 60s confirmation window and the
-      // fatal signal was not re-raised until then).
-      expect(signal).toBe('SIGTERM');
-      expect(elapsed).toBeGreaterThanOrEqual(700);
-      expect(elapsed).toBeLessThan(15_000);
-      // The (genuinely unkillable-by-the-fake-killer) child is STILL ALIVE at parent
-      // exit — the only path to a completed teardown with a live group is the
-      // deadline's quarantine of the pair (confirmation was impossible). Reap it.
-      expect(() => process.kill(pid!, 0)).not.toThrow();
-    } finally {
-      try {
-        parent.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-      if (pid !== undefined) {
-        try {
-          process.kill(-pid, 'SIGKILL');
-        } catch {
-          try {
-            process.kill(pid, 'SIGKILL');
-          } catch {
-            // already gone
-          }
-        }
-      }
-    }
-  }, 20_000);
-});
-
-describe('createDefaultRunWrangler — post-spawn child `error` events confirm/quarantine', () => {
-  const POST_SPAWN_TMP = join(import.meta.dirname, '.tmp-post-spawn-error');
-  const spawnedChildren = new Set<import('node:child_process').ChildProcess>();
-  beforeEach(() => {
-    rmSync(POST_SPAWN_TMP, { recursive: true, force: true });
-    mkdirSync(POST_SPAWN_TMP, { recursive: true });
-  });
-  afterEach(async () => {
-    // A test deadline can interrupt the assertion before the runner's deadline.
-    // Wait for actual close before removing a directory a Windows child uses as cwd.
-    for (const child of spawnedChildren) {
-      const closed = new Promise<void>((resolve) => child.once('close', () => resolve()));
-      child.kill('SIGKILL');
-      await closed;
-    }
-    rmSync(POST_SPAWN_TMP, { recursive: true, force: true });
-  });
-
-  function createRunner(options: NonNullable<Parameters<typeof createDefaultRunWrangler>[1]>) {
-    return createDefaultRunWrangler(POST_SPAWN_TMP, {
-      ...options,
-      onSpawnedChild: (child) => {
-        spawnedChildren.add(child);
-        child.once('close', () => spawnedChildren.delete(child));
-        options.onSpawnedChild?.(child);
-      },
-    });
-  }
-
-  function writeHangScript(path: string): void {
-    // Ignores SIGTERM; only the machine's SIGKILL can end it.
-    writeFileSync(
-      path,
-      `require('fs').writeFileSync(process.argv[2], String(process.pid));\n` +
-        `process.on('SIGTERM', () => {});\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-  }
-
-  function reapPidFile(pidFile: string): number | undefined {
-    if (!existsSync(pidFile)) {
-      return undefined;
-    }
-    const pid = Number(readFileSync(pidFile, 'utf-8'));
-    try {
-      process.kill(-pid, 'SIGKILL');
-    } catch {
-      try {
-        process.kill(pid, 'SIGKILL');
-      } catch {
-        // already gone
-      }
-    }
-    return pid;
-  }
-
-  function injectErrorAfterChildStarts(
-    child: import('node:child_process').ChildProcess,
-    pidFile: string,
-    message: string,
-  ): void {
-    // A fixed delay can fire before Node loads the child script on a busy runner.
-    // Wait until the child has written its PID so this is truly a post-spawn error.
-    void (async () => {
-      const deadline = Date.now() + 5_000;
-      while (!existsSync(pidFile) && Date.now() < deadline) {
-        await new Promise((resolve) => setTimeout(resolve, 10));
-      }
-      child.emit('error', new Error(message));
-    })();
-  }
-
-  it('pre-spawn ENOENT still settles directly as a hard failure (the one carve-out: no pid, nothing to confirm)', async () => {
-    const run = createRunner({
-      launcher: [join(POST_SPAWN_TMP, 'no-such-wrangler-binary')],
-    });
-    const result = await run(
-      {
-        type: 'hyperdrive.create',
-        name: 'missing-launcher-db',
-        binding: 'HYPERDRIVE',
-        configPath: 'literal config.jsonc',
-      },
-      { accountId: 'acct', input: 'postgres://user:secret@localhost/db' },
-    );
-    expect(result.status).toBe(1);
-    expect(result.error).toContain('ENOENT');
-    expect(result.signal).toBeNull();
-  });
-
-  it('an early closed stdin rejects a buffered success envelope and confirms child termination', async (ctx) => {
-    // Even after closing fd 0 and destroying its stream, a live Node process on
-    // Windows retains inherited pipe handles. Real peer-exit and Writable-error
-    // regressions below cover Windows without relying on POSIX descriptor closure.
-    ctx.skip(
-      process.platform === 'win32',
-      'closing a live child stdin descriptor does not close inherited Windows pipe handles',
-    );
-    const script = join(POST_SPAWN_TMP, 'closed-stdin.cjs');
-    const pidFile = join(POST_SPAWN_TMP, 'closed-stdin.pid');
-    writeFileSync(
-      script,
-      `const fs = require('fs');\n` +
-        `fs.writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
-        `fs.writeSync(1, JSON.stringify({ operationResult: 1, data: { id: 'provider-id' } }));\n` +
-        `fs.closeSync(0);\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const run = createRunner({
-      launcher: [process.execPath, script],
-      timeoutMs: 30_000,
-    });
-    try {
-      const result = await run(
-        {
-          type: 'hyperdrive.create',
-          name: 'closed-stdin-db',
-          binding: 'HYPERDRIVE',
-          configPath: 'literal config.jsonc',
-        },
-        { accountId: 'acct', input: 'x'.repeat(2 * 1024 * 1024) },
-      );
-      expect(result.status).toBe(1);
-      expect(result.signal).toBe('SIGKILL');
-      expect(result.stderr).toMatch(/EPIPE|broken pipe/i);
-      expect(result.stdout).toContain('"operationResult":1');
-      expect(result.data).toBeUndefined();
-      const pid = Number(readFileSync(pidFile, 'utf-8'));
-      expect(() => process.kill(pid, 0)).toThrow();
-    } finally {
-      reapPidFile(pidFile);
-    }
-  }, 15_000);
-
-  it('a provider exiting after reporting success rejects unread stdin through its real pipe error', async () => {
-    const script = join(POST_SPAWN_TMP, 'exited-stdin.cjs');
-    const pidFile = join(POST_SPAWN_TMP, 'exited-stdin.pid');
-    writeFileSync(
-      script,
-      `const fs = require('fs');\n` +
-        `fs.writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
-        `fs.writeSync(1, JSON.stringify({ operationResult: 1, data: { id: 'provider-id' } }));\n` +
-        // Exit closes every inherited handle on Windows as well as POSIX. The
-        // oversized unread input is still pending, so the parent gets a real
-        // closed-pipe error (write EOF on Windows, EPIPE on POSIX).
-        `process.exit(0);\n`,
-    );
-    let observedOutput = '';
-    let childClosed = Promise.resolve();
-    const run = createRunner({
-      launcher: [process.execPath, script],
-      timeoutMs: 30_000,
-      onSpawnedChild: (child) => {
-        child.stdout!.on('data', (chunk: string) => {
-          observedOutput += chunk;
-        });
-        childClosed = new Promise<void>((resolve) => child.once('close', () => resolve()));
-      },
-    });
-    let result: Awaited<ReturnType<typeof run>> | undefined;
-    let failure: unknown;
-    try {
-      result = await run(
-        {
-          type: 'hyperdrive.create',
-          name: 'exited-stdin-db',
-          binding: 'HYPERDRIVE',
-          configPath: 'literal config.jsonc',
-        },
-        { accountId: 'acct', input: 'x'.repeat(2 * 1024 * 1024) },
-      );
-    } catch (error) {
-      failure = error;
-    }
-    if (failure !== undefined) {
-      // macOS can return EPERM when signalling an already-exiting process group.
-      // The runner must quarantine that unconfirmed group, never trust its output.
-      expect(failure).toBeInstanceOf(WranglerQuarantineError);
-      expect((failure as Error).message).toMatch(
-        /post-spawn child error \(.*EPIPE.*\).*failed process-group kill/s,
-      );
-    } else {
-      expect(result!.status).toBe(1);
-      // The stdin error owns termination even if exit 0 is concurrently observed.
-      expect(result!.signal).toBe('SIGKILL');
-      expect(result!.stderr).toMatch(
-        process.platform === 'win32' ? /write EOF|EPIPE|broken pipe/i : /EPIPE|broken pipe/i,
-      );
-      expect(result!.stdout).toContain('"operationResult":1');
-      expect(result!.data).toBeUndefined();
-    }
-    expect(observedOutput).toContain('"operationResult":1');
-    await childClosed;
-    const pid = Number(readFileSync(pidFile, 'utf-8'));
-    expect(() => process.kill(pid, 0)).toThrow();
-  }, 15_000);
-
-  it('a stdin Writable error rejects buffered success only after the child is confirmed dead', async () => {
-    const script = join(POST_SPAWN_TMP, 'stdin-error.cjs');
-    const pidFile = join(POST_SPAWN_TMP, 'stdin-error.pid');
-    writeFileSync(
-      script,
-      `const fs = require('fs');\n` +
-        `fs.writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
-        `fs.writeSync(1, JSON.stringify({ operationResult: 1, data: { id: 'provider-id' } }));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    const run = createRunner({
-      launcher: [process.execPath, script],
-      timeoutMs: 30_000,
-      onSpawnedChild: (child) => {
-        child.stdout!.once('data', () => {
-          // Drive Node's real Writable error event after the runner buffered success.
-          // This separately covers the error path regardless of platform pipe behavior.
-          child.stdin!.destroy(Object.assign(new Error('write EPIPE'), { code: 'EPIPE' }));
-        });
-      },
-    });
-    const result = await run(
-      {
-        type: 'hyperdrive.create',
-        name: 'stdin-error-db',
-        binding: 'HYPERDRIVE',
-        configPath: 'literal config.jsonc',
-      },
-      { accountId: 'acct', input: 'x'.repeat(2 * 1024 * 1024) },
-    );
-    expect(result.status).toBe(1);
-    expect(result.signal).toBe('SIGKILL');
-    expect(result.stderr).toContain('write EPIPE');
-    expect(result.stdout).toContain('"operationResult":1');
-    expect(result.data).toBeUndefined();
-    const pid = Number(readFileSync(pidFile, 'utf-8'));
-    expect(() => process.kill(pid, 0)).toThrow();
-  }, 15_000);
-
-  it('an injected POST-spawn `error` routes through the termination machine: the group is DEAD before the promise settles', async () => {
-    // Pre-fix the `error` handler ALWAYS called finish() — a post-spawn error (e.g. a
-    // kill-delivery failure) settled as an ordinary hard failure and RELEASED the
-    // whole-provision lock while the hung child lived on.
-    const pidFile = join(POST_SPAWN_TMP, 'child.pid');
-    const hang = join(POST_SPAWN_TMP, 'hang.cjs');
-    writeHangScript(hang);
-    const run = createRunner({
-      launcher: [process.execPath, hang, pidFile],
-      timeoutMs: 30_000,
-      onSpawnedChild: (child) => {
-        injectErrorAfterChildStarts(child, pidFile, 'injected kill-delivery failure');
-      },
-    });
-    const result = await run(operationFixtureRequest(['d1', 'list']), { accountId: 'acct' });
-    // Settled as a HARD failure carrying the injected error + kill provenance…
-    expect(result.status).toBe(1);
-    expect(result.signal).toBe('SIGKILL');
-    expect(result.stderr).toContain('injected kill-delivery failure');
-    // …and ONLY once the whole group was confirmed dead: the hung child was reaped
-    // BEFORE the promise settled (pre-fix it was still alive here).
-    const pid = Number(readFileSync(pidFile, 'utf-8'));
-    let alive = true;
-    try {
-      process.kill(pid, 0);
-    } catch {
-      alive = false;
-    }
-    reapPidFile(pidFile); // belt + braces: never leak on assertion failure
-    expect(alive).toBe(false);
-  }, 15_000);
-
-  it('a POST-spawn `error` + a FAILED group kill QUARANTINES (rejects; the caller retains the lock)', async () => {
-    const pidFile = join(POST_SPAWN_TMP, 'child2.pid');
-    const hang = join(POST_SPAWN_TMP, 'hang2.cjs');
-    writeHangScript(hang);
-    const run = createRunner({
-      launcher: [process.execPath, hang, pidFile],
-      timeoutMs: 30_000,
-      killProcessGroup: () => {
-        throw Object.assign(new Error('EPERM: operation not permitted'), { code: 'EPERM' });
-      },
-      onSpawnedChild: (child) => {
-        injectErrorAfterChildStarts(child, pidFile, 'injected post-spawn failure');
-      },
-    });
-    let thrown: unknown;
-    try {
-      await run(operationFixtureRequest(['d1', 'list']), { accountId: 'acct' });
-    } catch (error) {
-      thrown = error;
-    }
-    expect(thrown).toBeInstanceOf(WranglerQuarantineError);
-    expect((thrown as Error).message).toMatch(
-      /post-spawn child error \(injected post-spawn failure\).*could not be signalled|post-spawn child error \(injected post-spawn failure\).*failed process-group kill/s,
-    );
-    // The (really alive) child is reaped by the test, then confirmed gone.
-    const pid = reapPidFile(pidFile);
-    expect(pid).toBeDefined();
-    const deadline = Date.now() + 5_000;
-    let dead = false;
-    while (!dead && Date.now() < deadline) {
-      try {
-        process.kill(pid!, 0);
-      } catch {
-        dead = true;
-      }
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    expect(dead).toBe(true);
-  }, 15_000);
-});
-
-describe('withListerDeadline — the deadline holds in a REAL process (child-process regression)', () => {
-  const LISTER_DEADLINE_TMP = join(import.meta.dirname, '.tmp-lister-deadline');
-  beforeEach(() => {
-    rmSync(LISTER_DEADLINE_TMP, { recursive: true, force: true });
-    mkdirSync(LISTER_DEADLINE_TMP, { recursive: true });
-  });
-  afterEach(() => {
-    rmSync(LISTER_DEADLINE_TMP, { recursive: true, force: true });
-  });
-
-  it('a never-settling lister REJECTS after the deadline — the process does NOT exit 0 early, lock released', async () => {
-    // Pre-fix, the deadline timer was unref'd: with a never-settling lister nothing else
-    // referenced the loop (proper-lockfile's heartbeat is unref'd too), so a REAL node
-    // process drained its loop and exited STATUS 0 before the deadline fired — silently
-    // "succeeding" mid-provision. Vitest's own handles mask this in-worker, so the
-    // regression must run in a spawned child process.
-    const appRoot = join(LISTER_DEADLINE_TMP, 'app');
-    const probe = join(LISTER_DEADLINE_TMP, 'probe.mjs');
-    const provisionUrl = `file://${join(import.meta.dirname, '../../src/cli/provision.ts')}`;
-    writeFileSync(
-      probe,
-      `import { mkdirSync, writeFileSync } from 'node:fs';\n` +
-        `import { join } from 'node:path';\n` +
-        `import { provisionCloudflareResources } from ${JSON.stringify(provisionUrl)};\n` +
-        `const root = ${JSON.stringify(appRoot)};\n` +
-        `mkdirSync(root, { recursive: true });\n` +
-        `const cfg = join(root, 'wrangler.jsonc');\n` +
-        `writeFileSync(cfg, JSON.stringify({ name: 'app', account_id: 'acct' }));\n` +
-        `provisionCloudflareResources(root, cfg, {\n` +
-        `  kvNamespaces: [],\n` +
-        `  queues: [],\n` +
-        `  hyperdrive: { binding: 'HYPERDRIVE', name: 'probe-hd', connectionString: 'postgres://u:pw@h/db' },\n` +
-        `}, {\n` +
-        `  runWrangler: () => ({ stdout: '', stderr: '', status: 0 }),\n` +
-        `  listHyperdriveConfigs: () => new Promise(() => {}),\n` +
-        `  listTimeoutMs: 500,\n` +
-        `  log: { info: () => {}, warn: (m) => console.log('WARN:' + m) },\n` +
-        `}).then(\n` +
-        `  () => console.log('RESOLVED'),\n` +
-        `  (err) => { console.log('REJECTED:' + err.message); process.exitCode = 7; },\n` +
-        `);\n`,
-    );
-    const { spawn } = await import('node:child_process');
-    const child = spawn(process.execPath, [probe], {
-      cwd: LISTER_DEADLINE_TMP,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stdout = '';
-    child.stdout.setEncoding('utf-8');
-    child.stdout.on('data', (chunk: string) => {
-      stdout += chunk;
-    });
-    const killTimer = setTimeout(() => child.kill('SIGKILL'), 15_000);
-    try {
-      const [code, signal] = await new Promise<[number | null, NodeJS.Signals | null]>((res) => {
-        child.on('close', (c, s) => res([c, s]));
-      });
-      expect(signal).toBeNull();
-      // THE crux: pre-fix the loop drained and the process exited 0 with NO output.
-      expect(code).not.toBe(0);
-      expect(code).toBe(7);
-      expect(stdout).toContain('exceeded the 500ms deadline');
-      expect(stdout).toContain('REJECTED:');
-      expect(stdout).not.toContain('RESOLVED');
-      // The whole-provision lock was RELEASED on the normal fail-closed path.
-      expect(existsSync(join(appRoot, 'wrangler.jsonc.void-provision.lock.lock'))).toBe(false);
-    } finally {
-      clearTimeout(killTimer);
-      try {
-        child.kill('SIGKILL');
-      } catch {
-        // already gone
-      }
-    }
-  }, 20_000);
-});
-
-describe('provisionCloudflareResources — R2 absence needs the STRUCTURED code', () => {
-  it('a failure whose text merely contains 10006 inside a bucket name is NOT absence (fails closed, no create)', async () => {
-    setup(JSON.stringify({ name: 'app', account_id: 'acct' }));
-    const { run, calls } = makeRunner([
-      {
-        // An AUTH failure (code 10000) whose text contains the digits 10006 inside a bucket name.
-        match: /^r2 bucket info /,
-        reply: () =>
-          fail('', 'X [ERROR] Authentication error for bucket archive-10006-prod [code: 10000]'),
-      },
-    ]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'archive-10006-prod' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/r2 bucket info archive-10006-prod.*(failed|refusing)/s);
-    // No blind create on a non-structured-10006 failure.
-    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(false);
-  });
-
-  it('the GENUINE structured [code: 10006] IS absence → create', async () => {
-    setup(JSON.stringify({ name: 'app', account_id: 'acct' }));
-    const { run, calls } = makeRunner([
-      {
-        match: /^r2 bucket info /,
-        reply: () => fail('', 'X [ERROR] The specified bucket does not exist. [code: 10006]'),
-      },
-      {
-        match: /^r2 bucket create /,
-        reply: () => {
-          simulateUpdateConfig('r2_buckets', {
-            binding: 'STORAGE',
-            bucket_name: 'archive-10006-prod',
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, r2: { binding: 'STORAGE', bucketName: 'archive-10006-prod' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(calls.some((c) => isCall(c, 'r2', 'bucket', 'create'))).toBe(true);
-    expect(result.resources[0].action).toBe('created');
-  });
-});
-
-describe('provisionCloudflareResources — Hyperdrive lister deadline', () => {
-  const lockMutex = `${wranglerPath}.void-provision.lock.lock`;
-
-  it('a never-settling lister makes the boundary REJECT within the deadline (no infinite hold, lock released)', async () => {
-    setup(
-      JSON.stringify({ account_id: 'acct', hyperdrive: [{ binding: 'HYPERDRIVE', id: 'local' }] }),
-    );
-    const { run } = makeRunner([]);
-    const start = Date.now();
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          // Ignores the signal and NEVER settles — pre-fix this held the lock forever.
-          listHyperdriveConfigs: () => new Promise<never>(() => {}),
-          listTimeoutMs: 200,
-        },
-      ),
-    ).rejects.toThrow(/cannot verify whether Hyperdrive config .* already/s);
-    const elapsed = Date.now() - start;
-    // The rejection itself proves the boundary did NOT hold forever (else the vitest
-    // timeout below fires). This is a load-tolerant "bounded" sanity bound — the 200ms
-    // deadline timer can be delayed under heavy load, so keep generous headroom.
-    expect(elapsed).toBeLessThan(12_000);
-    // The lock was released (no infinite hold).
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 15_000);
-
-  it('the deadline signal is aborted when the deadline fires (so a real fetch would cancel)', async () => {
-    setup(JSON.stringify({ account_id: 'acct', name: 'app' }));
-    let capturedSignal: AbortSignal | undefined;
-    const { run } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: (ctx) => {
-            capturedSignal = ctx.signal;
-            return new Promise<never>(() => {});
-          },
-          listTimeoutMs: 150,
-        },
-      ),
-    ).rejects.toThrow(/cannot verify/);
-    expect(capturedSignal?.aborted).toBe(true);
-  }, 10_000);
-});
-
-describe('createDefaultRunWrangler — confirmed child termination + kill classification', () => {
-  /**
-   * A UNIQUE directory per test. Every child spawned in this block runs with its `cwd` set to
-   * this directory, and a fixed shared path lets a crashed or concurrent run leave a stale
-   * `*.pid` file behind whose pid the OS may since have reassigned — so nothing may be inferred
-   * from, and certainly nothing killed by, a pid found on disk. Per-test isolation also stops
-   * one case's stranded child from blocking every later case's cleanup.
-   */
-  let killClassifyTmp = '';
-  /**
-   * Windows refuses to remove a directory that is a live process's CWD, and `waitForDead` only
-   * proves the exit CODE is set — the rundown that releases the CWD handle finishes slightly
-   * later. `maxRetries` is Node's documented remedy for exactly that: it retries
-   * EBUSY/EMFILE/ENFILE/ENOTEMPTY/EPERM on a linear backoff, and is honored only when
-   * `recursive` is set. Inert on POSIX, which unlinks a directory regardless of open handles.
-   *
-   * This deliberately KILLS NOTHING. A pid read from a file is not proof that the process now
-   * holding that pid is the one that wrote it, so signalling it could terminate an unrelated
-   * process.
-   *
-   * A removal that still fails is then classified, not blanket-tolerated: a recorded pid that is
-   * STILL LIVE means a child was genuinely stranded — a real leak, failed loud. Otherwise the
-   * only things left are the dead child's own script and pid file, which Windows keeps mapped
-   * until process rundown completes; that can outlast any practical retry budget and is an OS
-   * artifact rather than a defect in the code under test, whose assertions have already passed.
-   */
-  const rmTmp = (): void => {
-    if (killClassifyTmp === '') {
-      return;
-    }
-    try {
-      rmSync(killClassifyTmp, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
-      return;
-    } catch (error) {
-      const left = existsSync(killClassifyTmp) ? readdirSync(killClassifyTmp) : [];
-      const live = left
-        .filter((entry) => entry.endsWith('.pid'))
-        .map((entry) => Number(readFileSync(join(killClassifyTmp, entry), 'utf-8').trim()))
-        .filter((pid) => {
-          try {
-            process.kill(pid, 0);
-            return true;
-          } catch {
-            return false;
-          }
-        });
-      const detail =
-        `${(error as Error).message}\n` +
-        `  entries remaining: ${left.length > 0 ? left.join(', ') : '(none)'}\n` +
-        `  recorded pids still resolving to a live process: ${live.length > 0 ? live.join(', ') : 'none'}`;
-      if (live.length > 0) {
-        throw new Error(`could not remove ${killClassifyTmp}: ${detail}`);
-      }
-      // Nothing of ours is running. Warn so it stays visible, rather than reddening a green
-      // behavioural test over temp-file hygiene; the directory is unique per test and ignored by
-      // git, so a leftover cannot affect any other case.
-      console.warn(`warn: leaving ${killClassifyTmp} behind — ${detail}`);
-    }
-  };
-  beforeEach(() => {
-    killClassifyTmp = mkdtempSync(join(import.meta.dirname, '.tmp-kill-classify-'));
-  });
-  afterEach(() => {
-    rmTmp();
-  });
-
-  async function waitForDead(pid: number, timeoutMs: number): Promise<boolean> {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        return true;
-      }
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    return false;
-  }
-
-  it('isAlreadyGoneKillError: ESRCH → true (already gone), any other code → false (real failure)', () => {
-    expect(isAlreadyGoneKillError(Object.assign(new Error('x'), { code: 'ESRCH' }))).toBe(true);
-    expect(isAlreadyGoneKillError(Object.assign(new Error('x'), { code: 'EPERM' }))).toBe(false);
-    expect(isAlreadyGoneKillError(new Error('x'))).toBe(false);
-    expect(isAlreadyGoneKillError(null)).toBe(false);
-  });
-
-  it('a REAL kill failure (EPERM) on timeout QUARANTINES: the runner REJECTS, never settle-and-release', async () => {
-    const pidFile = join(killClassifyTmp, 'cli.pid');
-    const hungCli = join(killClassifyTmp, 'hung.cjs');
-    writeFileSync(
-      hungCli,
-      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    let spawnedPid: number | undefined;
-    const run = createDefaultRunWrangler(killClassifyTmp, {
-      launcher: [process.execPath, hungCli],
-      onSpawnedChild: (child) => {
-        spawnedPid = child.pid;
-      },
-      timeoutMs: 300,
-      // Simulate a kill that FAILS for a non-ESRCH reason (the child is still alive).
-      killProcessGroup: () => {
-        throw Object.assign(new Error('EPERM: operation not permitted'), { code: 'EPERM' });
-      },
-    });
-    // The child may still be running, so the runner must NOT resolve (a resolution would
-    // let the provision error path release the whole-provision lock under a live child).
-    // It REJECTS with a quarantine error naming the pid + manual-recovery guidance.
-    let rejected: unknown;
-    try {
-      await run(operationFixtureRequest(['d1', 'list', '--json']), { accountId: 'acct' });
-    } catch (error) {
-      rejected = error;
-    }
-    expect(rejected).toBeInstanceOf(WranglerQuarantineError);
-    const err = rejected as WranglerQuarantineError;
-    expect(err.quarantine).toBe(true);
-    expect(err.message).toMatch(/could not be killed: EPERM/);
-    expect(err.message).toMatch(/intentionally RETAINED/);
-    expect(err.message).toMatch(/pid \d+/);
-    // The child is genuinely STILL ALIVE (the bug scenario) — prove it, then clean up.
-    const pid = spawnedPid!;
-    expect(pid).toBeTypeOf('number');
-    expect(() => process.kill(pid, 0)).not.toThrow();
-    try {
-      process.kill(pid, 'SIGKILL');
-    } catch {
-      // already gone
-    }
-    expect(await waitForDead(pid, 10_000)).toBe(true);
-  }, 15_000);
-
-  it('an unconfirmable termination (grace expiry, child still alive) QUARANTINES too', async () => {
-    const pidFile = join(killClassifyTmp, 'cli3.pid');
-    const hungCli = join(killClassifyTmp, 'hung3.cjs');
-    writeFileSync(
-      hungCli,
-      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    let spawnedPid: number | undefined;
-    const run = createDefaultRunWrangler(killClassifyTmp, {
-      launcher: [process.execPath, hungCli],
-      onSpawnedChild: (child) => {
-        spawnedPid = child.pid;
-      },
-      timeoutMs: 250,
-      confirmKillGraceMs: 500,
-      // A killer that CLAIMS success but kills nothing: the group stays alive, so
-      // close/group-gone can never both be confirmed → quarantine at the grace expiry.
-      killProcessGroup: () => {},
-    });
-    let rejected: unknown;
-    try {
-      await run(operationFixtureRequest(['d1', 'list', '--json']), { accountId: 'acct' });
-    } catch (error) {
-      rejected = error;
-    }
-    expect(rejected).toBeInstanceOf(WranglerQuarantineError);
-    expect((rejected as Error).message).toMatch(/could not be confirmed terminated within 500ms/);
-    expect((rejected as Error).message).toMatch(/intentionally RETAINED/);
-    // Clean up the real child the fake killer left alive.
-    const pid = spawnedPid!;
-    expect(pid).toBeTypeOf('number');
-    try {
-      process.kill(pid, 'SIGKILL');
-    } catch {
-      // already gone
-    }
-    expect(await waitForDead(pid, 10_000)).toBe(true);
-  }, 15_000);
-
-  it('an ESRCH kill (already gone) is treated as SUCCESS — settles as the timeout hard-failure, no kill-error text', async () => {
-    const pidFile = join(killClassifyTmp, 'cli2.pid');
-    const hungCli = join(killClassifyTmp, 'hung2.cjs');
-    writeFileSync(
-      hungCli,
-      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    let spawnedPid: number | undefined;
-    const run = createDefaultRunWrangler(killClassifyTmp, {
-      launcher: [process.execPath, hungCli],
-      onSpawnedChild: (child) => {
-        spawnedPid = child.pid;
-      },
-      timeoutMs: 300,
-      // Kill FOR REAL, then report ESRCH (the child exited in the race window) → treated as gone.
-      killProcessGroup: (target, signal) => {
-        process.kill(target, signal);
-        throw Object.assign(new Error('ESRCH: no such process'), { code: 'ESRCH' });
-      },
-    });
-    const result = await run(operationFixtureRequest(['d1', 'list', '--json']), {
-      accountId: 'acct',
-    });
-    expect(result.signal).toBe('SIGKILL');
-    expect(result.status).not.toBe(0);
-    // ESRCH is NOT a kill failure — no "could not be killed" surfaced.
-    expect(result.stderr).not.toMatch(/could not be killed/);
-    expect(result.error).toBeNull();
-    const pid = spawnedPid!;
-    expect(pid).toBeTypeOf('number');
-    expect(await waitForDead(pid, 10_000)).toBe(true);
-  }, 15_000);
-
-  it('lock is released only AFTER confirmed child termination: a hung wrangler → provision rejects, child dead, mutex gone', async () => {
-    // Drive a FULL provision whose wrangler runner is the REAL default runner spawning a hung
-    // CLI. The `d1 list` times out → confirmed-termination hard failure → provision rejects →
-    // the whole-provision lock is released. The child must be dead and the mutex gone.
-    const cfgDir = join(killClassifyTmp, 'app');
-    mkdirSync(cfgDir, { recursive: true });
-    const cfgPath = join(cfgDir, 'wrangler.jsonc');
-    writeFileSync(cfgPath, JSON.stringify({ name: 'app', account_id: 'acct' }));
-    const pidFile = join(killClassifyTmp, 'prov-cli.pid');
-    const hungCli = join(killClassifyTmp, 'prov-hung.cjs');
-    writeFileSync(
-      hungCli,
-      `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid));\n` +
-        `process.on('SIGTERM', () => {});\n` +
-        `setInterval(() => {}, 1 << 30);\n`,
-    );
-    let spawnedPid: number | undefined;
-    const runner = createDefaultRunWrangler(cfgDir, {
-      launcher: [process.execPath, hungCli],
-      onSpawnedChild: (child) => {
-        spawnedPid = child.pid;
-      },
-      timeoutMs: 400,
-    });
-    const lockMutex = `${realpathSync(cfgPath)}.void-provision.lock.lock`;
-    await expect(
-      provisionCloudflareResources(
-        cfgDir,
-        cfgPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: runner, log: silentLog },
-      ),
-    ).rejects.toThrow(/d1 list.*(failed|timeout)/s);
-    const pid = spawnedPid!;
-    expect(pid).toBeTypeOf('number');
-    // The child (and its group) was confirmed terminated...
-    expect(await waitForDead(pid, 5_000)).toBe(true);
-    // ...and the lock was released (never leaked past the child).
-    expect(existsSync(lockMutex)).toBe(false);
-  }, 15_000);
-});
-
-describe('provisionCloudflareResources — dangling-symlink lock identity', () => {
-  it('provisions via dangling-symlink aliases to the SAME not-yet-created target share ONE lock identity (one create)', async () => {
-    // A `shared/` dir exists but `shared/wrangler.jsonc` does NOT yet. Two aliases both point
-    // (as DANGLING symlinks) at that same not-yet-created target. Without resolving the dangling
-    // final link each alias would canonicalize to ITS OWN lexical path → two marker locks → an
-    // alias provision would not contend on the canonical lock and both could create a duplicate.
-    // (Two provisions can no longer race in ONE process — the identity proof is that
-    // an alias provision blocks on the CANONICAL mutex, plus create-then-reuse across aliases.)
-    const sharedDir = join(tmpDir, 'shared');
-    mkdirSync(sharedDir, { recursive: true });
-    const target = join(sharedDir, 'wrangler.jsonc'); // NOT created yet — dangling
-    const aliasA = join(tmpDir, 'aliasA.jsonc');
-    const aliasB = join(tmpDir, 'aliasB.jsonc');
-    symlinkSync(target, aliasA);
-    symlinkSync(target, aliasB);
-    expect(existsSync(target)).toBe(false); // both aliases are dangling at start
-
-    let createCalls = 0;
-    const run: RunWrangler = provisionOperationFixture((args) => {
-      if (isCall(args, 'hyperdrive', 'create')) {
-        createCalls++;
-        // --update-config writes to the CANONICAL target (both aliases resolve to it).
-        simulateUpdateConfig(
-          'hyperdrive',
-          { binding: 'HYPERDRIVE', id: hex32('hd-' + createCalls) },
-          target,
-        );
-        return ok();
-      }
-      return ok();
-    });
-    const makeProv = (
-      aliasPath: string,
-      retries?: number,
-    ): Promise<{ resources: Array<{ kind: string; action: string }> }> =>
-      provisionCloudflareResources(
-        tmpDir,
-        aliasPath,
-        {
-          ...emptyDesired,
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: 'postgres://x' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => [],
-          ...(retries !== undefined ? { lockOptions: { retries } } : {}),
-        },
-      ) as Promise<{ resources: Array<{ kind: string; action: string }> }>;
-    // IDENTITY: while the CANONICAL (real-target) lock is held, a dangling-alias
-    // provision cannot acquire — it resolves to the same mutex.
-    const canonicalTarget = join(realpathSync(sharedDir), 'wrangler.jsonc');
-    const held = await acquireProvisionLock(canonicalTarget);
-    await expect(makeProv(aliasA, 0)).rejects.toThrow(/already being held/);
-    await held.release();
-    // One underlying (initially not-yet-created) file: a create via alias A is
-    // read-first-REUSED via alias B.
-    const a = await makeProv(aliasA);
-    const b = await makeProv(aliasB);
-    expect(a.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('created');
-    expect(b.resources.find((r) => r.kind === 'hyperdrive')?.action).toBe('reused');
-    expect(createCalls).toBe(1);
-    // The ONE canonical mutex (keyed on the real target) is released.
-    expect(existsSync(`${realpathSync(target)}.void-provision.lock.lock`)).toBe(false);
-  }, 15_000);
-
-  it('a non-ENOENT realpath error (a self-referential symlink cycle → ELOOP) SURFACES, not swallowed', async () => {
-    // `loop.jsonc` → `loop.jsonc` is a symlink cycle: realpath throws ELOOP (NOT ENOENT). The
-    // old broad catch swallowed it and fell back to a bogus lexical path; the fix rethrows it.
-    mkdirSync(tmpDir, { recursive: true });
-    const loop = join(tmpDir, 'loop.jsonc');
-    symlinkSync(loop, loop);
-    const { run } = makeRunner([]);
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        loop,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/ELOOP/);
-  });
-});
-
-describe('provisionCloudflareResources — dotenv fence: export prefix + empty-env files', () => {
-  const redirect = 'CLOUDFLARE_API_BASE_URL=https://api.staging.cloudflare.com/client/v4\n';
-  const runFail = () => {
-    const { run, calls } = makeRunner([]);
-    return { run, calls };
-  };
-
-  it('detects an `export `-prefixed transport-redirect var in `.env` and fails closed (no remote work)', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.env'), `export ${redirect}`);
-    const { run, calls } = runFail();
-    let listerCalled = false;
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        {
-          ...emptyDesired,
-          d1: { binding: 'DB', name: 'myapp-db' },
-          hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hd', connectionString: '' },
-        },
-        {
-          runWrangler: run,
-          log: silentLog,
-          listHyperdriveConfigs: async () => {
-            listerCalled = true;
-            return [];
-          },
-        },
-      ),
-    ).rejects.toThrow(/refusing to provision.*\.env.*CLOUDFLARE_API_BASE_URL.*redirect/s);
-    expect(calls.length).toBe(0);
-    expect(listerCalled).toBe(false);
-  });
-
-  it('detects a transport-redirect var in the empty-env file `.env.` (loaded because every command passes --env=)', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.env.'), redirect);
-    const { run, calls } = runFail();
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/refusing to provision.*"\.env\.".*CLOUDFLARE_API_BASE_URL.*redirect/s);
-    expect(calls.length).toBe(0);
-  });
-
-  it('detects a transport-redirect var in the empty-env file `.env..local`', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.env..local'), redirect);
-    const { run, calls } = runFail();
-    await expect(
-      provisionCloudflareResources(
-        tmpDir,
-        wranglerPath,
-        { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-        { runWrangler: run, log: silentLog },
-      ),
-    ).rejects.toThrow(/refusing to provision.*"\.env\.\.local".*redirect/s);
-    expect(calls.length).toBe(0);
-  });
-
-  it('does NOT false-trigger on a benign `.env` with an unrelated `export` var', async () => {
-    setup(JSON.stringify({ account_id: 'config-acct', name: 'app' }));
-    writeFileSync(join(tmpDir, '.env'), 'export DATABASE_URL=postgres://localhost/app\nFOO=bar\n');
-    const { run } = makeRunner([
-      { match: /^d1 list/, reply: () => ok('[]') },
-      {
-        match: /^d1 create/,
-        reply: () => {
-          simulateUpdateConfig('d1_databases', {
-            binding: 'DB',
-            database_name: 'myapp-db',
-            database_id: uuid('db'),
-          });
-          return ok();
-        },
-      },
-    ]);
-    const result = await provisionCloudflareResources(
-      tmpDir,
-      wranglerPath,
-      { ...emptyDesired, d1: { binding: 'DB', name: 'myapp-db' } },
-      { runWrangler: run, log: silentLog },
-    );
-    expect(result.resources.find((r) => r.kind === 'd1')?.action).toBe('created');
-  });
-});
-
-describe('checkCloudflareProvisionDrift — id-drift vs the committed wrangler config', () => {
-  it('reports every desired id-bearing resource as missing when the config file is absent', () => {
-    rmSync(tmpDir, { recursive: true, force: true });
-    mkdirSync(tmpDir, { recursive: true });
-    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
-      d1: { binding: 'DB', name: 'myapp-db' },
-      kvNamespaces: [
-        { binding: 'KV', title: 'myapp-kv' },
-        { binding: 'ISR_CACHE', title: 'myapp-isr-cache' },
-      ],
-      r2: { binding: 'STORAGE', bucketName: 'myapp-storage' },
-      queues: ['jobs'],
-      hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hyperdrive', connectionString: '' },
-    });
-    // Queues are name-bearing, not id-bearing → excluded from the id-drift check.
-    expect(missing.map((m) => m.binding).sort()).toEqual([
-      'DB',
-      'HYPERDRIVE',
-      'ISR_CACHE',
-      'KV',
-      'STORAGE',
-    ]);
-  });
-
-  it('treats placeholder ids (local / default) as NOT provisioned', () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'default', database_id: 'local' }],
-        kv_namespaces: [{ binding: 'ISR_CACHE', id: 'local' }],
-        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }],
-      }),
-    );
-    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
-      d1: { binding: 'DB', name: 'myapp-db' },
-      kvNamespaces: [{ binding: 'ISR_CACHE', title: 'myapp-isr-cache' }],
-      r2: { binding: 'STORAGE', bucketName: 'myapp-storage' },
-      queues: [],
-    });
-    expect(missing.map((m) => m.kind).sort()).toEqual(['d1', 'kv', 'r2']);
-  });
-
-  it('accepts a stored R2 bucket named default when that is the desired bucket', () => {
-    setup(JSON.stringify({ r2_buckets: [{ binding: 'STORAGE', bucket_name: 'default' }] }));
-    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
-      ...emptyDesired,
-      r2: { binding: 'STORAGE', bucketName: 'default' },
-    });
-    expect(missing).toEqual([]);
-  });
-
-  it('reports NO drift when every desired resource has a real id', () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db') }],
-        kv_namespaces: [
-          { binding: 'KV', id: hex32('kv') },
-          { binding: 'ISR_CACHE', id: hex32('isr') },
-        ],
-        r2_buckets: [{ binding: 'STORAGE', bucket_name: 'myapp-storage' }],
-        hyperdrive: [{ binding: 'HYPERDRIVE', id: hex32('hd') }],
-      }),
-    );
-    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
-      d1: { binding: 'DB', name: 'myapp-db' },
-      kvNamespaces: [
-        { binding: 'KV', title: 'myapp-kv' },
-        { binding: 'ISR_CACHE', title: 'myapp-isr-cache' },
-      ],
-      r2: { binding: 'STORAGE', bucketName: 'myapp-storage' },
-      queues: [],
-      hyperdrive: { binding: 'HYPERDRIVE', name: 'myapp-hyperdrive', connectionString: '' },
-    });
-    expect(missing).toEqual([]);
-  });
-
-  it('flags only the newly-desired resource when the rest are already provisioned', () => {
-    setup(
-      JSON.stringify({
-        d1_databases: [{ binding: 'DB', database_name: 'myapp-db', database_id: uuid('db') }],
-        // ISR_CACHE not yet declared — routes just started using `revalidate`.
-      }),
-    );
-    const { missing } = checkCloudflareProvisionDrift(wranglerPath, {
-      d1: { binding: 'DB', name: 'myapp-db' },
-      kvNamespaces: [{ binding: 'ISR_CACHE', title: 'myapp-isr-cache' }],
-      queues: [],
-    });
-    expect(missing).toEqual([{ binding: 'ISR_CACHE', kind: 'kv', name: 'myapp-isr-cache' }]);
-  });
-});
diff --git a/packages/void/test/unit/purge-cache-command.test.ts b/packages/void/test/unit/purge-cache-command.test.ts
index 0db278a9f..db4d6591a 100644
--- a/packages/void/test/unit/purge-cache-command.test.ts
+++ b/packages/void/test/unit/purge-cache-command.test.ts
@@ -2,8 +2,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
-import { Buffer } from '../../src/cli/node-buffer.ts';
-import { savePlatformConnection } from '../../src/cli/platform-registry.ts';
+import { captureOutput, setIsolatedHome } from '../helpers/cli-command.ts';
 import { withPlatformDiscovery } from '../helpers/platform-discovery.ts';
 
 const tempHomes: Array<string> = [];
@@ -15,23 +14,6 @@ vi.mock('../../src/cli/auth', async (importOriginal) => ({
   getToken: () => mockGetToken(),
 }));
 
-function setIsolatedHome(): void {
-  const dir = mkdtempSync(join(tmpdir(), 'void-home-'));
-  tempHomes.push(dir);
-  process.env.HOME = dir;
-  process.env.USERPROFILE = dir;
-  process.env.VOID_PLATFORM_REGISTRY_DIR = join(dir, 'registry');
-  savePlatformConnection({
-    accountId: null,
-    apiUrl: 'https://api.example.test',
-    applicationDomain: 'apps.example.test',
-    displayName: 'Test platform',
-    installationId: null,
-    kind: 'connected',
-    proxyUrl: 'https://proxy.example.test',
-  });
-}
-
 function createLinkedProject(root: string): void {
   const voidDir = join(root, '.void');
   mkdirSync(voidDir, { recursive: true });
@@ -45,31 +27,6 @@ function createLinkedProject(root: string): void {
   );
 }
 
-function captureOutput(): { output: () => string; restore: () => void } {
-  const chunks: Array<string> = [];
-  const writeMock = vi
-    .spyOn(process.stdout, 'write')
-    .mockImplementation((...args: Array<unknown>) => {
-      const chunk = args[0];
-      if (typeof chunk === 'string') {
-        chunks.push(chunk);
-      } else if (Buffer.isBuffer(chunk)) {
-        chunks.push(chunk.toString());
-      }
-      return true;
-    });
-  const logMock = vi.spyOn(console, 'log').mockImplementation((...args: Array<unknown>) => {
-    chunks.push(args.map(String).join(' ') + '\n');
-  });
-  return {
-    output: () => chunks.join(''),
-    restore: () => {
-      writeMock.mockRestore();
-      logMock.mockRestore();
-    },
-  };
-}
-
 async function importRunPurgeCacheCommand() {
   vi.resetModules();
   const mod = await import('../../src/cli/cache.ts');
@@ -100,7 +57,7 @@ describe('runPurgeCacheCommand', () => {
   });
 
   it('purges cache for linked project', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
     mockGetToken.mockReturnValue('test-token');
     process.env.VOID_API_URL = 'https://api.example.test';
 
@@ -134,7 +91,7 @@ describe('runPurgeCacheCommand', () => {
   });
 
   it('purges cache using --project slug', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
     mockGetToken.mockReturnValue('test-token');
     process.env.VOID_API_URL = 'https://api.example.test';
 
@@ -166,7 +123,7 @@ describe('runPurgeCacheCommand', () => {
   });
 
   it('exits with error when --project slug not found', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
     mockGetToken.mockReturnValue('test-token');
     process.env.VOID_API_URL = 'https://api.example.test';
 
@@ -179,7 +136,7 @@ describe('runPurgeCacheCommand', () => {
     );
 
     const capture = captureOutput();
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
       throw new Error(`process.exit:${code ?? 0}`);
     }) as never);
 
@@ -189,17 +146,16 @@ describe('runPurgeCacheCommand', () => {
     capture.restore();
 
     expect(out).toContain("project: No project found with slug 'nonexistent'");
-    expect(exitSpy).toHaveBeenCalled();
   });
 
   it('exits with error when not logged in', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
 
     const root = mkdtempSync(join(tmpdir(), 'void-root-'));
     tempRoots.push(root);
 
     const capture = captureOutput();
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
       throw new Error(`process.exit:${code ?? 0}`);
     }) as never);
 
@@ -209,18 +165,17 @@ describe('runPurgeCacheCommand', () => {
     capture.restore();
 
     expect(out).toContain('Not logged in');
-    expect(exitSpy).toHaveBeenCalled();
   });
 
   it('exits with error when no linked project', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
     mockGetToken.mockReturnValue('test-token');
 
     const root = mkdtempSync(join(tmpdir(), 'void-root-'));
     tempRoots.push(root);
 
     const capture = captureOutput();
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
       throw new Error(`process.exit:${code ?? 0}`);
     }) as never);
 
@@ -230,11 +185,10 @@ describe('runPurgeCacheCommand', () => {
     capture.restore();
 
     expect(out).toContain('No linked project');
-    expect(exitSpy).toHaveBeenCalled();
   });
 
   it('exits with error when API returns an error', async () => {
-    setIsolatedHome();
+    tempHomes.push(setIsolatedHome());
     mockGetToken.mockReturnValue('test-token');
     process.env.VOID_API_URL = 'https://api.example.test';
 
@@ -248,7 +202,7 @@ describe('runPurgeCacheCommand', () => {
     );
 
     const capture = captureOutput();
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
       throw new Error(`process.exit:${code ?? 0}`);
     }) as never);
 
@@ -258,6 +212,5 @@ describe('runPurgeCacheCommand', () => {
     capture.restore();
 
     expect(out).toContain('Cache purge failed');
-    expect(exitSpy).toHaveBeenCalled();
   });
 });
diff --git a/packages/void/test/unit/queue-scan.test.ts b/packages/void/test/unit/queue-scan.test.ts
index b91925e58..849c80e16 100644
--- a/packages/void/test/unit/queue-scan.test.ts
+++ b/packages/void/test/unit/queue-scan.test.ts
@@ -6,44 +6,18 @@ import { scanQueuesSync } from '../../src/queues/scan.ts';
 
 describe('scanQueuesSync', () => {
   let root: string;
+  let queuesDir: string;
 
   beforeEach(() => {
     root = join(tmpdir(), `queue-scan-test-${Date.now()}`);
-    mkdirSync(join(root, 'queues'), { recursive: true });
+    queuesDir = join(root, 'queues');
+    mkdirSync(queuesDir, { recursive: true });
   });
 
   afterEach(() => {
     rmSync(root, { recursive: true, force: true });
   });
 
-  it('extracts maxRetries and retryDelay from queue file', () => {
-    writeFileSync(
-      join(root, 'queues', 'emails.ts'),
-      `import { defineQueue } from "void";
-export const maxRetries = 5;
-export const retryDelay = 30;
-export default defineQueue(async (batch, env) => {});`,
-    );
-
-    const queues = scanQueuesSync(root);
-    expect(queues).toHaveLength(1);
-    expect(queues[0].maxRetries).toBe(5);
-    expect(queues[0].retryDelay).toBe(30);
-  });
-
-  it('returns undefined for missing consumer options', () => {
-    writeFileSync(
-      join(root, 'queues', 'basic.ts'),
-      `import { defineQueue } from "void";
-export default defineQueue(async (batch, env) => {});`,
-    );
-
-    const queues = scanQueuesSync(root);
-    expect(queues).toHaveLength(1);
-    expect(queues[0].maxRetries).toBeUndefined();
-    expect(queues[0].retryDelay).toBeUndefined();
-  });
-
   it('extracts all consumer options together', () => {
     writeFileSync(
       join(root, 'queues', 'full.ts'),
@@ -55,7 +29,7 @@ export const retryDelay = 60;
 export default defineQueue(async (batch, env) => {});`,
     );
 
-    const queues = scanQueuesSync(root);
+    const queues = scanQueuesSync(queuesDir);
     expect(queues).toHaveLength(1);
     expect(queues[0].maxBatchSize).toBe(50);
     expect(queues[0].maxBatchTimeout).toBe(10);
@@ -71,7 +45,7 @@ const example = 'export const retryDelay = 50';
 export const maxRetries = 3 as const;
 export default async () => {};`,
     );
-    expect(scanQueuesSync(root)).toMatchObject([
+    expect(scanQueuesSync(queuesDir)).toMatchObject([
       { maxBatchSize: undefined, maxRetries: 3, retryDelay: undefined },
     ]);
   });
@@ -81,7 +55,7 @@ export default async () => {};`,
       join(root, 'queues', 'basic.ts'),
       'export const maxBatchSize = 2 + 3; export default async () => {};',
     );
-    expect(() => scanQueuesSync(root)).toThrow('maxBatchSize');
+    expect(() => scanQueuesSync(queuesDir)).toThrow('maxBatchSize');
   });
 
   it('normalizes nested paths while preserving binding derivation', () => {
@@ -91,7 +65,7 @@ export default async () => {};`,
       `export default async () => {};`,
     );
 
-    expect(scanQueuesSync(root)).toEqual([
+    expect(scanQueuesSync(queuesDir)).toEqual([
       {
         filePath: 'order/notifications.ts',
         name: 'order-notifications',
@@ -105,7 +79,7 @@ export default async () => {};`,
     writeFileSync(join(root, 'queues', 'order-notifications.ts'), 'export default {};');
     writeFileSync(join(root, 'queues', 'order', 'notifications.ts'), 'export default {};');
 
-    expect(() => scanQueuesSync(root)).toThrow(
+    expect(() => scanQueuesSync(queuesDir)).toThrow(
       [
         'queue: Multiple queue files resolve to the same queue name:',
         '  "order-notifications": "order-notifications.ts", "order/notifications.ts"',
diff --git a/packages/void/test/unit/release-policy.test.ts b/packages/void/test/unit/release-policy.test.ts
index 3b2ef3ca4..27ae9208b 100644
--- a/packages/void/test/unit/release-policy.test.ts
+++ b/packages/void/test/unit/release-policy.test.ts
@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs';
 import { describe, expect, it } from 'vite-plus/test';
 import { releasePolicy } from '../../../../.github/scripts/release-policy.ts';
 
@@ -106,49 +105,3 @@ describe('public package release policy', () => {
     ).toThrow('create-void@0.10.14 does not match');
   });
 });
-
-describe('trusted publishing workflow', () => {
-  const workflow = readFileSync(
-    new URL('../../../../.github/workflows/publish.yml', import.meta.url),
-    'utf8',
-  );
-  function job(name: string): string {
-    const parts = workflow.split(`\n  ${name}:\n`);
-    expect(parts).toHaveLength(2);
-    return parts[1]!.split(/\n {2}[\w-]+:\n/)[0]!;
-  }
-  const publishJob = job('publish');
-
-  it('rejects invalid tags before installing dependencies or running CI', () => {
-    const validation = job('validate-release');
-    expect(validation).toContain('node .github/scripts/release-policy.ts');
-    expect(validation).toContain('run-install: false');
-    expect(validation).toContain('cache: false');
-    expect(validation).not.toContain('id-token: write');
-    for (const name of ['ci', 'platform-ci', 'prepublish-test']) {
-      expect(job(name)).toContain('    needs: validate-release\n');
-    }
-  });
-
-  it('grants OIDC permission to the GitHub-hosted release job', () => {
-    expect(publishJob).toBeDefined();
-    expect(publishJob).toContain('    runs-on: ubuntu-latest\n');
-    expect(publishJob).toContain('    environment: Release\n');
-    expect(publishJob).toMatch(/ {4}permissions:\n(?: {6}[^\n]+\n)* {6}id-token: write\n/);
-  });
-
-  it('does not require a stored token or use whoami to validate OIDC', () => {
-    expect(publishJob).not.toMatch(/NPM_TOKEN|NODE_AUTH_TOKEN|npm whoami/);
-    expect(publishJob).toContain('npm install -g npm@11');
-    expect(publishJob).toContain(
-      'vp pm publish -r --access public --tag "$RELEASE_NPM_TAG" --no-git-checks',
-    );
-    expect(publishJob).not.toContain('--force');
-  });
-
-  it('keeps CI gates and validated stable or prerelease channel selection', () => {
-    expect(publishJob).toContain('    needs: [ci, platform-ci, prepublish-test]\n');
-    expect(publishJob).toContain('node .github/scripts/release-policy.ts');
-    expect(publishJob).toContain('RELEASE_NPM_TAG: ${{ steps.release.outputs.npm-tag }}');
-  });
-});
diff --git a/packages/void/test/unit/remote/client.test.ts b/packages/void/test/unit/remote/client.test.ts
index 98562af45..dd771b37d 100644
--- a/packages/void/test/unit/remote/client.test.ts
+++ b/packages/void/test/unit/remote/client.test.ts
@@ -19,12 +19,9 @@ describe('ProxyClient', () => {
     vi.restoreAllMocks();
   });
 
-  describe.each(['fetch', 'stream'] as const)('%s error diagnostics', (method) => {
+  describe('error diagnostics', () => {
     function request() {
-      const client = new ProxyClient(PROXY_URL, TOKEN, PROJECT_ID);
-      return method === 'fetch'
-        ? client.fetch('/d1/query', { binding: 'DB' })
-        : client.stream('/r2/get', { method: 'POST', body: JSON.stringify({ binding: 'FILES' }) });
+      return new ProxyClient(PROXY_URL, TOKEN, PROJECT_ID).fetch('/d1/query', { binding: 'DB' });
     }
 
     it('prefers server recovery guidance over the machine error and private metadata', async () => {
@@ -186,100 +183,13 @@ describe('ProxyClient', () => {
         }),
       );
 
-      // Verify projectId was injected into body
       const call = fetchMock.mock.calls[0];
       expect(call).toBeDefined();
-      if (!call) {
-        throw new Error('Expected fetch to be called');
-      }
       const [, init] = call as unknown as [RequestInfo | URL, RequestInit];
       const body = JSON.parse(String(init.body));
       expect(body.projectId).toBe(PROJECT_ID);
       expect(body.binding).toBe('DB');
       expect(body.sql).toBe('SELECT 1');
     });
-
-    it('throws on non-OK responses with error message from body', async () => {
-      setFetchMock(
-        async () => new Response(JSON.stringify({ error: 'not found' }), { status: 404 }),
-      );
-
-      const client = new ProxyClient(PROXY_URL, TOKEN, PROJECT_ID);
-      await expect(client.fetch('/d1/query', { binding: 'MISSING' })).rejects.toThrow(
-        /remote: Proxy request failed with 404/,
-      );
-    });
-
-    it('returns response for successful requests', async () => {
-      setFetchMock(async () => Response.json({ results: [{ id: 1 }], success: true }));
-
-      const client = new ProxyClient(PROXY_URL, TOKEN, PROJECT_ID);
-      const res = await client.fetch('/d1/query', { binding: 'DB', sql: 'SELECT 1' });
-
-      expect(res.ok).toBe(true);
-      const data = (await res.json()) as { results: Array<unknown> };
-      expect(data.results).toEqual([{ id: 1 }]);
-    });
-  });
-
-  describe('stream()', () => {
-    it('returns raw Response for streaming', async () => {
-      const stream = new ReadableStream({
-        start(controller) {
-          controller.enqueue(new TextEncoder().encode('chunk1'));
-          controller.close();
-        },
-      });
-      setFetchMock(
-        async () =>
-          new Response(stream, { headers: { 'content-type': 'application/octet-stream' } }),
-      );
-
-      const client = new ProxyClient(PROXY_URL, TOKEN, PROJECT_ID);
-      const res = await client.stream('/r2/get', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ binding: 'STORAGE', key: 'file.txt' }),
-      });
-
-      expect(res.ok).toBe(true);
-      const text = await res.text();
-      expect(text).toBe('chunk1');
-    });
-
-    it('injects Authorization header and projectId into body', async () => {
-      const fetchMock = setFetchMock(async () => Response.json({ ok: true }));
-
-      const client = new ProxyClient(PROXY_URL, TOKEN, PROJECT_ID);
-      await client.stream('/r2/get', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ binding: 'STORAGE', key: 'file.txt' }),
-      });
-
-      const call = fetchMock.mock.calls[0];
-      expect(call).toBeDefined();
-      if (!call) {
-        throw new Error('Expected fetch to be called');
-      }
-      const [, init] = call as unknown as [RequestInfo | URL, RequestInit];
-      const headers = new Headers(init.headers);
-      expect(headers.get('Authorization')).toBe(`Bearer ${TOKEN}`);
-      // Verify projectId was injected into body
-      const body = JSON.parse(String(init.body));
-      expect(body.projectId).toBe(PROJECT_ID);
-    });
-
-    it('throws on non-OK responses', async () => {
-      setFetchMock(async () => new Response('server error', { status: 502 }));
-
-      const client = new ProxyClient(PROXY_URL, TOKEN, PROJECT_ID);
-      await expect(
-        client.stream('/r2/get', {
-          method: 'POST',
-          body: JSON.stringify({ binding: 'STORAGE', key: 'file.txt' }),
-        }),
-      ).rejects.toThrow(/remote: Proxy request failed with 502/);
-    });
   });
 });
diff --git a/packages/void/test/unit/remote/d1.test.ts b/packages/void/test/unit/remote/d1.test.ts
index 275e8fb62..be3e4908e 100644
--- a/packages/void/test/unit/remote/d1.test.ts
+++ b/packages/void/test/unit/remote/d1.test.ts
@@ -131,43 +131,25 @@ describe('ProxyD1Database', () => {
 
   describe('batch()', () => {
     it('keeps independent bindings when reusing a prepared statement', async () => {
-      mockFetch([]);
-      const db = new ProxyD1Database(createClient(), 'DB');
-      const prepared = db.prepare('INSERT INTO users (name) VALUES (?)');
-      const alice = prepared.bind('Alice');
-      const bob = alice.bind('Bob');
-      await db.batch([alice, bob] as unknown as Array<D1PreparedStatement>);
-
-      const call = vi.mocked(globalThis.fetch).mock.calls[0] as [string, RequestInit];
-      expect(JSON.parse(String(call[1].body)).statements).toEqual([
-        { sql: 'INSERT INTO users (name) VALUES (?)', params: ['Alice'] },
-        { sql: 'INSERT INTO users (name) VALUES (?)', params: ['Bob'] },
-      ]);
-      expect(prepared._params).toEqual([]);
-    });
-
-    it('sends all statements in a batch request', async () => {
       mockFetch([
         { results: [], success: true, meta: {} },
         { results: [], success: true, meta: {} },
       ]);
-
       const db = new ProxyD1Database(createClient(), 'DB');
-      const stmt1 = db.prepare('INSERT INTO users (name) VALUES (?)').bind('Alice');
-      const stmt2 = db.prepare('INSERT INTO users (name) VALUES (?)').bind('Bob');
-      const results = await db.batch([
-        stmt1 as unknown as D1PreparedStatement,
-        stmt2 as unknown as D1PreparedStatement,
-      ]);
+      const prepared = db.prepare('INSERT INTO users (name) VALUES (?)');
+      const alice = prepared.bind('Alice');
+      const bob = alice.bind('Bob');
+      const results = await db.batch([alice, bob] as unknown as Array<D1PreparedStatement>);
 
       expect(results).toHaveLength(2);
 
       const call = vi.mocked(globalThis.fetch).mock.calls[0] as [string, RequestInit];
-      const body = JSON.parse(String(call[1].body));
-      expect(body.statements).toEqual([
+      expect(JSON.parse(String(call[1].body)).statements).toEqual([
         { sql: 'INSERT INTO users (name) VALUES (?)', params: ['Alice'] },
         { sql: 'INSERT INTO users (name) VALUES (?)', params: ['Bob'] },
       ]);
+      expect(prepared._params).toEqual([]);
+      expect(call[0]).toBe('https://proxy.void.cloud/d1/batch');
     });
   });
 
@@ -185,8 +167,6 @@ describe('ProxyD1Database', () => {
 
   describe('bind()', () => {
     it('replaces params only on the returned statement', async () => {
-      mockFetch({ results: [], success: true });
-
       const db = new ProxyD1Database(createClient(), 'DB');
       const stmt = db.prepare('SELECT * FROM users WHERE id = ?');
 
diff --git a/packages/void/test/unit/remote/env.test.ts b/packages/void/test/unit/remote/env.test.ts
index dc6b0b64c..ecaff9250 100644
--- a/packages/void/test/unit/remote/env.test.ts
+++ b/packages/void/test/unit/remote/env.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vite-plus/test';
+import { describe, it, expect, vi } from 'vite-plus/test';
 import { ProxyD1Database } from '../../../src/runtime/remote/d1.ts';
 import { createRemoteEnv } from '../../../src/runtime/remote/index.ts';
 import { ProxyKVNamespace } from '../../../src/runtime/remote/kv.ts';
@@ -12,21 +12,6 @@ const BASE_ENV: Record<string, unknown> = {
 };
 
 describe('createRemoteEnv', () => {
-  it('replaces DB with ProxyD1Database', () => {
-    const env = createRemoteEnv({ ...BASE_ENV, DB: {} });
-    expect(env.DB).toBeInstanceOf(ProxyD1Database);
-  });
-
-  it('replaces KV with ProxyKVNamespace', () => {
-    const env = createRemoteEnv({ ...BASE_ENV, KV: {} });
-    expect(env.KV).toBeInstanceOf(ProxyKVNamespace);
-  });
-
-  it('replaces STORAGE with ProxyR2Bucket', () => {
-    const env = createRemoteEnv({ ...BASE_ENV, STORAGE: {} });
-    expect(env.STORAGE).toBeInstanceOf(ProxyR2Bucket);
-  });
-
   it('does not add bindings that are not in env', () => {
     const env = createRemoteEnv({ ...BASE_ENV });
     expect(env.DB).toBeUndefined();
@@ -40,7 +25,7 @@ describe('createRemoteEnv', () => {
     expect(env.__VOID_PROXY_URL).toBe('https://proxy.void.cloud');
   });
 
-  it('replaces all bindings when all are present', () => {
+  it('replaces all bindings when all are present', async () => {
     const env = createRemoteEnv({
       ...BASE_ENV,
       DB: {},
@@ -50,6 +35,19 @@ describe('createRemoteEnv', () => {
     expect(env.DB).toBeInstanceOf(ProxyD1Database);
     expect(env.KV).toBeInstanceOf(ProxyKVNamespace);
     expect(env.STORAGE).toBeInstanceOf(ProxyR2Bucket);
+
+    const originalFetch = globalThis.fetch;
+    const fetchMock = vi.fn(async () => Response.json({ results: [], success: true, meta: {} }));
+    globalThis.fetch = fetchMock as typeof fetch;
+    try {
+      await (env.DB as D1Database).prepare('SELECT 1').all();
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+    const [url, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    expect(url).toBe('https://proxy.void.cloud/d1/query');
+    expect(init.headers).toMatchObject({ Authorization: 'Bearer test-token' });
+    expect(JSON.parse(String(init.body)).projectId).toBe('proj_1');
   });
 
   it('replaces custom binding names when configured', () => {
diff --git a/packages/void/test/unit/remote/kv.test.ts b/packages/void/test/unit/remote/kv.test.ts
index 149740e48..b7dc4a145 100644
--- a/packages/void/test/unit/remote/kv.test.ts
+++ b/packages/void/test/unit/remote/kv.test.ts
@@ -39,6 +39,7 @@ describe('ProxyKVNamespace', () => {
       expect(body.key).toBe('my-key');
       expect(body.type).toBe('text');
       expect(body.binding).toBe('KV');
+      expect(call[0]).toBe('https://proxy.void.cloud/kv/get');
     });
 
     it('returns parsed JSON with type=json', async () => {
@@ -114,6 +115,7 @@ describe('ProxyKVNamespace', () => {
       expect(body.key).toBe('my-key');
       expect(body.value).toBe('my-value');
       expect(body.binding).toBe('KV');
+      expect(call[0]).toBe('https://proxy.void.cloud/kv/put');
     });
 
     it('sends expiration options', async () => {
@@ -167,6 +169,7 @@ describe('ProxyKVNamespace', () => {
       const body = JSON.parse(String(call[1].body));
       expect(body.prefix).toBe('user:');
       expect(body.limit).toBe(2);
+      expect(call[0]).toBe('https://proxy.void.cloud/kv/list');
     });
 
     it('returns complete list when no cursor', async () => {
diff --git a/packages/void/test/unit/remote/r2.test.ts b/packages/void/test/unit/remote/r2.test.ts
index be927a262..e80455600 100644
--- a/packages/void/test/unit/remote/r2.test.ts
+++ b/packages/void/test/unit/remote/r2.test.ts
@@ -75,8 +75,10 @@ describe('ProxyR2Bucket', () => {
 
       expect(obj).not.toBeNull();
       expect(obj!.key).toBe('file.txt');
+      expect(obj!.size).toBe(body.length);
       const text = await obj!.text();
       expect(text).toBe('file contents here');
+      expect(fetchMock).toHaveBeenCalledWith('https://proxy.void.cloud/r2/get', expect.anything());
     });
 
     it('returns null for missing key', async () => {
@@ -192,6 +194,7 @@ describe('ProxyR2Bucket', () => {
       expect(body.key).toBe('file.txt');
       expect(body.value).toBe('hello world');
       expect(body.binding).toBe('STORAGE');
+      expect(call[0]).toBe('https://proxy.void.cloud/r2/put');
     });
 
     it('sends ArrayBuffer value as base64', async () => {
@@ -230,6 +233,7 @@ describe('ProxyR2Bucket', () => {
       const call = vi.mocked(globalThis.fetch).mock.calls[0] as [string, RequestInit];
       const body = JSON.parse(String(call[1].body));
       expect(body.key).toBe('file.txt');
+      expect(call[0]).toBe('https://proxy.void.cloud/r2/delete');
     });
 
     it('deletes multiple keys', async () => {
@@ -262,6 +266,10 @@ describe('ProxyR2Bucket', () => {
       expect(result.objects[0].key).toBe('file1.txt');
       expect(result.objects[1].key).toBe('file2.txt');
       expect(result.truncated).toBe(false);
+      expect(globalThis.fetch).toHaveBeenCalledWith(
+        'https://proxy.void.cloud/r2/list',
+        expect.anything(),
+      );
     });
 
     it('returns cursor when truncated', async () => {
diff --git a/packages/void/test/unit/rewrite-destination.typecheck.ts b/packages/void/test/unit/rewrite-destination.typecheck.ts
index a82e3563e..283dc149c 100644
--- a/packages/void/test/unit/rewrite-destination.typecheck.ts
+++ b/packages/void/test/unit/rewrite-destination.typecheck.ts
@@ -1,20 +1,7 @@
 import { describe, expectTypeOf, it } from 'vite-plus/test';
 import type { RewriteDestination, RouteName } from '../../src/routes-stub.ts';
 
-/**
- * Type-level tests for RouteName / RewriteDestination on the `void/routes`
- * module (resolved to `routes-stub.ts` via tsconfig paths).
- *
- * Module augmentations via `declare module 'void/routes'` are project-wide,
- * so `RouteMap` here is whatever every test file in the compilation unit has
- * contributed (notably fetch.test.ts, which adds `/api/hello`, `/api/users`,
- * etc.). We use those known entries to assert autocomplete-style inference
- * while also verifying the `(string & {})` escape hatch still accepts any
- * string (needed for dynamic paths like `/users/${id}`).
- */
-
-// Contribute a unique pattern so at least one route is guaranteed present
-// regardless of which other test files share the project.
+// `void/routes` resolves to routes-stub.ts; this augmentation adds a known route.
 declare module 'void/routes' {
   interface RouteMap {
     '/rewrite-destination-test/known': {
@@ -24,10 +11,6 @@ declare module 'void/routes' {
 }
 
 describe('RewriteDestination', () => {
-  it('includes generated route patterns as assignable literals', () => {
-    expectTypeOf<'/rewrite-destination-test/known'>().toMatchTypeOf<RewriteDestination>();
-  });
-
   it('still accepts arbitrary strings (dynamic path escape hatch)', () => {
     // This is what the `(string & {})` trick preserves — without it the
     // union would collapse to a literal-only type and reject dynamic paths.
@@ -36,25 +19,7 @@ describe('RewriteDestination', () => {
     expectTypeOf<'/totally/made/up'>().toMatchTypeOf<RewriteDestination>();
   });
 
-  it('accepts any literal string type', () => {
-    expectTypeOf<'/anything'>().toMatchTypeOf<RewriteDestination>();
-    expectTypeOf<'/users/123'>().toMatchTypeOf<RewriteDestination>();
-  });
-
-  it('works as the value type of a Record<string, …>', () => {
-    const rewrites: Record<string, RewriteDestination> = {
-      '/old': '/new',
-      '/legacy/*': '/v2/catchall',
-      '/known': '/rewrite-destination-test/known',
-    };
-    expectTypeOf(rewrites).toMatchTypeOf<Record<string, string>>();
-  });
-
   it('exposes known route names via RouteName', () => {
     expectTypeOf<'/rewrite-destination-test/known'>().toMatchTypeOf<RouteName>();
   });
-
-  it('RewriteDestination is assignable to string', () => {
-    expectTypeOf<RewriteDestination>().toMatchTypeOf<string>();
-  });
 });
diff --git a/packages/void/test/unit/route-type-extraction.typecheck.ts b/packages/void/test/unit/route-type-extraction.typecheck.ts
index 5e4d0c9ce..787dfae51 100644
--- a/packages/void/test/unit/route-type-extraction.typecheck.ts
+++ b/packages/void/test/unit/route-type-extraction.typecheck.ts
@@ -6,15 +6,8 @@ import { defineHandler } from '../../src/runtime/handler.ts';
 import type { StandardSchemaV1 } from '../../src/standard-schema.ts';
 
 /**
- * These types mirror what generateRouteTypes() emits in .void/routes.d.ts.
- * The test verifies they correctly extract types from real TypedHandler instances
- * produced by defineHandler / defineHandler.withValidator with real schemas.
- *
- * In codegen the pattern is:
- *   output: Serialize<Awaited<(typeof import("../routes/..."))["GET"]["__output"]>>
- *   input:  ExtractInput<(typeof import("../routes/..."))["POST"]["__validators"]>
- *
- * Here we use `typeof handler` in place of `typeof import(...)["METHOD"]`.
+ * Copies of the helpers generateRouteTypes() emits into .void/routes.d.ts, applied to
+ * `typeof handler` in place of `typeof import("../routes/...")["METHOD"]`.
  */
 type Serialize<T> = T extends Response
   ? never
@@ -53,45 +46,6 @@ describe('Serialize<Awaited<handler.__output>>', () => {
     void ({} as Output).email;
   });
 
-  it('converts Date to string', () => {
-    const handler = defineHandler((_c) => {
-      return { createdAt: new Date(), label: 'test' as string };
-    });
-    type Output = Serialize<Awaited<(typeof handler)['__output']>>;
-
-    expectTypeOf<Output>().toEqualTypeOf<{ createdAt: string; label: string }>();
-  });
-
-  it('strips function-valued keys', () => {
-    const handler = defineHandler((_c) => {
-      return { id: 1 as number, toJSON: () => '{}', name: 'x' as string };
-    });
-    type Output = Serialize<Awaited<(typeof handler)['__output']>>;
-
-    expectTypeOf<Output>().toEqualTypeOf<{ id: number; name: string }>();
-
-    // @ts-expect-error - 'toJSON' was stripped by Serialize
-    void ({} as Output).toJSON;
-  });
-
-  it('serializes arrays of objects', () => {
-    const handler = defineHandler((_c) => {
-      return [{ id: '1' as string, name: 'Alice' as string }];
-    });
-    type Output = Serialize<Awaited<(typeof handler)['__output']>>;
-
-    expectTypeOf<Output>().toEqualTypeOf<Array<{ id: string; name: string }>>();
-  });
-
-  it('preserves primitives', () => {
-    const handler = defineHandler((_c) => {
-      return { count: 0 as number, active: true as boolean, label: '' as string };
-    });
-    type Output = Serialize<Awaited<(typeof handler)['__output']>>;
-
-    expectTypeOf<Output>().toEqualTypeOf<{ count: number; active: boolean; label: string }>();
-  });
-
   it('works with withValidator return types', () => {
     const handler = defineHandler.withValidator({
       body: z.object({ name: z.string() }),
@@ -172,58 +126,3 @@ describe('ExtractInput<handler.__validators>', () => {
     }>();
   });
 });
-
-// ─── Combined input + output (full pipeline) ────────────────────────────────
-
-describe('full extraction pipeline (input + output)', () => {
-  it('zod: body in, serialized object out', () => {
-    const handler = defineHandler.withValidator({
-      body: z.object({ email: z.string(), tags: z.array(z.string()) }),
-    })((_c, { body }) => ({
-      email: body.email,
-      tagCount: body.tags.length,
-    }));
-
-    type Input = ExtractInput<(typeof handler)['__validators']>;
-    type Output = Serialize<Awaited<(typeof handler)['__output']>>;
-
-    expectTypeOf<Input>().toEqualTypeOf<{
-      body: { email: string; tags: Array<string> };
-    }>();
-    expectTypeOf<Output>().toEqualTypeOf<{ email: string; tagCount: number }>();
-  });
-
-  it('valibot: params + body in, array out', () => {
-    const handler = defineHandler.withValidator({
-      params: v.object({ userId: v.string() }),
-      body: v.object({ role: v.string() }),
-    })((_c, { params, body }) => [{ userId: params.userId, role: body.role }]);
-
-    type Input = ExtractInput<(typeof handler)['__validators']>;
-    type Output = Serialize<Awaited<(typeof handler)['__output']>>;
-
-    expectTypeOf<Input>().toEqualTypeOf<{
-      params: { userId: string };
-      body: { role: string };
-    }>();
-    expectTypeOf<Output>().toEqualTypeOf<Array<{ userId: string; role: string }>>();
-  });
-
-  it('arktype: query in, nested object out', () => {
-    const handler = defineHandler.withValidator({
-      query: arktype({ q: 'string' }),
-    })((_c, { query }) => ({
-      results: [{ match: query.q }],
-      meta: { query: query.q },
-    }));
-
-    type Input = ExtractInput<(typeof handler)['__validators']>;
-    type Output = Serialize<Awaited<(typeof handler)['__output']>>;
-
-    expectTypeOf<Input>().toEqualTypeOf<{ query: { q: string } }>();
-    expectTypeOf<Output>().toEqualTypeOf<{
-      results: Array<{ match: string }>;
-      meta: { query: string };
-    }>();
-  });
-});
diff --git a/packages/void/test/unit/route-types.test.ts b/packages/void/test/unit/route-types.test.ts
index 3770bafc2..8c2fc9942 100644
--- a/packages/void/test/unit/route-types.test.ts
+++ b/packages/void/test/unit/route-types.test.ts
@@ -10,9 +10,28 @@ const pageRenderingDefaults = {
   shouldPrerender: false,
 } satisfies Pick<PageDefinition, 'ssrMode' | 'prerenderMode' | 'renderMode' | 'shouldPrerender'>;
 
+function makeScan({
+  routes = [],
+  websockets,
+  pages = [],
+}: {
+  routes?: ScanResult['routes'];
+  websockets?: ScanResult['websockets'];
+  pages?: Array<PageDefinition>;
+} = {}): ScanResult {
+  return {
+    routes,
+    websockets,
+    middleware: [],
+    jobs: [],
+    queues: [],
+    pages: { pages, layouts: [], namedLayouts: [] },
+  };
+}
+
 describe('generateRouteTypes', () => {
   it('generates route type declarations for single-method routes', () => {
-    const scan: ScanResult = {
+    const scan = makeScan({
       routes: [
         {
           pattern: '/api/hello',
@@ -23,11 +42,7 @@ describe('generateRouteTypes', () => {
           filePath: 'api/hello.ts',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
 
@@ -40,7 +55,7 @@ describe('generateRouteTypes', () => {
   });
 
   it('generates multi-method routes', () => {
-    const scan: ScanResult = {
+    const scan = makeScan({
       routes: [
         {
           pattern: '/api/users',
@@ -51,11 +66,7 @@ describe('generateRouteTypes', () => {
           filePath: 'api/users/index.ts',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
 
@@ -65,7 +76,7 @@ describe('generateRouteTypes', () => {
   });
 
   it('emits one route key and preserves methods from colliding route files', () => {
-    const scan: ScanResult = {
+    const scan = makeScan({
       routes: [
         {
           pattern: '/api/health',
@@ -84,11 +95,7 @@ describe('generateRouteTypes', () => {
           filePath: 'api/health/index.ts',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
     const routeMap = dts
@@ -103,7 +110,7 @@ describe('generateRouteTypes', () => {
   });
 
   it('combines colliding environment-specific methods conservatively', () => {
-    const scan: ScanResult = {
+    const scan = makeScan({
       routes: [
         {
           pattern: '/api/health',
@@ -122,11 +129,7 @@ describe('generateRouteTypes', () => {
           filePath: 'api/health.prod.ts',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
     const routeMap = dts
@@ -140,7 +143,7 @@ describe('generateRouteTypes', () => {
   });
 
   it('skips routes with no methods', () => {
-    const scan: ScanResult = {
+    const scan = makeScan({
       routes: [
         {
           pattern: '/api/legacy',
@@ -151,11 +154,7 @@ describe('generateRouteTypes', () => {
           filePath: 'api/legacy.ts',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
 
@@ -163,7 +162,7 @@ describe('generateRouteTypes', () => {
   });
 
   it('handles dynamic params in patterns', () => {
-    const scan: ScanResult = {
+    const scan = makeScan({
       routes: [
         {
           pattern: '/api/users/:id',
@@ -174,11 +173,7 @@ describe('generateRouteTypes', () => {
           filePath: 'api/users/[id].ts',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
 
@@ -187,14 +182,7 @@ describe('generateRouteTypes', () => {
   });
 
   it('includes Serialize and ExtractInput helper types', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-    const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
+    const { dts } = generateRouteTypes(makeScan(), '/project/routes', '/project/.void');
 
     expect(dts).toContain('type Serialize<T>');
     expect(dts).toContain('type ExtractInput<V>');
@@ -202,20 +190,13 @@ describe('generateRouteTypes', () => {
   });
 
   it('includes export {} so declare module is an augmentation', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-    const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
+    const { dts } = generateRouteTypes(makeScan(), '/project/routes', '/project/.void');
 
     expect(dts).toContain('export {}');
   });
 
   it('emits RouteName and RewriteDestination aliases on void/routes', () => {
-    const scan: ScanResult = {
+    const scan = makeScan({
       routes: [
         {
           pattern: '/api/hello',
@@ -226,11 +207,7 @@ describe('generateRouteTypes', () => {
           filePath: 'api/hello.ts',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
 
@@ -246,53 +223,21 @@ describe('generateRouteTypes', () => {
     expect(moduleBlock).toContain('export type RewriteDestination = RouteName | (string & {});');
   });
 
-  it('generates correct relative paths', () => {
-    const scan: ScanResult = {
-      routes: [
+  it('generates PageActionMap for pages with actions', () => {
+    const scan = makeScan({
+      pages: [
         {
-          pattern: '/api/deep/nested',
-          methods: ['GET'],
+          ...pageRenderingDefaults,
+          pattern: '/users',
           params: [],
           catchAll: false,
-          env: null,
-          filePath: 'api/deep/nested.ts',
+          componentPath: 'users/index.vue',
+          serverPath: 'users/index.server.ts',
+          methods: ['loader', 'action'],
+          componentId: 'users',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
-
-    const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
-
-    // Should have relative path from .void to routes
-    expect(dts).toContain('../routes/api/deep/nested.ts');
-  });
-
-  it('generates PageActionMap for pages with actions', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: {
-        pages: [
-          {
-            ...pageRenderingDefaults,
-            pattern: '/users',
-            params: [],
-            catchAll: false,
-            componentPath: 'users/index.vue',
-            serverPath: 'users/index.server.ts',
-            methods: ['loader', 'action'],
-            componentId: 'users',
-          },
-        ],
-        layouts: [],
-        namedLayouts: [],
-      },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void', '/project/pages');
 
@@ -303,28 +248,20 @@ describe('generateRouteTypes', () => {
   });
 
   it('generates params in PageActionMap for dynamic routes', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: {
-        pages: [
-          {
-            ...pageRenderingDefaults,
-            pattern: '/users/:id',
-            params: ['id'],
-            catchAll: false,
-            componentPath: 'users/[id].vue',
-            serverPath: 'users/[id].server.ts',
-            methods: ['loader', 'action'],
-            componentId: 'users/[id]',
-          },
-        ],
-        layouts: [],
-        namedLayouts: [],
-      },
-    };
+    const scan = makeScan({
+      pages: [
+        {
+          ...pageRenderingDefaults,
+          pattern: '/users/:id',
+          params: ['id'],
+          catchAll: false,
+          componentPath: 'users/[id].vue',
+          serverPath: 'users/[id].server.ts',
+          methods: ['loader', 'action'],
+          componentId: 'users/[id]',
+        },
+      ],
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void', '/project/pages');
 
@@ -333,8 +270,7 @@ describe('generateRouteTypes', () => {
   });
 
   it('generates WebSocketRouteMap entries', () => {
-    const scan: ScanResult = {
-      routes: [],
+    const scan = makeScan({
       websockets: [
         {
           pattern: '/chat/:room',
@@ -349,11 +285,7 @@ describe('generateRouteTypes', () => {
           hasAuthGate: true,
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
 
@@ -378,8 +310,7 @@ describe('generateRouteTypes', () => {
       mode: 'room' as const,
       hasAuthGate: true,
     };
-    const scan: ScanResult = {
-      routes: [],
+    const scan = makeScan({
       websockets: [
         websocket,
         {
@@ -390,11 +321,7 @@ describe('generateRouteTypes', () => {
           bindingName: 'ChatRoomProdWs',
         },
       ],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: { pages: [], layouts: [], namedLayouts: [] },
-    };
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
     const websocketMap = dts.split('  interface WebSocketRouteMap {')[1]!.split('\n  }\n}')[0]!;
@@ -407,28 +334,20 @@ describe('generateRouteTypes', () => {
   });
 
   it('skips pages without action in PageActionMap', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: {
-        pages: [
-          {
-            ...pageRenderingDefaults,
-            pattern: '/about',
-            params: [],
-            catchAll: false,
-            componentPath: 'about.vue',
-            serverPath: 'about.server.ts',
-            methods: ['loader'],
-            componentId: 'about',
-          },
-        ],
-        layouts: [],
-        namedLayouts: [],
-      },
-    };
+    const scan = makeScan({
+      pages: [
+        {
+          ...pageRenderingDefaults,
+          pattern: '/about',
+          params: [],
+          catchAll: false,
+          componentPath: 'about.vue',
+          serverPath: 'about.server.ts',
+          methods: ['loader'],
+          componentId: 'about',
+        },
+      ],
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void', '/project/pages');
 
@@ -437,28 +356,20 @@ describe('generateRouteTypes', () => {
   });
 
   it('generates PageActionMap with named actions', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: {
-        pages: [
-          {
-            ...pageRenderingDefaults,
-            pattern: '/users',
-            params: [],
-            catchAll: false,
-            componentPath: 'users/index.vue',
-            serverPath: 'users/index.server.ts',
-            methods: ['loader', 'actions'],
-            componentId: 'users',
-          },
-        ],
-        layouts: [],
-        namedLayouts: [],
-      },
-    };
+    const scan = makeScan({
+      pages: [
+        {
+          ...pageRenderingDefaults,
+          pattern: '/users',
+          params: [],
+          catchAll: false,
+          componentPath: 'users/index.vue',
+          serverPath: 'users/index.server.ts',
+          methods: ['loader', 'actions'],
+          componentId: 'users',
+        },
+      ],
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void', '/project/pages');
 
@@ -469,61 +380,21 @@ describe('generateRouteTypes', () => {
     expect(dts).toContain('ParseActionUrl<U>["action"]');
   });
 
-  it('generates PageActionMap for named actions with dynamic params', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: {
-        pages: [
-          {
-            ...pageRenderingDefaults,
-            pattern: '/users/:id',
-            params: ['id'],
-            catchAll: false,
-            componentPath: 'users/[id].vue',
-            serverPath: 'users/[id].server.ts',
-            methods: ['loader', 'actions'],
-            componentId: 'users/[id]',
-          },
-        ],
-        layouts: [],
-        namedLayouts: [],
-      },
-    };
-
-    const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void', '/project/pages');
-
-    expect(dts).toContain('interface PageActionMap');
-    expect(dts).toContain('"/users/:id"');
-    expect(dts).toContain('["actions"]');
-    expect(dts).toContain('params: { id: string }');
-  });
-
   it('errors when both action and actions are present', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: {
-        pages: [
-          {
-            ...pageRenderingDefaults,
-            pattern: '/users',
-            params: [],
-            catchAll: false,
-            componentPath: 'users/index.vue',
-            serverPath: 'users/index.server.ts',
-            methods: ['loader', 'action', 'actions'],
-            componentId: 'users',
-          },
-        ],
-        layouts: [],
-        namedLayouts: [],
-      },
-    };
+    const scan = makeScan({
+      pages: [
+        {
+          ...pageRenderingDefaults,
+          pattern: '/users',
+          params: [],
+          catchAll: false,
+          componentPath: 'users/index.vue',
+          serverPath: 'users/index.server.ts',
+          methods: ['loader', 'action', 'actions'],
+          componentId: 'users',
+        },
+      ],
+    });
 
     expect(() =>
       generateRouteTypes(scan, '/project/routes', '/project/.void', '/project/pages'),
@@ -531,28 +402,20 @@ describe('generateRouteTypes', () => {
   });
 
   it('omits PageActionMap when pagesDir is not provided', () => {
-    const scan: ScanResult = {
-      routes: [],
-      middleware: [],
-      jobs: [],
-      queues: [],
-      pages: {
-        pages: [
-          {
-            ...pageRenderingDefaults,
-            pattern: '/users',
-            params: [],
-            catchAll: false,
-            componentPath: 'users/index.vue',
-            serverPath: 'users/index.server.ts',
-            methods: ['loader', 'action'],
-            componentId: 'users',
-          },
-        ],
-        layouts: [],
-        namedLayouts: [],
-      },
-    };
+    const scan = makeScan({
+      pages: [
+        {
+          ...pageRenderingDefaults,
+          pattern: '/users',
+          params: [],
+          catchAll: false,
+          componentPath: 'users/index.vue',
+          serverPath: 'users/index.server.ts',
+          methods: ['loader', 'action'],
+          componentId: 'users',
+        },
+      ],
+    });
 
     const { dts } = generateRouteTypes(scan, '/project/routes', '/project/.void');
 
diff --git a/packages/void/test/unit/runner-pg.test.ts b/packages/void/test/unit/runner-pg.test.ts
index 19d0f54ef..d37196ab9 100644
--- a/packages/void/test/unit/runner-pg.test.ts
+++ b/packages/void/test/unit/runner-pg.test.ts
@@ -34,39 +34,6 @@ describe('applyPgMigrations', () => {
     expect(result).toEqual([]);
   });
 
-  it('applies a single migration and creates the table', async () => {
-    const migrations = [
-      {
-        name: '001_create_users.sql',
-        sql: 'CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL)',
-      },
-    ];
-
-    const applied = await applyPgMigrations(client, migrations);
-    expect(applied).toEqual(['001_create_users.sql']);
-
-    const result = await pglite.query<{ column_name: string }>(
-      "SELECT column_name FROM information_schema.columns WHERE table_name = 'users' ORDER BY ordinal_position",
-    );
-    const columns = result.rows.map((r) => r.column_name);
-    expect(columns).toEqual(['id', 'name']);
-  });
-
-  it('records applied migration in _void_migrations tracking table', async () => {
-    const migrations = [
-      { name: '001_create_users.sql', sql: 'CREATE TABLE users (id SERIAL PRIMARY KEY)' },
-    ];
-
-    await applyPgMigrations(client, migrations);
-
-    const tracking = await pglite.query<{ name: string; applied_at: string }>(
-      'SELECT name, applied_at FROM _void_migrations',
-    );
-    expect(tracking.rows).toHaveLength(1);
-    expect(tracking.rows[0].name).toBe('001_create_users.sql');
-    expect(tracking.rows[0].applied_at).toBeTruthy();
-  });
-
   it('skips already-applied migrations (idempotent re-run)', async () => {
     const migrations = [
       { name: '001_create_users.sql', sql: 'CREATE TABLE users (id SERIAL PRIMARY KEY)' },
diff --git a/packages/void/test/unit/runner-sqlite.test.ts b/packages/void/test/unit/runner-sqlite.test.ts
index 617e2768e..4fee832f1 100644
--- a/packages/void/test/unit/runner-sqlite.test.ts
+++ b/packages/void/test/unit/runner-sqlite.test.ts
@@ -9,20 +9,6 @@ import {
   toBetterSqlite3Error,
 } from '../../src/migrations/runner.ts';
 
-/**
- * Low-level tests for `runMigrations` against a real better-sqlite3
- * database file. These tests exercise the transactional semantics and
- * legacy-table upgrade that the platform's D1 runtime can't easily
- * simulate — specifically:
- *
- *   - multi-statement atomic rollback when one statement fails mid-file
- *   - legacy `_migrations` table upgrade path (copy + drop)
- *   - applied-set filter on re-run (idempotency)
- *   - tracking row gets written only after all statements succeed
- *
- * These are unit-level because they instantiate better-sqlite3 directly.
- */
-
 const roots: Array<string> = [];
 
 function createDir(): string {
@@ -316,6 +302,27 @@ describe('runMigrations (local SQLite)', () => {
     expect(rows).toEqual([]);
   });
 
+  it('getAppliedMigrations returns applied migrations sorted by name', async () => {
+    const root = createDir();
+    const dbPath = join(root, 'migrations.sqlite');
+    const db = await openSqliteDatabase(dbPath);
+    try {
+      db.exec(`
+        CREATE TABLE _void_migrations (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);
+        INSERT INTO _void_migrations (name, applied_at) VALUES ('002_second.sql', '2025-01-02T00:00:00Z');
+        INSERT INTO _void_migrations (name, applied_at) VALUES ('001_first.sql', '2025-01-01T00:00:00Z');
+      `);
+    } finally {
+      db.close();
+    }
+
+    const rows = await getAppliedMigrations(dbPath);
+    expect(rows).toEqual([
+      { name: '001_first.sql', applied_at: '2025-01-01T00:00:00Z' },
+      { name: '002_second.sql', applied_at: '2025-01-02T00:00:00Z' },
+    ]);
+  });
+
   it('getAppliedMigrations reads from legacy _migrations if _void_migrations is absent', async () => {
     const root = createDir();
     const dbPath = join(root, 'legacy-only.sqlite');
@@ -346,17 +353,7 @@ describe('runMigrations (local SQLite)', () => {
   });
 
   it('writes the tracking row AFTER the migration SQL, not before (mutation-sensitive ordering)', async () => {
-    // Load-bearing invariant: the per-migration transaction body must run
-    // `db.exec(migration.sql)` BEFORE `insertStmt.run(migration.name)`. If a
-    // future refactor reverses the order, the classic "tracking row written
-    // before the SQL" bug returns — and a rollback test can't catch it
-    // because the failing transaction rolls back both.
-    //
-    // The trick: write a migration that peeks at its own tracking row mid-
-    // apply. If the INSERT ran first, the peek sees 1; if after, it sees 0.
-    // Because both the exec and the insert are inside the same transaction
-    // and SQLite sees the in-flight transaction state, the observation is
-    // deterministic.
+    // The migration counts its own tracking row: 0 means the row is written after the SQL.
     const root = createDir();
     const migDir = join(root, 'migrations');
     const dbPath = join(root, 'test.sqlite');
@@ -375,115 +372,13 @@ describe('runMigrations (local SQLite)', () => {
     const db = await openSqliteDatabase(dbPath, { readonly: true });
     try {
       const rows = db.prepare('SELECT saw FROM peek').all() as Array<{ saw: number }>;
-      // saw === 0 proves the tracking INSERT happened AFTER db.exec.
-      // saw === 1 would mean the INSERT ran first — this test regresses.
       expect(rows).toEqual([{ saw: 0 }]);
     } finally {
       db.close();
     }
   });
 
-  it('is safe when two runMigrations calls race against the same DB (concurrent-runner recovery)', async () => {
-    // Two local `void` processes can target the same SQLite file. Without
-    // write-side re-checks, both see the migration as pending, both try to
-    // run its DDL, and the loser crashes with "table already exists". The
-    // runner's per-migration IMMEDIATE-transaction re-check must make the
-    // loser observe the winner's tracking row under the write lock and skip.
-    //
-    // Two sequential runMigrations calls over the same file simulate this —
-    // the second call opens the DB fresh, so its in-memory applied-set
-    // snapshot is accurate here, but the point is to exercise the re-check
-    // path and prove it's idempotent. The real regression we're guarding
-    // against is a future change that breaks the re-check by reading from
-    // the snapshot instead of the DB.
-    const root = createDir();
-    const migDir = join(root, 'migrations');
-    const dbPath = join(root, 'test.sqlite');
-    writeMigration(migDir, '001_init.sql', 'CREATE TABLE users (id TEXT PRIMARY KEY)');
-
-    const first = await runMigrations(migDir, dbPath);
-    expect(first).toEqual(['001_init.sql']);
-
-    // Re-run: should observe the migration applied and skip, NOT crash
-    // with "table users already exists".
-    const second = await runMigrations(migDir, dbPath);
-    expect(second).toEqual([]);
-
-    // Exactly one tracking row
-    const db = await openSqliteDatabase(dbPath, { readonly: true });
-    try {
-      const tracked = db.prepare('SELECT name FROM _void_migrations').all();
-      expect(tracked).toEqual([{ name: '001_init.sql' }]);
-    } finally {
-      db.close();
-    }
-  });
-
-  it('upgradeTrackingTable is idempotent under concurrent invocation (DROP IF EXISTS)', async () => {
-    // Two runMigrations calls racing the legacy→void upgrade must both
-    // succeed. Before the fix, the second process would crash on
-    // `DROP TABLE _migrations` after the first already dropped it. The
-    // upgrade is now wrapped in an IMMEDIATE transaction that re-checks
-    // legacy presence under the write lock, and uses `DROP TABLE IF EXISTS`.
-    //
-    // Seed legacy, run runMigrations (which runs the upgrade as part of
-    // applying pending migrations), then run it again — proving the second
-    // call no-ops cleanly instead of crashing on a missing `_migrations`.
-    const root = createDir();
-    const migDir = join(root, 'migrations');
-    const dbPath = join(root, 'test.sqlite');
-    writeMigration(migDir, '001_bootstrap.sql', 'CREATE TABLE bootstrap (id TEXT PRIMARY KEY)');
-    writeMigration(migDir, '002.sql', 'CREATE TABLE users (id TEXT PRIMARY KEY)');
-
-    // Seed legacy with the first on-disk migration, so the upgrade preserves
-    // it and the apply loop still has a later migration pending.
-    let db = await openSqliteDatabase(dbPath);
-    try {
-      db.exec(
-        "CREATE TABLE _migrations (name TEXT PRIMARY KEY, applied_at TEXT DEFAULT (datetime('now')))",
-      );
-      db.prepare('INSERT INTO _migrations (name, applied_at) VALUES (?, ?)').run(
-        '001_bootstrap.sql',
-        '2023-01-01T00:00:00Z',
-      );
-    } finally {
-      db.close();
-    }
-
-    // First run: upgrade copies 001_bootstrap.sql into _void_migrations,
-    // drops _migrations, then applies 002.sql.
-    const first = await runMigrations(migDir, dbPath);
-    expect(first).toEqual(['002.sql']);
-
-    db = await openSqliteDatabase(dbPath, { readonly: true });
-    try {
-      const rows = (
-        db.prepare('SELECT name FROM _void_migrations ORDER BY name').all() as Array<{
-          name: string;
-        }>
-      ).map((r) => r.name);
-      expect(rows).toEqual(['001_bootstrap.sql', '002.sql']);
-      const legacy = db
-        .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='_migrations'")
-        .get();
-      expect(legacy).toBeUndefined();
-    } finally {
-      db.close();
-    }
-
-    // Second run: legacy is already gone, both migrations already applied. Must
-    // no-op, not crash on a "no such table" during the upgrade body.
-    const second = await runMigrations(migDir, dbPath);
-    expect(second).toEqual([]);
-  });
-
   it('handles semicolons inside string literals as a single statement', async () => {
-    // A naive `sql.split(';')` preprocessor would fracture this migration
-    // at the `;` inside the default literal, producing garbage fragments
-    // like `CREATE TABLE t (msg TEXT DEFAULT 'a` and `b')`. The runner
-    // must hand the raw SQL to better-sqlite3's multi-statement exec so
-    // SQLite does the tokenizing and understands that the `;` inside
-    // a quoted literal is NOT a statement terminator.
     const root = createDir();
     const migDir = join(root, 'migrations');
     const dbPath = join(root, 'test.sqlite');
@@ -500,7 +395,6 @@ describe('runMigrations (local SQLite)', () => {
     try {
       const rows = db.prepare('SELECT msg FROM t').all() as Array<{ msg: string }>;
       expect(rows).toEqual([{ msg: 'a;b' }]);
-      // Exactly one tracking row.
       const tracked = db.prepare('SELECT name FROM _void_migrations').all();
       expect(tracked).toEqual([{ name: '001_literal.sql' }]);
     } finally {
diff --git a/packages/void/test/unit/runtime-log.test.ts b/packages/void/test/unit/runtime-log.test.ts
index 4a0914def..f0fcd042b 100644
--- a/packages/void/test/unit/runtime-log.test.ts
+++ b/packages/void/test/unit/runtime-log.test.ts
@@ -52,11 +52,7 @@ describe('runtime log', () => {
     expect(JSON.parse(arg)).toEqual({ msg: 'lonely' });
   });
 
-  it('msg argument wins when fields contain a msg key (safer default — user intent in arg is preserved)', () => {
-    // Rationale: the explicit `message` argument is the primary contract.
-    // If a user accidentally passes `{ msg: ... }` in fields, dropping their
-    // primary message would be a silent data loss. msg-wins keeps the
-    // argument visible.
+  it('msg argument wins when fields contain a msg key', () => {
     logger.error('intended', { msg: 'sneaky', extra: 1 });
 
     const arg = (console.error as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
@@ -64,12 +60,6 @@ describe('runtime log', () => {
   });
 
   it('a `toJSON` key in fields cannot hijack the output shape', () => {
-    // Rationale: `JSON.stringify` calls `payload.toJSON()` if present and
-    // serializes its return value instead of the object. If we copied a
-    // user-supplied `toJSON` onto our payload, the user could replace the
-    // entire emitted shape — dropping `msg` and faking an arbitrary `level`.
-    // We skip the `toJSON` key during the field copy to preserve the
-    // greppable `{ msg, ...fields }` contract.
     logger.info('visible', {
       toJSON: () => ({ level: 'error' }),
       x: 1,
@@ -80,16 +70,10 @@ describe('runtime log', () => {
     expect(parsed.msg).toBe('visible');
     expect(parsed.x).toBe(1);
     expect('toJSON' in parsed).toBe(false);
-    // No phantom `level` key from the would-be hijack.
     expect('level' in parsed).toBe(false);
   });
 
   it('inherited enumerable keys from the prototype chain are not copied', () => {
-    // Rationale: `for...in` walks the prototype chain. `Object.entries` does
-    // not. The contract is "log the data the caller passed me", not "log
-    // anything reachable from the caller's object". This makes the output
-    // predictable for callers passing class instances or `Object.create(...)`
-    // results.
     const parent = { inherited: 'should-not-appear' };
     const fields = Object.create(parent) as Record<string, unknown>;
     fields.own = 'should-appear';
@@ -103,32 +87,7 @@ describe('runtime log', () => {
     expect('inherited' in parsed).toBe(false);
   });
 
-  it('function-valued fields are skipped deterministically', () => {
-    // Rationale: `JSON.stringify` silently omits function values, so the
-    // observable output is the same. Skipping explicitly keeps the
-    // intent visible (and matches the `toJSON` exclusion above — both are
-    // "no callable surface in the payload").
-    logger.info('fn', {
-      cb: () => 'nope',
-      keep: 'yes',
-    } as Record<string, unknown>);
-
-    const arg = (console.info as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-    const parsed = JSON.parse(arg);
-    expect(parsed.msg).toBe('fn');
-    expect(parsed.keep).toBe('yes');
-    expect('cb' in parsed).toBe(false);
-  });
-
   it('an own enumerable `__proto__` cannot hijack the output via prototype mutation', () => {
-    // Rationale: writing `payload.__proto__ = value` on a plain `{}` invokes
-    // the `Object.prototype.__proto__` setter and mutates the payload's
-    // prototype. If the assigned value has a `toJSON` method, the payload
-    // then inherits it and `JSON.stringify(payload)` calls it — letting the
-    // attacker substitute the entire emitted shape. Building the payload
-    // with `Object.create(null)` removes the setter entirely, turning
-    // `payload.__proto__ = value` into a plain own-property write (which we
-    // then skip explicitly for defense in depth).
     const fields = {} as Record<string, unknown>;
     Object.defineProperty(fields, '__proto__', {
       enumerable: true,
@@ -146,11 +105,6 @@ describe('runtime log', () => {
   });
 
   it('throwing enumerable getters do not crash — fallback to safe shape', () => {
-    // Rationale: `Object.entries(fields)` invokes enumerable getters during
-    // enumeration. If a getter throws (or a proxy trap throws), the
-    // logging call must catch it and emit the fallback shape rather than
-    // propagating the error and breaking the caller's control flow
-    // (typically an error-handling path).
     const fields = { ok: 1 } as Record<string, unknown>;
     Object.defineProperty(fields, 'bomb', {
       enumerable: true,
@@ -170,27 +124,17 @@ describe('runtime log', () => {
   });
 
   it('a `constructor` key in fields is skipped', () => {
-    // Rationale: defense in depth alongside the `__proto__` skip. A
-    // `constructor` field on a normal object isn't dangerous on its own
-    // (the payload uses `Object.create(null)` so there's nothing to
-    // shadow), but skipping it keeps the field-copy loop's intent
-    // consistent with `__proto__` and avoids surprises if the payload
-    // construction ever changes.
     logger.info('ctor', { constructor: 'evil', keep: 'yes' });
 
     const arg = (console.info as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
     const parsed = JSON.parse(arg);
     expect(parsed.msg).toBe('ctor');
     expect(parsed.keep).toBe('yes');
-    // `JSON.parse` returns a plain object whose prototype already has
-    // `constructor`, so check own-property only.
+    // Object.prototype already has `constructor`, so check own properties only.
     expect(Object.hasOwn(parsed, 'constructor')).toBe(false);
   });
 
   it('non-stringifiable values (circular refs) do not crash — fallback to safe shape', () => {
-    // Rationale: throwing inside a logger call would break user code paths
-    // (often error-handling paths). Catching and emitting a safe fallback
-    // is the simpler, less surprising behavior.
     const circular: Record<string, unknown> = { name: 'cycle' };
     circular.self = circular;
 
@@ -199,7 +143,6 @@ describe('runtime log', () => {
     expect(console.error).toHaveBeenCalledTimes(1);
     const arg = (console.error as ReturnType<typeof vi.fn>).mock.calls[0][0];
     expect(typeof arg).toBe('string');
-    // Must still be valid JSON containing the original msg.
     const parsed = JSON.parse(arg as string);
     expect(parsed.msg).toBe('circular failure');
   });
diff --git a/packages/void/test/unit/sandbox-runtime.test.ts b/packages/void/test/unit/sandbox-runtime.test.ts
index 450b256c7..e2da6257b 100644
--- a/packages/void/test/unit/sandbox-runtime.test.ts
+++ b/packages/void/test/unit/sandbox-runtime.test.ts
@@ -143,20 +143,6 @@ describe('Sandbox runtime', () => {
       );
     },
   );
-  it.each(['concurrency', 'runtime_budget'] as const)(
-    'restores typed %s errors after RPC',
-    async (reason) => {
-      const invoke = vi.fn().mockRejectedValue(new Error(`VOID_SANDBOX_${reason}`));
-      await envContext.run(
-        { __VOID_SANDBOX: { getSandbox: async () => ({ invoke }) } },
-        async () => {
-          const client = await getSandbox();
-          await expect(client.exec(['true'])).rejects.toBeInstanceOf(SandboxLimitError);
-          await expect(client.exec(['true'])).rejects.toMatchObject({ reason });
-        },
-      );
-    },
-  );
   it('rejects legacy namespaces, custom managed bindings and removed SDK options', async () => {
     await envContext.run({ __PROJECT_ID: 'project', SANDBOX: {} }, async () => {
       await expect(getSandbox()).rejects.toBeInstanceOf(SandboxUnavailableError);
@@ -217,6 +203,7 @@ describe('Sandbox usage-limit rejections', () => {
                 ? client.files.readFile('/data')
                 : client.fetch(8080, new Request('http://sandbox'));
           await expect(op).rejects.toBeInstanceOf(UsageLimit);
+          await expect(op).rejects.toBeInstanceOf(SandboxLimitError);
           await expect(op).rejects.toMatchObject({ reason: 'concurrency' });
           expect(invoke).toHaveBeenCalledOnce();
         },
diff --git a/packages/void/test/unit/limits.typecheck.ts b/packages/void/test/unit/sandbox.typecheck.ts
similarity index 68%
rename from packages/void/test/unit/limits.typecheck.ts
rename to packages/void/test/unit/sandbox.typecheck.ts
index 6dc76ec60..0d45ee003 100644
--- a/packages/void/test/unit/limits.typecheck.ts
+++ b/packages/void/test/unit/sandbox.typecheck.ts
@@ -8,7 +8,3 @@ expectTypeOf(sandboxClient.run(['work'])).toEqualTypeOf<Promise<ExecOutput>>();
 expectTypeOf(sandboxClient.files.readFile('/data')).toEqualTypeOf<Promise<Response>>();
 expectTypeOf(process.exitCode).toEqualTypeOf<Promise<number>>();
 expectTypeOf(process.output()).toEqualTypeOf<Promise<ExecOutput>>();
-// @ts-expect-error Files must be awaited before reading their Response.
-sandboxClient.files.readFile('/data').text();
-// @ts-expect-error Operations use the standard Promise API.
-sandboxClient.run(['work']).match({ ok: (value: unknown) => value, limited: () => null });
diff --git a/packages/void/test/unit/scan.test.ts b/packages/void/test/unit/scan.test.ts
index 4cfb80fd3..4c5f861a2 100644
--- a/packages/void/test/unit/scan.test.ts
+++ b/packages/void/test/unit/scan.test.ts
@@ -1,11 +1,18 @@
 import { mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { describe, expect, it, beforeEach, afterEach } from 'vite-plus/test';
-import { scanRoutePatternsSync, scanRoutes } from '../../src/router/scan.ts';
-import { scanWebSocketRoutesSync } from '../../src/router/websocket.ts';
+import { analyzeApplication } from '../../src/application-routing.ts';
+import { readConfig } from '../../src/config.ts';
+import type { RouteEnvironment } from '../../src/router/parse-filename.ts';
+import { scanRoutePatternsSync } from '../../src/router/scan.ts';
 
 const TMP = join(import.meta.dirname, '__tmp_scan_test__');
 
+async function scanRoutes(root: string, options?: { environment?: RouteEnvironment }) {
+  const config = readConfig(root);
+  return (await analyzeApplication(root, { config, environment: options?.environment })).scan;
+}
+
 function createFile(path: string, content = 'export const GET = () => {}') {
   const full = join(TMP, path);
   mkdirSync(join(full, '..'), { recursive: true });
@@ -131,19 +138,6 @@ describe('scanRoutes', () => {
     ]);
   });
 
-  it('discovers cron jobs with array cron syntax', async () => {
-    createFile('routes/api/hello.ts');
-    createFile(
-      'crons/multi.ts',
-      'export const cron = ["0 * * * *", "30 * * * *"]\nexport default () => {}',
-    );
-
-    const result = await scanRoutes(TMP);
-    expect(result.jobs).toEqual([
-      { filePath: 'multi.ts', name: 'multi', crons: ['0 * * * *', '30 * * * *'] },
-    ]);
-  });
-
   it('reads the exported cron rather than matching comments or string contents', async () => {
     createFile(
       'crons/actual.ts',
@@ -190,53 +184,6 @@ export default () => {};`,
     ]);
   });
 
-  it('derives binding name from filename', async () => {
-    createFile('routes/api/hello.ts');
-    createFile('queues/order-notifications.ts', 'export default async () => {}');
-
-    const result = await scanRoutes(TMP);
-    expect(result.queues).toHaveLength(1);
-    expect(result.queues[0].name).toBe('order-notifications');
-    expect(result.queues[0].bindingName).toBe('QUEUE_ORDER_NOTIFICATIONS');
-  });
-
-  it('handles nested queue files', async () => {
-    createFile('routes/api/hello.ts');
-    createFile('queues/order/notifications.ts', 'export default async () => {}');
-
-    const result = await scanRoutes(TMP);
-    expect(result.queues).toHaveLength(1);
-    expect(result.queues[0].name).toBe('order-notifications');
-    expect(result.queues[0].bindingName).toBe('QUEUE_ORDER_NOTIFICATIONS');
-  });
-
-  it('rejects nested queue names that collide after normalization', async () => {
-    createFile('routes/api/hello.ts');
-    createFile('queues/order-notifications.ts', 'export default async () => {}');
-    createFile('queues/order/notifications.ts', 'export default async () => {}');
-
-    await expect(scanRoutes(TMP)).rejects.toThrow(
-      [
-        'queue: Multiple queue files resolve to the same queue name:',
-        '  "order-notifications": "order-notifications.ts", "order/notifications.ts"',
-        'Rename the conflicting files so each queue has a unique name.',
-      ].join('\n'),
-    );
-  });
-
-  it('extracts maxBatchSize and maxBatchTimeout', async () => {
-    createFile('routes/api/hello.ts');
-    createFile(
-      'queues/emails.ts',
-      'export const maxBatchSize = 50\nexport const maxBatchTimeout = 10\nexport default async () => {}',
-    );
-
-    const result = await scanRoutes(TMP);
-    expect(result.queues).toHaveLength(1);
-    expect(result.queues[0].maxBatchSize).toBe(50);
-    expect(result.queues[0].maxBatchTimeout).toBe(10);
-  });
-
   it('ignores _-prefixed queue files', async () => {
     createFile('routes/api/hello.ts');
     createFile('queues/_helpers.ts', 'export const x = 1');
@@ -324,21 +271,4 @@ describe('sync scanners', () => {
         .sort(),
     ).toEqual(['api/always.ts', 'api/hello.dev.ts', 'api/hello.prod.ts']);
   });
-
-  it('scanWebSocketRoutesSync filters websocket routes by environment', () => {
-    createFile('routes/chat.dev.ws.ts', 'export default defineWebSocket({})');
-    createFile('routes/chat.prod.ws.ts', 'export default defineWebSocket({})');
-
-    expect(scanWebSocketRoutesSync(TMP, undefined, 'dev').map((r) => r.filePath)).toEqual([
-      'chat.dev.ws.ts',
-    ]);
-    expect(scanWebSocketRoutesSync(TMP, undefined, 'prod').map((r) => r.filePath)).toEqual([
-      'chat.prod.ws.ts',
-    ]);
-    expect(
-      scanWebSocketRoutesSync(TMP)
-        .map((r) => r.filePath)
-        .sort(),
-    ).toEqual(['chat.dev.ws.ts', 'chat.prod.ws.ts']);
-  });
 });
diff --git a/packages/void/test/unit/schema-compat-tests.test.ts b/packages/void/test/unit/schema-compat-tests.test.ts
deleted file mode 100644
index 190e72e22..000000000
--- a/packages/void/test/unit/schema-compat-tests.test.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { describe, expect, it } from 'vite-plus/test';
-import {
-  compatibilityTemplate,
-  correctLegacyDeployFixture,
-  correctLegacyEmailFixture,
-  correctedDeployBodyFixture,
-  correctedZoneFixture,
-  correctedZoneProvision,
-  legacyDeployBodyFixture,
-  legacyZoneFixture,
-  legacyZoneProvision,
-  runIsolatedCompatibilityTests,
-} from '../../../../.github/scripts/schema-compat-tests.ts';
-
-const templateUrl = 'postgresql://void_ci:test@127.0.0.1:5432/void_schema_compat';
-
-describe('schema compatibility database isolation', () => {
-  it('drains only the known unfinished legacy deploy fixture without changing its assertion', () => {
-    const current = readFileSync(
-      new URL(
-        '../../../../platform/packages/api/test/integration/deploy-direct-r2.test.ts',
-        import.meta.url,
-      ),
-      'utf8',
-    ).replaceAll('\r\n', '\n');
-    expect(current).toContain(correctedDeployBodyFixture);
-    const legacy = current.replace(correctedDeployBodyFixture, legacyDeployBodyFixture);
-    expect(correctLegacyDeployFixture(legacy)).toBe(current);
-    expect(correctLegacyDeployFixture(current)).toBe(current);
-    expect(correctLegacyDeployFixture(legacy + '\n')).toBe(legacy + '\n');
-  });
-
-  it('corrects only the checksum-verified legacy fixture and preserves all assertions', () => {
-    const current = readFileSync(
-      new URL(
-        '../../../../platform/packages/api/test/integration/email-connections.test.ts',
-        import.meta.url,
-      ),
-      'utf8',
-    ).replaceAll('\r\n', '\n');
-    expect(current).toContain(correctedZoneFixture);
-    const legacy = current
-      .replace(correctedZoneFixture, legacyZoneFixture)
-      .replace(correctedZoneProvision, legacyZoneProvision);
-    expect(correctLegacyEmailFixture(legacy)).toBe(current);
-    expect(correctLegacyEmailFixture(legacy.replaceAll('\n', '\r\n'))).toBe(
-      current.replaceAll('\n', '\r\n'),
-    );
-    expect(correctLegacyEmailFixture(current)).toBe(current);
-    expect(correctLegacyEmailFixture(legacy + '\n')).toBe(legacy + '\n');
-  });
-
-  it.each([
-    'postgresql://void_ci:test@database.example/void_schema_compat',
-    'postgresql://void_ci:test@127.0.0.1/production',
-    'postgresql://owner:test@127.0.0.1/void_schema_compat',
-    templateUrl + '?options=arbitrary',
-    'invalid',
-  ])('rejects unsafe template configuration before database work: %s', (url) => {
-    expect(() => compatibilityTemplate(url)).toThrow();
-  });
-
-  it('isolates overlapping files and cleans every owned database after failures', async () => {
-    const databases = new Map<string, Set<string>>();
-    const destinations = new Set<string>();
-    let active = 0;
-    let peak = 0;
-    const failures = await runIsolatedCompatibilityTests({
-      templateUrl,
-      files: ['first.test.ts', 'second.test.ts', 'third.test.ts'],
-      query: async (statement) => {
-        const name = statement.match(/"(void_compat_[a-f0-9]+_\d+)"/)?.[1];
-        expect(name).toBeTruthy();
-        if (statement.startsWith('CREATE')) {
-          expect(statement).toContain('TEMPLATE "void_schema_compat"');
-          expect(databases.has(name!)).toBe(false);
-          databases.set(name!, new Set());
-        } else {
-          expect(databases.delete(name!)).toBe(true);
-        }
-      },
-      runTest: async (file, url) => {
-        const destination = new URL(url);
-        expect(destination.host).toBe('127.0.0.1:5432');
-        expect(destination.username).toBe('void_ci');
-        expect(destination.password).toBe('test');
-        expect(destinations.has(destination.pathname)).toBe(false);
-        destinations.add(destination.pathname);
-        const tables = databases.get(destination.pathname.slice(1))!;
-        // Each file can independently create and leave the same fixture table behind.
-        expect(tables.has('__void_platform_installation')).toBe(false);
-        tables.add('__void_platform_installation');
-        active++;
-        peak = Math.max(peak, active);
-        await new Promise((resolve) => setTimeout(resolve, 5));
-        active--;
-        if (file === 'second.test.ts') {
-          throw new Error('fixture failure');
-        }
-        return file === 'third.test.ts' ? 1 : 0;
-      },
-    });
-    expect(failures.sort()).toEqual(['second.test.ts', 'third.test.ts']);
-    expect(peak).toBe(2);
-    expect(destinations.size).toBe(3);
-    expect(databases.size).toBe(0);
-  });
-});
diff --git a/packages/void/test/unit/schema-fixture.test.ts b/packages/void/test/unit/schema-fixture.test.ts
deleted file mode 100644
index 4bbf2d14d..000000000
--- a/packages/void/test/unit/schema-fixture.test.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { beforeAll, describe, expect, it } from 'vite-plus/test';
-
-type Rows = Record<string, Record<string, unknown>>;
-let assertPreserved: (original: Rows, rows: Rows, projectModeMigrationApplied?: boolean) => void;
-let migrationApplied: (rows: Array<{ hash?: string; created_at?: number | string }>) => boolean;
-const migration = {
-  hash: createHash('sha256')
-    .update(
-      readFileSync(
-        new URL('../../../../platform/packages/api/drizzle/0054_project_mode.sql', import.meta.url),
-      ),
-    )
-    .digest('hex'),
-  created_at: 1790841384175,
-};
-
-beforeAll(async () => {
-  const module = await import(
-    new URL('../../../../.github/scripts/schema-fixture.mjs', import.meta.url).href
-  );
-  assertPreserved = module.assertSchemaFixturePreserved;
-  migrationApplied = module.isProjectModeMigrationApplied;
-});
-
-function original(mode = 'worker'): Rows {
-  return {
-    users: { id: 'user_compat', role: 'admin', email: 'compat@example.invalid' },
-    projects: { id: 'proj_compat', user_id: 'user_compat', slug: 'schema-compat-fixture', mode },
-    project_secrets: { id: 'psc_compat', ciphertext: 'fixture-ciphertext', iv: 'fixture-iv' },
-  };
-}
-
-describe('populated schema compatibility fixture', () => {
-  it('accepts only the exact applied project-mode migration and intentional Worker normalization', () => {
-    expect(migrationApplied([migration])).toBe(true);
-    expect(migrationApplied([{ ...migration, created_at: String(migration.created_at) }])).toBe(
-      true,
-    );
-    const before = original();
-    const after = structuredClone(before);
-    after.projects.mode = 'void';
-    expect(() => assertPreserved(before, after, migrationApplied([migration]))).not.toThrow();
-    expect(after.project_secrets).toEqual(before.project_secrets);
-  });
-
-  it.each([
-    { rows: [] },
-    { rows: [{ created_at: migration.created_at }] },
-    { rows: [{ ...migration, hash: '0'.repeat(64) }] },
-    { rows: [{ ...migration, created_at: migration.created_at + 1 }] },
-    { rows: [migration, migration] },
-  ])('refuses normalization without the exact unique applied migration $rows', ({ rows }) => {
-    expect(migrationApplied(rows)).toBe(false);
-    const before = original();
-    const after = structuredClone(before);
-    after.projects.mode = 'void';
-    expect(() => assertPreserved(before, after, migrationApplied(rows))).toThrow('projects.mode');
-  });
-
-  it.each(['spa', 'static', 'framework', 'unexpected'])(
-    'refuses a Worker conversion to %s',
-    (mode) => {
-      const before = original();
-      const after = structuredClone(before);
-      after.projects.mode = mode;
-      expect(() => assertPreserved(before, after, true)).toThrow('projects.mode');
-    },
-  );
-
-  it.each(['void', 'spa', 'static', 'framework'])(
-    'preserves existing %s projects exactly',
-    (mode) => {
-      const before = original(mode);
-      const after = structuredClone(before);
-      expect(() => assertPreserved(before, after, true)).not.toThrow();
-      after.projects.mode = mode === 'void' ? 'worker' : 'void';
-      expect(() => assertPreserved(before, after, true)).toThrow('projects.mode');
-    },
-  );
-
-  it.each([
-    ['users', 'email'],
-    ['projects', 'slug'],
-    ['projects', 'user_id'],
-    ['project_secrets', 'ciphertext'],
-    ['project_secrets', 'iv'],
-  ])('still rejects unrelated mutation of %s.%s', (table, column) => {
-    const before = original();
-    const after = structuredClone(before);
-    after.projects.mode = 'void';
-    after[table][column] = 'changed';
-    expect(() => assertPreserved(before, after, true)).toThrow(`${table}.${column}`);
-  });
-
-  it('does not allow another project identity to use the fixture normalization exception', () => {
-    const before = original();
-    before.projects.id = 'unrelated';
-    const after = structuredClone(before);
-    after.projects.mode = 'void';
-    expect(() => assertPreserved(before, after, true)).toThrow('projects.mode');
-  });
-});
diff --git a/packages/void/test/unit/secret-output.test.ts b/packages/void/test/unit/secret-output.test.ts
index c2570f10c..f34b06f50 100644
--- a/packages/void/test/unit/secret-output.test.ts
+++ b/packages/void/test/unit/secret-output.test.ts
@@ -59,9 +59,9 @@ it('prints no success after a secret mutation fails', async () => {
   expect(output).not.toContain('✓');
 });
 
-it.each([0, 2])('lists secrets when the terminal reports %i columns', async (columns) => {
+it('lists secrets when the terminal reports 0 columns', async () => {
   const descriptor = Object.getOwnPropertyDescriptor(process.stdout, 'columns');
-  Object.defineProperty(process.stdout, 'columns', { configurable: true, value: columns });
+  Object.defineProperty(process.stdout, 'columns', { configurable: true, value: 0 });
   let output = '';
   const write = vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
     output += String(chunk);
diff --git a/packages/void/test/unit/seed.typecheck.ts b/packages/void/test/unit/seed.typecheck.ts
index f95e25938..2f48bc509 100644
--- a/packages/void/test/unit/seed.typecheck.ts
+++ b/packages/void/test/unit/seed.typecheck.ts
@@ -1,4 +1,3 @@
-import { describe, expect, it } from 'vite-plus/test';
 import { integer, sqliteTable, text as sqliteText } from '../../src/runtime/schema-d1.ts';
 import { int, mysqlTable, text as mysqlText } from '../../src/runtime/schema-mysql.ts';
 import { pgTable, serial, text as pgText, timestamp } from '../../src/runtime/schema-pg.ts';
@@ -30,22 +29,14 @@ type PostgresSchema = typeof postgresSchema;
 type SqliteSchema = typeof sqliteSchema;
 type MySqlSchema = typeof mysqlSchema;
 
-const sqliteSeed = defineSeed<SqliteSchema>(async ({ db, schema }) => {
+defineSeed<SqliteSchema>(async ({ db, schema }) => {
   await db.insert(schema.messages).values([{ text: 'hello from sqlite' }]);
 });
 
-const postgresSeed = defineSeed<PostgresSchema>(async ({ db, schema }) => {
+defineSeed<PostgresSchema>(async ({ db, schema }) => {
   await db.insert(schema.messages).values([{ text: 'hello from postgresql' }]);
 });
 
-const mysqlSeed = defineSeed<MySqlSchema>(async ({ db, schema }) => {
+defineSeed<MySqlSchema>(async ({ db, schema }) => {
   await db.insert(schema.messages).values([{ text: 'hello from mysql' }]);
 });
-
-describe('defineSeed types', () => {
-  it('accepts generated seed callbacks for schema-specific dialects', () => {
-    expect(typeof sqliteSeed).toBe('function');
-    expect(typeof postgresSeed).toBe('function');
-    expect(typeof mysqlSeed).toBe('function');
-  });
-});
diff --git a/packages/void/test/unit/serialize-page-data.test.ts b/packages/void/test/unit/serialize-page-data.test.ts
deleted file mode 100644
index 895932cff..000000000
--- a/packages/void/test/unit/serialize-page-data.test.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { describe, expect, it } from 'vite-plus/test';
-import { serializePageData } from '../../src/pages/serialize.ts';
-
-const LS = String.fromCharCode(0x2028);
-const PS = String.fromCharCode(0x2029);
-
-describe('serializePageData', () => {
-  it('escapes </script> so the inline script tag cannot be closed early', () => {
-    const payload = { html: '</script><script>alert(1)</script>' };
-    const out = serializePageData(payload);
-
-    expect(out).not.toMatch(/<\/script/i);
-    expect(out).not.toContain('<');
-    expect(out).not.toContain('>');
-    expect(JSON.parse(out)).toEqual(payload);
-  });
-
-  it('escapes ampersands and U+2028 / U+2029 line separators', () => {
-    const payload = { amp: 'a & b', ls: `a${LS}b`, ps: `a${PS}b` };
-    const out = serializePageData(payload);
-
-    expect(out).not.toContain('&');
-    expect(out).not.toContain(LS);
-    expect(out).not.toContain(PS);
-    expect(JSON.parse(out)).toEqual(payload);
-  });
-});
diff --git a/packages/void/test/unit/sse.test.ts b/packages/void/test/unit/sse.test.ts
index 74e76df49..af00f29fd 100644
--- a/packages/void/test/unit/sse.test.ts
+++ b/packages/void/test/unit/sse.test.ts
@@ -8,46 +8,7 @@ import {
   SseStreamClosedError,
   type SseStream,
 } from '../../src/runtime/sse.ts';
-
-class MockEventSource {
-  static instances: Array<MockEventSource> = [];
-
-  readonly listeners = new Map<string, Set<(event: Event) => void>>();
-  closed = false;
-
-  constructor(
-    readonly url: string,
-    readonly options?: { withCredentials?: boolean },
-  ) {
-    MockEventSource.instances.push(this);
-  }
-
-  addEventListener(type: string, listener: (event: Event) => void): void {
-    const listeners = this.listeners.get(type) ?? new Set();
-    listeners.add(listener);
-    this.listeners.set(type, listeners);
-  }
-
-  removeEventListener(type: string, listener: (event: Event) => void): void {
-    this.listeners.get(type)?.delete(listener);
-  }
-
-  emit(type: string, data: string, lastEventId = ''): void {
-    for (const listener of this.listeners.get(type) ?? []) {
-      listener({ data, lastEventId } as MessageEvent);
-    }
-  }
-
-  emitError(event: Event): void {
-    for (const listener of this.listeners.get('error') ?? []) {
-      listener(event);
-    }
-  }
-
-  close(): void {
-    this.closed = true;
-  }
-}
+import { MockEventSource } from '../helpers/mock-event-source.ts';
 
 const decoder = new TextDecoder();
 const originalEventSource = (globalThis as { EventSource?: unknown }).EventSource;
@@ -260,9 +221,9 @@ describe('connectEventStream', () => {
     stream.on('log', messageHandler);
     const offError = stream.onError(errorHandler);
     source.emit('log', 'hello');
-    source.emitError({ type: 'error' } as Event);
+    source.emit('error', { type: 'error' } as Event);
     offError();
-    source.emitError({ type: 'error' } as Event);
+    source.emit('error', { type: 'error' } as Event);
     stream.close();
 
     expect(messageHandler.mock.calls[0]?.[0].data).toBe('hello');
diff --git a/packages/void/test/unit/static-data.test.ts b/packages/void/test/unit/static-data.test.ts
index 489088b8a..554be5aaa 100644
--- a/packages/void/test/unit/static-data.test.ts
+++ b/packages/void/test/unit/static-data.test.ts
@@ -31,34 +31,24 @@ describe('resolveStaticPageDataBuildOptions', () => {
   });
 
   it('disables the fast path when routing.redirects is non-empty', () => {
-    // Existing guard — covered for completeness.
     setupConfig({ output: 'static', routing: { redirects: { '/old': '/new' } } });
     const opts = resolveStaticPageDataBuildOptions(tmpDir, { publicDir: false });
     expect(opts.fastPath).toBe(false);
   });
 
   it('disables the fast path when routing.rewrites is non-empty', () => {
-    // Regression: the fast-path client request goes to
-    // /_void/pages/<path>.json, never the user-facing URL, so dispatch's
-    // edge rewrite never fires. The fast path must be disabled when any
-    // config rewrite is defined or the client commits unrewritten page data.
     setupConfig({ output: 'static', routing: { rewrites: { '/old': '/new' } } });
     const opts = resolveStaticPageDataBuildOptions(tmpDir, { publicDir: false });
     expect(opts.fastPath).toBe(false);
   });
 
   it('disables the fast path when routing.fallbacks is non-empty', () => {
-    // Same logic as rewrites — fallback rules can also alter response body
-    // shape, and the fast path bypasses the dispatch fallback phase.
     setupConfig({ output: 'static', routing: { fallbacks: { '/missing': '/index' } } });
     const opts = resolveStaticPageDataBuildOptions(tmpDir, { publicDir: false });
     expect(opts.fastPath).toBe(false);
   });
 
   it('keeps the fast path enabled when only routing.headers is set', () => {
-    // Header rules don't change response body — they're applied to the
-    // page-data JSON the same as any other static asset, so they don't
-    // need to disable the fast path.
     setupConfig({
       output: 'static',
       routing: { headers: { '/api/*': ['Cache-Control: no-store'] } },
diff --git a/packages/void/test/unit/storage.test.ts b/packages/void/test/unit/storage.test.ts
index b8d8d504b..043c74ec6 100644
--- a/packages/void/test/unit/storage.test.ts
+++ b/packages/void/test/unit/storage.test.ts
@@ -4,50 +4,9 @@ vi.mock('cloudflare:workers', () => ({ env: {} }));
 
 import { createStorage } from '../../src/runtime/storage.ts';
 
-function createMockR2Bucket() {
-  return {
-    get: vi.fn().mockResolvedValue(null),
-    put: vi.fn().mockResolvedValue({}),
-    delete: vi.fn().mockResolvedValue(undefined),
-    list: vi.fn().mockResolvedValue({ objects: [], truncated: false }),
-    head: vi.fn().mockResolvedValue(null),
-  } as unknown as R2Bucket & {
-    get: ReturnType<typeof vi.fn>;
-    put: ReturnType<typeof vi.fn>;
-    delete: ReturnType<typeof vi.fn>;
-  };
-}
-
 describe('createStorage', () => {
   it('returns the bucket directly', () => {
-    const mockBucket = createMockR2Bucket();
-    const s = createStorage(mockBucket);
-    expect(s).toBe(mockBucket);
-  });
-
-  it('get passes through to bucket', async () => {
-    const mockBucket = createMockR2Bucket();
-    const mockBody = { key: 'file.txt', body: 'content' };
-    mockBucket.get.mockResolvedValue(mockBody);
-    const s = createStorage(mockBucket);
-    const result = await s.get('file.txt');
-    expect(mockBucket.get).toHaveBeenCalledWith('file.txt');
-    expect(result).toBe(mockBody);
-  });
-
-  it('put passes through to bucket', async () => {
-    const mockBucket = createMockR2Bucket();
-    const s = createStorage(mockBucket);
-    await s.put('file.txt', 'content', { httpMetadata: { contentType: 'text/plain' } });
-    expect(mockBucket.put).toHaveBeenCalledWith('file.txt', 'content', {
-      httpMetadata: { contentType: 'text/plain' },
-    });
-  });
-
-  it('delete passes through to bucket', async () => {
-    const mockBucket = createMockR2Bucket();
-    const s = createStorage(mockBucket);
-    await s.delete('file.txt');
-    expect(mockBucket.delete).toHaveBeenCalledWith('file.txt');
+    const bucket = {} as R2Bucket;
+    expect(createStorage(bucket)).toBe(bucket);
   });
 });
diff --git a/packages/void/test/unit/stream-deploy-errors.test.ts b/packages/void/test/unit/stream-deploy-errors.test.ts
index 1b6d51e26..b10e69295 100644
--- a/packages/void/test/unit/stream-deploy-errors.test.ts
+++ b/packages/void/test/unit/stream-deploy-errors.test.ts
@@ -147,17 +147,6 @@ describe('formatStreamDeployError', () => {
     expect(formatted.message).toContain('HTTP 500');
   });
 
-  it('never replaces a real error message with only "Connection lost during deploy"', () => {
-    // Regression guard: prior behavior collapsed any non-DeployEventError to the
-    // opaque connection-lost string, hiding the real cause. The new contract must
-    // always preserve the original message substring for generic errors.
-    const err = new Error('socket hang up');
-
-    const formatted = formatStreamDeployError(err, null);
-
-    expect(formatted.message).toContain('socket hang up');
-  });
-
   it('falls back to the raw body when the JSON payload has no error/message field', () => {
     const err = new PlatformApiError('Deploy failed', 500, JSON.stringify({ foo: 'bar' }));
 
diff --git a/packages/void/test/unit/test-projects.test.ts b/packages/void/test/unit/test-projects.test.ts
deleted file mode 100644
index 707330ddd..000000000
--- a/packages/void/test/unit/test-projects.test.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { globSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { expect, it } from 'vite-plus/test';
-
-type TestProject = {
-  test: {
-    name: string;
-    include: Array<string>;
-    exclude?: Array<string>;
-    pool?: string;
-    isolate?: boolean;
-  };
-};
-const root = fileURLToPath(new URL('../../../../', import.meta.url));
-const { default: config } = await import(
-  new URL('../../../../vite.config.ts', import.meta.url).href
-);
-const projects = config.test.projects as Array<TestProject>;
-
-function files(project: TestProject): Array<string> {
-  return [...globSync(project.test.include, { cwd: root, exclude: project.test.exclude ?? [] })];
-}
-
-it('assigns every API integration file exactly once across its worker pools', () => {
-  const discovered = [
-    ...globSync('platform/packages/api/test/integration/**/*.test.ts', { cwd: root }),
-  ];
-  const selected = projects
-    .filter((project) => project.test.name.startsWith('platform-api-integration'))
-    .flatMap(files);
-  expect(selected.sort()).toEqual(discovered.sort());
-  expect(new Set(selected).size).toBe(discovered.length);
-});
-
-it('keeps process-timezone tests in forks', () => {
-  for (const project of projects.filter((project) =>
-    project.test.name.startsWith('platform-api-integration'),
-  )) {
-    for (const file of files(project)) {
-      const source = readFileSync(join(root, file), 'utf8');
-      if (/process\.env\.TZ|vi\.stubEnv\(['"]TZ['"]/.test(source)) {
-        expect(project.test.pool ?? 'forks', file).toBe('forks');
-      }
-    }
-  }
-});
-
-it('assigns every SDK unit file exactly once including the subprocess project', () => {
-  const discovered = [...globSync('packages/*/test/unit/**/*.test.ts', { cwd: root })];
-  const selected = projects
-    .filter((project) => ['unit', 'unit-pglite', 'cli-unit'].includes(project.test.name))
-    .flatMap(files);
-  expect(selected.sort()).toEqual(discovered.sort());
-  expect(new Set(selected).size).toBe(discovered.length);
-});
-
-it('keeps module isolation for every project', () => {
-  for (const project of projects) {
-    expect(project.test.isolate, project.test.name).not.toBe(false);
-    expect(['threads', 'forks']).toContain(project.test.pool ?? 'forks');
-  }
-});
diff --git a/packages/void/test/unit/test-sharding.test.ts b/packages/void/test/unit/test-sharding.test.ts
deleted file mode 100644
index a52b7b38c..000000000
--- a/packages/void/test/unit/test-sharding.test.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import { describe, expect, it } from 'vite-plus/test';
-import { integrationTimings } from '../../../../test/integration-timings.ts';
-import { balanceTests, shuffleTests, testFileKey } from '../../../../test/test-sharding.ts';
-
-describe('integration test scheduling', () => {
-  it('preserves seeded shuffle without changing membership or the input', () => {
-    const files = Object.keys(integrationTimings);
-    const original = [...files];
-    expect(shuffleTests(files, 42)).toEqual(shuffleTests(files, 42));
-    expect(shuffleTests(files, 42)).not.toEqual(shuffleTests(files, 43));
-    expect(shuffleTests(files, 42).sort()).toEqual([...files].sort());
-    expect(files).toEqual(original);
-  });
-  it.each([1, 2, 3, 50])(
-    'assigns every known and newly added file exactly once across %i shards',
-    (count) => {
-      const files = [
-        ...Object.keys(integrationTimings),
-        'packages/void/test/integration/new.test.ts',
-      ];
-      const original = [...files];
-      const shards = balanceTests(
-        files,
-        count,
-        (file) => file,
-        (file) => integrationTimings[file] ?? 5000,
-      );
-      expect(shards).toHaveLength(count);
-      expect(shards.flat().sort()).toEqual([...files].sort());
-      expect(new Set(shards.flat()).size).toBe(files.length);
-      expect(files).toEqual(original);
-    },
-  );
-
-  it('is independent of discovery order and checkout path', () => {
-    const files = Object.keys(integrationTimings);
-    const posix = files.map((file) => `/work/repo/${file}`);
-    const windows = [...files]
-      .reverse()
-      .map((file) => `D:\\a\\repo\\${file.replaceAll('/', '\\')}`);
-    const plan = (items: Array<string>, root: string) =>
-      balanceTests(
-        items,
-        2,
-        (file) => testFileKey(file, root),
-        (file) => integrationTimings[testFileKey(file, root)],
-      ).map((shard) => shard.map((file) => testFileKey(file, root)));
-    expect(plan(posix, '/work/repo')).toEqual(plan(windows, 'D:\\a\\repo'));
-  });
-
-  it('keeps the measured two-shard load balanced', () => {
-    const files = Object.keys(integrationTimings);
-    const shards = balanceTests(
-      files,
-      2,
-      (file) => file,
-      (file) => integrationTimings[file],
-    );
-    const loads = shards.map((shard) =>
-      shard.reduce((total, file) => total + integrationTimings[file], 0),
-    );
-    expect(Math.max(...loads) / Math.min(...loads)).toBeLessThan(1.05);
-  });
-
-  it.each([0, -1, 1.5])('rejects invalid shard count %s', (count) => {
-    expect(() => balanceTests([], count, String, () => 1)).toThrow('positive integer');
-  });
-});
diff --git a/packages/void/test/unit/validate-migrations.test.ts b/packages/void/test/unit/validate-migrations.test.ts
index 6865b9b4a..756766a4f 100644
--- a/packages/void/test/unit/validate-migrations.test.ts
+++ b/packages/void/test/unit/validate-migrations.test.ts
@@ -164,28 +164,6 @@ describe('classifyMigration', () => {
       }),
     ).toThrow('contains BEGIN');
   });
-
-  it('only splits on executable statement breakpoint comments', () => {
-    const plan = classifyMigration({
-      name: '001_breakpoints.sql',
-      sql:
-        "INSERT INTO logs(message) VALUES('--> statement-breakpoint');\n" +
-        'CREATE TABLE users (id TEXT);\n' +
-        '--> statement-breakpoint\n' +
-        'CREATE TABLE posts (id TEXT);',
-    });
-
-    expect(plan).toEqual(
-      expect.objectContaining({
-        kind: 'breakpoint-framed',
-        statements: [
-          "INSERT INTO logs(message) VALUES('--> statement-breakpoint');\nCREATE TABLE users (id TEXT);",
-          'CREATE TABLE posts (id TEXT);',
-        ],
-        stability: 'stable',
-      }),
-    );
-  });
 });
 
 describe('assertJournalCoherence', () => {
@@ -210,10 +188,11 @@ describe('assertJournalCoherence', () => {
       tag,
       breakpoints: true,
     }));
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({ version: '7', dialect: 'sqlite', entries }),
-    );
+    writeFileSync(join(migrationsDir, 'meta', '_journal.json'), journalWith(entries));
+  }
+
+  function journalWith(entries: unknown): string {
+    return JSON.stringify({ version: '7', dialect: 'sqlite', entries });
   }
 
   it('passes when disk and journal match', () => {
@@ -250,11 +229,6 @@ describe('assertJournalCoherence', () => {
   });
 
   it('passes in legacy mode: files on disk but no journal at all', () => {
-    // Bare-legacy projects (hand-written .sql migrations, no db/schema.ts,
-    // no drizzle-kit) never have a `_journal.json`. The drift check has
-    // nothing to diff against there — the local/remote runners track
-    // applied migrations by filename via `_void_migrations`. Missing
-    // journal must pass silently.
     rmSync(join(migrationsDir, 'meta', '_journal.json'), { force: true });
     expect(() =>
       assertJournalCoherence(migrationsDir, [
@@ -264,24 +238,7 @@ describe('assertJournalCoherence', () => {
     ).not.toThrow();
   });
 
-  it('passes in legacy mode even when meta/ itself does not exist', () => {
-    // Some bare-legacy projects never created a meta/ directory at all.
-    // assertJournalCoherence must not synthesize drift from thin air.
-    rmSync(migrationsDir, { recursive: true, force: true });
-    mkdirSync(migrationsDir, { recursive: true });
-    expect(() =>
-      assertJournalCoherence(migrationsDir, [
-        { name: '0000_create_posts.sql', sql: 'CREATE TABLE posts (id TEXT);' },
-      ]),
-    ).not.toThrow();
-  });
-
   it('passes on a placeholder journal: empty entries, disk files, no snapshots (kitchen-sink shape)', () => {
-    // The checked-in kitchen-sink playground ships `meta/_journal.json` with
-    // `{ "entries": [] }` alongside hand-written .sql files and no snapshot
-    // metadata. That's functionally identical to "no journal at all" — the
-    // drift gate must treat it as bare-legacy so `void db status`, `migrate`,
-    // `reset`, and `deploy` keep working on unchanged projects.
     writeJournal([]);
     expect(() =>
       assertJournalCoherence(migrationsDir, [
@@ -292,12 +249,6 @@ describe('assertJournalCoherence', () => {
   });
 
   it('throws on an empty-entries journal when a snapshot is also present', () => {
-    // An empty journal with snapshot files is NOT the bare-legacy shape;
-    // it's a half-deleted drizzle state. Surface it as a hard error
-    // referencing the specific leftover artifact, the same way the
-    // missing-journal branch does. The presence of `.sql` files on
-    // disk is irrelevant — the journal-vs-artifacts mismatch is the
-    // corruption signal.
     writeJournal([]);
     writeFileSync(join(migrationsDir, 'meta', '0000_snapshot.json'), JSON.stringify({ id: 'abc' }));
 
@@ -312,13 +263,10 @@ describe('assertJournalCoherence', () => {
     expect(message).toContain('has no entries');
     expect(message).toContain('db/migrations/meta/0000_snapshot.json');
     expect(message).toContain('partial drizzle-kit state');
+    expect(message).toContain('void db generate');
   });
 
   it('throws on an empty-entries journal with a snapshot even when no .sql files remain', () => {
-    // The half-deleted shape where `_journal.json` has `entries: []`, a
-    // stale `meta/*_snapshot.json` is still present, and every on-disk
-    // `.sql` file has been deleted. The drift diff finds neither orphans
-    // nor missing entries here, so the guard must fire on its own.
     writeJournal([]);
     writeFileSync(join(migrationsDir, 'meta', '0000_snapshot.json'), JSON.stringify({ id: 'abc' }));
 
@@ -334,11 +282,6 @@ describe('assertJournalCoherence', () => {
   });
 
   it('throws on an empty-entries journal when the bundled migrations.js is still present', () => {
-    // Same half-deleted shape but with the bundled-mode
-    // artifact (`db/migrations/migrations.js`) left behind instead of
-    // a snapshot JSON. `void gen migration` already refuses this
-    // shape; `assertJournalCoherence` must match so every downstream
-    // command surfaces the corruption uniformly.
     writeJournal([]);
     writeFileSync(join(migrationsDir, 'migrations.js'), 'export default {};\n');
 
@@ -354,11 +297,6 @@ describe('assertJournalCoherence', () => {
   });
 
   it('throws when _journal.json is missing but a meta/*_snapshot.json is present', () => {
-    // Deleting just `_journal.json` while leaving `meta/*_snapshot.json`
-    // behind is a realistic merge/cleanup failure. Treating that as bare-
-    // legacy would silently let `void db status`, `migrate`, `reset`, and
-    // `deploy` continue on a partial drizzle-kit state. Surface it as a
-    // hard error with a concrete recovery path.
     rmSync(join(migrationsDir, 'meta', '_journal.json'), { force: true });
     writeFileSync(join(migrationsDir, 'meta', '0000_snapshot.json'), JSON.stringify({ id: 'abc' }));
 
@@ -376,9 +314,6 @@ describe('assertJournalCoherence', () => {
   });
 
   it('throws when _journal.json is missing but migrations.js (bundled mode) is present', () => {
-    // A bundled-mode project that lost `_journal.json` but kept its
-    // compiled `migrations.js` on disk is still in a partial drizzle-kit
-    // state. Refuse to silently fall through to bare-legacy.
     rmSync(join(migrationsDir, 'meta', '_journal.json'), { force: true });
     writeFileSync(join(migrationsDir, 'migrations.js'), 'export default {};\n');
 
@@ -395,363 +330,63 @@ describe('assertJournalCoherence', () => {
     expect(message).toContain('partial drizzle-kit state');
   });
 
-  it('throws an actionable error when journal.entries is null', () => {
-    // A bad merge / hand-edit can leave `_journal.json` parseable as JSON
-    // but with `entries` replaced by `null`. Without the shape guard, the
-    // subsequent `.length` access throws a raw `Cannot read properties of
-    // null (reading 'length')`. Surface an actionable error instead so
-    // users who hit this from `void db status`/`migrate`/`reset`/deploy
-    // get the same recovery path as `void gen migration`.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({ version: '7', dialect: 'sqlite', entries: null }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('`entries` array');
-  });
-
-  it('throws an actionable error when journal.entries is an object', () => {
-    // Same bad-merge shape as above but with `entries` replaced by a
-    // non-null object. Without the guard, `.map()` throws a raw
-    // `...map is not a function`. The actionable error must fire before
-    // the drift-check `.map()` call.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({ version: '7', dialect: 'sqlite', entries: { '0': 'foo' } }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('`entries` array');
-  });
-
-  it('throws an actionable error when the journal file is a JSON scalar null', () => {
-    // `readJournal` returns `undefined` only when the file is missing on
-    // disk. A hand-edit or merge can leave `_journal.json` parseable as
-    // the JSON scalar `null`. Treating that as bare-legacy mode would let
-    // `void db status`/`migrate`/`reset`/deploy continue on a corrupted
-    // drizzle project. Reject the malformed shape instead.
-    writeFileSync(join(migrationsDir, 'meta', '_journal.json'), 'null');
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('`entries` array');
-  });
-
-  it('throws an actionable error when the journal file is a JSON scalar number', () => {
-    // Same path as the `null` scalar: the file parses but the top-level
-    // value is a number. Must hit the same malformed branch rather than
-    // falling through to the bare-legacy check.
-    writeFileSync(join(migrationsDir, 'meta', '_journal.json'), '0');
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-  });
-
-  it('throws an actionable error when the journal file is a JSON array', () => {
-    // Arrays are truthy `typeof 'object'` values, so the only thing
-    // catching this shape is the explicit `Array.isArray(journal)` check.
-    // The drift code below would otherwise throw `journal.entries is not
-    // iterable` on the `.map()` call.
-    writeFileSync(join(migrationsDir, 'meta', '_journal.json'), '[]');
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('`entries` array');
-  });
-
-  it('throws an actionable error when a journal entry is null', () => {
-    // `{ "entries": [null] }` survives the top-level `Array.isArray`
-    // guard, but the drift check below reads `e.tag` for each entry — a
-    // null entry would crash with a raw `Cannot read properties of null
-    // (reading 'tag')`. The per-entry guard must fire first so every
-    // caller (`runStatus`, `runMigrate`, `runReset`, deploy paths, and
-    // `void gen migration`) gets the same actionable malformed-journal
-    // error instead of a raw TypeError.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({ version: '7', dialect: 'sqlite', entries: [null] }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('entry at index 0');
-    expect(message).toContain('missing required fields');
-  });
-
-  it('throws an actionable error when a journal entry is missing the tag field', () => {
-    // A hand-edit or merge can leave an entry as a plain object without
-    // the `tag` field. The drift check would then feed `undefined.sql`
-    // into its missing-file list, masking the corruption. Surface the
-    // malformed-journal error with the offending index instead.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({
-        version: '7',
-        dialect: 'sqlite',
-        entries: [
-          {
-            idx: 0,
-            version: '7',
-            when: 0,
-            tag: '0000_ok',
-            breakpoints: true,
-          },
-          {},
-        ],
-      }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('entry at index 1');
-    expect(message).toContain('missing required fields');
-  });
-
-  it('throws an actionable error when a journal entry has a non-string tag', () => {
-    // A corrupted-but-parseable journal can have `tag` as a number (e.g.
-    // `42`) instead of a string. `${e.tag}.sql` would then silently
-    // produce `42.sql` and the drift check would flag every on-disk file
-    // as missing. Require `typeof tag === 'string'` explicitly.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({
-        version: '7',
-        dialect: 'sqlite',
-        entries: [{ idx: 0, version: '7', when: 0, tag: 42, breakpoints: true }],
-      }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('entry at index 0');
-    expect(message).toContain('missing required fields');
-  });
-
-  it('throws an actionable error when top-level `version` is missing', () => {
-    // `runRenameMigrations` rewrites `journal.version` and
-    // `journal.dialect` verbatim when it writes the updated journal. A
-    // missing top-level `version` would produce
-    // `{ version: undefined, dialect: ..., entries: [...] }` after the
-    // rewrite — an unusable journal. Surface the corrupted shape up front.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
+  it.each([
+    ['journal.entries is null', journalWith(null), '`entries` array'],
+    ['journal.entries is an object', journalWith({ '0': 'foo' }), '`entries` array'],
+    ['the journal file is JSON null', 'null', '`entries` array'],
+    ['the journal file is a JSON number', '0', '`entries` array'],
+    ['the journal file is a JSON array', '[]', '`entries` array'],
+    [
+      'top-level `version` is missing',
       JSON.stringify({ dialect: 'sqlite', entries: [] }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('string `version`');
-  });
-
-  it('throws an actionable error when top-level `dialect` is missing', () => {
-    // Symmetric to the missing-`version` case — `runRenameMigrations`
-    // also rewrites `dialect` verbatim, so an undefined one corrupts the
-    // output journal.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
+      'string `version`',
+    ],
+    [
+      'top-level `dialect` is missing',
       JSON.stringify({ version: '7', entries: [] }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('string `dialect`');
-  });
-
-  it('throws an actionable error when top-level `version` is a non-string', () => {
-    // Drizzle writes `version` as a string literal (e.g. `"7"`). A
-    // hand-edit to a JSON number would leak into the rewritten journal
-    // as a number.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
+      'string `dialect`',
+    ],
+    [
+      'top-level `version` is a number',
       JSON.stringify({ version: 7, dialect: 'sqlite', entries: [] }),
+      'string `version`',
+    ],
+    ['a journal entry is null', journalWith([null]), 'entry at index 0 is missing required fields'],
+    [
+      'a journal entry is missing `tag`',
+      journalWith([{ idx: 0, version: '7', when: 0, tag: '0000_ok', breakpoints: true }, {}]),
+      'entry at index 1 is missing required fields',
+    ],
+    [
+      'a journal entry has a non-string `tag`',
+      journalWith([{ idx: 0, version: '7', when: 0, tag: 42, breakpoints: true }]),
+      'entry at index 0 is missing required fields',
+    ],
+    [
+      'a journal entry is missing `idx`',
+      journalWith([{ version: '7', when: 0, tag: '0000_no_idx', breakpoints: true }]),
+      'entry at index 0 is missing required fields',
+    ],
+    [
+      'a journal entry has a non-number `idx`',
+      journalWith([{ idx: '0', version: '7', when: 0, tag: '0000_str_idx', breakpoints: true }]),
+      'entry at index 0 is missing required fields',
+    ],
+    [
+      'a journal entry is missing `breakpoints`',
+      journalWith([{ idx: 0, version: '7', when: 0, tag: '0000_no_breakpoints' }]),
+      'entry at index 0 is missing required fields',
+    ],
+    [
+      'a journal entry is missing `version`',
+      journalWith([{ idx: 0, when: 0, tag: '0000_no_version', breakpoints: true }]),
+      'entry at index 0 is missing required fields',
+    ],
+  ])('throws an actionable error when %s', (_case, journal, fragment) => {
+    writeFileSync(join(migrationsDir, 'meta', '_journal.json'), journal);
+    expect(() => assertJournalCoherence(migrationsDir, [])).toThrow(
+      new RegExp(`db/migrations/meta/_journal\\.json is malformed: [\\s\\S]*${fragment}`),
     );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('string `version`');
-  });
-
-  it('throws an actionable error when a journal entry is missing `idx`', () => {
-    // `runMigration` (the custom-migration path) computes the
-    // next entry's `idx` via `Math.max(...entries.map(e => e.idx)) + 1`.
-    // An entry missing `idx` would make that `NaN + 1 === NaN` and
-    // write a corrupted entry back to disk. Reject the shape up front.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({
-        version: '7',
-        dialect: 'sqlite',
-        entries: [{ version: '7', when: 0, tag: '0000_no_idx', breakpoints: true }],
-      }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('entry at index 0');
-    expect(message).toContain('missing required fields');
-  });
-
-  it('throws an actionable error when a journal entry has a non-number `idx`', () => {
-    // `idx` is read via `entries.map(e => e.idx)` and fed into
-    // `Math.max(...)`. A string coerces to NaN through Math.max, so
-    // explicitly require the numeric shape here.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({
-        version: '7',
-        dialect: 'sqlite',
-        entries: [{ idx: '0', version: '7', when: 0, tag: '0000_str_idx', breakpoints: true }],
-      }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('entry at index 0');
-    expect(message).toContain('missing required fields');
-  });
-
-  it('throws an actionable error when a journal entry is missing `breakpoints`', () => {
-    // `runMigration` inherits `breakpoints` from the last
-    // entry into the new one (`breakpoints: lastEntry.breakpoints`).
-    // A missing field would serialize as `breakpoints: undefined` in
-    // the rewritten entry, producing a malformed output journal.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({
-        version: '7',
-        dialect: 'sqlite',
-        entries: [{ idx: 0, version: '7', when: 0, tag: '0000_no_breakpoints' }],
-      }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('entry at index 0');
-    expect(message).toContain('missing required fields');
-  });
-
-  it('throws an actionable error when a journal entry is missing `version`', () => {
-    // `runMigration` inherits `version` from the last entry
-    // into the new one — the drizzle-kit snapshot schema version (e.g.
-    // `"6"` / `"7"`). Missing it here would produce `version: undefined`
-    // in the rewritten entry.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({
-        version: '7',
-        dialect: 'sqlite',
-        entries: [{ idx: 0, when: 0, tag: '0000_no_version', breakpoints: true }],
-      }),
-    );
-    let message = '';
-    try {
-      assertJournalCoherence(migrationsDir, []);
-    } catch (err) {
-      message = (err as Error).message;
-    }
-    expect(message).toContain('db/migrations/meta/_journal.json');
-    expect(message).toContain('malformed');
-    expect(message).toContain('entry at index 0');
-    expect(message).toContain('missing required fields');
-  });
-
-  it('passes on a journal with all required top-level and entry fields (happy-path regression)', () => {
-    // A canonical drizzle-kit journal with an entry matching the on-disk
-    // .sql file must pass through silently.
-    writeFileSync(
-      join(migrationsDir, 'meta', '_journal.json'),
-      JSON.stringify({
-        version: '7',
-        dialect: 'sqlite',
-        entries: [
-          {
-            idx: 0,
-            version: '6',
-            when: 1_700_000_000_000,
-            tag: '0000_initial',
-            breakpoints: true,
-          },
-        ],
-      }),
-    );
-    expect(() =>
-      assertJournalCoherence(migrationsDir, [
-        { name: '0000_initial.sql', sql: 'CREATE TABLE posts (id TEXT);' },
-      ]),
-    ).not.toThrow();
   });
 
   it('mentions both orphans and missing entries together', () => {
@@ -770,14 +405,6 @@ describe('assertJournalCoherence', () => {
   });
 
   it('throws when _journal.json contains duplicate tag entries', () => {
-    // Regression: a bad merge can leave two
-    // entries in `_journal.json` sharing the same `tag`. The old
-    // `new Set(journal.entries.map(...))` silently collapsed those into
-    // a single tag, the drift diff passed, and every downstream caller
-    // continued on a corrupted journal. `void db rename-migrations` would
-    // then rewrite both copies to the same new tag, deepening the
-    // corruption. The coherence gate must surface the duplication with
-    // an actionable error that mentions the repeated tag.
     writeFileSync(
       join(migrationsDir, 'meta', '_journal.json'),
       JSON.stringify({
diff --git a/packages/void/test/unit/validator-real-schemas.test.ts b/packages/void/test/unit/validator-real-schemas.test.ts
index 71d2a5762..5dc6399ec 100644
--- a/packages/void/test/unit/validator-real-schemas.test.ts
+++ b/packages/void/test/unit/validator-real-schemas.test.ts
@@ -3,8 +3,9 @@ import { Hono } from 'hono';
 import * as v from 'valibot';
 import { describe, expect, it } from 'vite-plus/test';
 import { z } from 'zod';
-import { defineHandler, type CloudContext, type TypedHandler } from '../../src/runtime/handler.ts';
+import { defineHandler, type CloudContext } from '../../src/runtime/handler.ts';
 import { convertReturnValue } from '../../src/runtime/response.ts';
+import type { StandardSchemaV1 } from '../../src/standard-schema.ts';
 
 type ValidationIssueBody = {
   error: string;
@@ -14,239 +15,54 @@ type ValidationIssueBody = {
   }>;
 };
 
-function postJson(path: string, body: unknown) {
-  return new Request(`http://localhost${path}`, {
+function postJson(body: unknown) {
+  return new Request('http://localhost/test', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(body),
   });
 }
 
-function createPostApp(handler: (c: CloudContext) => unknown, path = '/test') {
+function createPostApp(handler: (c: CloudContext) => unknown) {
   const app = new Hono();
-  app.post(path, async (c) => {
+  app.post('/test', async (c) => {
     return convertReturnValue(await handler(c as unknown as CloudContext));
   });
   return app;
 }
 
-function createGetApp(handler: (c: CloudContext) => unknown, path = '/test') {
-  const app = new Hono();
-  app.get(path, async (c) => {
-    return convertReturnValue(await handler(c as unknown as CloudContext));
-  });
-  return app;
-}
-
-function createValidatedApp(method: 'get' | 'post', path: string, handler: TypedHandler) {
-  const app = new Hono();
-  app[method](path, async (c) => {
-    return convertReturnValue(await handler(c as unknown as CloudContext));
-  });
-  return app;
-}
-
-// ─── Zod ─────────────────────────────────────────────────────────────────────
-
-describe('withValidator + zod', () => {
-  const CreateUser = z.object({
-    name: z.string().min(1),
-    email: z.string().email(),
-  });
+const libraries: Array<{ library: string; CreateUser: StandardSchemaV1 }> = [
+  {
+    library: 'zod',
+    CreateUser: z.object({ name: z.string().min(1), email: z.string().email() }),
+  },
+  {
+    library: 'valibot',
+    CreateUser: v.object({
+      name: v.pipe(v.string(), v.minLength(1)),
+      email: v.pipe(v.string(), v.email()),
+    }),
+  },
+  {
+    library: 'arktype',
+    CreateUser: type({ name: 'string >= 1', email: 'string.email' }),
+  },
+];
+
+describe.each(libraries)('withValidator + $library', ({ CreateUser }) => {
+  const app = createPostApp(
+    defineHandler.withValidator({ body: CreateUser })((_c, { body }) => body),
+  );
 
   it('accepts valid body', async () => {
-    const handler = defineHandler.withValidator({
-      body: CreateUser,
-    })((_c, { body }) => {
-      return { name: body.name, email: body.email };
-    });
-
-    const app = createPostApp(handler);
-    const res = await app.request(postJson('/test', { name: 'Alice', email: 'alice@example.com' }));
+    const res = await app.request(postJson({ name: 'Alice', email: 'alice@example.com' }));
 
     expect(res.status).toBe(200);
     expect(await res.json()).toEqual({ name: 'Alice', email: 'alice@example.com' });
   });
 
   it('rejects invalid body with 400', async () => {
-    const handler = defineHandler.withValidator({
-      body: CreateUser,
-    })((_c, { body }) => {
-      return body;
-    });
-
-    const app = createPostApp(handler);
-    const res = await app.request(postJson('/test', { name: '', email: 'not-an-email' }));
-
-    expect(res.status).toBe(400);
-    const json = (await res.json()) as ValidationIssueBody;
-    expect(json.error).toBe('Validation failed');
-    expect(json.issues[0].slot).toBe('body');
-    expect(json.issues[0].issues.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it('rejects completely wrong shape', async () => {
-    const handler = defineHandler.withValidator({
-      body: CreateUser,
-    })((_c, { body }) => {
-      return body;
-    });
-
-    const app = createPostApp(handler);
-    const res = await app.request(postJson('/test', { garbage: 123 }));
-
-    expect(res.status).toBe(400);
-  });
-
-  it('validates query params', async () => {
-    const Pagination = z.object({
-      page: z.string(),
-      limit: z.string(),
-    });
-
-    const handler = defineHandler.withValidator({
-      query: Pagination,
-    })((_c, { query }) => {
-      return { page: query.page, limit: query.limit };
-    });
-
-    const app = createGetApp(handler);
-    const res = await app.request(new Request('http://localhost/test?page=2&limit=20'));
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ page: '2', limit: '20' });
-  });
-
-  it('validates params + body together', async () => {
-    const Params = z.object({ id: z.string() });
-    const Body = z.object({ role: z.enum(['admin', 'user']) });
-
-    const handler = defineHandler.withValidator({
-      params: Params,
-      body: Body,
-    })((_c, { params, body }) => {
-      return { userId: params.id, role: body.role };
-    });
-
-    const app = createValidatedApp('post', '/users/:id/role', handler);
-
-    const res = await app.request(postJson('/users/42/role', { role: 'admin' }));
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ userId: '42', role: 'admin' });
-  });
-});
-
-// ─── Valibot ─────────────────────────────────────────────────────────────────
-
-describe('withValidator + valibot', () => {
-  const CreateUser = v.object({
-    name: v.pipe(v.string(), v.minLength(1)),
-    email: v.pipe(v.string(), v.email()),
-  });
-
-  it('accepts valid body', async () => {
-    const handler = defineHandler.withValidator({
-      body: CreateUser,
-    })((_c, { body }) => {
-      return { name: body.name, email: body.email };
-    });
-
-    const app = createPostApp(handler);
-    const res = await app.request(postJson('/test', { name: 'Bob', email: 'bob@example.com' }));
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ name: 'Bob', email: 'bob@example.com' });
-  });
-
-  it('rejects invalid body with 400', async () => {
-    const handler = defineHandler.withValidator({
-      body: CreateUser,
-    })((_c, { body }) => {
-      return body;
-    });
-
-    const app = createPostApp(handler);
-    const res = await app.request(postJson('/test', { name: '', email: 'bad' }));
-
-    expect(res.status).toBe(400);
-    const json = (await res.json()) as ValidationIssueBody;
-    expect(json.error).toBe('Validation failed');
-    expect(json.issues[0].slot).toBe('body');
-    expect(json.issues[0].issues.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it('validates query params', async () => {
-    const Search = v.object({
-      q: v.string(),
-    });
-
-    const handler = defineHandler.withValidator({
-      query: Search,
-    })((_c, { query }) => {
-      return { q: query.q };
-    });
-
-    const app = createGetApp(handler);
-    const res = await app.request(new Request('http://localhost/test?q=hello'));
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ q: 'hello' });
-  });
-
-  it('validates params + body together', async () => {
-    const Params = v.object({ id: v.string() });
-    const Body = v.object({ title: v.string() });
-
-    const handler = defineHandler.withValidator({
-      params: Params,
-      body: Body,
-    })((_c, { params, body }) => {
-      return { id: params.id, title: body.title };
-    });
-
-    const app = createValidatedApp('post', '/items/:id', handler);
-
-    const res = await app.request(postJson('/items/7', { title: 'Updated' }));
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ id: '7', title: 'Updated' });
-  });
-});
-
-// ─── ArkType ─────────────────────────────────────────────────────────────────
-
-describe('withValidator + arktype', () => {
-  const CreateUser = type({
-    name: 'string >= 1',
-    email: 'string.email',
-  });
-
-  it('accepts valid body', async () => {
-    const handler = defineHandler.withValidator({
-      body: CreateUser,
-    })((_c, { body }) => {
-      return { name: body.name, email: body.email };
-    });
-
-    const app = createPostApp(handler);
-    const res = await app.request(
-      postJson('/test', { name: 'Charlie', email: 'charlie@example.com' }),
-    );
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ name: 'Charlie', email: 'charlie@example.com' });
-  });
-
-  it('rejects invalid body with 400', async () => {
-    const handler = defineHandler.withValidator({
-      body: CreateUser,
-    })((_c, { body }) => {
-      return body;
-    });
-
-    const app = createPostApp(handler);
-    const res = await app.request(postJson('/test', { name: '', email: 'not-email' }));
+    const res = await app.request(postJson({ name: '', email: 'not-an-email' }));
 
     expect(res.status).toBe(400);
     const json = (await res.json()) as ValidationIssueBody;
@@ -254,39 +70,4 @@ describe('withValidator + arktype', () => {
     expect(json.issues[0].slot).toBe('body');
     expect(json.issues[0].issues.length).toBeGreaterThanOrEqual(1);
   });
-
-  it('validates query params', async () => {
-    const Query = type({ tag: 'string' });
-
-    const handler = defineHandler.withValidator({
-      query: Query,
-    })((_c, { query }) => {
-      return { tag: query.tag };
-    });
-
-    const app = createGetApp(handler);
-    const res = await app.request(new Request('http://localhost/test?tag=featured'));
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ tag: 'featured' });
-  });
-
-  it('validates params + body together', async () => {
-    const Params = type({ slug: 'string' });
-    const Body = type({ published: 'boolean' });
-
-    const handler = defineHandler.withValidator({
-      params: Params,
-      body: Body,
-    })((_c, { params, body }) => {
-      return { slug: params.slug, published: body.published };
-    });
-
-    const app = createValidatedApp('post', '/posts/:slug', handler);
-
-    const res = await app.request(postJson('/posts/my-post', { published: true }));
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ slug: 'my-post', published: true });
-  });
 });
diff --git a/packages/void/test/unit/validator.test.ts b/packages/void/test/unit/validator.test.ts
index c1fa432bb..5e46daf0f 100644
--- a/packages/void/test/unit/validator.test.ts
+++ b/packages/void/test/unit/validator.test.ts
@@ -11,19 +11,6 @@ type ValidationIssueBody = {
   }>;
 };
 
-/** Create a mock Standard Schema that always succeeds with the given value. */
-function mockSchema<T>(output: T): StandardSchemaV1<unknown, T> {
-  return {
-    '~standard': {
-      version: 1,
-      vendor: 'test',
-      validate(value: unknown) {
-        return { value: output ?? (value as T) };
-      },
-    },
-  };
-}
-
 /** Create a mock Standard Schema that always fails with the given issues. */
 function failSchema(issues: Array<StandardSchemaV1.Issue>): StandardSchemaV1 {
   return {
@@ -37,120 +24,13 @@ function failSchema(issues: Array<StandardSchemaV1.Issue>): StandardSchemaV1 {
   };
 }
 
-/** Create a minimal mock CloudContext. */
-function mockContext(options: {
-  params?: Record<string, string>;
-  query?: Record<string, string>;
-  body?: unknown;
-}): CloudContext {
-  const url = new URL('http://localhost/test');
-  if (options.query) {
-    for (const [key, value] of Object.entries(options.query)) {
-      url.searchParams.set(key, value);
-    }
-  }
-  return {
-    req: {
-      param: () => options.params ?? {},
-      url: url.toString(),
-      json: async () => {
-        if (options.body === undefined) {
-          throw new Error('No body');
-        }
-        return options.body;
-      },
-    },
-  } as unknown as CloudContext;
+function mockContext(body?: unknown): CloudContext {
+  return { req: { json: async () => body } } as unknown as CloudContext;
 }
 
 describe('runValidation', () => {
-  it('validates body successfully', async () => {
-    const validators = {
-      body: mockSchema({ name: 'Alice' }),
-    } satisfies ValidatorSlots;
-    const c = mockContext({ body: { name: 'Alice' } });
-    const result = await runValidation(validators, c);
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.input.body).toEqual({ name: 'Alice' });
-    }
-  });
-
-  it('validates query successfully', async () => {
-    const validators = {
-      query: mockSchema({ page: '1' }),
-    } satisfies ValidatorSlots;
-    const c = mockContext({ query: { page: '1' } });
-    const result = await runValidation(validators, c);
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.input.query).toEqual({ page: '1' });
-    }
-  });
-
-  it('validates params successfully', async () => {
-    const validators = {
-      params: mockSchema({ id: '42' }),
-    } satisfies ValidatorSlots;
-    const c = mockContext({ params: { id: '42' } });
-    const result = await runValidation(validators, c);
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.input.params).toEqual({ id: '42' });
-    }
-  });
-
-  it('validates multiple slots', async () => {
-    const validators = {
-      params: mockSchema({ id: '1' }),
-      body: mockSchema({ name: 'Bob' }),
-    } satisfies ValidatorSlots;
-    const c = mockContext({ params: { id: '1' }, body: { name: 'Bob' } });
-    const result = await runValidation(validators, c);
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.input.params).toEqual({ id: '1' });
-      expect(result.input.body).toEqual({ name: 'Bob' });
-    }
-  });
-
-  it('returns 400 on body validation failure', async () => {
-    const validators: ValidatorSlots = {
-      body: failSchema([{ message: 'name is required' }]),
-    };
-    const c = mockContext({ body: {} });
-    const result = await runValidation(validators, c);
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.response.status).toBe(400);
-      const json = (await result.response.json()) as ValidationIssueBody;
-      expect(json.error).toBe('Validation failed');
-      expect(json.issues[0].slot).toBe('body');
-    }
-  });
-
-  it('returns 400 on invalid JSON body', async () => {
-    const validators: ValidatorSlots = {
-      body: mockSchema(null),
-    };
-    const c = mockContext({});
-    const result = await runValidation(validators, c);
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.response.status).toBe(400);
-      const json = (await result.response.json()) as { error: string };
-      expect(json.error).toBe('Invalid JSON body');
-    }
-  });
-
   it('passes with empty validators', async () => {
-    const c = mockContext({});
+    const c = mockContext();
     const result = await runValidation({}, c);
     expect(result.ok).toBe(true);
   });
@@ -159,7 +39,7 @@ describe('runValidation', () => {
     const validators: ValidatorSlots = {
       body: failSchema([{ message: 'too short', path: [{ key: 'name' }] }]),
     };
-    const c = mockContext({ body: { name: '' } });
+    const c = mockContext({ name: '' });
     const result = await runValidation(validators, c);
 
     expect(result.ok).toBe(false);
diff --git a/packages/void/test/unit/websocket-scan.test.ts b/packages/void/test/unit/websocket-scan.test.ts
index 4c5ed92af..e04d1d373 100644
--- a/packages/void/test/unit/websocket-scan.test.ts
+++ b/packages/void/test/unit/websocket-scan.test.ts
@@ -7,7 +7,6 @@ import {
   deriveWebSocketClassNameFromName,
   detectWebSocketDefinition,
   inferWebSocketResourceName,
-  scanWebSocketRoutes,
   scanWebSocketRoutesSync,
 } from '../../src/router/websocket.ts';
 
@@ -48,7 +47,7 @@ describe('WebSocket resource names', () => {
 
   it.each(['defineRoom', 'defineWebSocket'])(
     'pins %s identity unchanged, then preserves it after moving the route',
-    async (helper) => {
+    (helper) => {
       const root = createRoot();
       const file = createRoute(root, 'chat/[room].ws.ts', `export default ${helper}({})`);
       const [original] = scanWebSocketRoutesSync(root);
@@ -64,7 +63,6 @@ describe('WebSocket resource names', () => {
         filePath: 'rooms/[room].ws.ts',
         pattern: '/rooms/:room',
       });
-      expect(await scanWebSocketRoutes(root)).toEqual(scanWebSocketRoutesSync(root));
     },
   );
 
diff --git a/packages/void/test/unit/windows-resource-diagnostics.test.ts b/packages/void/test/unit/windows-resource-diagnostics.test.ts
deleted file mode 100644
index 259197bed..000000000
--- a/packages/void/test/unit/windows-resource-diagnostics.test.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { afterEach, expect, it, vi } from 'vite-plus/test';
-import { createWindowsResourceReporter } from '../../../../test/windows-resource-diagnostics.ts';
-
-const { execFileMock } = vi.hoisted(() => ({ execFileMock: vi.fn() }));
-vi.mock('node:child_process', () => ({ execFile: execFileMock }));
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  execFileMock.mockReset();
-});
-
-it('shares one bounded snapshot across concurrent failures', async () => {
-  const log = vi.spyOn(console, 'error').mockImplementation(() => {});
-  const report = createWindowsResourceReporter();
-  const first = report();
-  const second = report();
-
-  expect(second).toBe(first);
-  expect(execFileMock).toHaveBeenCalledOnce();
-  const [command, args, options, finish] = execFileMock.mock.calls[0]!;
-  expect(command).toBe('powershell.exe');
-  expect(args).toEqual([
-    '-NoLogo',
-    '-NoProfile',
-    '-NonInteractive',
-    '-File',
-    expect.stringMatching(/windows-resource-diagnostics\.ps1$/),
-  ]);
-  expect(options).toEqual({
-    encoding: 'utf8',
-    timeout: 10_000,
-    maxBuffer: 64 * 1024,
-    windowsHide: true,
-  });
-  finish(null, 'TCP connections: 12', '');
-  await Promise.all([first, second, report()]);
-  expect(execFileMock).toHaveBeenCalledOnce();
-  expect(log).toHaveBeenCalledExactlyOnceWith('Windows resource snapshot:\nTCP connections: 12');
-});
-
-it('retains partial output without rejecting when collection times out', async () => {
-  const log = vi.spyOn(console, 'error').mockImplementation(() => {});
-  execFileMock.mockImplementation((_command, _args, _options, finish) => {
-    finish(new Error('timed out'), 'Memory (KiB): partial snapshot', 'TCP query interrupted');
-  });
-
-  await expect(createWindowsResourceReporter()()).resolves.toBeUndefined();
-  expect(log).toHaveBeenCalledWith(
-    'Windows resource snapshot:\nMemory (KiB): partial snapshot\nTCP query interrupted\nSnapshot incomplete: timed out',
-  );
-});
-
-it('does not turn a process startup failure into another test failure', async () => {
-  const log = vi.spyOn(console, 'error').mockImplementation(() => {});
-  execFileMock.mockImplementation(() => {
-    throw new Error('unable to spawn');
-  });
-
-  await expect(createWindowsResourceReporter()()).resolves.toBeUndefined();
-  expect(log).toHaveBeenCalledWith(
-    'Windows resource snapshot:\nSnapshot incomplete: unable to spawn',
-  );
-});
diff --git a/packages/void/test/unit/wrangler.test.ts b/packages/void/test/unit/wrangler.test.ts
index bea46be69..2c199d322 100644
--- a/packages/void/test/unit/wrangler.test.ts
+++ b/packages/void/test/unit/wrangler.test.ts
@@ -20,6 +20,7 @@ import {
   syncWranglerBindings,
   syncWranglerDurableObjects,
   syncWranglerWebSockets,
+  type ProvisionedWranglerPatch,
   writeProvisionedWranglerConfig,
 } from '../../src/cli/wrangler.ts';
 import type { VoidConfig } from '../../src/config.ts';
@@ -44,6 +45,20 @@ function parseErrors(text: string): number {
   return errs.length;
 }
 
+function readRaw(filename: string): string {
+  return readFileSync(join(tmpDir, filename), 'utf-8');
+}
+
+function parseRaw(filename: string): Record<string, unknown> {
+  return parseJsoncRaw(readRaw(filename)) as Record<string, unknown>;
+}
+
+function appendProducer() {
+  return writeProvisionedWranglerConfig(tmpDir, {
+    queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
+  });
+}
+
 describe('readWranglerCompat', () => {
   it('resolves the latest known-good compatibility date without writing void.json', () => {
     rmSync(tmpDir, { recursive: true, force: true });
@@ -139,26 +154,6 @@ describe('readWranglerCompat', () => {
     expect(result.compatibilityDate).toBe('2026-02-24');
   });
 
-  it('void.json overrides wrangler.jsonc date', () => {
-    setup('wrangler.jsonc', '{ "compatibility_date": "2025-01-01" }');
-    const config: VoidConfig = { worker: { compatibility_date: '2026-06-01' } };
-    expect(readWranglerCompat(tmpDir, config)).toEqual({
-      compatibilityDate: '2026-06-01',
-    });
-  });
-
-  it('void.json overrides wrangler.jsonc flags', () => {
-    setup(
-      'wrangler.jsonc',
-      '{ "compatibility_date": "2026-01-01", "compatibility_flags": ["nodejs_compat"] }',
-    );
-    const config: VoidConfig = {
-      worker: { compatibility_flags: ['nodejs_compat', 'nodejs_als'] },
-    };
-    const result = readWranglerCompat(tmpDir, config);
-    expect(result.compatibilityFlags).toEqual(['nodejs_compat', 'nodejs_als']);
-  });
-
   it('void.json date used when no wrangler config exists', () => {
     rmSync(tmpDir, { recursive: true, force: true });
     mkdirSync(tmpDir, { recursive: true });
@@ -168,13 +163,8 @@ describe('readWranglerCompat', () => {
     });
   });
 
-  it('throws on invalid date format in wrangler config', () => {
-    setup('wrangler.json', '{ "compatibility_date": "not-a-date" }');
-    expect(() => readWranglerCompat(tmpDir)).toThrow('YYYY-MM-DD format');
-  });
-
-  it('throws on partial date format in wrangler config', () => {
-    setup('wrangler.json', '{ "compatibility_date": "2026-02" }');
+  it.each(['not-a-date', '2026-02'])('throws on date %s in wrangler config', (date) => {
+    setup('wrangler.json', JSON.stringify({ compatibility_date: date }));
     expect(() => readWranglerCompat(tmpDir)).toThrow('YYYY-MM-DD format');
   });
 
@@ -287,17 +277,6 @@ describe('ensureWranglerCompat', () => {
     });
   });
 
-  it('pins void.json when the build output fallback is missing too', () => {
-    rmSync(tmpDir, { recursive: true, force: true });
-    mkdirSync(tmpDir, { recursive: true });
-    expect(ensureWranglerCompat(tmpDir, undefined, join(tmpDir, 'nonexistent'))).toEqual({
-      compatibilityDate: LATEST_KNOWN_COMPAT_DATE,
-    });
-    expect(JSON.parse(readFileSync(join(tmpDir, 'void.json'), 'utf-8'))).toEqual({
-      worker: { compatibility_date: LATEST_KNOWN_COMPAT_DATE },
-    });
-  });
-
   it('preserves existing void.json fields when pinning compatibility_date', () => {
     setup(
       'void.json',
@@ -387,33 +366,6 @@ describe('syncWranglerBindings', () => {
     expect(created).toEqual({});
   });
 
-  it('does NOT add a send_email binding even when needsEmail is true', () => {
-    // Outbound email goes through __VOID_PROXY/email/send (the proxy
-    // worker holds the platform-level send_email binding). User workers
-    // never get one, so wrangler sync intentionally skips emission.
-    setup('wrangler.jsonc', '{ "name": "test" }');
-    const result = syncWranglerBindings(tmpDir, { ...noBindings, needsEmail: true });
-    expect(result).toBe(false);
-    const parsed = JSON.parse(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf-8'));
-    expect(parsed.send_email).toBeUndefined();
-  });
-
-  it('leaves a user-defined send_email block alone (does not strip it)', () => {
-    // If a user manually added one, that's harmless dead config they
-    // should remove — but the framework never rewrites it.
-    setup(
-      'wrangler.jsonc',
-      JSON.stringify({
-        name: 'test',
-        send_email: [{ name: 'CUSTOM_EMAIL', destination_address: 'me@x.dev' }],
-      }),
-    );
-    const result = syncWranglerBindings(tmpDir, { ...noBindings, needsEmail: true });
-    expect(result).toBe(false);
-    const parsed = JSON.parse(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf-8'));
-    expect(parsed.send_email).toEqual([{ name: 'CUSTOM_EMAIL', destination_address: 'me@x.dev' }]);
-  });
-
   it('adds D1 binding when needsD1 is true', () => {
     setup('wrangler.jsonc', '{ "name": "test" }');
     const result = syncWranglerBindings(tmpDir, { ...noBindings, needsD1: true });
@@ -433,13 +385,6 @@ describe('syncWranglerBindings', () => {
     expect(parsed.r2_buckets).toEqual([{ binding: 'STORAGE', bucket_name: 'default' }]);
   });
 
-  it('does not add auth-specific bindings', () => {
-    setup('wrangler.jsonc', '{ "name": "test" }');
-    syncWranglerBindings(tmpDir, { ...noBindings, needsAuth: true });
-    const parsed = JSON.parse(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf-8'));
-    expect(parsed).toEqual({ name: 'test' });
-  });
-
   it('uses custom binding names', () => {
     setup('wrangler.jsonc', '{ "name": "test" }');
     syncWranglerBindings(
@@ -465,33 +410,6 @@ describe('syncWranglerBindings', () => {
     expect(result).toBe(false);
   });
 
-  it('adds WebSocket classes as SQLite Durable Objects', () => {
-    setup('wrangler.jsonc', '{ "name": "test" }');
-    const result = syncWranglerWebSockets(tmpDir, [
-      {
-        pattern: '/chat/:room',
-        methods: ['GET'],
-        params: ['room'],
-        catchAll: false,
-        env: null,
-        filePath: 'chat/[room].ws.ts',
-        className: 'WsChatRoomWs',
-        bindingName: 'WS_CHAT_ROOM_WS',
-        mode: 'room',
-        hasAuthGate: false,
-      },
-    ]);
-
-    expect(result).toBe(true);
-    const parsed = JSON.parse(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf-8'));
-    expect(parsed.durable_objects.bindings).toEqual([
-      { name: 'WS_CHAT_ROOM_WS', class_name: 'WsChatRoomWs' },
-    ]);
-    expect(parsed.migrations).toEqual([
-      { tag: 'void-ws-v1', new_sqlite_classes: ['WsChatRoomWs'] },
-    ]);
-  });
-
   it('preserves a legacy WebSocket class and appends new classes as SQLite', () => {
     setup(
       'wrangler.jsonc',
@@ -555,7 +473,7 @@ describe('syncWranglerBindings', () => {
     expect(readWranglerWebSocketTombstones(tmpDir, [])).toEqual(['OldChatWs']);
   });
 
-  it('replaces a renamed generated WebSocket binding', () => {
+  it('keeps a renamed WebSocket binding, appends the new one and reports the old class as a tombstone', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({
@@ -606,75 +524,6 @@ describe('syncWranglerBindings', () => {
     ).toEqual(['OldChatWs']);
   });
 
-  it('adds sandbox durable object, container, and migration metadata', () => {
-    setup('wrangler.jsonc', '{ "name": "test" }');
-    const result = syncWranglerBindings(tmpDir, { ...noBindings, needsSandbox: true });
-    expect(result).toBe(true);
-    const parsed = JSON.parse(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf-8'));
-    expect(parsed.durable_objects.bindings).toEqual([{ name: 'SANDBOX', class_name: 'SandboxV1' }]);
-    expect(parsed.containers[0]).toMatchObject({
-      name: 'void-sandbox-v1',
-      class_name: 'SandboxV1',
-    });
-    expect(parsed.containers[0].images.default.dockerfile).toMatch(/sandbox\.Dockerfile$/);
-    expect(parsed.containers[0].scheduling_policy).toBe('durable_object');
-    expect(parsed.migrations).toEqual([
-      { tag: 'void-sandbox-v2', new_sqlite_classes: ['SandboxV1'] },
-    ]);
-  });
-
-  it('refuses to reuse a legacy Sandbox namespace before changing the deployment config', () => {
-    const original = JSON.stringify({
-      name: 'legacy',
-      durable_objects: { bindings: [{ name: 'SANDBOX', class_name: 'Sandbox' }] },
-      containers: [
-        {
-          name: 'void-sandbox',
-          class_name: 'Sandbox',
-          image: 'docker.io/cloudflare/sandbox:0.12.10',
-        },
-      ],
-      migrations: [{ tag: 'void-sandbox-v1', new_sqlite_classes: ['Sandbox'] }],
-    });
-    setup('wrangler.jsonc', original);
-    expect(() => syncWranglerBindings(tmpDir, { ...noBindings, needsSandbox: true })).toThrow(
-      'new Durable Object namespace',
-    );
-    expect(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf8')).toBe(original);
-  });
-
-  it('preserves custom Sandbox SQLite rename history even when the reserved tag belongs to another class', () => {
-    const migrations = [
-      { tag: 'custom-v1', new_sqlite_classes: ['OriginalSandbox'] },
-      { tag: 'custom-v2', renamed_classes: [{ from: 'OriginalSandbox', to: 'SandboxV1' }] },
-      { tag: 'void-sandbox-v2', new_sqlite_classes: ['Unrelated'] },
-    ];
-    setup('wrangler.jsonc', JSON.stringify({ name: 'custom', migrations }));
-    expect(syncWranglerBindings(tmpDir, { ...noBindings, needsSandbox: true })).toBe(true);
-    const parsed = JSON.parse(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf8'));
-    expect(parsed.migrations).toEqual(migrations);
-    expect(parsed.durable_objects.bindings).toEqual([{ name: 'SANDBOX', class_name: 'SandboxV1' }]);
-  });
-
-  it.each([
-    { tag: 'void-sandbox-v2', new_sqlite_classes: ['Unrelated'] },
-    { tag: 'legacy', new_classes: ['SandboxV1'] },
-    {
-      tag: 'transfer',
-      transferred_classes: [{ from_script: 'foreign', from: 'Original', to: 'SandboxV1' }],
-    },
-  ])(
-    'refuses an incompatible Sandbox migration before writing any generated config',
-    (migration) => {
-      const original = JSON.stringify({ name: 'incompatible', migrations: [migration] });
-      setup('wrangler.jsonc', original);
-      expect(() => syncWranglerBindings(tmpDir, { ...noBindings, needsSandbox: true })).toThrow(
-        /another class|needs SQLite storage/,
-      );
-      expect(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf8')).toBe(original);
-    },
-  );
-
   it('appends typed Durable Object migrations when new files sort earlier', () => {
     setup('wrangler.jsonc', '{ "name": "test" }');
     const zeta = {
@@ -791,36 +640,6 @@ describe('syncWranglerBindings', () => {
     expect(readExistingLiveBindingConfig(tmpDir)).toBeUndefined();
   });
 
-  it('uses custom sandbox config', () => {
-    setup('wrangler.jsonc', '{ "name": "test" }');
-    syncWranglerBindings(
-      tmpDir,
-      { ...noBindings, needsSandbox: true },
-      {
-        sandbox: {
-          binding: 'CODE',
-          className: 'CodeSandbox',
-          containerName: 'code-sandbox',
-          image: '/project/Dockerfile.sandbox',
-          platformImage:
-            'registry.cloudflare.com/account/code-sandbox@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-          instanceType: 'lite',
-        },
-      },
-    );
-    const parsed = JSON.parse(readFileSync(join(tmpDir, 'wrangler.jsonc'), 'utf-8'));
-    expect(parsed.durable_objects.bindings[0]).toEqual({
-      name: 'CODE',
-      class_name: 'CodeSandbox',
-    });
-    expect(parsed.containers[0]).toMatchObject({
-      name: 'code-sandbox',
-      class_name: 'CodeSandbox',
-      scheduling_policy: 'durable_object',
-      images: { default: { dockerfile: '/project/Dockerfile.sandbox' } },
-    });
-  });
-
   it('returns false when no bindings are needed', () => {
     setup('wrangler.jsonc', '{ "name": "test" }');
     expect(syncWranglerBindings(tmpDir, noBindings)).toBe(false);
@@ -839,14 +658,6 @@ describe('writeProvisionedWranglerConfig', () => {
   ]
 }`;
 
-  function readRaw(filename: string): string {
-    return readFileSync(join(tmpDir, filename), 'utf-8');
-  }
-
-  function parseRaw(filename: string): Record<string, unknown> {
-    return parseJsoncRaw(readRaw(filename)) as Record<string, unknown>;
-  }
-
   it('preserves comments and appends stable WebSocket migration history', () => {
     setup(
       'wrangler.jsonc',
@@ -912,32 +723,37 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(config);
   });
 
-  it('preserves comments while filling account_id, name, compatibility_date, and migrations_dir', () => {
+  it('fills account_id, name, compatibility_date and migrations_dir, keeping comments, and is idempotent', () => {
     setup('wrangler.jsonc', commentedFixture);
-    const result = writeProvisionedWranglerConfig(tmpDir, {
+    const patch = {
       accountId: 'acc-999',
       name: 'my-app',
       compatibilityDate: '2026-02-24',
       d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
-    });
+    };
+    const result = writeProvisionedWranglerConfig(tmpDir, patch);
 
     expect(result.modified).toBe(true);
     expect(result.d1MigrationsDirSkipped).toBe(false);
     expect(result.configPath).toBe(toSlash(join(tmpDir, 'wrangler.jsonc')));
 
     const raw = readRaw('wrangler.jsonc');
-    // Crux: comments must survive the write.
     expect(raw).toContain('// Void manages this file');
     expect(raw).toContain('/* App databases');
+    expect((raw.match(/"account_id"/g) ?? []).length).toBe(1);
+    expect((raw.match(/"migrations_dir"/g) ?? []).length).toBe(1);
 
     const parsed = parseRaw('wrangler.jsonc');
     expect(parsed.account_id).toBe('acc-999');
     expect(parsed.name).toBe('my-app');
     expect(parsed.compatibility_date).toBe('2026-02-24');
     const d1 = parsed.d1_databases as Array<Record<string, unknown>>;
+    expect(d1).toHaveLength(2);
     expect(d1[0]).toMatchObject({ binding: 'DB', migrations_dir: 'db/migrations' });
-    // The other D1 entry is untouched.
     expect(d1[1].migrations_dir).toBeUndefined();
+
+    expect(writeProvisionedWranglerConfig(tmpDir, patch).modified).toBe(false);
+    expect(readRaw('wrangler.jsonc')).toBe(raw);
   });
 
   it('overwrites account_id but only sets name/compatibility_date when absent', () => {
@@ -958,9 +774,7 @@ describe('writeProvisionedWranglerConfig', () => {
 
     expect(result.modified).toBe(true);
     const parsed = parseRaw('wrangler.jsonc');
-    // account_id is always corrected on re-resolve.
     expect(parsed.account_id).toBe('fresh-account');
-    // name / compatibility_date are only-if-absent — user's values win.
     expect(parsed.name).toBe('user-chosen-name');
     expect(parsed.compatibility_date).toBe('2025-01-01');
     expect(readRaw('wrangler.jsonc')).toContain('// user-owned fields');
@@ -1029,30 +843,6 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('is idempotent — running twice yields byte-identical output with no duplicate keys/entries', () => {
-    setup('wrangler.jsonc', commentedFixture);
-    const patch = {
-      accountId: 'acc-999',
-      name: 'my-app',
-      compatibilityDate: '2026-02-24',
-      d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
-    };
-
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-    const afterFirst = readRaw('wrangler.jsonc');
-
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-
-    // No duplicated D1 entries or keys.
-    const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
-    expect(d1).toHaveLength(2);
-    expect((afterFirst.match(/"account_id"/g) ?? []).length).toBe(1);
-    expect((afterFirst.match(/"migrations_dir"/g) ?? []).length).toBe(1);
-  });
-
   it('operates on wrangler.json when wrangler.jsonc is absent', () => {
     setup('wrangler.json', '{ "name": "json-app" }');
     const result = writeProvisionedWranglerConfig(tmpDir, { accountId: 'acc-1' });
@@ -1066,7 +856,6 @@ describe('writeProvisionedWranglerConfig', () => {
     const result = writeProvisionedWranglerConfig(tmpDir, { accountId: 'acc-2' });
     expect(result.configPath).toBe(toSlash(join(tmpDir, 'wrangler.jsonc')));
     expect(parseRaw('wrangler.jsonc').account_id).toBe('acc-2');
-    // The wrangler.json is left untouched.
     expect(parseRaw('wrangler.json').account_id).toBeUndefined();
   });
 
@@ -1092,9 +881,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(parseRaw('wrangler.jsonc').account_id).toBe('acc-tab');
   });
 
-  it('handles a leading UTF-8 BOM: parses (never fail-open), respects only-if-absent, matches D1, keeps the BOM + comments', () => {
-    // Node's utf-8 read preserves the BOM; a fail-open-to-`{}` parser would see
-    // name/compatibility_date as absent and clobber them, and miss the D1 entry.
+  it('reads the fields of a config with a leading UTF-8 BOM and keeps the BOM and comments', () => {
     const bomFixture =
       '' +
       `{
@@ -1114,16 +901,13 @@ describe('writeProvisionedWranglerConfig', () => {
     });
 
     expect(result.modified).toBe(true);
-    // D1 matched despite the BOM (fail-open would have skipped it).
     expect(result.d1MigrationsDirSkipped).toBe(false);
 
     const raw = readRaw('wrangler.jsonc');
-    // BOM round-trips (wrangler-compatible) and comments survive.
     expect(raw.charCodeAt(0)).toBe(0xfeff);
     expect(raw).toContain('// BOM-prefixed config');
 
     const parsed = parseJsoncRaw(raw.replace(/^/, '')) as Record<string, unknown>;
-    // Only-if-absent respected — the user's values are NOT clobbered.
     expect(parsed.name).toBe('user-name');
     expect(parsed.compatibility_date).toBe('2025-06-01');
     expect(parsed.account_id).toBe('acc-bom');
@@ -1137,14 +921,11 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(() => writeProvisionedWranglerConfig(tmpDir, { accountId: 'acc-x', name: 'y' })).toThrow(
       /not valid JSON/,
     );
-    // The file is left byte-for-byte untouched.
     expect(readRaw('wrangler.jsonc')).toBe(malformed);
   });
 
   it('fails closed on a queue consumer with a duplicated property — throws without writing', () => {
-    // jsonc-parser resolves the duplicate `max_batch_size` to the LAST member (20,
-    // what wrangler reads) but modify() edits the FIRST — so patching to 25 would
-    // leave wrangler on the stale 20 while the write looks byte-idempotent. Reject.
+    // Wrangler reads the last duplicate member, but jsonc-parser's modify() edits the first.
     const dup = `{
   "queues": {
     "consumers": [
@@ -1162,7 +943,6 @@ describe('writeProvisionedWranglerConfig', () => {
         queues: { consumers: [{ queue: 'jobs', max_batch_size: 25 }] },
       }),
     ).toThrow(/duplicate key "max_batch_size"/);
-    // File left byte-for-byte untouched.
     expect(readRaw('wrangler.jsonc')).toBe(dup);
   });
 
@@ -1283,73 +1063,29 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(dup);
   });
 
-  it('does not fire the duplicate guard on a valid config — still upserts and stays idempotent', () => {
-    // Sanity: the guard must not break the normal path. A no-duplicate config
-    // upserts a queue consumer and a second run is byte-identical.
+  it('upserts a queue producer and consumer into a config without queues, keeping comments, and is idempotent', () => {
     setup('wrangler.jsonc', commentedFixture);
     const patch = {
-      accountId: 'acc-ok',
-      queues: { consumers: [{ queue: 'jobs', max_batch_size: 25 }] },
-    };
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-    const afterFirst = readRaw('wrangler.jsonc');
-
-    const q = parseRaw('wrangler.jsonc').queues as { consumers: Array<Record<string, unknown>> };
-    expect(q.consumers).toEqual([{ queue: 'jobs', max_batch_size: 25 }]);
-
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-  });
-
-  it('upserts queue producers/consumers into a config with no queues — exactly one each, comments preserved', () => {
-    setup('wrangler.jsonc', commentedFixture);
-    const result = writeProvisionedWranglerConfig(tmpDir, {
       queues: {
         producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }],
         consumers: [{ queue: 'jobs', max_batch_size: 10 }],
       },
-    });
+    };
 
-    expect(result.modified).toBe(true);
-    expect(readRaw('wrangler.jsonc')).toContain('// Void manages this file');
+    expect(writeProvisionedWranglerConfig(tmpDir, patch).modified).toBe(true);
+    const afterFirst = readRaw('wrangler.jsonc');
+    expect(afterFirst).toContain('// Void manages this file');
+    expect((afterFirst.match(/"binding": "QUEUE_JOBS"/g) ?? []).length).toBe(1);
 
     const q = parseRaw('wrangler.jsonc').queues as {
       producers: Array<Record<string, unknown>>;
       consumers: Array<Record<string, unknown>>;
     };
-    expect(q.producers).toHaveLength(1);
-    expect(q.producers[0]).toEqual({ queue: 'jobs', binding: 'QUEUE_JOBS' });
-    expect(q.consumers).toHaveLength(1);
-    expect(q.consumers[0]).toEqual({ queue: 'jobs', max_batch_size: 10 });
-  });
-
-  it('queue upsert is idempotent — re-running yields exactly one producer + one consumer, byte-identical', () => {
-    setup('wrangler.jsonc', commentedFixture);
-    const patch = {
-      queues: {
-        producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }],
-        consumers: [{ queue: 'jobs', max_batch_timeout: 5 }],
-      },
-    };
-
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-    const afterFirst = readRaw('wrangler.jsonc');
+    expect(q.producers).toEqual([{ queue: 'jobs', binding: 'QUEUE_JOBS' }]);
+    expect(q.consumers).toEqual([{ queue: 'jobs', max_batch_size: 10 }]);
 
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
+    expect(writeProvisionedWranglerConfig(tmpDir, patch).modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-
-    const q = parseRaw('wrangler.jsonc').queues as {
-      producers: Array<unknown>;
-      consumers: Array<unknown>;
-    };
-    expect(q.producers).toHaveLength(1);
-    expect(q.consumers).toHaveLength(1);
-    // No duplicated producer binding in the emitted text.
-    expect((afterFirst.match(/"binding": "QUEUE_JOBS"/g) ?? []).length).toBe(1);
   });
 
   it('appends a new queue producer/consumer without duplicating existing ones, leaving them untouched', () => {
@@ -1366,8 +1102,8 @@ describe('writeProvisionedWranglerConfig', () => {
     const result = writeProvisionedWranglerConfig(tmpDir, {
       queues: {
         producers: [
-          { queue: 'jobs', binding: 'QUEUE_JOBS' }, // already present — must not duplicate
-          { queue: 'emails', binding: 'QUEUE_EMAILS' }, // new — appended
+          { queue: 'jobs', binding: 'QUEUE_JOBS' },
+          { queue: 'emails', binding: 'QUEUE_EMAILS' },
         ],
         consumers: [{ queue: 'emails', max_retries: 3 }],
       },
@@ -1386,12 +1122,9 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(q.consumers.map((c) => c.queue).sort()).toEqual(['emails', 'jobs']);
   });
 
-  it('updating a matching queue entry preserves user fields + inline comments (no whole-object clobber), and is idempotent', () => {
-    // A matching-but-differing entry must be patched property-by-property, NOT
-    // replaced wholesale: replacing the array element with the narrow inferred
-    // patch would drop the user's tuned fields (producer `delivery_delay`;
-    // consumer `dead_letter_queue`, `max_concurrency`) AND their comments,
-    // silently changing production delivery/retry/concurrency/failure-routing.
+  it('patches a matching queue entry field by field, keeping user fields and comments, and is idempotent', () => {
+    // Replacing the whole entry would drop user-tuned fields such as
+    // delivery_delay and dead_letter_queue, and their comments.
     setup(
       'wrangler.jsonc',
       `{
@@ -1415,11 +1148,7 @@ describe('writeProvisionedWranglerConfig', () => {
 
     const patch = {
       queues: {
-        // Matches by binding; differs only because the fixture carries an extra
-        // `delivery_delay` the patch omits. This is exactly the clobber case.
         producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }],
-        // Matches by queue; changes max_batch_size 10 -> 25 and adds max_retries,
-        // while dead_letter_queue + max_concurrency must be preserved.
         consumers: [{ queue: 'jobs', max_batch_size: 25, max_retries: 5 }],
       },
     };
@@ -1428,7 +1157,6 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(first.modified).toBe(true);
 
     const raw = readRaw('wrangler.jsonc');
-    // All comments — file-level, producer-level, and the inline one — survive.
     expect(raw).toContain('// Void manages this file');
     expect(raw).toContain('// job producer — delivery_delay is user-tuned');
     expect(raw).toContain('// route failures here — must survive');
@@ -1438,10 +1166,8 @@ describe('writeProvisionedWranglerConfig', () => {
       consumers: Array<Record<string, unknown>>;
     };
     expect(q.producers).toHaveLength(1);
-    // Producer: user's delivery_delay preserved; queue/binding untouched.
     expect(q.producers[0]).toEqual({ queue: 'jobs', binding: 'QUEUE_JOBS', delivery_delay: 60 });
     expect(q.consumers).toHaveLength(1);
-    // Consumer: supplied fields applied; user's DLQ + concurrency preserved.
     expect(q.consumers[0]).toEqual({
       queue: 'jobs',
       max_batch_size: 25,
@@ -1450,20 +1176,14 @@ describe('writeProvisionedWranglerConfig', () => {
       max_concurrency: 3,
     });
 
-    // Idempotent — a second run writes nothing and is byte-identical.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, patch);
     expect(second.modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('producer upsert keys on binding — a matching QUEUE_JOBS beside a user CUSTOM producer on the same queue is a no-op (no duplicate binding)', () => {
-    // Producers are keyed by their UNIQUE `binding`, not the queue: wrangler
-    // allows multiple producers per queue but rejects duplicate binding names.
-    // Given a legal `{jobs,CUSTOM}` + `{jobs,QUEUE_JOBS}` pair, desiring
-    // `{jobs,QUEUE_JOBS}` must leave both untouched. A by-queue upsert would
-    // rewrite the FIRST match (CUSTOM → QUEUE_JOBS), minting two identical
-    // QUEUE_JOBS bindings that wrangler rejects.
+  it('matches producers by binding, so QUEUE_JOBS beside a user producer on the same queue is a no-op', () => {
+    // Wrangler allows several producers per queue but rejects duplicate binding names.
     setup(
       'wrangler.jsonc',
       `{
@@ -1481,7 +1201,6 @@ describe('writeProvisionedWranglerConfig', () => {
       queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
     });
 
-    // Already present under its binding — nothing to do, byte-identical.
     expect(result.modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(before);
 
@@ -1490,15 +1209,10 @@ describe('writeProvisionedWranglerConfig', () => {
       { queue: 'jobs', binding: 'CUSTOM' },
       { queue: 'jobs', binding: 'QUEUE_JOBS' },
     ]);
-    // Exactly one QUEUE_JOBS binding — no duplicate minted.
     expect((before.match(/"QUEUE_JOBS"/g) ?? []).length).toBe(1);
   });
 
-  it('producer upsert appends QUEUE_JOBS beside a user CUSTOM producer on the same queue — never hijacks the user producer', () => {
-    // A user renamed their producer binding to CUSTOM on queue "jobs". Void's
-    // deterministic QUEUE_JOBS binding is absent, so it is APPENDED as its own
-    // producer; the user's CUSTOM producer (and its tuned delivery_delay) is left
-    // exactly as-is. Void must not rewrite a binding it does not own.
+  it('appends QUEUE_JOBS beside a user producer on the same queue without changing it', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -1524,19 +1238,17 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(raw).toContain("// user's own producer — must be left untouched");
 
     const q = parseRaw('wrangler.jsonc').queues as { producers: Array<Record<string, unknown>> };
-    // Two producers now: the user's CUSTOM (untouched) + Void's appended QUEUE_JOBS.
     expect(q.producers).toHaveLength(2);
     expect(q.producers[0]).toEqual({ queue: 'jobs', binding: 'CUSTOM', delivery_delay: 60 });
     expect(q.producers[1]).toEqual({ queue: 'jobs', binding: 'QUEUE_JOBS' });
 
-    // Idempotent — a second run writes nothing and is byte-identical.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, patch);
     expect(second.modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('fails closed when the desired producer binding is already bound to a DIFFERENT queue — throws without writing', () => {
+  it('fails closed when the producer binding is already bound to a different queue — throws without writing', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -1546,380 +1258,137 @@ describe('writeProvisionedWranglerConfig', () => {
 }`,
     );
     const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/already bound to queue "other"/);
-
-    // Fail closed — the file is untouched.
+    expect(appendProducer).toThrow(/already bound to queue "other"/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('fails closed when the desired producer binding collides with a D1 binding name (worker-wide uniqueness) — throws without writing', () => {
-    // wrangler requires every binding NAME to be unique across the ENTIRE worker,
-    // not just within queues.producers. QUEUE_JOBS is already a D1 binding, so
-    // appending a producer with that binding would emit a cross-type duplicate
-    // wrangler 4.x rejects at deploy. Fail closed instead.
+  // Wrangler requires every binding name to be unique across the whole Worker.
+  it.each([
+    {
+      owner: 'a D1 binding',
+      config: {
+        d1_databases: [{ binding: 'QUEUE_JOBS', database_name: 'app', database_id: 'id' }],
+      },
+      error: /"QUEUE_JOBS" is already used by a D1 Database binding/,
+    },
+    {
+      owner: 'a var',
+      config: { vars: { QUEUE_JOBS: 'some-value' } },
+      error: /"QUEUE_JOBS" is already used by an? Environment Variable binding/,
+    },
+    {
+      owner: 'a secrets.required name',
+      config: { secrets: { required: ['QUEUE_JOBS'] } },
+      error: /"QUEUE_JOBS" is already used by a Secret binding/,
+    },
+    {
+      owner: 'a send_email name',
+      config: { send_email: [{ name: 'QUEUE_JOBS', destination_address: 'ops@example.com' }] },
+      error: /"QUEUE_JOBS" is already used by a Send Email binding/,
+    },
+  ])(
+    'fails closed when the producer binding collides with $owner — throws without writing',
+    ({ config, error }) => {
+      setup('wrangler.jsonc', JSON.stringify(config, null, 2));
+      const before = readRaw('wrangler.jsonc');
+      expect(appendProducer).toThrow(error);
+      expect(readRaw('wrangler.jsonc')).toBe(before);
+    },
+  );
+
+  it('does not treat the worker name, a D1 database_name or a consumer queue as binding names', () => {
     setup(
       'wrangler.jsonc',
       `{
-  "d1_databases": [{ "binding": "QUEUE_JOBS", "database_name": "app", "database_id": "id" }]
+  "name": "QUEUE_JOBS",
+  "d1_databases": [{ "binding": "DB", "database_name": "QUEUE_JOBS", "database_id": "id" }],
+  "queues": {
+    "consumers": [{ "queue": "QUEUE_JOBS", "max_batch_size": 10 }]
+  }
 }`,
     );
-    const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"QUEUE_JOBS" is already used by a D1 Database binding/);
 
-    // Fail closed — the file is byte-unchanged.
-    expect(readRaw('wrangler.jsonc')).toBe(before);
+    expect(appendProducer().modified).toBe(true);
+    const q = parseRaw('wrangler.jsonc').queues as {
+      producers: Array<Record<string, unknown>>;
+      consumers: Array<Record<string, unknown>>;
+    };
+    expect(q.producers).toEqual([{ queue: 'jobs', binding: 'QUEUE_JOBS' }]);
+    expect(q.consumers).toEqual([{ queue: 'QUEUE_JOBS', max_batch_size: 10 }]);
   });
 
-  it('fails closed when the desired producer binding collides with a KV binding name — throws without writing', () => {
+  it('fails closed on an array-shaped queues field when adopting a D1 binding — throws without writing', () => {
+    // Wrangler requires `queues` to be an object; reading the array would hide the DB producer.
     setup(
       'wrangler.jsonc',
       `{
-  "kv_namespaces": [{ "binding": "QUEUE_JOBS", "id": "abc" }]
+  "queues": [{ "binding": "DB", "queue": "jobs" }],
+  "d1_databases": []
 }`,
     );
     const before = readRaw('wrangler.jsonc');
 
     expect(() =>
       writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
+        d1: { binding: 'DB', databaseName: 'app', databaseId: 'db-id' },
       }),
-    ).toThrow(/"QUEUE_JOBS" is already used by a KV Namespace binding/);
-
+    ).toThrow(/"queues" must be an object/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('fails closed when the desired producer binding collides with a var name — throws without writing', () => {
+  it('fails closed on an array-shaped secrets field when adding a producer — throws without writing', () => {
     setup(
       'wrangler.jsonc',
       `{
-  "vars": { "QUEUE_JOBS": "some-value" }
+  "secrets": ["QUEUE_JOBS"]
 }`,
     );
     const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"QUEUE_JOBS" is already used by an? Environment Variable binding/);
-
+    expect(appendProducer).toThrow(/"secrets" must be an object/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('fails closed when the desired producer binding collides with a secrets.required name — throws without writing', () => {
-    // wrangler folds `secrets.required` into its worker-wide uniqueness set under
-    // the label "Secret" (validateBindingsHaveUniqueNames). QUEUE_JOBS is declared
-    // there, so appending a producer with that binding would emit a cross-type
-    // duplicate wrangler rejects at deploy. Fail closed instead.
+  it('fails closed on an array-shaped queues field when adding a producer — throws without writing', () => {
     setup(
       'wrangler.jsonc',
       `{
-  "secrets": { "required": ["QUEUE_JOBS"] }
+  "queues": [{ "binding": "DB", "queue": "jobs" }]
 }`,
     );
     const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"QUEUE_JOBS" is already used by a Secret binding/);
-
-    // Fail closed — the file is byte-unchanged.
+    expect(appendProducer).toThrow(/"queues" must be an object/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('fails closed when the desired producer binding collides with an unsafe_hello_world binding — throws without writing', () => {
-    // `unsafe_hello_world` is a `[{ binding }]` array in wrangler's
-    // friendlyBindingNames set. QUEUE_JOBS is already such a binding, so the
-    // append would make the config undeployable — fail closed.
+  it('fails closed on an explicit different migrations_dir — names both paths, throws without writing', () => {
+    // Rewriting a user's migrations_dir would strand their migration files.
     setup(
       'wrangler.jsonc',
       `{
-  "unsafe_hello_world": [{ "binding": "QUEUE_JOBS", "enable_timer": false }]
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "app",
+      "database_id": "id",
+      "migrations_dir": "drizzle",
+      "migrations_pattern": "drizzle/*/migration.sql"
+    }
+  ]
 }`,
     );
     const before = readRaw('wrangler.jsonc');
 
     expect(() =>
       writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
+        d1MigrationsDir: { binding: 'DB', dir: './db/migrations' },
       }),
-    ).toThrow(/"QUEUE_JOBS" is already used by a Hello World binding/);
-
+    ).toThrow(
+      /already sets "migrations_dir": "drizzle".*"\.\/db\/migrations".*Refusing to overwrite an explicit different migrations directory/s,
+    );
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('fails closed when the desired producer binding collides with a ratelimits[].name — throws without writing', () => {
-    // ratelimit bindings key their NAME on `.name`, not `.binding`, so wrangler's
-    // own getBindingNames overlooks them — but validateRateLimitBinding requires
-    // `.name`, making it the binding name enforced at deploy. Collect it as a safe
-    // superset and fail closed on the collision.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "ratelimits": [{ "name": "QUEUE_JOBS", "namespace_id": "1", "simple": { "limit": 100, "period": 60 } }]
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"QUEUE_JOBS" is already used by a Rate Limit binding/);
-
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('fails closed when the desired producer binding collides with a send_email[].name — throws without writing', () => {
-    // send_email is the other `.name`-keyed binding array (like ratelimits). A
-    // producer binding must never silently collide with a send_email binding.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "send_email": [{ "name": "QUEUE_JOBS", "destination_address": "ops@example.com" }]
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"QUEUE_JOBS" is already used by a Send Email binding/);
-
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('negative control: top-level name, d1 database_name, and consumer queue equal to the producer binding are NOT binding names — append succeeds', () => {
-    // None of these fields is a binding NAME: the worker `name`, a D1
-    // `database_name`, and a queues.consumers[].queue can all legally equal
-    // QUEUE_JOBS without colliding with the QUEUE_JOBS producer binding. The guard
-    // must only inspect the binding-bearing fields wrangler enumerates, so this
-    // append proceeds.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "name": "QUEUE_JOBS",
-  "d1_databases": [{ "binding": "DB", "database_name": "QUEUE_JOBS", "database_id": "id" }],
-  "queues": {
-    "consumers": [{ "queue": "QUEUE_JOBS", "max_batch_size": 10 }]
-  }
-}`,
-    );
-
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-    expect(result.modified).toBe(true);
-
-    const q = parseRaw('wrangler.jsonc').queues as {
-      producers: Array<Record<string, unknown>>;
-      consumers: Array<Record<string, unknown>>;
-    };
-    // The producer was appended; the consumer keyed on the same queue string is
-    // untouched (not a binding-name collision).
-    expect(q.producers).toEqual([{ queue: 'jobs', binding: 'QUEUE_JOBS' }]);
-    expect(q.consumers).toEqual([{ queue: 'QUEUE_JOBS', max_batch_size: 10 }]);
-  });
-
-  it('negative control: a producer binding that collides with nothing appends normally', () => {
-    // A DB binding named DB does NOT collide with the QUEUE_JOBS producer binding,
-    // so the append proceeds — the worker-wide guard is precise, not paranoid.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "d1_databases": [{ "binding": "DB", "database_name": "app", "database_id": "id" }],
-  "kv_namespaces": [{ "binding": "KV", "id": "abc" }]
-}`,
-    );
-
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-    expect(result.modified).toBe(true);
-
-    const q = parseRaw('wrangler.jsonc').queues as { producers: Array<Record<string, unknown>> };
-    expect(q.producers).toEqual([{ queue: 'jobs', binding: 'QUEUE_JOBS' }]);
-  });
-
-  it('worker-wide guard does not fire on the idempotent same-queue producer path (no false collision)', () => {
-    // QUEUE_JOBS already exists as a producer for the SAME queue. The worker-wide
-    // collision guard now runs for EVERY producer upsert, but the collector
-    // deliberately OMITS `queues`, so a producer never self-collides — with no OTHER
-    // binding owning QUEUE_JOBS the upsert stays an idempotent no-op.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "queues": {
-    "producers": [{ "queue": "jobs", "binding": "QUEUE_JOBS" }]
-  }
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-    expect(result.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('fails closed when an ARRAY-shaped `queues` (present) would hide a producer/D1 binding collision on adopt — throws without writing', () => {
-    // wrangler 4.131 REQUIRES `queues` to be an OBJECT `{ producers, consumers }`.
-    // A PRESENT array-shaped `queues` makes the old `isRecord(queues)` guard in
-    // `addQueueProducerOwners` return early, so a producer-like `{ binding: "DB" }`
-    // is NOT collected — and a D1 adopt of binding `DB` would then slip through the
-    // cross-type uniqueness check. The shared `assertObjectContainer` validator now
-    // fails closed on the malformed outer shape instead of hiding the collision.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "queues": [{ "binding": "DB", "queue": "jobs" }],
-  "d1_databases": []
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        d1: { binding: 'DB', databaseName: 'app', databaseId: 'db-id' },
-      }),
-    ).toThrow(/"queues" must be an object/);
-
-    // Fail closed — the file is byte-unchanged (collision NOT hidden).
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('fails closed when a WRONG-SHAPE `secrets` (present, non-object) would hide a secret binding collision on producer upsert — throws without writing', () => {
-    // wrangler requires `secrets` to be an OBJECT `{ required: string[] }`. A
-    // present-but-array `secrets` was silently skipped by the old `isRecord(secrets)`
-    // guard in `collectWorkerBindingNames`, so a producer could collide with a real
-    // secret binding name unnoticed. `assertObjectContainer` now fails closed.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "secrets": ["QUEUE_JOBS"]
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"secrets" must be an object/);
-
-    // Fail closed — the file is byte-unchanged.
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('fails closed when an ARRAY-shaped `queues` (present) is seen on the producer UPSERT path — throws without writing (no bypass)', () => {
-    // The producer-upsert path (`upsertQueueEntries`) is ALSO routed through
-    // `assertObjectContainer`, so an array-shaped `queues` throws there too — proving
-    // no path can bypass the outer-shape validator.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "queues": [{ "binding": "DB", "queue": "jobs" }]
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"queues" must be an object/);
-
-    // Fail closed — the file is byte-unchanged.
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('ABSENT `queues` and `secrets` containers are a NO-OP — a D1 adopt with neither present succeeds normally', () => {
-    // Regression guard: `assertObjectContainer(undefined, …)` returns undefined (a
-    // no-op, NOT an error). A config with NO `queues` and NO `secrets` adopts a D1
-    // binding normally.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "d1_databases": [{ "binding": "DB", "database_name": "app", "database_id": "" }]
-}`,
-    );
-
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      d1: { binding: 'DB', databaseName: 'app', databaseId: 'real-id' },
-    });
-    expect(result.modified).toBe(true);
-
-    const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
-    expect(d1[0]).toMatchObject({ binding: 'DB', database_id: 'real-id' });
-  });
-
-  it('fails closed on an explicit DIFFERENT migrations_dir — names both paths, throws without writing', () => {
-    // A reused D1 configured with its own
-    // migrations directory must NEVER be silently rewritten to Void's default —
-    // that would strand the user's migration files. Fail closed, naming both.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "d1_databases": [
-    {
-      "binding": "DB",
-      "database_name": "app",
-      "database_id": "id",
-      "migrations_dir": "drizzle",
-      "migrations_pattern": "drizzle/*/migration.sql"
-    }
-  ]
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        d1MigrationsDir: { binding: 'DB', dir: './db/migrations' },
-      }),
-    ).toThrow(
-      /already sets "migrations_dir": "drizzle".*"\.\/db\/migrations".*Refusing to overwrite an explicit different migrations directory/s,
-    );
-
-    // Fail closed — the file is byte-unchanged (dir + pattern untouched).
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('an explicit legacy migrations_dir on a reused D1 is never overwritten', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  "d1_databases": [
-    { "binding": "DB", "database_name": "app", "database_id": "id", "migrations_dir": "./legacy-migrations" }
-  ]
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        d1MigrationsDir: { binding: 'DB', dir: './db/migrations' },
-      }),
-    ).toThrow(/"\.\/legacy-migrations".*"\.\/db\/migrations"/s);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('normalized-EQUIVALENT migrations_dir spellings are kept untouched (byte-identical file)', () => {
-    // `db/migrations` vs `./db/migrations` vs `db/migrations/` all normalize equal
-    // (wrangler's normalizeRelativePath rule) — the user's spelling survives.
+  it('keeps an equivalent migrations_dir spelling as written', () => {
     for (const existing of ['db/migrations', './db/migrations', 'db/migrations/']) {
       setup(
         'wrangler.jsonc',
@@ -1939,9 +1408,8 @@ describe('writeProvisionedWranglerConfig', () => {
     }
   });
 
-  it('fill-if-absent still validates a companion migrations_pattern — throws without writing', () => {
-    // The entry has a pattern but NO migrations_dir; filling Void's default dir would
-    // invalidate the pattern (wrangler requires it to start with `${migrations_dir}/`).
+  it('refuses to fill migrations_dir when migrations_pattern is outside it — throws without writing', () => {
+    // Wrangler requires migrations_pattern to start with `<migrations_dir>/`.
     setup(
       'wrangler.jsonc',
       `{
@@ -1964,11 +1432,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('a DEFINED non-string migrations_pattern fails closed BEFORE any fill/keep branch — byte-identical file', () => {
-    // Pre-fix the pattern compatibility check ran only for `typeof === "string"`, so an
-    // object/array/number/null pattern was silently IGNORED, migrations_dir was
-    // committed, provisioning reported success — and wrangler's own d1 migrations
-    // commands later rejected the config we just accepted.
+  it('rejects a non-string migrations_pattern with or without migrations_dir — throws without writing', () => {
     const badPatterns: Array<[label: string, json: string]> = [
       ['object', '{ "glob": "*.sql" }'],
       ['array', '["*.sql"]'],
@@ -1976,7 +1440,6 @@ describe('writeProvisionedWranglerConfig', () => {
       ['null', 'null'],
     ];
     for (const [label, json] of badPatterns) {
-      // Once WITHOUT migrations_dir (the fill branch)...
       setup(
         'wrangler.jsonc',
         `{
@@ -2000,8 +1463,6 @@ describe('writeProvisionedWranglerConfig', () => {
       ).toThrow(/non-string "migrations_pattern"/);
       expect(readRaw('wrangler.jsonc'), `pattern kind: ${label} (fill branch)`).toBe(before);
 
-      // ...and once WITH an equivalent migrations_dir (the keep-equivalent branch):
-      // the non-string pattern must be rejected before EVERY branch, not only fill.
       setup(
         'wrangler.jsonc',
         `{
@@ -2030,61 +1491,8 @@ describe('writeProvisionedWranglerConfig', () => {
     }
   });
 
-  it('migrations_dir upsert proceeds when there is no migrations_pattern (unchanged behavior, idempotent)', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  "d1_databases": [
-    { "binding": "DB", "database_name": "app", "database_id": "id" }
-  ]
-}`,
-    );
-
-    const patch = { d1MigrationsDir: { binding: 'DB', dir: 'drizzle' } };
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-    const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
-    expect(d1[0]).toMatchObject({ binding: 'DB', migrations_dir: 'drizzle' });
-
-    // Idempotent — a second run writes nothing and is byte-identical.
-    const afterFirst = readRaw('wrangler.jsonc');
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-  });
-
-  it('migrations_dir upsert is a no-op when a compatible migrations_pattern already matches the requested dir', () => {
-    // The existing pattern is under the requested dir, so setting the (already
-    // equal) migrations_dir is a byte-idempotent no-op that leaves the pattern
-    // untouched.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "d1_databases": [
-    {
-      "binding": "DB",
-      "database_name": "app",
-      "database_id": "id",
-      "migrations_dir": "db/migrations",
-      "migrations_pattern": "db/migrations/0001_init.sql"
-    }
-  ]
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
-    });
-    expect(result.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('inserting migrations_dir keeps a trailing inline comment on the property it documented (no reassociation)', () => {
-    // The D1 entry's LAST property carries a trailing inline comment. Naively
-    // inserting migrations_dir via a formatting modify() reflows the region and
-    // re-emits the comment at the end — silently moving `// production database`
-    // onto migrations_dir. The comment must stay with database_id.
+  it('keeps a trailing comment on its property when inserting migrations_dir', () => {
+    // A plain modify() reflows the region and moves the comment onto the new member.
     setup(
       'wrangler.jsonc',
       `{
@@ -2105,14 +1513,12 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(result.d1MigrationsDirSkipped).toBe(false);
 
     const raw = readRaw('wrangler.jsonc');
-    // Comment stays attached to database_id (comma before it), NOT migrations_dir.
     expect(raw).toContain('"database_id": "prod-id", // production database');
     expect(raw).not.toMatch(/migrations_dir[^\n]*production database/);
 
     const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
     expect(d1[0]).toMatchObject({ binding: 'DB', migrations_dir: 'db/migrations' });
 
-    // Idempotent — a second run writes nothing and is byte-identical.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, {
       d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
@@ -2121,10 +1527,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('appending a queue entry keeps a trailing inline comment on the entry it documented (no reassociation)', () => {
-    // The producers array's LAST entry carries a trailing inline comment.
-    // Appending a new entry must not reflow `// jobs producer` onto the appended
-    // emails entry — it must stay with the jobs entry.
+  it('keeps a trailing comment on its entry when appending a queue producer', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -2142,8 +1545,6 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(result.modified).toBe(true);
 
     const raw = readRaw('wrangler.jsonc');
-    // The comment stays with the jobs entry (before the appended emails entry),
-    // never reassociated onto QUEUE_EMAILS.
     expect(raw).toContain('}, // jobs producer');
     expect(raw.indexOf('// jobs producer')).toBeGreaterThan(raw.indexOf('QUEUE_JOBS'));
     expect(raw.indexOf('// jobs producer')).toBeLessThan(raw.indexOf('QUEUE_EMAILS'));
@@ -2155,7 +1556,6 @@ describe('writeProvisionedWranglerConfig', () => {
       { queue: 'emails', binding: 'QUEUE_EMAILS' },
     ]);
 
-    // Idempotent — a second run writes nothing and is byte-identical.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, {
       queues: { producers: [{ queue: 'emails', binding: 'QUEUE_EMAILS' }] },
@@ -2164,11 +1564,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('inserting migrations_dir keeps a trailing comment that sits AFTER a separator comma on its property', () => {
-    // The last property carries a JSONC trailing comma BEFORE its inline comment
-    // (`"database_id": "prod-id", // …`). A naive scan sees the comma first and
-    // gives up, letting the plain formatting edit reassociate the comment onto
-    // the inserted migrations_dir. The comment must stay with database_id.
+  it('keeps a trailing comment after a separator comma on its property when inserting migrations_dir', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -2189,14 +1585,12 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(result.d1MigrationsDirSkipped).toBe(false);
 
     const raw = readRaw('wrangler.jsonc');
-    // Comment stays attached to database_id, NOT migrations_dir.
     expect(raw).toContain('"database_id": "prod-id", // production database');
     expect(raw).not.toMatch(/migrations_dir[^\n]*production database/);
 
     const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
     expect(d1[0]).toMatchObject({ binding: 'DB', migrations_dir: 'db/migrations' });
 
-    // Idempotent — a second run writes nothing and is byte-identical.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, {
       d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
@@ -2205,7 +1599,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('inserting migrations_dir keeps a single-line block comment that sits after a separator comma', () => {
+  it('keeps a single-line block comment after a separator comma when inserting migrations_dir', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -2228,7 +1622,6 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(raw).toContain('"database_id": "prod-id", /* production database */');
     expect(raw).not.toMatch(/migrations_dir[^\n]*production database/);
 
-    // Idempotent.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, {
       d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
@@ -2237,11 +1630,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('creating a missing queues.producers section keeps the trailing comment on the existing consumers entry', () => {
-    // Only `consumers` exists (with a trailing inline comment). Adding the
-    // `producers` section makes modify() append `producers` as a NEW member of
-    // the `queues` object, right after `consumers`. The `// jobs consumer`
-    // comment must stay on the consumers entry, not move onto producers.
+  it('keeps the consumers trailing comment when creating a missing queues.producers section', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -2259,7 +1648,6 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(result.modified).toBe(true);
 
     const raw = readRaw('wrangler.jsonc');
-    // Comment stays with consumers (its comma comes before it), never on producers.
     expect(raw).toContain('], // jobs consumer');
     expect(raw.indexOf('// jobs consumer')).toBeGreaterThan(raw.indexOf('"consumers"'));
     expect(raw.indexOf('// jobs consumer')).toBeLessThan(raw.indexOf('"producers"'));
@@ -2272,7 +1660,6 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(q.consumers).toEqual([{ queue: 'jobs', max_batch_size: 10 }]);
     expect(q.producers).toEqual([{ queue: 'emails', binding: 'QUEUE_EMAILS' }]);
 
-    // Idempotent — a second run writes nothing and is byte-identical.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, {
       queues: { producers: [{ queue: 'emails', binding: 'QUEUE_EMAILS' }] },
@@ -2281,7 +1668,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('creating a missing queues.producers section keeps a single-line block comment on the consumers entry', () => {
+  it('keeps a single-line block comment on consumers when creating a missing queues.producers section', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -2303,7 +1690,6 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(raw.indexOf('/* jobs consumer */')).toBeLessThan(raw.indexOf('"producers"'));
     expect(raw).not.toMatch(/"producers"[\s\S]*jobs consumer/);
 
-    // Idempotent.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, {
       queues: { producers: [{ queue: 'emails', binding: 'QUEUE_EMAILS' }] },
@@ -2312,13 +1698,9 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('KNOWN LIMITATION: jsonc-parser modify() reassociates a MULTI-LINE block comment used as a trailing comment; comment text is preserved, association is best-effort', () => {
-    // A block comment that spans multiple lines cannot be safely relocated onto
-    // a single line, so readTrailingComment declines it and the plain formatting
-    // edit runs. jsonc-parser then re-emits the comment at the end of the
-    // reflowed region — moving it onto the appended entry. We PIN this: the hard
-    // guarantee is that the comment TEXT survives; exact association is
-    // best-effort for this exotic placement and is not chased further.
+  it('keeps the text of a multi-line trailing block comment when appending a producer', () => {
+    // A multi-line block comment cannot move onto one line, so modify() may attach it
+    // to the appended entry. Only its text is guaranteed to survive.
     setup(
       'wrangler.jsonc',
       `{
@@ -2337,16 +1719,13 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(result.modified).toBe(true);
 
     const raw = readRaw('wrangler.jsonc');
-    // Hard guarantee: the comment text is never dropped.
     expect(raw).toContain('producer spanning lines');
-    // Both producers are present and parse cleanly.
     const q = parseRaw('wrangler.jsonc').queues as { producers: Array<Record<string, unknown>> };
     expect(q.producers).toEqual([
       { queue: 'jobs', binding: 'QUEUE_JOBS' },
       { queue: 'emails', binding: 'QUEUE_EMAILS' },
     ]);
 
-    // Still idempotent despite the best-effort association.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, {
       queues: { producers: [{ queue: 'emails', binding: 'QUEUE_EMAILS' }] },
@@ -2358,9 +1737,7 @@ describe('writeProvisionedWranglerConfig', () => {
   const CR = '\r';
 
   it('CR-only line endings: inserting migrations_dir stays valid, keeps the trailing comment, byte-identical on re-run', () => {
-    // Classic-Mac CR-only file. A `\n`-only comment scanner would swallow the CR
-    // + the closing brace, writing migrations_dir OUTSIDE the object (parse error)
-    // and making a second run throw. Stopping the scan at CR keeps it valid.
+    // A comment scan that stops only at `\n` would swallow the CR and the closing brace.
     const fixture =
       `{${CR}` +
       `  "d1_databases": [${CR}` +
@@ -2379,15 +1756,12 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(result.d1MigrationsDirSkipped).toBe(false);
 
     const raw = readRaw('wrangler.jsonc');
-    // Zero parse errors — the closing brace was NOT consumed by the comment scan.
     expect(parseErrors(raw)).toBe(0);
-    // Comment text preserved and still on database_id (not moved onto migrations_dir).
     expect(raw).toContain('// entrypoint');
     expect(raw).not.toMatch(/migrations_dir[^\r\n]*entrypoint/);
     const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
     expect(d1[0]).toMatchObject({ binding: 'DB', migrations_dir: 'db/migrations' });
 
-    // Byte-identical second run — previously the corrupted file made this THROW.
     const afterFirst = raw;
     const second = writeProvisionedWranglerConfig(tmpDir, {
       d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
@@ -2415,7 +1789,6 @@ describe('writeProvisionedWranglerConfig', () => {
     const raw = readRaw('wrangler.jsonc');
     expect(parseErrors(raw)).toBe(0);
     expect(raw).toContain('// jobs producer');
-    // Comment stays with the jobs entry, never reassociated onto the appended one.
     expect(raw).not.toMatch(/QUEUE_EMAILS[\s\S]*jobs producer/);
     const q = parseRaw('wrangler.jsonc').queues as { producers: Array<Record<string, unknown>> };
     expect(q.producers).toEqual([
@@ -2466,10 +1839,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('producer conflict is order-independent: a duplicate binding across producers fails closed in EITHER array order', () => {
-    // Both entries share binding QUEUE_JOBS (already undeployable). The desired
-    // {jobs,QUEUE_JOBS} must fail closed regardless of order — a first-match check
-    // would falsely report convergence when {jobs,...} happens to come first.
+  it('fails closed on a binding declared by two producers in either order', () => {
     const forward =
       `{\n` +
       `  "queues": {\n` +
@@ -2480,11 +1850,7 @@ describe('writeProvisionedWranglerConfig', () => {
       `  }\n` +
       `}`;
     setup('wrangler.jsonc', forward);
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/declared 2 times/);
+    expect(appendProducer).toThrow(/declared 2 times/);
     expect(readRaw('wrangler.jsonc')).toBe(forward);
 
     const reversed =
@@ -2497,11 +1863,7 @@ describe('writeProvisionedWranglerConfig', () => {
       `  }\n` +
       `}`;
     setup('wrangler.jsonc', reversed);
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/declared 2 times/);
+    expect(appendProducer).toThrow(/declared 2 times/);
     expect(readRaw('wrangler.jsonc')).toBe(reversed);
   });
 
@@ -2513,25 +1875,13 @@ describe('writeProvisionedWranglerConfig', () => {
       `  }\n` +
       `}`;
     setup('wrangler.jsonc', fixture);
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-    expect(result.modified).toBe(false);
+    expect(appendProducer().modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(fixture);
   });
 
-  // Global comment-text-preservation invariant (final gate before write). The
-  // writer's contract is that every comment's TEXT survives a write. A
-  // scalar-expected field holding a composite object/array value with a comment
-  // inside is a case jsonc-parser's modify() silently drops (it replaces the
-  // whole node yet reports modified:true). The final gate compares the comment
-  // token multiset of the original vs the final output and throws WITHOUT
-  // writing on any drop, rather than chasing each pathological path.
-
   it('fails closed when a composite account_id value drops an inner comment — throws without writing', () => {
-    // `account_id` is scalar-expected but holds an object with a comment inside.
-    // modify() replaces the whole node (deleting the comment) and reports
-    // success; the final gate must catch the dropped comment and refuse to write.
+    // modify() replaces a composite value whole, dropping comments inside it, and still
+    // reports success. The final comment check refuses that write.
     const fixture = `{
   "account_id": { "x": 1 /* keep this note */ },
   "name": "app"
@@ -2540,13 +1890,10 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(() => writeProvisionedWranglerConfig(tmpDir, { accountId: 'acc-999' })).toThrow(
       /"account_id" has an object\/array value; expected a string/,
     );
-    // Fail closed — the file is byte-for-byte untouched.
     expect(readRaw('wrangler.jsonc')).toBe(fixture);
   });
 
   it('fails closed on a composite (non-string) migrations_dir on the matched D1 entry — throws without writing', () => {
-    // The provisioner rejects the malformed value BEFORE any edit (previously the comment-drop
-    // gate caught it after the fact) — the file is never touched either way.
     const fixture = `{
   "d1_databases": [
     {
@@ -2583,135 +1930,71 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(fixture);
   });
 
-  it('does NOT fire on a normal comment-rich config — upsert succeeds, every comment survives, idempotent', () => {
-    // Negative control: the invariant must never fire for a valid edit. A config
-    // with several comments upserts cleanly, keeps ALL comments, and a second run
-    // is byte-identical (the gate does not perturb idempotence).
-    setup('wrangler.jsonc', commentedFixture);
-    const patch = {
-      accountId: 'acc-ok',
-      name: 'my-app',
-      compatibilityDate: '2026-02-24',
-      d1MigrationsDir: { binding: 'DB', dir: 'db/migrations' },
-      queues: {
-        producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }],
-        consumers: [{ queue: 'jobs', max_batch_size: 10 }],
-      },
-    };
-
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-
-    const raw = readRaw('wrangler.jsonc');
-    // Every original comment token is still present.
-    expect(raw).toContain('// Void manages this file');
-    expect(raw).toContain('/* App databases');
-
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(raw);
-  });
-
-  it('does NOT fire on a relocation — appending after a trailing-commented sibling keeps every comment', () => {
-    // Relocation MOVES a comment (same text, new position), so the comment-token
-    // multiset is unchanged and the invariant passes. Appending a queue producer
-    // after a sibling that carries a trailing inline comment must succeed.
-    setup(
-      'wrangler.jsonc',
-      `{
-  // file-level note
-  "queues": {
-    "producers": [
-      { "queue": "jobs", "binding": "QUEUE_JOBS" } // jobs producer
-    ]
-  }
-}`,
-    );
-
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'emails', binding: 'QUEUE_EMAILS' }] },
-    });
-    expect(result.modified).toBe(true);
-
-    const raw = readRaw('wrangler.jsonc');
-    // Both comments survive; the trailing one stays on the jobs entry.
-    expect(raw).toContain('// file-level note');
-    expect(raw).toContain('// jobs producer');
-    expect(raw).toContain('}, // jobs producer');
-
-    const q = parseRaw('wrangler.jsonc').queues as { producers: Array<Record<string, unknown>> };
-    expect(q.producers).toEqual([
-      { queue: 'jobs', binding: 'QUEUE_JOBS' },
-      { queue: 'emails', binding: 'QUEUE_EMAILS' },
-    ]);
-
-    // Idempotent.
-    const second = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'emails', binding: 'QUEUE_EMAILS' }] },
-    });
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(raw);
-  });
-
-  // Adopt fields — write the REAL id/name of an already-existing resource into
-  // the binding's entry (the CREATE path can't, since `wrangler <res> create
-  // --update-config` errors on a name collision). Upsert-existing + upsert-new +
-  // idempotent-rerun + comment-preserved, for each of d1/kv/r2/hyperdrive.
+  const adoptCases: Array<{
+    field: string;
+    placeholder: string;
+    patch: ProvisionedWranglerPatch;
+    adopted: Record<string, unknown>;
+  }> = [
+    {
+      field: 'd1_databases',
+      placeholder: '{ "binding": "DB", "database_name": "default", "database_id": "local" }',
+      patch: { d1: { binding: 'DB', databaseName: 'myapp-db', databaseId: 'real-uuid-123' } },
+      adopted: { binding: 'DB', database_name: 'myapp-db', database_id: 'real-uuid-123' },
+    },
+    {
+      field: 'kv_namespaces',
+      placeholder: '{ "binding": "ISR_CACHE", "id": "local" }',
+      patch: { kv: { binding: 'ISR_CACHE', id: 'realkvid456' } },
+      adopted: { binding: 'ISR_CACHE', id: 'realkvid456' },
+    },
+    {
+      field: 'r2_buckets',
+      placeholder: '{ "binding": "STORAGE", "bucket_name": "default" }',
+      patch: { r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } },
+      adopted: { binding: 'STORAGE', bucket_name: 'myapp-uploads' },
+    },
+    {
+      field: 'hyperdrive',
+      placeholder: '{ "binding": "HYPERDRIVE", "id": "local" }',
+      patch: { hyperdrive: { binding: 'HYPERDRIVE', id: 'realhyperid789' } },
+      adopted: { binding: 'HYPERDRIVE', id: 'realhyperid789' },
+    },
+  ];
 
-  it('d1 adopt: overwrites a placeholder database_id/database_name in place, keeps comments, idempotent', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  // Void manages this file — comments must survive adoption.
-  "d1_databases": [
-    { "binding": "DB", "database_name": "default", "database_id": "local" }
+  it.each(adoptCases)(
+    'adopt into $field overwrites a placeholder in place, keeps comments, and is idempotent',
+    ({ field, placeholder, patch, adopted }) => {
+      setup(
+        'wrangler.jsonc',
+        `{
+  // comment must survive
+  "${field}": [
+    ${placeholder}
   ]
 }`,
-    );
-
-    const patch = {
-      d1: { binding: 'DB', databaseName: 'myapp-db', databaseId: 'real-uuid-123' },
-    };
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-
-    const raw = readRaw('wrangler.jsonc');
-    expect(raw).toContain('// Void manages this file');
-
-    const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
-    // No duplicate entry — the placeholder was updated in place.
-    expect(d1).toHaveLength(1);
-    expect(d1[0]).toEqual({
-      binding: 'DB',
-      database_name: 'myapp-db',
-      database_id: 'real-uuid-123',
-    });
-
-    // Idempotent — a second run is byte-identical.
-    const afterFirst = raw;
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-  });
+      );
+      expect(writeProvisionedWranglerConfig(tmpDir, patch).modified).toBe(true);
+      const afterFirst = readRaw('wrangler.jsonc');
+      expect(afterFirst).toContain('// comment must survive');
+      expect(parseRaw('wrangler.jsonc')[field]).toEqual([adopted]);
 
-  it('d1 adopt: creates the d1_databases entry when the binding is absent', () => {
-    setup('wrangler.jsonc', '{ "name": "app" }');
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      d1: { binding: 'DB', databaseName: 'myapp-db', databaseId: 'real-uuid-123' },
-    });
-    expect(result.modified).toBe(true);
-    const d1 = parseRaw('wrangler.jsonc').d1_databases as Array<Record<string, unknown>>;
-    expect(d1).toHaveLength(1);
-    expect(d1[0]).toEqual({
-      binding: 'DB',
-      database_name: 'myapp-db',
-      database_id: 'real-uuid-123',
-    });
-  });
+      expect(writeProvisionedWranglerConfig(tmpDir, patch).modified).toBe(false);
+      expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
+    },
+  );
+
+  it.each(adoptCases)(
+    'adopt into $field creates the entry when the binding is absent',
+    ({ field, patch, adopted }) => {
+      setup('wrangler.jsonc', '{ "name": "app" }');
+      expect(writeProvisionedWranglerConfig(tmpDir, patch).modified).toBe(true);
+      expect(parseRaw('wrangler.jsonc')[field]).toEqual([adopted]);
+    },
+  );
 
-  it('d1 adopt composes with d1MigrationsDir on the same binding (the real adopt path)', () => {
-    // The adopt path passes both: capture the real id AND set migrations_dir. Even
-    // when the D1 entry is absent, adopt creates it and migrations_dir lands on it.
+  it('d1 adopt composes with d1MigrationsDir on the same binding', () => {
+    // Adopt runs first, so migrations_dir lands on the D1 entry adopt just created.
     setup('wrangler.jsonc', '{ "name": "app" }');
     const patch = {
       d1: { binding: 'DB', databaseName: 'myapp-db', databaseId: 'real-uuid-123' },
@@ -2730,123 +2013,13 @@ describe('writeProvisionedWranglerConfig', () => {
       migrations_dir: './db/migrations',
     });
 
-    // Idempotent.
-    const afterFirst = readRaw('wrangler.jsonc');
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-  });
-
-  it('kv adopt: overwrites a placeholder id in place, keeps comments, idempotent', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  // comment must survive
-  "kv_namespaces": [
-    { "binding": "ISR_CACHE", "id": "local" }
-  ]
-}`,
-    );
-    const patch = { kv: { binding: 'ISR_CACHE', id: 'realkvid456' } };
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-    expect(readRaw('wrangler.jsonc')).toContain('// comment must survive');
-
-    const kv = parseRaw('wrangler.jsonc').kv_namespaces as Array<Record<string, unknown>>;
-    expect(kv).toHaveLength(1);
-    expect(kv[0]).toEqual({ binding: 'ISR_CACHE', id: 'realkvid456' });
-
-    const afterFirst = readRaw('wrangler.jsonc');
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-  });
-
-  it('kv adopt: creates the kv_namespaces entry when the binding is absent', () => {
-    setup('wrangler.jsonc', '{ "name": "app" }');
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      kv: { binding: 'KV', id: 'realkvid456' },
-    });
-    expect(result.modified).toBe(true);
-    const kv = parseRaw('wrangler.jsonc').kv_namespaces as Array<Record<string, unknown>>;
-    expect(kv).toEqual([{ binding: 'KV', id: 'realkvid456' }]);
-  });
-
-  it('r2 adopt: overwrites a placeholder bucket_name in place, keeps comments, idempotent', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  // comment must survive
-  "r2_buckets": [
-    { "binding": "STORAGE", "bucket_name": "default" }
-  ]
-}`,
-    );
-    const patch = { r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' } };
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-    expect(readRaw('wrangler.jsonc')).toContain('// comment must survive');
-
-    const r2 = parseRaw('wrangler.jsonc').r2_buckets as Array<Record<string, unknown>>;
-    expect(r2).toEqual([{ binding: 'STORAGE', bucket_name: 'myapp-uploads' }]);
-
-    const afterFirst = readRaw('wrangler.jsonc');
-    const second = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(second.modified).toBe(false);
-    expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
-  });
-
-  it('r2 adopt: creates the r2_buckets entry when the binding is absent', () => {
-    setup('wrangler.jsonc', '{ "name": "app" }');
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      r2: { binding: 'STORAGE', bucketName: 'myapp-uploads' },
-    });
-    expect(result.modified).toBe(true);
-    const r2 = parseRaw('wrangler.jsonc').r2_buckets as Array<Record<string, unknown>>;
-    expect(r2).toEqual([{ binding: 'STORAGE', bucket_name: 'myapp-uploads' }]);
-  });
-
-  it('hyperdrive adopt: overwrites the id in place, keeps comments, idempotent', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  // comment must survive
-  "hyperdrive": [
-    { "binding": "HYPERDRIVE", "id": "local" }
-  ]
-}`,
-    );
-    const patch = { hyperdrive: { binding: 'HYPERDRIVE', id: 'realhyperid789' } };
-    const first = writeProvisionedWranglerConfig(tmpDir, patch);
-    expect(first.modified).toBe(true);
-    expect(readRaw('wrangler.jsonc')).toContain('// comment must survive');
-
-    const hd = parseRaw('wrangler.jsonc').hyperdrive as Array<Record<string, unknown>>;
-    expect(hd).toEqual([{ binding: 'HYPERDRIVE', id: 'realhyperid789' }]);
-
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, patch);
     expect(second.modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('hyperdrive adopt: creates the hyperdrive entry when the binding is absent', () => {
-    setup('wrangler.jsonc', '{ "name": "app" }');
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      hyperdrive: { binding: 'HYPERDRIVE', id: 'realhyperid789' },
-    });
-    expect(result.modified).toBe(true);
-    const hd = parseRaw('wrangler.jsonc').hyperdrive as Array<Record<string, unknown>>;
-    expect(hd).toEqual([{ binding: 'HYPERDRIVE', id: 'realhyperid789' }]);
-  });
-
-  // Adopt-field invariants — the append path must uphold the SAME worker-wide
-  // binding-uniqueness rules the queue-producer guard enforces, and the update
-  // path must fail closed on an ambiguous duplicate binding in the target array.
-
-  it('adopt fails closed when the binding is already used by a DIFFERENT resource type (worker-wide collision) — no write', () => {
-    // A KV is already bound `DB`; adopting a D1 as `DB` would emit a cross-type
-    // duplicate binding name wrangler rejects at deploy. Fail closed.
+  it('adopt fails closed when the binding is already used by a different resource type — no write', () => {
     setup('wrangler.jsonc', '{ "kv_namespaces": [{ "binding": "DB", "id": "abc" }] }');
     const before = readRaw('wrangler.jsonc');
     expect(() =>
@@ -2889,9 +2062,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('negative control: adopt appends normally when the binding collides with nothing, and is idempotent', () => {
-    // A D1 binding `DB` and a KV binding `KV` do NOT collide with adopting an R2
-    // as `STORAGE` — the worker-wide guard is precise, not paranoid.
+  it('adopt appends when the binding collides with nothing, and is idempotent', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -2905,17 +2076,14 @@ describe('writeProvisionedWranglerConfig', () => {
     const r2 = parseRaw('wrangler.jsonc').r2_buckets as Array<Record<string, unknown>>;
     expect(r2).toEqual([{ binding: 'STORAGE', bucket_name: 'uploads' }]);
 
-    // Idempotent — a second run writes nothing and is byte-identical.
     const afterFirst = readRaw('wrangler.jsonc');
     const second = writeProvisionedWranglerConfig(tmpDir, patch);
     expect(second.modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(afterFirst);
   });
 
-  it('honors an explicit configPath option (writes the pinned file, not discovery)', () => {
-    // The provisioner pins the exact file so read-first + wrangler -c + this write
-    // never diverge. With both files present, discovery would prefer .jsonc; the
-    // explicit option must win and write .json.
+  it('honors an explicit configPath option over discovery', () => {
+    // With both files present, discovery would pick wrangler.jsonc.
     setup('wrangler.jsonc', '{ "name": "jsonc" }');
     writeFileSync(join(tmpDir, 'wrangler.json'), '{ "name": "json" }');
     const jsonPath = join(tmpDir, 'wrangler.json');
@@ -2925,19 +2093,12 @@ describe('writeProvisionedWranglerConfig', () => {
       { configPath: jsonPath },
     );
     expect(result.configPath).toBe(jsonPath);
-    expect((parseRaw('wrangler.json') as Record<string, unknown>).account_id).toBe('acc-pinned');
-    // The .jsonc (which discovery would have preferred) is untouched.
-    expect((parseRaw('wrangler.jsonc') as Record<string, unknown>).account_id).toBeUndefined();
+    expect(parseRaw('wrangler.json').account_id).toBe('acc-pinned');
+    expect(parseRaw('wrangler.jsonc').account_id).toBeUndefined();
   });
 
-  // Adopt collision guards must be built from the CURRENT text, cover MATCHED
-  // (existing-target) entries, include queues.producers, and reject duplicate D1
-  // migration targets — not just the append/initial-parse cases.
-
-  it('adopt fails closed when the binding collides with an existing queue PRODUCER binding — no write', () => {
-    // An existing queue producer already binds `DB`; adopting a D1 as `DB` would
-    // emit a cross-type duplicate binding name wrangler rejects at deploy. The base
-    // collector omits producers, so the adopt guard must layer them back in.
+  it('adopt fails closed when the binding collides with an existing queue producer binding — no write', () => {
+    // The base collector leaves out producers, so the adopt guard adds them back.
     setup(
       'wrangler.jsonc',
       `{
@@ -2953,10 +2114,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('adopt fails closed when TWO adopts in one patch request the same binding (current-text rebuild, not stale map)', () => {
-    // A single patch adopting the same binding into two arrays would, with a map
-    // built once from the INITIAL parse, append both. The guard rebuilds from the
-    // current text before each adopt, so the second sees the first and fails closed.
+  it('adopt fails closed when two adopts in one patch use the same binding — no write', () => {
     setup('wrangler.jsonc', '{ "name": "app" }');
     const before = readRaw('wrangler.jsonc');
     expect(() =>
@@ -2965,15 +2123,10 @@ describe('writeProvisionedWranglerConfig', () => {
         kv: { binding: 'DUP', id: 'real-kv-id' },
       }),
     ).toThrow(/cannot adopt "DUP" into "kv_namespaces".*already used by a D1 Database binding/s);
-    // Fail closed — nothing written (the d1 append is discarded because the whole
-    // write only commits past the final gate).
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('adopt fails closed on a MATCHED existing-target entry whose binding also collides cross-type — no write', () => {
-    // The target D1 entry already exists (matched, not appended) AND a KV binds the
-    // same name — an undeployable cross-type duplicate. The MATCHED/update path must
-    // fail closed too, not just the append path.
+  it('adopt fails closed on an existing target entry whose binding also collides with another type — no write', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -2990,11 +2143,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('adopt fails closed when a collected field has a malformed member masking a real binding — no write', () => {
-    // kv_namespaces holds a null member AND a valid { binding: 'DB' }. The collector
-    // must NOT silently drop the null and lose the 'DB' binding — adopting a D1 as
-    // 'DB' would then emit an undeployable cross-type duplicate. Reject the whole
-    // config (fail closed) instead of committing the conflicting binding.
+  it('adopt fails closed when another field has a malformed member beside a real binding — no write', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({ kv_namespaces: [null, { binding: 'DB', id: 'kv-id' }] }),
@@ -3008,85 +2157,33 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('producer append fails closed on a mixed-malformed binding field rather than silently dropping', () => {
-    // A namespace field with a null member alongside a valid binding must reject the
-    // whole config when the worker-wide uniqueness collector reads it — never a
-    // partial read that could hide a collision.
+  it('producer append fails closed on a binding field with a malformed member — no write', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({ d1_databases: [null, { binding: 'DB', database_id: 'id' }] }),
     );
     const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/malformed entry at index 0 \(missing a non-empty string "binding"\)/);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('collector fails closed on a malformed binding-list member — no write', () => {
-    // The `{ bindings: [...] }` shape (durable_objects/unsafe) is equally strict: a
-    // malformed member throws rather than falling through to a partial read.
-    setup(
-      'wrangler.jsonc',
-      JSON.stringify({
-        durable_objects: { bindings: [null, { name: 'DO', class_name: 'C' }] },
-      }),
+    expect(appendProducer).toThrow(
+      /malformed entry at index 0 \(missing a non-empty string "binding"\)/,
     );
-    const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/malformed entry at index 0 \(missing a non-empty string "name"\)/);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('binding-list with ALL members malformed ({bindings:[null]}) throws — no plain-map fall-through', () => {
-    // The sibling gap left open: when NO member is a record, the old
-    // `some(isRecord)` guard fell through and read the field as a plain map (a bogus
-    // binding named "bindings"), hiding the malformed binding entirely. Field-aware
-    // strict validation throws even when every member is malformed.
-    setup('wrangler.jsonc', JSON.stringify({ durable_objects: { bindings: [null] } }));
-    const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/malformed entry at index 0 \(missing a non-empty string "name"\)/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('singleton binding with a non-string binding (ai:{binding:123}) throws — not a silent empty set', () => {
-    // wrangler's getBindingNames returns `[value.binding]` for a singleton with NO type
-    // check, so a non-string slips in as a bogus name and a malformed one contributes
-    // nothing. Field-aware strict validation rejects the whole config.
+  it('fails closed on a singleton with a non-string binding — no write', () => {
     setup('wrangler.jsonc', JSON.stringify({ ai: { binding: 123 } }));
     const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"ai" has a malformed "binding"/);
+    expect(appendProducer).toThrow(/"ai" has a malformed "binding"/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('malformed secrets.required member throws — never a silent skip', () => {
+  it('fails closed on a malformed secrets.required member — no write', () => {
     setup('wrangler.jsonc', JSON.stringify({ secrets: { required: ['API_KEY', null] } }));
     const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"secrets\.required" contains a malformed entry at index 1/);
+    expect(appendProducer).toThrow(/"secrets\.required" contains a malformed entry at index 1/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('malformed queues.producers member throws on the adopt path — never a silent skip', () => {
-    // The adopt guard layers existing producers into its owner map
-    // (addQueueProducerOwners); a null producer must reject the whole config rather
-    // than be dropped (which could hide a real producer-binding collision).
+  it('adopt fails closed on a malformed queues.producers member — no write', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({ queues: { producers: [null, { queue: 'q', binding: 'QUEUE_X' }] } }),
@@ -3100,10 +2197,8 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('adopt TARGET array with a mixed valid+malformed member throws — not a silent skip', () => {
-    // Adopting into kv_namespaces whose array holds a null beside a valid { binding:'KV' }.
-    // The owner collector EXCLUDES the target field, so the malformed member is caught
-    // only by the strict target-field validation the adopt path now runs before mutating.
+  it('adopt fails closed on a malformed member in its target array — no write', () => {
+    // The owner collector skips the target field, so the adopt path checks it separately.
     setup(
       'wrangler.jsonc',
       JSON.stringify({ kv_namespaces: [null, { binding: 'KV', id: 'kv-id' }] }),
@@ -3117,7 +2212,7 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('migrations_dir fails closed when the D1 binding is declared more than once (no findIndex-first)', () => {
+  it('migrations_dir fails closed when the D1 binding is declared more than once', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -3136,65 +2231,28 @@ describe('writeProvisionedWranglerConfig', () => {
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('producer upsert fails closed when the EXISTING queues.producers list has a null member', () => {
-    // The producer-upsert path previously cloned queues.producers and silently skipped
-    // non-record members, committing a new producer beside a corrupt list. It now routes
-    // the existing list through the SAME strict validator the adopt guard uses.
+  it('producer upsert fails closed when the existing queues.producers list has a null member', () => {
     setup('wrangler.jsonc', JSON.stringify({ queues: { producers: [null] } }));
     const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"queues\.producers" contains a malformed entry at index 0/);
+    expect(appendProducer).toThrow(/"queues\.producers" contains a malformed entry at index 0/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('collector fails closed on a malformed stream/media/websearch singleton binding', () => {
-    // These singleton `{ binding }` fields were OMITTED from the strict set, so a
-    // present-but-non-string binding silently contributed nothing (wrangler quirk).
-    for (const field of ['stream', 'media', 'websearch']) {
-      setup('wrangler.jsonc', JSON.stringify({ [field]: { binding: 123 } }));
-      const before = readRaw('wrangler.jsonc');
-      expect(() =>
-        writeProvisionedWranglerConfig(tmpDir, {
-          queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-        }),
-      ).toThrow(new RegExp(`"${field}" has a malformed "binding"`));
-      expect(readRaw('wrangler.jsonc')).toBe(before);
-    }
-  });
-
   it('collector fails closed on a wrong-shaped binding-list field (durable_objects as array)', () => {
-    // durable_objects must be `{ bindings: [...] }`; an array is the wrong outer shape
-    // and must throw rather than fall back to generic key collection (under-collection
-    // could hide a real binding collision).
     setup('wrangler.jsonc', JSON.stringify({ durable_objects: [{ name: 'DO', class_name: 'C' }] }));
     const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"durable_objects" must be an object with a "bindings" array/);
+    expect(appendProducer).toThrow(/"durable_objects" must be an object with a "bindings" array/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
   it('collector fails closed on a wrong-shaped name-keyed field (send_email as object)', () => {
-    // send_email must be an array of `{ name }`; a non-array is the wrong outer shape and
-    // must throw rather than be re-read as a key-map.
     setup('wrangler.jsonc', JSON.stringify({ send_email: { EMAIL: {} } }));
     const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"send_email" must be an array of binding entries/);
+    expect(appendProducer).toThrow(/"send_email" must be an array of binding entries/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('negative control: valid stream/media/websearch singletons + unsafe-with-only-metadata do NOT throw', () => {
-    // A well-formed singleton contributes its binding name; `unsafe` with only metadata
-    // (no bindings) contributes nothing — neither should trip the strict collector.
+  it('accepts valid stream/media/websearch singletons and a metadata-only unsafe', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({
@@ -3204,25 +2262,14 @@ describe('writeProvisionedWranglerConfig', () => {
         unsafe: { metadata: { foo: 'bar' } },
       }),
     );
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-    expect(result.modified).toBe(true);
-    const parsed = parseRaw('wrangler.jsonc');
-    const producers = (parsed.queues as Record<string, unknown>).producers as Array<
-      Record<string, unknown>
-    >;
+    expect(appendProducer().modified).toBe(true);
+    const producers = (parseRaw('wrangler.jsonc').queues as Record<string, unknown>).producers;
     expect(producers).toEqual([{ queue: 'jobs', binding: 'QUEUE_JOBS' }]);
   });
 });
 
-describe('writeProvisionedWranglerConfig — email (Mode B): sendEmail / addresses / vars', () => {
-  const readRaw = (f: string): string => readFileSync(join(tmpDir, f), 'utf-8');
-  const parseRaw = (f: string): Record<string, unknown> =>
-    parseJsoncRaw(readRaw(f), undefined, { allowTrailingComma: true }) as Record<string, unknown>;
-
-  // Comments everywhere a jsonc edit could disturb them, and trailing commas at
-  // every level — the shape a hand-edited wrangler.jsonc really has.
+describe('writeProvisionedWranglerConfig — email: sendEmail / addresses / vars', () => {
+  // Comments and trailing commas at every level, like a hand-edited file.
   const emailFixture = `{
   // Void manages this file — every comment below must survive.
   "name": "acme-support", // worker name
@@ -3367,9 +2414,8 @@ describe('writeProvisionedWranglerConfig — email (Mode B): sendEmail / address
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('addresses: a DIFFERENT array cannot be written over comments nested inside the old one — throws without writing', () => {
-    // Void owns the array, but the writer never drops a comment: the generic
-    // comment gate refuses instead of silently discarding `// routed here`.
+  it('addresses: a different array cannot be written over comments nested inside the old one — throws without writing', () => {
+    // Void owns the array, but the writer never drops a comment.
     setup('wrangler.jsonc', emailFixture);
     const before = readRaw('wrangler.jsonc');
     expect(() =>
@@ -3404,7 +2450,7 @@ describe('writeProvisionedWranglerConfig — email (Mode B): sendEmail / address
     expect(readRaw('wrangler.jsonc')).toBe(raw);
   });
 
-  it('addresses: null on the LAST member of a strict .json file removes the preceding comma (no trailing comma left)', () => {
+  it('addresses: null on the last member of a strict .json file removes the preceding comma (no trailing comma left)', () => {
     setup(
       'wrangler.json',
       `{
@@ -3505,7 +2551,7 @@ describe('writeProvisionedWranglerConfig — email (Mode B): sendEmail / address
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('the full Mode B patch composes: send_email + addresses + vars in one write, every comment survives, idempotent', () => {
+  it('the full email patch composes: send_email + addresses + vars in one write, every comment survives, idempotent', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -3564,58 +2610,38 @@ describe('writeProvisionedWranglerConfig — email (Mode B): sendEmail / address
   });
 });
 
-describe('writeProvisionedWranglerConfig — producer collision on EVERY upsert', () => {
-  const readRaw = (f: string): string => readFileSync(join(tmpDir, f), 'utf-8');
-  const parseRaw = (f: string): Record<string, unknown> =>
-    parseJsoncRaw(readRaw(f)) as Record<string, unknown>;
-
-  it('fails closed on the IDEMPOTENT same-queue producer path when the binding cross-type collides — throws (not a silent modified:false)', () => {
-    // A D1 named QUEUE_JOBS PLUS an existing producer QUEUE_JOBS for the SAME queue: the
-    // config is already undeployable (cross-type binding-name collision wrangler
-    // rejects). The old code took the `index >= 0` path and returned `modified:false`,
-    // silently accepting it. The worker-wide collision check now runs for EVERY producer
-    // upsert (matched/idempotent AND append), so the idempotent path fails closed too.
-    setup(
-      'wrangler.jsonc',
-      `{
-  "d1_databases": [{ "binding": "QUEUE_JOBS", "database_name": "app", "database_id": "id" }],
-  "queues": {
-    "producers": [{ "queue": "jobs", "binding": "QUEUE_JOBS" }]
-  }
-}`,
-    );
-    const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"QUEUE_JOBS" is already used by a D1 Database binding/);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('fails closed on the idempotent path when a matched producer binding collides with a var name', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  "vars": { "QUEUE_JOBS": "some-value" },
+describe('writeProvisionedWranglerConfig — producer collisions on the idempotent path', () => {
+  it.each([
+    {
+      owner: 'a D1 binding',
+      field:
+        '"d1_databases": [{ "binding": "QUEUE_JOBS", "database_name": "app", "database_id": "id" }]',
+      error: /"QUEUE_JOBS" is already used by a D1 Database binding/,
+    },
+    {
+      owner: 'a var',
+      field: '"vars": { "QUEUE_JOBS": "some-value" }',
+      error: /"QUEUE_JOBS" is already used by an? Environment Variable binding/,
+    },
+  ])(
+    'fails closed when an existing same-queue producer binding collides with $owner',
+    ({ field, error }) => {
+      setup(
+        'wrangler.jsonc',
+        `{
+  ${field},
   "queues": {
     "producers": [{ "queue": "jobs", "binding": "QUEUE_JOBS" }]
   }
 }`,
-    );
-    const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/"QUEUE_JOBS" is already used by an? Environment Variable binding/);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
+      );
+      const before = readRaw('wrangler.jsonc');
+      expect(appendProducer).toThrow(error);
+      expect(readRaw('wrangler.jsonc')).toBe(before);
+    },
+  );
 
-  it('fails closed on the idempotent path when a MALFORMED other binding field would mask a collision', () => {
-    // A null kv_namespaces member alongside the idempotent producer: the collector now
-    // runs on the idempotent path too, so a partially-readable binding set fails closed
-    // rather than silently accepting the config with modified:false.
+  it('fails closed when another binding field has a malformed member', () => {
     setup(
       'wrangler.jsonc',
       `{
@@ -3626,51 +2652,15 @@ describe('writeProvisionedWranglerConfig — producer collision on EVERY upsert'
 }`,
     );
     const before = readRaw('wrangler.jsonc');
-    expect(() =>
-      writeProvisionedWranglerConfig(tmpDir, {
-        queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-      }),
-    ).toThrow(/malformed entry at index 0 \(missing a non-empty string "binding"\)/);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('negative control: idempotent same-queue producer with NO cross-type collision stays a no-op (modified:false)', () => {
-    setup(
-      'wrangler.jsonc',
-      `{
-  "queues": {
-    "producers": [{ "queue": "jobs", "binding": "QUEUE_JOBS" }]
-  }
-}`,
+    expect(appendProducer).toThrow(
+      /malformed entry at index 0 \(missing a non-empty string "binding"\)/,
     );
-    const before = readRaw('wrangler.jsonc');
-    const result = writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-    expect(result.modified).toBe(false);
     expect(readRaw('wrangler.jsonc')).toBe(before);
-    // The producer is untouched.
-    expect((parseRaw('wrangler.jsonc').queues as Record<string, unknown>).producers).toEqual([
-      { queue: 'jobs', binding: 'QUEUE_JOBS' },
-    ]);
   });
 });
 
-describe('worker-wide binding collector — schema-metadata field shapes', () => {
-  const readRaw = (f: string): string => readFileSync(join(tmpDir, f), 'utf-8');
-  const parseRaw = (f: string): Record<string, unknown> =>
-    parseJsoncRaw(readRaw(f)) as Record<string, unknown>;
-
-  // Every case drives the collector through a queue-producer append of QUEUE_JOBS.
-  const appendProducer = () =>
-    writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-
-  it('key-map: a `vars` value that LOOKS like a binding list is collected as KEYS (not misread) — no false collision', () => {
-    // A var literally named "bindings" holding an array-of-records VALUE. The old
-    // content-guessing read the nested `.name` ("QUEUE_JOBS") and falsely flagged a
-    // collision. Key-map handling collects the KEY ("bindings"), so the append proceeds.
+describe('worker-wide binding collector — field shapes', () => {
+  it('key-map: reads vars keys, not a value that looks like a binding list', () => {
     setup('wrangler.jsonc', JSON.stringify({ vars: { bindings: [{ name: 'QUEUE_JOBS' }] } }));
     const result = appendProducer();
     expect(result.modified).toBe(true);
@@ -3679,16 +2669,13 @@ describe('worker-wide binding collector — schema-metadata field shapes', () =>
     ]);
   });
 
-  it('key-map: a `vars` key named "binding" reports the KEY, not its VALUE — no false collision', () => {
-    // A var named "binding" whose VALUE is "QUEUE_JOBS". The old singleton misread
-    // returned the VALUE ("QUEUE_JOBS") → false collision. Key-map collects the KEY
-    // ("binding"), so the QUEUE_JOBS producer appends cleanly.
+  it('key-map: a var named "binding" contributes its key, not its value', () => {
     setup('wrangler.jsonc', JSON.stringify({ vars: { binding: 'QUEUE_JOBS' } }));
     const result = appendProducer();
     expect(result.modified).toBe(true);
   });
 
-  it('key-map: a real KEY collision (a var named QUEUE_JOBS) still fails closed', () => {
+  it('key-map: a var named QUEUE_JOBS fails closed', () => {
     setup('wrangler.jsonc', JSON.stringify({ vars: { QUEUE_JOBS: { bindings: [] } } }));
     const before = readRaw('wrangler.jsonc');
     expect(appendProducer).toThrow(
@@ -3704,16 +2691,14 @@ describe('worker-wide binding collector — schema-metadata field shapes', () =>
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('singleton: a required singleton (ai) with NO binding fails closed', () => {
+  it('singleton: a required singleton (ai) without a binding fails closed', () => {
     setup('wrangler.jsonc', JSON.stringify({ ai: {} }));
     const before = readRaw('wrangler.jsonc');
     expect(appendProducer).toThrow(/"ai" requires a "binding"/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('singleton: a required singleton (browser) present with only OTHER keys fails closed (not mis-collected)', () => {
-    // The old fall-through read `{ remote: true }` via generic key collection, inventing
-    // a bogus "remote" binding name. The required-binding rule fails closed instead.
+  it('singleton: a required singleton (browser) with only other keys fails closed', () => {
     setup('wrangler.jsonc', JSON.stringify({ browser: { remote: true } }));
     const before = readRaw('wrangler.jsonc');
     expect(appendProducer).toThrow(/"browser" requires a "binding"/);
@@ -3727,29 +2712,21 @@ describe('worker-wide binding collector — schema-metadata field shapes', () =>
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('singleton: the OPTIONAL `assets` binding with only a directory contributes nothing (no throw, no bogus name)', () => {
-    // The old fall-through mis-collected "directory" as a binding name. assets is
-    // binding-optional, so it now contributes nothing and the producer appends.
-    setup('wrangler.jsonc', JSON.stringify({ assets: { directory: './public' } }));
-    const result = appendProducer();
-    expect(result.modified).toBe(true);
-  });
-
-  it('binding-list: durable_objects missing the REQUIRED `bindings` array fails closed', () => {
+  it('binding-list: durable_objects without its required `bindings` array fails closed', () => {
     setup('wrangler.jsonc', JSON.stringify({ durable_objects: {} }));
     const before = readRaw('wrangler.jsonc');
     expect(appendProducer).toThrow(/"durable_objects" requires a "bindings" array/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('binding-list: logfwdr missing the REQUIRED `bindings` array fails closed', () => {
+  it('binding-list: logfwdr without its required `bindings` array fails closed', () => {
     setup('wrangler.jsonc', JSON.stringify({ logfwdr: { schema: 'x' } }));
     const before = readRaw('wrangler.jsonc');
     expect(appendProducer).toThrow(/"logfwdr" requires a "bindings" array/);
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('binding-list: a durable_objects member missing its `name` identity fails closed', () => {
+  it('binding-list: a durable_objects member without a `name` fails closed', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({ durable_objects: { bindings: [{ class_name: 'C' }] } }),
@@ -3761,16 +2738,7 @@ describe('worker-wide binding collector — schema-metadata field shapes', () =>
     expect(readRaw('wrangler.jsonc')).toBe(before);
   });
 
-  it('binding-list: `unsafe.bindings` is OPTIONAL — metadata-only unsafe contributes nothing (no throw)', () => {
-    setup('wrangler.jsonc', JSON.stringify({ unsafe: { metadata: { foo: 'bar' } } }));
-    const result = appendProducer();
-    expect(result.modified).toBe(true);
-  });
-
-  it('no false rejection: a VALID full config across every shape is collected correctly and the producer appends', () => {
-    // A rich, well-formed config exercising key-map / singleton / binding-list /
-    // namespace-array / name-keyed shapes — none of which names QUEUE_JOBS — must NOT
-    // be rejected. (A real cross-type collision would still fail closed; see above.)
+  it('accepts a valid config that uses every field shape', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({
@@ -3797,19 +2765,7 @@ describe('worker-wide binding collector — schema-metadata field shapes', () =>
 });
 
 describe('name-keyed collector — send_email/ratelimits identity is `.name` only', () => {
-  const readRaw = (f: string): string => readFileSync(join(tmpDir, f), 'utf-8');
-  const parseRaw = (f: string): Record<string, unknown> =>
-    parseJsoncRaw(readRaw(f)) as Record<string, unknown>;
-  const appendProducer = () =>
-    writeProvisionedWranglerConfig(tmpDir, {
-      queues: { producers: [{ queue: 'jobs', binding: 'QUEUE_JOBS' }] },
-    });
-
-  it('a send_email entry carrying an optional `.binding` does NOT collide with a DIFFERENT resource using that string', () => {
-    // wrangler 4.131 keys send_email on `.name` ONLY (config-schema.json has no `.binding`
-    // property; upload keys by `output[name]`). A mixed array `[{name,binding},{name}]` must
-    // therefore leave the `.binding` string ("QUEUE_JOBS") FREE for a queue producer — the old
-    // union of `.binding` invented a false "Send Email" collision and blocked the append.
+  it('a send_email entry’s optional `.binding` is not a binding name', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({
@@ -3826,7 +2782,7 @@ describe('name-keyed collector — send_email/ratelimits identity is `.name` onl
     ]);
   });
 
-  it('a ratelimits entry carrying an optional `.binding` does NOT collide with a producer using that string', () => {
+  it('a ratelimits entry’s optional `.binding` is not a binding name', () => {
     setup(
       'wrangler.jsonc',
       JSON.stringify({
@@ -3844,19 +2800,7 @@ describe('name-keyed collector — send_email/ratelimits identity is `.name` onl
     expect(result.modified).toBe(true);
   });
 
-  it('a REAL same-`name` send_email collision is STILL caught (producer binding equals a send_email name)', () => {
-    setup(
-      'wrangler.jsonc',
-      JSON.stringify({
-        send_email: [{ name: 'QUEUE_JOBS', destination_address: 'ops@example.com' }],
-      }),
-    );
-    const before = readRaw('wrangler.jsonc');
-    expect(appendProducer).toThrow(/"QUEUE_JOBS" is already used by a Send Email binding/);
-    expect(readRaw('wrangler.jsonc')).toBe(before);
-  });
-
-  it('a name-keyed member missing its `.name` identity STILL fails closed (fail-closed preserved)', () => {
+  it('a name-keyed member without `.name` fails closed', () => {
     setup('wrangler.jsonc', JSON.stringify({ send_email: [{ binding: 'ONLY_BINDING' }] }));
     const before = readRaw('wrangler.jsonc');
     expect(appendProducer).toThrow(
@@ -3891,7 +2835,7 @@ describe('readProvisionedBindingEntry (strict canonical binding reader)', () =>
     expect(readProvisionedBindingEntry({}, 'd1_databases', 'DB', P)).toBeUndefined();
   });
 
-  it('fails closed on a DUPLICATE binding in the target field', () => {
+  it('fails closed on a duplicate binding in the target field', () => {
     const config = {
       kv_namespaces: [
         { binding: 'CACHE', id: 'a' },
@@ -3903,7 +2847,7 @@ describe('readProvisionedBindingEntry (strict canonical binding reader)', () =>
     );
   });
 
-  it('fails closed on a CROSS-TYPE collision with another binding field', () => {
+  it('fails closed when another binding field uses the same name', () => {
     const config = {
       d1_databases: [{ binding: 'DB', database_id: 'id-a' }],
       vars: { DB: 'oops' },
@@ -3913,7 +2857,7 @@ describe('readProvisionedBindingEntry (strict canonical binding reader)', () =>
     );
   });
 
-  it('fails closed on a CROSS-TYPE collision with a queue producer', () => {
+  it('fails closed when a queue producer uses the same name', () => {
     const config = {
       r2_buckets: [{ binding: 'STORAGE', bucket_name: 'b' }],
       queues: { producers: [{ binding: 'STORAGE', queue: 'jobs' }] },
@@ -3930,45 +2874,8 @@ describe('readProvisionedBindingEntry (strict canonical binding reader)', () =>
   });
 });
 
-// ---------------------------------------------------------------------------
-// bindingEntriesForField mirrors bindingNamesForField's shape switch but returns
-// each binding's NAME + its full config ENTRY object, so the deploy pass-through
-// check can pin a binding's TARGET (service/namespace/type), not just its name.
-// The two readers MUST agree on names for every shape, and both fail closed on a
-// malformed member.
-// ---------------------------------------------------------------------------
-
-describe('bindingEntriesForField — entry reader parity with bindingNamesForField', () => {
-  // One representative value per REACHABLE shape (key-map is excluded from the assert-set and
-  // its entry reader throws by design — see the dedicated case below).
-  const REPRESENTATIVE: Array<{ field: string; value: unknown }> = [
-    // namespace-array
-    {
-      field: 'services',
-      value: [
-        { binding: 'MY_SVC', service: 'my-other-worker' },
-        { binding: 'OTHER', service: 'w2', entrypoint: 'Fetcher' },
-      ],
-    },
-    // name-keyed-array
-    { field: 'send_email', value: [{ name: 'EMAIL', destination_address: 'to@example.com' }] },
-    // singleton
-    { field: 'browser', value: { binding: 'BROWSER', remote: true } },
-    // binding-list
-    { field: 'unsafe', value: { bindings: [{ name: 'X', type: 'secret_text' }] } },
-    // whole-object (not a binding — pinned whole by the deploy verifier)
-    { field: 'addresses', value: ['support@mail.acme.com', '*@acme.com'] },
-  ];
-
-  it('yields the SAME names as bindingNamesForField for a representative value of each shape', () => {
-    for (const { field, value } of REPRESENTATIVE) {
-      expect(bindingEntriesForField(field, value).map((e) => e.name)).toEqual(
-        bindingNamesForField(field, value),
-      );
-    }
-  });
-
-  it('carries each binding’s full config entry object (so a retargeted binding is visible)', () => {
+describe('bindingEntriesForField', () => {
+  it('carries each binding’s full config entry object', () => {
     const entries = bindingEntriesForField('services', [
       { binding: 'MY_SVC', service: 'my-other-worker' },
     ]);
@@ -3977,52 +2884,16 @@ describe('bindingEntriesForField — entry reader parity with bindingNamesForFie
     ]);
   });
 
-  it('reads the singleton value itself as the entry, and an empty array as no entries', () => {
+  it('reads the singleton value itself as the entry, and empty or whole-object fields as no entries', () => {
     expect(bindingEntriesForField('browser', { binding: 'BROWSER' })).toEqual([
       { name: 'BROWSER', entry: { binding: 'BROWSER' } },
     ]);
-    // Empty-array assert fields (the normalizer default) → no entries → the deploy loop never runs.
     expect(bindingEntriesForField('services', [])).toEqual([]);
-    // logfwdr is always emitted as { bindings: [] } → no entries.
     expect(bindingEntriesForField('logfwdr', { bindings: [] })).toEqual([]);
-  });
-
-  it('fails closed on a malformed member for each shape (mirrors the name reader)', () => {
-    // namespace-array member missing `.binding`
-    expect(() => bindingEntriesForField('services', [{ service: 'w' }])).toThrow(
-      /malformed entry at index 0 \(missing a non-empty string "binding"\)/,
-    );
-    // name-keyed-array member missing `.name`
-    expect(() => bindingEntriesForField('send_email', [{ destination_address: 'x' }])).toThrow(
-      /malformed entry at index 0 \(missing a non-empty string "name"\)/,
-    );
-    // singleton (required) with no `.binding`
-    expect(() => bindingEntriesForField('browser', { remote: true })).toThrow(
-      /"browser" requires a "binding"/,
-    );
-    // binding-list member missing `.name`
-    expect(() => bindingEntriesForField('unsafe', { bindings: [{ type: 'secret_text' }] })).toThrow(
-      /malformed entry at index 0 \(missing a non-empty string "name"\)/,
-    );
-  });
-
-  it('addresses is a whole-object field: no binding names, no entries, never misread as a namespace-array', () => {
-    // `addresses` is `string[]` (wrangler ≥ 4.113 Email Routing rules). The default
-    // namespace-array reader would throw on its string members; the registry names it
-    // whole-object so neither reader sees a binding in it — the deploy verifier pins the
-    // value WHOLE instead (DEPLOY_WHOLE_OBJECT_PINNED_FIELDS).
-    const value = ['support@mail.acme.com', '*@acme.com'];
-    expect(bindingNamesForField('addresses', value)).toEqual([]);
-    expect(bindingEntriesForField('addresses', value)).toEqual([]);
+    // `addresses` is a string array, not bindings; the deploy check compares it whole.
+    const addresses = ['support@mail.acme.com', '*@acme.com'];
+    expect(bindingEntriesForField('addresses', addresses)).toEqual([]);
+    expect(bindingNamesForField('addresses', addresses)).toEqual([]);
     expect(bindingNamesForField('addresses', undefined)).toEqual([]);
   });
-
-  it('fails closed when a key-map field is routed here (unreachable — asserts fail-closed)', () => {
-    // All key-map fields (vars/wasm_modules/…) are EXCLUDED from the assert-set, so this reader is
-    // never called with one. If a future misclassification did, it must throw rather than silently
-    // return no entries.
-    expect(() => bindingEntriesForField('vars', { A: '1' })).toThrow(
-      /"vars" must be an object mapping names to values/,
-    );
-  });
 });
diff --git a/packages/void/test/unit/wrapper.test.ts b/packages/void/test/unit/wrapper.test.ts
index df09d5223..00a41c0e9 100644
--- a/packages/void/test/unit/wrapper.test.ts
+++ b/packages/void/test/unit/wrapper.test.ts
@@ -492,28 +492,38 @@ describe('generated wrapper queue dispatch', () => {
 });
 
 describe('generateWrapper with migrations', () => {
-  const tmpRoot = join(import.meta.dirname, '..', '..', '.test-wrapper-tmp');
-  const workerDir = join(tmpRoot, 'server');
-  const projectRoot = join(tmpRoot, 'project');
-
+  const roots: Array<string> = [];
   afterEach(() => {
-    rmSync(tmpRoot, { recursive: true, force: true });
+    for (const root of roots.splice(0)) {
+      rmSync(root, { recursive: true, force: true });
+    }
   });
 
-  it('generates wrapper with /__void/migrate handler', async () => {
-    // Set up fake worker dir with a minimal entry
+  function createMigrationFixture(migration?: { name: string; sql: string }): {
+    workerDir: string;
+    projectRoot: string;
+  } {
+    const root = mkdtempSync(join(tmpdir(), 'void-wrapper-migrations-'));
+    roots.push(root);
+    const workerDir = join(root, 'server');
+    const projectRoot = join(root, 'project');
     mkdirSync(workerDir, { recursive: true });
     writeFileSync(
       join(workerDir, 'index.mjs'),
       'export default { fetch() { return new Response("ok"); } };',
     );
-
-    // Set up fake project with a migration
     mkdirSync(join(projectRoot, 'db', 'migrations'), { recursive: true });
-    writeFileSync(
-      join(projectRoot, 'db', 'migrations', '001_test.sql'),
-      'CREATE TABLE test (id INTEGER PRIMARY KEY);',
-    );
+    if (migration) {
+      writeFileSync(join(projectRoot, 'db', 'migrations', migration.name), migration.sql);
+    }
+    return { workerDir, projectRoot };
+  }
+
+  it('embeds SQLite migrations, a self-contained handler and the readiness probe', async () => {
+    const { workerDir, projectRoot } = createMigrationFixture({
+      name: '001_create_users.sql',
+      sql: 'CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT);',
+    });
 
     await generateWrapper(workerDir, 'index.mjs', projectRoot, {
       ...base,
@@ -521,80 +531,29 @@ describe('generateWrapper with migrations', () => {
       migrationDialect: 'sqlite',
     });
 
-    // Original entry should be renamed
-    expect(existsSync(join(workerDir, '__original.mjs'))).toBe(true);
-
-    // Wrapper should be written as index.mjs
     const wrapper = readFileSync(join(workerDir, 'index.mjs'), 'utf-8');
-    expect(wrapper).toContain('/__void/migrate');
-    expect(wrapper).toContain('createMigrationHandler');
     expect(wrapper).toContain('__migrations');
-    expect(wrapper).toContain('import original from "./__original.mjs"');
-
-    expect(existsSync(join(workerDir, '__void_migration_handler.mjs'))).toBe(true);
-  });
-
-  it('bundles the SQLite migration handler into a self-contained worker module', async () => {
-    mkdirSync(workerDir, { recursive: true });
-    writeFileSync(
-      join(workerDir, 'index.mjs'),
-      'export default { fetch() { return new Response("ok"); } };',
-    );
-
-    mkdirSync(join(projectRoot, 'db', 'migrations'), { recursive: true });
-    writeFileSync(
-      join(projectRoot, 'db', 'migrations', '001_test.sql'),
-      'CREATE TABLE test (id INTEGER PRIMARY KEY);',
-    );
-
-    await generateWrapper(workerDir, 'index.mjs', projectRoot, {
-      ...base,
-      hasMigrations: true,
-      migrationDialect: 'sqlite',
-    });
+    expect(wrapper).toContain('001_create_users.sql');
+    expect(wrapper).toContain('CREATE TABLE users');
 
     const handler = readFileSync(join(workerDir, '__void_migration_handler.mjs'), 'utf-8');
     expect(handler).not.toMatch(/from\s+["']\.\.\//);
     expect(handler).not.toContain('../migrations/canonical-json');
     expect(handler).not.toContain('../canonical-json-');
     expect(handler).toContain('function canonicalJson');
-  });
-
-  it('includes migrations JSON in wrapper source', async () => {
-    mkdirSync(workerDir, { recursive: true });
-    writeFileSync(
-      join(workerDir, 'index.mjs'),
-      'export default { fetch() { return new Response("ok"); } };',
-    );
-
-    mkdirSync(join(projectRoot, 'db', 'migrations'), { recursive: true });
-    writeFileSync(
-      join(projectRoot, 'db', 'migrations', '001_create_users.sql'),
-      'CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT);',
-    );
-
-    await generateWrapper(workerDir, 'index.mjs', projectRoot, {
-      ...base,
-      hasMigrations: true,
-    });
 
-    const wrapper = readFileSync(join(workerDir, 'index.mjs'), 'utf-8');
-    expect(wrapper).toContain('001_create_users.sql');
-    expect(wrapper).toContain('CREATE TABLE users');
+    expect(wrapper).toMatch(/Response\.json\(\s*\{\s*ready:\s*true\s*\}\s*\)/);
+    const readyIdx = wrapper.indexOf('/__void/ready');
+    const originalIdx = wrapper.indexOf('original.fetch');
+    expect(readyIdx).toBeGreaterThanOrEqual(0);
+    expect(originalIdx).toBeGreaterThan(readyIdx);
   });
 
   it('uses PG migration handler when dialect is postgresql', async () => {
-    mkdirSync(workerDir, { recursive: true });
-    writeFileSync(
-      join(workerDir, 'index.mjs'),
-      'export default { fetch() { return new Response("ok"); } };',
-    );
-
-    mkdirSync(join(projectRoot, 'db', 'migrations'), { recursive: true });
-    writeFileSync(
-      join(projectRoot, 'db', 'migrations', '001_test.sql'),
-      'CREATE TABLE test (id SERIAL PRIMARY KEY);',
-    );
+    const { workerDir, projectRoot } = createMigrationFixture({
+      name: '001_test.sql',
+      sql: 'CREATE TABLE test (id SERIAL PRIMARY KEY);',
+    });
 
     await generateWrapper(workerDir, 'index.mjs', projectRoot, {
       ...base,
@@ -602,12 +561,6 @@ describe('generateWrapper with migrations', () => {
       migrationDialect: 'postgresql',
     });
 
-    const wrapper = readFileSync(join(workerDir, 'index.mjs'), 'utf-8');
-    expect(wrapper).toContain('/__void/migrate');
-    expect(wrapper).toContain('createMigrationHandler');
-    expect(wrapper).toContain('"postgresql"');
-
-    expect(existsSync(join(workerDir, '__void_migration_handler.mjs'))).toBe(true);
     const handler = readFileSync(join(workerDir, '__void_migration_handler.mjs'), 'utf-8');
     expect(handler).not.toContain('import("pg")');
     expect(
@@ -633,79 +586,26 @@ describe('generateWrapper with migrations', () => {
   });
 
   it('uses the MySQL migration handler when dialect is mysql', async () => {
-    mkdirSync(workerDir, { recursive: true });
-    writeFileSync(
-      join(workerDir, 'index.mjs'),
-      'export default { fetch() { return new Response("ok"); } };',
-    );
-    mkdirSync(join(projectRoot, 'db', 'migrations'), { recursive: true });
-    writeFileSync(
-      join(projectRoot, 'db', 'migrations', '001_test.sql'),
-      'CREATE TABLE test (id INT);',
-    );
-
-    await generateWrapper(workerDir, 'index.mjs', projectRoot, {
-      ...base,
-      hasMigrations: true,
-      migrationDialect: 'mysql',
+    const { workerDir, projectRoot } = createMigrationFixture({
+      name: '001_test.sql',
+      sql: 'CREATE TABLE test (id INT);',
     });
 
-    const wrapper = readFileSync(join(workerDir, 'index.mjs'), 'utf-8');
-    expect(wrapper).toContain('/__void/migrate');
-    expect(wrapper).toContain('"mysql"');
-    expect(existsSync(join(workerDir, '__void_migration_handler.mjs'))).toBe(true);
-  });
-
-  it('intercepts GET /__void/ready with {ready:true} when wrapper is generated', async () => {
-    // Platform's deploy-time readiness probe (packages/api/src/routes/deploy.ts)
-    // expects a JSON 200 from GET /__void/ready before dispatching migrations.
-    // Without this, the request falls through to the user's framework handler
-    // (e.g. SvelteKit -> env.ASSETS), which returns CF's "Assets have not yet
-    // been deployed to this script." stub during WfP propagation, causing the
-    // probe to retry until exhaustion.
-    mkdirSync(workerDir, { recursive: true });
-    writeFileSync(
-      join(workerDir, 'index.mjs'),
-      'export default { fetch() { return new Response("ok"); } };',
-    );
-
-    mkdirSync(join(projectRoot, 'db', 'migrations'), { recursive: true });
-    writeFileSync(
-      join(projectRoot, 'db', 'migrations', '001_test.sql'),
-      'CREATE TABLE test (id INTEGER PRIMARY KEY);',
-    );
-
     await generateWrapper(workerDir, 'index.mjs', projectRoot, {
       ...base,
       hasMigrations: true,
-      migrationDialect: 'sqlite',
+      migrationDialect: 'mysql',
     });
 
-    const wrapper = readFileSync(join(workerDir, 'index.mjs'), 'utf-8');
-    expect(wrapper).toContain('/__void/ready');
-    expect(wrapper).toMatch(/Response\.json\(\s*\{\s*ready:\s*true\s*\}\s*\)/);
-    // Must be checked before delegating to original.fetch, otherwise the
-    // user's framework handler will see the request.
-    const readyIdx = wrapper.indexOf('/__void/ready');
-    const originalIdx = wrapper.indexOf('original.fetch');
-    expect(readyIdx).toBeGreaterThanOrEqual(0);
-    expect(originalIdx).toBeGreaterThan(readyIdx);
+    const handler = readFileSync(join(workerDir, '__void_migration_handler.mjs'), 'utf-8');
+    expect(handler).toContain('VARCHAR(255)');
   });
 
   it('does not generate migration handler when hasMigrations is false', async () => {
-    mkdirSync(workerDir, { recursive: true });
-    writeFileSync(
-      join(workerDir, 'index.mjs'),
-      'export default { fetch() { return new Response("ok"); } };',
-    );
-
-    mkdirSync(join(projectRoot, 'db', 'migrations'), { recursive: true });
-
-    // Create fake cron handler
+    const { workerDir, projectRoot } = createMigrationFixture();
     mkdirSync(join(projectRoot, 'crons'), { recursive: true });
     writeFileSync(join(projectRoot, 'crons', 'daily.ts'), 'export default async () => {};');
 
-    // Only crons, no migrations
     await generateWrapper(workerDir, 'index.mjs', projectRoot, {
       ...base,
       crons: [{ name: 'daily', filePath: 'daily.ts', crons: ['0 0 * * *'] }],
diff --git a/packages/void/test/unit/ws.test.ts b/packages/void/test/unit/ws.test.ts
index 720057eb4..d179c28b8 100644
--- a/packages/void/test/unit/ws.test.ts
+++ b/packages/void/test/unit/ws.test.ts
@@ -80,13 +80,6 @@ describe('typed websocket client', () => {
     (globalThis as { location?: unknown }).location = originalLocation;
   });
 
-  it('resolves relative paths and interpolates params', () => {
-    connect('/chat/:room', { params: { room: 'general' } });
-
-    expect(MockWebSocket.instances).toHaveLength(1);
-    expect(MockWebSocket.instances[0]!.url).toBe('wss://void.test/chat/general');
-  });
-
   it('expands complete catch-all tokens', () => {
     connect('/files/:path{.+}', { params: { path: 'docs/start here' } });
     expect(MockWebSocket.instances[0]!.url).toBe('wss://void.test/files/docs/start%20here');
diff --git a/packages/void/tsconfig.json b/packages/void/tsconfig.json
index bdb20bc03..5590d3a46 100644
--- a/packages/void/tsconfig.json
+++ b/packages/void/tsconfig.json
@@ -21,5 +21,5 @@
     "isolatedDeclarations": true,
     "allowImportingTsExtensions": true
   },
-  "include": ["src", "test", "env.d.ts"]
+  "include": ["src", "test", "env.d.ts", "../../test/*.ts", "../../.github/scripts/*.ts"]
 }
diff --git a/packages/void/vite.config.ts b/packages/void/vite.config.ts
index b2abf7a58..32f14672e 100644
--- a/packages/void/vite.config.ts
+++ b/packages/void/vite.config.ts
@@ -94,7 +94,6 @@ export default defineConfig({
       'src/runtime/env.ts',
       'src/runtime/env-public.ts',
       'src/runtime/env-public-client.ts',
-      'src/runtime/env-helpers.ts',
       'src/runtime/db.ts',
       'src/runtime/db-pg.ts',
       'src/runtime/db-mysql.ts',
@@ -129,15 +128,12 @@ export default defineConfig({
       'src/pages/index.ts',
       'src/pages/protocol.ts',
       'src/pages/head.ts',
-      'src/pages/head-client.ts',
       'src/pages/prefetch.ts',
       'src/pages/client.ts',
       'src/pages/serialize.ts',
       'src/pages/islands-plugin.ts',
       'src/cli/cli.ts',
-      // Standalone entry so `void deploy --backend cloudflare` can self-spawn it as an isolated
-      // child (via import.meta.url) to derive the env-insensitive schema facts (server and
-      // required-secret names) under a scrubbed env — a stable dist filename for the spawn.
+      // Stable entry that deploy spawns as an isolated child.
       'src/cli/env-schema-probe.ts',
       // Private typed Cloudflare transport, spawned by deployment orchestrators.
       'src/cli/cloudflare-operation-process.ts',
@@ -180,8 +176,8 @@ export default defineConfig({
         'picocolors',
         'ofetch',
         'pathslash',
-        // Dependency-free; bundled like the other CLI-only helpers so the deploy's wrangler-compatible
-        // interactivity gate (`isWranglerNonInteractiveOrCI`) adds no runtime dependency.
+        // Dependency-free; bundled so the CLI interactivity gate (`isWranglerNonInteractiveOrCI`)
+        // adds no runtime dependency.
         'ci-info',
       ],
     },
diff --git a/packages/vue/src/env.d.ts b/packages/vue/src/env.d.ts
deleted file mode 100644
index 629a90ea0..000000000
--- a/packages/vue/src/env.d.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-declare module '*.vue' {
-  import type { DefineComponent } from 'vue';
-  const component: DefineComponent<{}, {}, unknown>;
-  export default component;
-}
diff --git a/packages/vue/src/plugin-islands.ts b/packages/vue/src/plugin-islands.ts
index d714282e7..e204adbca 100644
--- a/packages/vue/src/plugin-islands.ts
+++ b/packages/vue/src/plugin-islands.ts
@@ -26,34 +26,6 @@ type MdPluginWithApi = Plugin & {
 };
 type ScannableEntry = { filePath: string; island: boolean | undefined };
 
-function extractCss(filePath: string): string {
-  const code = readFileSync(filePath, 'utf-8');
-  const parts: Array<string> = [];
-
-  // JS-style CSS imports → @import
-  const jsRe =
-    /^\s*import\b[^"']*["']([^"']+\.(?:css|scss|sass|less|styl|stylus|pcss|postcss))["']/gm;
-  let match;
-  while ((match = jsRe.exec(code)) !== null) {
-    parts.push(`@import ${JSON.stringify(match[1])};`);
-  }
-
-  // Vue <style> block contents (non-scoped only)
-  const styleBlockRe = /<style\b([^>]*)>([\s\S]*?)<\/style>/g;
-  while ((match = styleBlockRe.exec(code)) !== null) {
-    const attrs = match[1];
-    if (/\bscoped\b/.test(attrs)) {
-      continue;
-    }
-    const content = match[2].trim();
-    if (content) {
-      parts.push(content);
-    }
-  }
-
-  return parts.join('\n');
-}
-
 export function islandsPlugin(
   pagesDir: string,
   options?: { root?: string },
@@ -63,10 +35,8 @@ export function islandsPlugin(
   const islandManifest = new Map<string, IslandEntry>();
   const islandCssFiles = new Set<string>();
   let isDev = false;
-  let viteRoot = '';
   let resolvedConfig: ResolvedConfig | null = null;
 
-  /** Resolve an island import and record it in the client manifest. */
   function registerIsland(
     spec: string,
     importerDir: string,
@@ -88,7 +58,6 @@ export function islandsPlugin(
 
       configResolved(config) {
         resolvedConfig = config;
-        viteRoot = config.root;
         isDev = config.command === 'serve';
       },
 
@@ -104,7 +73,6 @@ export function islandsPlugin(
           // Pre-scan island pages to populate the manifest eagerly.
           // This is needed because the client build may load the virtual
           // islands-client entry before island page transforms run.
-          // Scan both pages AND layouts for island imports
           const filesToScan: ReadonlyArray<ScannableEntry> = [
             ...pageScan.pages.map((page) => ({
               filePath: page.componentPath,
@@ -131,7 +99,6 @@ export function islandsPlugin(
             }
           }
 
-          // Collect .vue files needing CSS for island pages
           for (const page of pageScan.pages) {
             if (!page.island) {
               continue;
@@ -152,31 +119,17 @@ export function islandsPlugin(
       },
 
       resolveId: {
-        filter: { id: /^virtual:void-islands-(renderer|client)$|\.vue\.css$/ },
+        filter: { id: /^virtual:void-islands-(renderer|client)$/ },
         handler(source) {
           if (source === ISLANDS_RENDERER_ID || source === ISLANDS_CLIENT_ENTRY_ID) {
             return '\0' + source;
           }
-          // Virtual island CSS modules — no \0 prefix so Vite CSS pipeline processes them.
-          // Return absolute path so CSS @import resolution uses the correct directory.
-          if (source.endsWith('.css')) {
-            const srcPath = normalizePath(source.slice(0, -4));
-            if (islandCssFiles.has(srcPath)) {
-              return srcPath + '.css';
-            }
-            if (srcPath.startsWith('/')) {
-              const absPath = normalizePath(resolve(viteRoot, srcPath.slice(1)));
-              if (islandCssFiles.has(absPath)) {
-                return absPath + '.css';
-              }
-            }
-          }
         },
       },
 
       load: {
         // eslint-disable-next-line no-control-regex -- Vite virtual module null-byte prefix
-        filter: { id: /^\0virtual:void-islands-(renderer|client)$|\.vue\.css$/ },
+        filter: { id: /^\0virtual:void-islands-(renderer|client)$/ },
         handler(id) {
           if (id === '\0' + ISLANDS_RENDERER_ID) {
             if (!pageScan) {
@@ -197,13 +150,6 @@ export function islandsPlugin(
             }
             return generateIslandClientEntry(islandManifest, islandCssFiles, isDev);
           }
-          // Virtual island CSS module — resolveId returns absolute path
-          if (id.endsWith('.css') && !id.startsWith('\0')) {
-            const srcPath = id.slice(0, -4);
-            if (islandCssFiles.has(srcPath)) {
-              return extractCss(srcPath);
-            }
-          }
         },
       },
 
@@ -239,8 +185,6 @@ export function islandsPlugin(
             const replacement = `import ${rawName} from ${specRaw}`;
             edits.push({ start: islandImport.start, end: islandImport.end, text: replacement });
 
-            // Generate wrapper that adds data-island attributes during SSR.
-            // Uses Vue's h() function for createElement.
             wrappers.push(
               `const ${name} = {` +
                 ` inheritAttrs: false,` +
@@ -287,7 +231,6 @@ export function islandsPlugin(
         if (env.command === 'serve') {
           return { optimizeDeps: { include: ['vue'] } };
         }
-        // Only add the islands client entry when content needs it
         if (needsIslandClientBundle(pagesDir, /\.island\.vue$/, true)) {
           return {
             environments: {
@@ -341,7 +284,6 @@ export async function renderIslandPage(pageObj, assetTags) {
   const app = createSSRApp({
     setup() {
       provide("__void_shared", reactive(pageObj.shared || {}));
-      provide("__void_errors", reactive(pageObj.errors || {}));
       provide("__void_params", reactive(pageObj.params || {}));
       if (__frontmatter) provide("__void_frontmatter", __frontmatter);
       // No router provided — islands have no Void Router
@@ -397,7 +339,6 @@ function generateIslandClientEntry(
     const styleRe = /<style\b([^>]*)>/g;
     for (const file of cssFiles) {
       const content = readFileSync(file, 'utf-8');
-      // Extract <style> blocks via Vue SFC query params
       styleRe.lastIndex = 0;
       let index = 0;
       let match;
diff --git a/packages/vue/src/plugin-pages.ts b/packages/vue/src/plugin-pages.ts
index 61d9b76b8..a1629774c 100644
--- a/packages/vue/src/plugin-pages.ts
+++ b/packages/vue/src/plugin-pages.ts
@@ -286,7 +286,6 @@ export async function renderPage(pageObj, assetTags) {
   const app = createSSRApp({
     setup() {
       provide("__void_shared", reactive(pageObj.shared || {}));
-      provide("__void_errors", reactive(pageObj.errors || {}));
       provide("__void_params", reactive(pageObj.params || {}));
       provide("__void_router", createSsrRouter(pageObj.url || "/", pageObj.params || {}));
       provide("__void_navigation", idleNavigationState());
@@ -338,7 +337,6 @@ import { parseCacheFor } from "void/pages-prefetch";
 ${generateComponentManifest(scan, pagesDir)}
 
 const shared = reactive({});
-const errors = reactive({});
 const params = reactive({});
 const currentComponent = shallowRef(null);
 const currentLayouts = shallowRef([]);
@@ -368,7 +366,6 @@ const { router, initialPageData, initialComponent, initialLayouts, start, commit
       applyUpdate(pageData, comp, layouts, options) {
         if (!options?.preserveState) currentPageKey.value++;
         replaceRecord(shared, pageData.shared || {});
-        replaceRecord(errors, pageData.errors || {});
         replaceRecord(params, pageData.params || {});
         currentProps.value = pageData.props;
         currentLayouts.value = layouts;
@@ -397,7 +394,6 @@ const reactiveRouter = createRouterFacade(router, () => routeUrl.value, () => pa
 setActionRouter(reactiveRouter);
 
 Object.assign(shared, initialPageData.shared || {});
-replaceRecord(errors, initialPageData.errors || {});
 replaceRecord(params, initialPageData.params || {});
 currentProps.value = initialPageData.props;
 currentComponent.value = initialComponent;
@@ -409,7 +405,6 @@ const createVoidApp = appEl.getAttribute("data-void-ssr") === "false" ? createAp
 const app = createVoidApp({
   setup() {
     provide("__void_shared", shared);
-    provide("__void_errors", errors);
     provide("__void_params", params);
     provide("__void_router", reactiveRouter);
     provide("__void_navigation", navigation);
diff --git a/packages/vue/src/runtime/link.ts b/packages/vue/src/runtime/link.ts
index 675152f51..a8aa03455 100644
--- a/packages/vue/src/runtime/link.ts
+++ b/packages/vue/src/runtime/link.ts
@@ -1,4 +1,9 @@
-import { isModifiedEvent, mergeDataIntoHref, type VoidRouter } from 'void/pages-client';
+import {
+  isModifiedEvent,
+  mergeDataIntoHref,
+  type PrefetchOptions,
+  type VoidRouter,
+} from 'void/pages-client';
 import {
   computed,
   defineComponent,
@@ -14,16 +19,6 @@ import {
 type PrefetchStrategy = 'hover' | 'click' | 'mount' | 'visible';
 type LinkMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
 type NavigateEvent = { preventDefault(): void };
-type PrefetchOptions = {
-  cacheFor?: number | string | [string, string];
-  method?: LinkMethod;
-};
-
-function hasPrefetch(
-  prefetch: boolean | PrefetchStrategy | ReadonlyArray<PrefetchStrategy>,
-): boolean {
-  return prefetch !== false;
-}
 
 function callHandler(handler: unknown, event: Event): void {
   if (Array.isArray(handler)) {
@@ -89,13 +84,10 @@ export const Link: Component = defineComponent({
       if (hrefWithData.value === current) {
         return;
       }
-      const options: PrefetchOptions = {};
+      const options: PrefetchOptions = { method: normalizedMethod.value };
       if (props.cacheFor !== undefined) {
         options.cacheFor = props.cacheFor;
       }
-      if (normalizedMethod.value) {
-        options.method = normalizedMethod.value;
-      }
       router.prefetch(hrefWithData.value, options);
     }
 
@@ -204,7 +196,7 @@ export const Link: Component = defineComponent({
     });
 
     return () => {
-      if (hasPrefetch(props.prefetch) && !isGet.value) {
+      if (props.prefetch !== false && !isGet.value) {
         throw new Error(
           'Link: prefetch only supports GET links. Remove `prefetch` or use method="GET".',
         );
diff --git a/packages/vue/src/runtime/use-navigation.ts b/packages/vue/src/runtime/use-navigation.ts
index e51891a87..0384d2a19 100644
--- a/packages/vue/src/runtime/use-navigation.ts
+++ b/packages/vue/src/runtime/use-navigation.ts
@@ -1,8 +1,6 @@
 import { idleNavigationState, type NavigationState } from 'void/pages-client';
 import { inject } from 'vue';
 
-export type { NavigationState } from 'void/pages-client';
-
 export function useNavigation(): NavigationState {
   return inject<NavigationState | null>('__void_navigation', null) ?? idleNavigationState();
 }
diff --git a/packages/vue/src/runtime/use-router.ts b/packages/vue/src/runtime/use-router.ts
index 6ac1c5572..27d5ee9e3 100644
--- a/packages/vue/src/runtime/use-router.ts
+++ b/packages/vue/src/runtime/use-router.ts
@@ -2,8 +2,6 @@ import { ssrProxy } from 'void/pages-client';
 import type { VoidRouter } from 'void/pages-client';
 import { inject } from 'vue';
 
-export type { VoidRouter } from 'void/pages-client';
-
 export function useRouter(): VoidRouter {
   return inject<VoidRouter | null>('__void_router', null) ?? ssrProxy;
 }
diff --git a/packages/vue/test/integration/vue-pages-client.test.ts b/packages/vue/test/integration/vue-pages-client.test.ts
index b38df5a19..62f75e4d8 100644
--- a/packages/vue/test/integration/vue-pages-client.test.ts
+++ b/packages/vue/test/integration/vue-pages-client.test.ts
@@ -1,22 +1,27 @@
-import { execSync } from 'node:child_process';
+import { execSync, type ChildProcess } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import spawn from 'cross-spawn';
 import { type Browser, type Page } from 'playwright';
 import { describe, expect, it, beforeAll, afterAll } from 'vite-plus/test';
-import { waitForIslandsHydrated } from '../../../../test/browser-helpers.ts';
-import { killChild, startServer, waitForServer } from '../../../../test/integration-helpers.ts';
+import {
+  killChild,
+  spawnPlaygroundServer,
+  startServer,
+  waitForServer,
+} from '../../../../test/integration-helpers.ts';
 import { launchPagesBrowser } from '../../../../test/pages-browser.ts';
-import { registerSharedClientTests } from '../../../../test/pages-client-contract.ts';
-import { defineSharedIslandTests } from '../../../../test/pages-island-contract.ts';
+import {
+  registerSharedClientTests,
+  registerSharedDevSsrTest,
+} from '../../../../test/pages-client-contract.ts';
+import {
+  defineSharedIslandHmrTests,
+  defineSharedIslandTests,
+} from '../../../../test/pages-island-contract.ts';
 
 declare global {
   interface Window {
     __void_vite_connected?: boolean;
-    __SPA_MARKER?: boolean;
-    __linkOnClick?: boolean;
-    __preventedClick?: boolean;
-    __preventedNavigate?: boolean;
     __hmr_marker?: boolean;
   }
 }
@@ -167,7 +172,6 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
       await page.goto(BASE + '/');
       await waitForHydration(page);
 
-      // Stamp the nav element
       await page.evaluate(() => {
         (document.querySelector('nav') as NavElement | null)!.__stamp = 1;
       });
@@ -188,62 +192,18 @@ function registerClientTests(getBase: () => string, coverage: 'smoke' | 'full')
       await page.context().close();
     }
   });
-
-  it('deferred props: SPA navigation resolves in browser', async () => {
-    const page = await newPage();
-    try {
-      await page.goto(BASE + '/');
-      await waitForHydration(page);
-
-      // SPA navigate to deferred page
-      await page.click('a[href="/deferred"]');
-      await page.waitForFunction(() => document.querySelector('[data-testid="deferred-resolved"]'));
-
-      const text = await page.textContent('[data-testid="deferred-resolved"]');
-      expect(text).toBe('Count: 42');
-      expect(page.url()).toBe(BASE + '/deferred');
-    } finally {
-      await page.context().close();
-    }
-  });
 }
 
 describe('vue-pages client (dev)', () => {
-  let child: ReturnType<typeof spawn>;
-  let stderr = '';
+  let child: ChildProcess | undefined;
 
   beforeAll(
     async () => {
       const serverTimeout = process.platform === 'win32' ? 45_000 : 20_000;
-      const server = await startServer((port) => {
-        child = spawn(
-          'vp',
-          [
-            'run',
-            '--filter',
-            './playground/vue-pages',
-            'dev',
-            '--host',
-            '127.0.0.1',
-            '--port',
-            String(port),
-            '--strictPort',
-          ],
-          {
-            cwd: ROOT,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            env: {
-              ...process.env,
-              VOID_INSPECTOR_PORT: 'false',
-            },
-          },
-        );
-        stderr = '';
-        child.stderr!.on('data', (chunk: Buffer) => {
-          stderr += String(chunk);
-        });
-        return child;
-      }, serverTimeout);
+      const server = await startServer(
+        (port) => (child = spawnPlaygroundServer(ROOT, 'vue-pages', 'dev', port)),
+        serverTimeout,
+      );
       DEV_BASE = server.base;
     },
     process.platform === 'win32' ? 60_000 : 30_000,
@@ -253,225 +213,9 @@ describe('vue-pages client (dev)', () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting dev server')) {
-      throw new Error(stderr);
-    }
   });
 
-  it('dev: SSR pages, Inertia protocol, form handling, API coexistence', async () => {
-    // 1. Initial page load returns SSR HTML with embedded page data
-    const rootRes = await fetch(`${DEV_BASE}/`);
-    expect(rootRes.status).toBe(200);
-    const rootHtml = await rootRes.text();
-    expect(rootHtml).toContain('__VOID_PAGE_DATA__');
-    expect(rootHtml).toContain('Welcome');
-    expect(rootHtml).toContain('Vue Pages Demo'); // shared data from middleware
-
-    // Inline page-data must round-trip through the <script> tag without
-    // truncation. If serializePageData ever regresses (e.g. via another
-    // template-literal backslash-collapse), the </script> in scriptProbe
-    // closes the inline tag early, the regex below captures truncated
-    // text, and JSON.parse throws.
-    const probe = '</script><script>alert(1)</script>\u2028\u2029&';
-    const probeMatch = rootHtml.match(/<script id="__VOID_PAGE_DATA__"[^>]*>([\s\S]*?)<\/script>/);
-    expect(probeMatch).not.toBeNull();
-    const probeJson = probeMatch![1];
-    expect(probeJson).not.toMatch(/<\/script/i);
-    expect(JSON.parse(probeJson).shared.scriptProbe).toBe(probe);
-
-    // 2. SSR content contains server-rendered props
-    expect(rootHtml).toContain('This is the Vue Pages playground.');
-
-    // 3. Users page SSR — server-rendered user list
-    const usersRes = await fetch(`${DEV_BASE}/users`);
-    expect(usersRes.status).toBe(200);
-    const usersHtml = await usersRes.text();
-    expect(usersHtml).toContain('__VOID_PAGE_DATA__');
-    expect(usersHtml).toContain('Alice');
-    expect(usersHtml).toContain('Bob');
-    expect(usersHtml).toContain('Vue Pages Demo'); // layout with shared data
-
-    // 4. User detail page SSR
-    const userRes = await fetch(`${DEV_BASE}/users/1`);
-    expect(userRes.status).toBe(200);
-    const userHtml = await userRes.text();
-    expect(userHtml).toContain('Alice');
-    expect(userHtml).toContain('alice@example.com');
-
-    // 5. Inertia navigation — GET / with X-VoidPages header returns JSON page object
-    const inertiaRoot = await fetch(`${DEV_BASE}/`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaRoot.status).toBe(200);
-    expect(inertiaRoot.headers.get('X-VoidPages')).toBe('true');
-    const rootPage = (await inertiaRoot.json()) as {
-      component: string;
-      props: Record<string, unknown>;
-      shared: Record<string, unknown>;
-      url: string;
-    };
-    expect(rootPage.component).toBe('index');
-    expect(rootPage.props).toHaveProperty('title', 'Home');
-    expect(rootPage.shared).toHaveProperty('appName', 'Vue Pages Demo');
-    expect(rootPage.url).toBe('/');
-
-    // 6. Inertia navigation — GET /users returns user list in props
-    const inertiaUsers = await fetch(`${DEV_BASE}/users`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaUsers.status).toBe(200);
-    const usersPage = (await inertiaUsers.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-    };
-    expect(usersPage.component).toBe('users');
-    expect(usersPage.props.users).toHaveLength(2);
-    expect(usersPage.props.users[0].name).toBe('Alice');
-
-    // 7. API coexistence — /api/health returns JSON (not a page object)
-    const healthRes = await fetch(`${DEV_BASE}/api/health`);
-    expect(healthRes.status).toBe(200);
-    const healthBody = (await healthRes.json()) as { status: string };
-    expect(healthBody.status).toBe('ok');
-
-    // 8. Form submission — POST /users with valid data
-    const postValid = await fetch(`${DEV_BASE}/users`, {
-      method: 'POST',
-      headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: 'Charlie', email: 'charlie@example.com' }),
-    });
-    expect(postValid.status).toBe(200);
-    const validPage = (await postValid.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-      errors: Record<string, string> | null;
-    };
-    expect(validPage.errors).toBeNull();
-    expect(validPage.props.users).toHaveLength(3);
-    expect(validPage.props.users[2].name).toBe('Charlie');
-
-    // 9. Form submission — POST /users with invalid data returns validation errors
-    const postInvalid = await fetch(`${DEV_BASE}/users`, {
-      method: 'POST',
-      headers: { 'X-VoidPages': 'true', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: '', email: '' }),
-    });
-    expect(postInvalid.status).toBe(200);
-    const invalidPage = (await postInvalid.json()) as {
-      component: string;
-      props: { users: ReadonlyArray<{ id: number; name: string }> };
-      errors: Record<string, string> | null;
-    };
-    expect(invalidPage.errors).not.toBeNull();
-    expect(invalidPage.errors!.name).toBe('Name is required');
-    expect(invalidPage.errors!.email).toBe('Email is required');
-    // Props should still be populated (re-ran GET)
-    expect(invalidPage.props.users.length).toBeGreaterThanOrEqual(2);
-
-    // 10. User detail via Inertia
-    const inertiaUser = await fetch(`${DEV_BASE}/users/1`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaUser.status).toBe(200);
-    const userPage = (await inertiaUser.json()) as {
-      component: string;
-      props: { user: { id: number; name: string; email: string } };
-    };
-    expect(userPage.component).toBe('users/[id]');
-    expect(userPage.props.user.name).toBe('Alice');
-
-    // 11. Newly added user is accessible via detail page
-    const inertiaCharlie = await fetch(`${DEV_BASE}/users/3`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaCharlie.status).toBe(200);
-    const charliePage = (await inertiaCharlie.json()) as {
-      component: string;
-      props: { user: { id: number; name: string; email: string } };
-    };
-    expect(charliePage.component).toBe('users/[id]');
-    expect(charliePage.props.user.name).toBe('Charlie');
-    expect(charliePage.props.user.email).toBe('charlie@example.com');
-
-    // --- Island pages ---
-
-    // 12. Island page SSR — HTML with data-island markers, NOT embedded page data
-    const blogRes = await fetch(`${DEV_BASE}/blog`);
-    expect(blogRes.status).toBe(200);
-    const blogHtml = await blogRes.text();
-    expect(blogHtml).toContain('data-island=');
-    expect(blogHtml).toContain('data-props=');
-    expect(blogHtml).toContain('data-hydrate=');
-    expect(blogHtml).not.toContain('__VOID_PAGE_DATA__');
-    expect(blogHtml).toContain('Hello World');
-    expect(blogHtml).toContain('Second Post');
-    expect(blogHtml).toContain('Count:');
-
-    // 13. Island page always returns HTML even with X-VoidPages header
-    const inertiaBlog = await fetch(`${DEV_BASE}/blog`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(inertiaBlog.status).toBe(200);
-    expect(inertiaBlog.headers.get('content-type')).toContain('text/html');
-    expect(inertiaBlog.headers.get('X-VoidPages')).toBeNull();
-    const inertiaBlogHtml = await inertiaBlog.text();
-    expect(inertiaBlogHtml).toContain('data-island=');
-
-    // 14. Island mutation — validation errors return JSON 422
-    const blogPostInvalid = await fetch(`${DEV_BASE}/blog`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ title: '', body: '' }),
-    });
-    expect(blogPostInvalid.status).toBe(422);
-    const invalidBlog = (await blogPostInvalid.json()) as { errors: Record<string, string> };
-    expect(invalidBlog.errors.title).toBe('Title is required');
-    expect(invalidBlog.errors.body).toBe('Body is required');
-
-    // 15. Island mutation — success returns JSON 200
-    const blogPostValid = await fetch(`${DEV_BASE}/blog`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ title: 'Third Post', body: 'Content here' }),
-    });
-    expect(blogPostValid.status).toBe(200);
-    const validBlog = (await blogPostValid.json()) as { success: boolean };
-    expect(validBlog.success).toBe(true);
-
-    // 16. Island detail page with dynamic param
-    const detailRes = await fetch(`${DEV_BASE}/blog/hello-world`);
-    expect(detailRes.status).toBe(200);
-    const detailHtml = await detailRes.text();
-    expect(detailHtml).toContain('Hello World');
-    expect(detailHtml).toContain('First post');
-    expect(detailHtml).not.toContain('__VOID_PAGE_DATA__');
-
-    // --- Deferred props ---
-
-    // 17. Deferred props: SPA navigation streams NDJSON
-    const deferredInertia = await fetch(`${DEV_BASE}/deferred`, {
-      headers: { 'X-VoidPages': 'true' },
-    });
-    expect(deferredInertia.headers.get('content-type')).toContain('application/x-ndjson');
-    const ndjsonText = await deferredInertia.text();
-    const ndjsonLines = ndjsonText.trim().split('\n');
-    expect(ndjsonLines.length).toBe(2);
-    const pageObj = JSON.parse(ndjsonLines[0]);
-    expect(pageObj.component).toBe('deferred');
-    expect(pageObj.props.title).toBe('Deferred Page');
-    expect(pageObj.deferredKeys).toEqual({ stats: 'stats' });
-    const deferredLine = JSON.parse(ndjsonLines[1]);
-    expect(deferredLine.__deferred).toBe('stats');
-    expect(deferredLine.data).toEqual({ count: 42 });
-
-    // 18. Deferred props: SSR includes resolution script tags
-    const deferredSsr = await fetch(`${DEV_BASE}/deferred`);
-    const deferredHtml = await deferredSsr.text();
-    expect(deferredHtml).toContain('__VOID_PAGE_DATA__');
-    expect(deferredHtml).toContain('Deferred Page');
-    expect(deferredHtml).toContain('window.__resolveDeferred("stats"');
-    expect(deferredHtml).toContain('"count":42');
-  });
+  registerSharedDevSsrTest({ getBase: () => DEV_BASE, framework: 'Vue' });
 
   defineClientTests(() => DEV_BASE, 'smoke');
   defineSharedIslandTests(
@@ -559,97 +303,19 @@ describe('vue-pages client (dev)', () => {
     },
   );
 
-  it('island component HMR updates without full page reload', { retry: 2 }, async () => {
-    const counterFile = join(ROOT, 'playground/vue-pages/pages/blog/_Counter.vue');
-    const original = readFileSync(counterFile, 'utf-8');
-
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    page.setDefaultTimeout(10_000);
-
-    try {
-      await prepareForViteHmr(page);
-      await page.goto(`${DEV_BASE}/blog`);
-      await waitForIslandsHydrated(page, 2);
-      await waitForViteHmr(page);
-
-      // Interact to establish client state — count becomes 1
-      await page.click("button:has-text('Increment')");
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent === 'Count: 1',
-      );
-
-      // Set a window marker to detect full page reload
-      await page.evaluate(() => {
-        window.__hmr_marker = true;
-      });
-
-      // Edit the island component — change the label in the template
-      const modified = original.replace('Count: {{ count }}', 'Total: {{ count }}');
-      writeFileSync(counterFile, modified);
-
-      // Wait for HMR to update the component text
-      await page.waitForFunction(
-        () => document.querySelector('[data-testid="count"]')?.textContent?.startsWith('Total:'),
-        { timeout: 15_000 },
-      );
-
-      // No full page reload — window marker should still be set
-      const markerSurvived = await page.evaluate(() => window.__hmr_marker === true);
-      expect(markerSurvived).toBe(true);
-
-      // Vue HMR preserves reactive state for template-only changes — count should still be 1
-      const text = await page.textContent('[data-testid="count"]');
-      expect(text).toBe('Total: 1');
-    } finally {
-      await page.context().close();
-      writeFileSync(counterFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: 'Count:' });
-    }
-  });
-
-  it('island file edit triggers reload with updated content', { retry: 2 }, async () => {
-    const islandFile = join(ROOT, 'playground/vue-pages/pages/blog/index.island.vue');
-    const original = readFileSync(islandFile, 'utf-8');
-
-    try {
-      // Verify initial content renders
-      const initialRes = await fetch(`${DEV_BASE}/blog`);
-      expect(initialRes.status).toBe(200);
-      const initialHtml = await initialRes.text();
-      expect(initialHtml).toContain('<h1>Blog</h1>');
-
-      // Edit the island file — change the heading
-      const modified = original.replace('<h1>Blog</h1>', '<h1>Blog Updated</h1>');
-      writeFileSync(islandFile, modified);
-
-      // Poll for updated content — every request must return 200 (no ISE).
-      // The previous bug: sending full-reload to the workerd triggered a
-      // program reload that caused framework dual-instance errors (500s).
-      const start = Date.now();
-      let updatedHtml = '';
-      while (Date.now() - start < 10_000) {
-        await new Promise((r) => setTimeout(r, 100));
-        const res = await fetch(`${DEV_BASE}/blog`);
-        expect(res.status).toBe(200);
-        updatedHtml = await res.text();
-        if (updatedHtml.includes('Blog Updated')) {
-          break;
-        }
-      }
-
-      expect(updatedHtml).toContain('<h1>Blog Updated</h1>');
-      expect(updatedHtml).toContain('data-island=');
-    } finally {
-      writeFileSync(islandFile, original);
-      await waitForServer(`${DEV_BASE}/blog`, 10_000, { expectBody: '<h1>Blog</h1>' });
-    }
+  defineSharedIslandHmrTests({
+    getBase: () => DEV_BASE,
+    getBrowser: () => browser,
+    counterFile: join(ROOT, 'playground/vue-pages/pages/blog/_Counter.vue'),
+    islandFile: join(ROOT, 'playground/vue-pages/pages/blog/index.island.vue'),
+    hmrKeepsState: true,
+    prepareHmr: prepareForViteHmr,
+    waitForHmr: waitForViteHmr,
   });
 });
 
 describe('vue-pages client (preview)', { retry: 2 }, () => {
-  let child: ReturnType<typeof spawn>;
-  let stderr = '';
+  let child: ChildProcess | undefined;
 
   beforeAll(async () => {
     if (!existsSync(join(ROOT, 'playground/vue-pages/dist'))) {
@@ -659,35 +325,10 @@ describe('vue-pages client (preview)', { retry: 2 }, () => {
       });
     }
 
-    const server = await startServer((port) => {
-      child = spawn(
-        'vp',
-        [
-          'run',
-          '--filter',
-          './playground/vue-pages',
-          'preview',
-          '--host',
-          '127.0.0.1',
-          '--port',
-          String(port),
-          '--strictPort',
-        ],
-        {
-          cwd: ROOT,
-          stdio: ['ignore', 'pipe', 'pipe'],
-          env: {
-            ...process.env,
-            VOID_INSPECTOR_PORT: 'false',
-          },
-        },
-      );
-      stderr = '';
-      child.stderr!.on('data', (chunk: Buffer) => {
-        stderr += String(chunk);
-      });
-      return child;
-    }, 30_000);
+    const server = await startServer(
+      (port) => (child = spawnPlaygroundServer(ROOT, 'vue-pages', 'preview', port)),
+      30_000,
+    );
     PREVIEW_BASE = server.base;
   });
 
@@ -695,9 +336,6 @@ describe('vue-pages client (preview)', { retry: 2 }, () => {
     if (child) {
       await killChild(child);
     }
-    if (stderr.includes('error when starting preview server')) {
-      throw new Error(stderr);
-    }
   });
 
   defineClientTests(() => PREVIEW_BASE);
diff --git a/packages/vue/test/unit/plugin-islands.test.ts b/packages/vue/test/unit/plugin-islands.test.ts
index c21da34af..19f32ebf1 100644
--- a/packages/vue/test/unit/plugin-islands.test.ts
+++ b/packages/vue/test/unit/plugin-islands.test.ts
@@ -7,6 +7,15 @@ import { islandsPlugin } from '../../src/plugin-islands.ts';
 const TMP = join(import.meta.dirname, '__tmp_islands_plugin__');
 const PAGES_DIR = join(TMP, 'pages');
 type HookWithHandler<T> = { handler: T };
+type MockServer = {
+  watcher: EventEmitter;
+  environments: {
+    client: {
+      moduleGraph: { getModuleById(): null; invalidateModule(): void };
+    };
+  };
+  middlewares: { use(): void };
+};
 type IslandsPluginHooks = {
   configResolved?: (config: {
     root: string;
@@ -14,27 +23,7 @@ type IslandsPluginHooks = {
     plugins: ReadonlyArray<unknown>;
   }) => void;
   buildStart?: (() => Promise<void>) | HookWithHandler<() => Promise<void>>;
-  configureServer?:
-    | ((server: {
-        watcher: EventEmitter;
-        environments: {
-          client: {
-            moduleGraph: { getModuleById(): null; invalidateModule(): void };
-          };
-        };
-        middlewares: { use(): void };
-      }) => void)
-    | HookWithHandler<
-        (server: {
-          watcher: EventEmitter;
-          environments: {
-            client: {
-              moduleGraph: { getModuleById(): null; invalidateModule(): void };
-            };
-          };
-          middlewares: { use(): void };
-        }) => void
-      >;
+  configureServer?: ((server: MockServer) => void) | HookWithHandler<(server: MockServer) => void>;
   load?: ((id: string) => string | undefined) | HookWithHandler<(id: string) => string | undefined>;
 };
 
@@ -136,12 +125,10 @@ const count = ref(0)
     const clientEntry = loadClientEntry();
 
     expect(clientEntry).toBeDefined();
-    // The island manifest should contain the Counter component from the layout
     expect(clientEntry).toContain('pages/_components/Counter');
   });
 
   it('pre-scans island imports from island pages into the manifest', async () => {
-    // Island page with an island import (no layout)
     writeFile(
       'index.island.vue',
       `<script setup>
@@ -149,7 +136,6 @@ import Toggle from "./Toggle.vue" with { island: "idle" }
 </script>
 <template><Toggle /></template>`,
     );
-    // The island component
     writeFile(
       'Toggle.vue',
       `<script setup>
@@ -168,7 +154,6 @@ const on = ref(false)
   });
 
   it('includes island imports from both pages and layouts', async () => {
-    // Island layout with one island import
     writeFile(
       'app/layout.island.vue',
       `<script setup>
@@ -176,7 +161,6 @@ import Nav from "../_components/Nav.vue" with { island: "load" }
 </script>
 <template><Nav /><slot /></template>`,
     );
-    // Island page with a different island import
     writeFile(
       'app/index.island.vue',
       `<script setup>
@@ -184,7 +168,6 @@ import Widget from "../_components/Widget.vue" with { island: "idle" }
 </script>
 <template><Widget /></template>`,
     );
-    // Both island components (under _ prefix so scanPages ignores them)
     writeFile('_components/Nav.vue', `<template><nav>Nav</nav></template>`);
     writeFile('_components/Widget.vue', `<template><div>Widget</div></template>`);
 
@@ -193,7 +176,6 @@ import Widget from "../_components/Widget.vue" with { island: "idle" }
     const clientEntry = loadClientEntry();
 
     expect(clientEntry).toBeDefined();
-    // Both should be in the manifest
     expect(clientEntry).toContain('pages/_components/Nav');
     expect(clientEntry).toContain('pages/_components/Widget');
   });
@@ -240,11 +222,9 @@ title: Hello
     await buildStart();
     configureServer();
 
-    // Before adding the named layout, the renderer should NOT contain it
     const rendererBefore = loadRenderer();
     expect(rendererBefore).not.toContain('_layouts/article');
 
-    // Now create the named layout file AND update the markdown to reference it
     writeFile('_layouts/article.island.vue', `<template><article><slot /></article></template>`);
     writeFile(
       'blog/hello.md',
@@ -256,7 +236,6 @@ title: Hello
 # Hello`,
     );
 
-    // Simulate a file add event for the new layout
     watcher.emit('add', join(PAGES_DIR, '_layouts/article.island.vue'));
 
     // Wait for the 50ms debounce + async scanPages to complete
@@ -278,7 +257,6 @@ import Sidebar from "./Sidebar.vue" with { island: "load" }
 </script>
 <template><slot /></template>`,
     );
-    // Island page
     writeFile(
       'index.island.vue',
       `<script setup></script>
@@ -290,7 +268,6 @@ import Sidebar from "./Sidebar.vue" with { island: "load" }
     await buildStart();
     const clientEntry = loadClientEntry();
 
-    // Sidebar should NOT be in the manifest since the layout is not an island layout
     expect(clientEntry).not.toContain('Sidebar');
   });
 });
diff --git a/packages/vue/vite.config.ts b/packages/vue/vite.config.ts
index 6bcf86643..b2b9c8242 100644
--- a/packages/vue/vite.config.ts
+++ b/packages/vue/vite.config.ts
@@ -2,7 +2,7 @@ import { defineConfig } from 'vite-plus';
 
 export default defineConfig({
   pack: {
-    entry: ['src/index.ts', 'src/plugin.ts', 'src/runtime/index.ts', 'src/runtime/use-deferred.ts'],
+    entry: ['src/index.ts', 'src/plugin.ts', 'src/runtime/use-deferred.ts'],
     format: 'esm',
     dts: true,
     clean: true,
diff --git a/platform/packages/api/test/integration/zero-trust-uninstall.test.ts b/platform/packages/api/test/integration/zero-trust-uninstall.test.ts
index 8c4c55d59..5cef75127 100644
--- a/platform/packages/api/test/integration/zero-trust-uninstall.test.ts
+++ b/platform/packages/api/test/integration/zero-trust-uninstall.test.ts
@@ -9,16 +9,15 @@ import {
   it,
   vi,
 } from 'vite-plus/test';
-import {
-  assertNoPlatformProjects,
-  readPlatformProjectSlugsConnection,
-} from '../../../../../packages/void/src/cli/platform-teardown.ts';
+import { readPlatformProjectSlugsConnection } from '../../../../../packages/void/src/cli/platform-installer-database.ts';
+import { assertNoPlatformProjects } from '../../../../../packages/void/src/cli/platform-teardown.ts';
 import {
   assertProjectZeroTrustAllowsUninstall,
   fencePlatformProjectZeroTrustConnection,
   liftPlatformProjectZeroTrustFenceConnection,
   lockPlatformProjectZeroTrustConnection,
   readPlatformProjectZeroTrustStateConnection,
+  type QueryConnection,
 } from '../../../../../packages/void/src/cli/platform-zero-trust-uninstall.ts';
 import type { ApiEnv } from '../../src/env.ts';
 import app from '../../src/index.ts';
@@ -152,8 +151,6 @@ async function settleOperation(platform: ApiEnv['Bindings']): Promise<void> {
   throw new Error('The Zero Trust operation did not finish within its expected batches');
 }
 
-type QueryConnection = Parameters<typeof readPlatformProjectZeroTrustStateConnection>[0];
-
 describe('platform uninstall check against the API database', () => {
   it('lets uninstall proceed once a project deletion that stopped partway is rerun', async () => {
     const owner = await createTestUser(env.db, 'stopped-deletion-owner');
diff --git a/platform/packages/api/test/unit/check-run.test.ts b/platform/packages/api/test/unit/check-run.test.ts
index 931f4d505..85782f009 100644
--- a/platform/packages/api/test/unit/check-run.test.ts
+++ b/platform/packages/api/test/unit/check-run.test.ts
@@ -173,7 +173,7 @@ describe('createCheckRun', () => {
     expect(reasons).not.toContain('exhausted');
   });
 
-  // Fix B: create: POST -> 500 => returns null WITHOUT retrying. The create POST is
+  // create: POST -> 500 => returns null WITHOUT retrying. The create POST is
   // SINGLE-SHOT (not idempotent — a retry on an ambiguous 5xx could duplicate the run
   // and orphan the first `in_progress`). Exactly ONE POST, one http-5xx warn, and NO
   // `exhausted` warn (the loop returns immediately, it does not run out of attempts).
@@ -204,7 +204,7 @@ describe('createCheckRun', () => {
     expect(reasons).not.toContain('exhausted'); // returns, never loops to exhaustion
   });
 
-  // Fix B: create: POST rejects (network error) => returns null WITHOUT retrying.
+  // create: POST rejects (network error) => returns null WITHOUT retrying.
   // A network failure on the POST is ambiguous (GitHub may have created the run), so
   // a retry risks a duplicate — single-shot. Exactly ONE POST attempt, one
   // network-error warn, no `exhausted`.
diff --git a/platform/packages/dispatch/src/index.ts b/platform/packages/dispatch/src/index.ts
index 0d7359f5b..4b21b166b 100644
--- a/platform/packages/dispatch/src/index.ts
+++ b/platform/packages/dispatch/src/index.ts
@@ -1,4 +1,5 @@
 import type { ProjectZeroTrustRouting } from '@void/edge';
+import { clientRevalidateResponse, isEventStreamResponse } from '@void/isr/runtime';
 import {
   PLATFORM_HEALTH_HOSTNAME_LABEL,
   platformHealthHostname,
@@ -164,13 +165,6 @@ function platformHealthExceptionPath(request: Request, url: URL): boolean {
   });
 }
 
-function clientRevalidateResponse(response: Response): Response {
-  const res = new Response(response.body, response);
-  res.headers.set('Cache-Control', CLIENT_REVALIDATE_CACHE_CONTROL);
-  res.headers.delete(SHARED_CACHE_POLICY_HEADER);
-  return res;
-}
-
 // Fast body-less response for an operation bounded by `withTimeout` that
 // stalled past the budget. `X-Void-Timeout` names the stalled operation for
 // observability; 503s advertise a short `Retry-After` so clients back off.
@@ -198,13 +192,6 @@ function staticAssetFailureResponse(kind: FailureKind): Response {
   });
 }
 
-export function isEventStreamResponse(response: Response): boolean {
-  return (
-    response.headers.get('content-type')?.toLowerCase().split(';', 1)[0]?.trim() ===
-    'text/event-stream'
-  );
-}
-
 export function isHtmlResponse(response: Response): boolean {
   return (
     response.headers.get('content-type')?.toLowerCase().split(';', 1)[0]?.trim() === 'text/html'
diff --git a/platform/packages/dispatch/src/isr.ts b/platform/packages/dispatch/src/isr.ts
index deb7ec044..facc78360 100644
--- a/platform/packages/dispatch/src/isr.ts
+++ b/platform/packages/dispatch/src/isr.ts
@@ -14,6 +14,7 @@ import {
   type IsrCacheEntry,
   type IsrCacheMetadata,
 } from '@void/isr/core';
+import { MAX_ISR_VARIANTS_PER_PATH } from '@void/isr/runtime';
 import type { Env } from './env.ts';
 import { matchSegmentPattern } from './pattern.ts';
 
@@ -40,21 +41,6 @@ export {
 export { isrCacheKey } from '@void/isr';
 export type { IsrCacheEntry, IsrCacheMetadata } from '@void/isr/core';
 
-/**
- * Hard cap on rewrite-variant ISR entries per (project, deployment, pathname).
- * The default `revalidateQueryAllowlist = {}` already drops every query param,
- * so most fanout vectors are closed at the variant-key level — but a path
- * with an allowlisted param (e.g. `/search` with `q`) can still be probed
- * with random `q` values. The cap is the second line of defense: once the
- * KV slot for a pathname holds this many variants, new variants stop being
- * written. The worker still renders fresh content; we simply refuse to
- * persist it, so KV growth and revalidation cost stay bounded.
- *
- * Existing variants continue to update so legitimate ISR refresh keeps
- * working; only NEW variants are rejected past the cap.
- */
-export const MAX_ISR_VARIANTS_PER_PATH = 200;
-
 /**
  * Read an ISR cache entry from KV.
  * Returns null on cache miss, malformed metadata, or a KV read failure so the
diff --git a/platform/packages/dispatch/test/unit/isr.test.ts b/platform/packages/dispatch/test/unit/isr.test.ts
index c40d11fd2..fad4334d5 100644
--- a/platform/packages/dispatch/test/unit/isr.test.ts
+++ b/platform/packages/dispatch/test/unit/isr.test.ts
@@ -1,7 +1,7 @@
+import { MAX_ISR_VARIANTS_PER_PATH } from '@void/isr/runtime';
 import { describe, expect, it, vi, beforeEach, afterEach } from 'vite-plus/test';
 import type { Env } from '../../src/env.ts';
 import {
-  MAX_ISR_VARIANTS_PER_PATH,
   SHARED_CACHE_POLICY_VERSION,
   isrCacheKey,
   isStale,
@@ -55,8 +55,7 @@ describe('isrCacheKey', () => {
     );
   });
 
-  // Host-scoping (FIX #4): the same path under two hostnames never shares a
-  // cache slot.
+  // Host-scoping: the same path under two hostnames never shares a cache slot.
   it('scopes the key to the host segment', () => {
     const a = isrCacheKey('proj_1', 'dpl_1', 'a.example.com', '/about');
     const b = isrCacheKey('proj_1', 'dpl_1', 'b.example.com', '/about');
@@ -242,7 +241,7 @@ describe('resolvePathTtl', () => {
     expect(resolvePathTtl({ '/user/*': 0, '*': 60 }, '/user/profile')).toBe(0);
   });
 
-  // Segment-aware manifest keys (FIX #3): `:slug` anchors to ONE segment,
+  // Segment-aware manifest keys: `:slug` anchors to ONE segment,
   // `*` still crosses `/`. Mirrors the matcher tests in pattern.test.ts.
   it('anchors a `:slug` manifest key to a single path segment', () => {
     expect(resolvePathTtl({ '/blog/:slug': 90 }, '/blog/hello')).toBe(90);
diff --git a/platform/packages/dispatch/test/unit/pattern.test.ts b/platform/packages/dispatch/test/unit/pattern.test.ts
index 9bd7533a8..c3d34bf8a 100644
--- a/platform/packages/dispatch/test/unit/pattern.test.ts
+++ b/platform/packages/dispatch/test/unit/pattern.test.ts
@@ -53,57 +53,52 @@ describe('matchPattern', () => {
 
 describe('compilePattern', () => {
   it('captures :name as single path segment', () => {
-    const { regex, paramNames } = compilePattern('/blog/:slug');
-    expect(paramNames).toEqual(['slug']);
-    expect(regex.exec('/blog/hello')?.groups).toEqual({ slug: 'hello' });
-    expect(regex.exec('/blog/hello/world')).toBeNull();
+    expect(compilePattern('/blog/:slug').paramNames).toEqual(['slug']);
+    expect(matchPatternCaptures('/blog/:slug', '/blog/hello')).toEqual({ slug: 'hello' });
+    expect(matchPatternCaptures('/blog/:slug', '/blog/hello/world')).toBeNull();
   });
 
   it('captures :name* as zero-or-more segments', () => {
-    const { regex, paramNames } = compilePattern('/docs/:path*');
-    expect(paramNames).toEqual(['path']);
-    expect(regex.exec('/docs/a/b/c')?.groups).toEqual({ path: 'a/b/c' });
-    expect(regex.exec('/docs/')?.groups).toEqual({ path: '' });
+    expect(compilePattern('/docs/:path*').paramNames).toEqual(['path']);
+    expect(matchPatternCaptures('/docs/:path*', '/docs/a/b/c')).toEqual({ path: 'a/b/c' });
+    expect(matchPatternCaptures('/docs/:path*', '/docs/')).toEqual({ path: '' });
   });
 
   it('captures legacy * as splat', () => {
-    const { regex, paramNames } = compilePattern('/assets/*');
-    expect(paramNames).toEqual(['splat']);
-    expect(regex.exec('/assets/js/app.js')?.groups).toEqual({ splat: 'js/app.js' });
+    expect(compilePattern('/assets/*').paramNames).toEqual(['splat']);
+    expect(matchPatternCaptures('/assets/*', '/assets/js/app.js')).toEqual({ splat: 'js/app.js' });
   });
 
   it('captures middle * as only what actually matched, not prefix-slice', () => {
-    const { regex } = compilePattern('/blog/*/edit');
-    expect(regex.exec('/blog/hello/edit')?.groups).toEqual({ splat: 'hello' });
-    expect(regex.exec('/blog/a/b/edit')?.groups).toEqual({ splat: 'a/b' });
-    expect(regex.exec('/blog/hello')).toBeNull();
+    expect(matchPatternCaptures('/blog/*/edit', '/blog/hello/edit')).toEqual({ splat: 'hello' });
+    expect(matchPatternCaptures('/blog/*/edit', '/blog/a/b/edit')).toEqual({ splat: 'a/b' });
+    expect(matchPatternCaptures('/blog/*/edit', '/blog/hello')).toBeNull();
   });
 
   it('matches legacy patterns with multiple anonymous wildcards', () => {
-    const { regex, paramNames } = compilePattern('/a/*/b/*');
-    expect(paramNames).toEqual(['splat']);
-    expect(regex.test('/a/x/b/y')).toBe(true);
-    expect(regex.test('/a/x/c/y')).toBe(false);
+    expect(compilePattern('/a/*/b/*').paramNames).toEqual(['splat']);
+    expect(matchPattern('/a/*/b/*', '/a/x/b/y')).toBe(true);
+    expect(matchPattern('/a/*/b/*', '/a/x/c/y')).toBe(false);
   });
 
   it('captures multiple named params in one pattern', () => {
-    const { regex, paramNames } = compilePattern('/blog/:author/:slug');
-    expect(paramNames).toEqual(['author', 'slug']);
-    expect(regex.exec('/blog/alice/hello')?.groups).toEqual({ author: 'alice', slug: 'hello' });
-    expect(regex.exec('/blog/alice/hello/world')).toBeNull();
+    expect(compilePattern('/blog/:author/:slug').paramNames).toEqual(['author', 'slug']);
+    expect(matchPatternCaptures('/blog/:author/:slug', '/blog/alice/hello')).toEqual({
+      author: 'alice',
+      slug: 'hello',
+    });
+    expect(matchPatternCaptures('/blog/:author/:slug', '/blog/alice/hello/world')).toBeNull();
   });
 
   it('escapes regex-special characters in literals', () => {
-    const { regex } = compilePattern('/foo.html');
-    expect(regex.test('/foo.html')).toBe(true);
-    expect(regex.test('/fooXhtml')).toBe(false);
+    expect(matchPattern('/foo.html', '/foo.html')).toBe(true);
+    expect(matchPattern('/foo.html', '/fooXhtml')).toBe(false);
   });
 
   it('treats bare colon (no name chars after) as literal', () => {
-    const { regex, paramNames } = compilePattern('/foo:/bar');
-    expect(paramNames).toEqual([]);
-    expect(regex.test('/foo:/bar')).toBe(true);
-    expect(regex.test('/fooX/bar')).toBe(false);
+    expect(compilePattern('/foo:/bar').paramNames).toEqual([]);
+    expect(matchPattern('/foo:/bar', '/foo:/bar')).toBe(true);
+    expect(matchPattern('/foo:/bar', '/fooX/bar')).toBe(false);
   });
 
   it('matchPattern supports legacy patterns with multiple anonymous wildcards', () => {
@@ -304,8 +299,8 @@ describe('matchSegmentPattern', () => {
   it('does NOT widen a REGEX-constrained `:name{...}` param (only exact `{.+}`)', () => {
     // Only the literal `{.+}` constraint widens to a catch-all. A regex-
     // constrained param like `:path{[0-9]+}` keeps its single-segment meaning
-    // (`[^/]+`) — the `{.+}` rule's name class `[^/{}]+` excludes braces, so it
-    // does not match `path{[0-9]+}`. Over-widening it would be a correctness bug.
+    // (`[^/]+`) — a name that contains a brace is not a catch-all name.
+    // Over-widening it would be a correctness bug.
     expect(matchSegmentPattern('/docs/:path{[0-9]+}', '/docs/a')).toBe(true);
     expect(matchSegmentPattern('/docs/:path{[0-9]+}', '/docs/a/b')).toBe(false);
   });
@@ -318,14 +313,20 @@ describe('matchSegmentPattern', () => {
   });
 
   it('leaves a mid-segment `:name{.+}` a literal (only whole-segment anchors)', () => {
-    // The `:` is mid-segment (preceded by `v1`, not `/`), so the catch-all rule's
-    // `(^|\/)` anchor does not fire and the whole token stays literal — consistent
-    // with the `/api/v1:health` literal rule above.
+    // The `:` is mid-segment (preceded by `v1`, not `/`), so it is not a
+    // whole-segment param and the whole token stays literal — consistent with
+    // the `/api/v1:health` literal rule above.
     expect(matchSegmentPattern('/api/v1:path{.+}', '/api/v1/a/b')).toBe(false);
   });
 
-  it('does not share a regex cache with matchLiteralPattern', () => {
-    // The SAME pattern string compiles to DIFFERENT regexes in the two matchers.
+  it('treats private-use characters in the pattern as literal text', () => {
+    expect(matchSegmentPattern('/a\uE000b', '/axyzb')).toBe(false);
+    expect(matchSegmentPattern('/a\uE001b', '/ax/yb')).toBe(false);
+    expect(matchSegmentPattern('/a\uE000b', '/a\uE000b')).toBe(true);
+  });
+
+  it('does not share a cache with matchLiteralPattern', () => {
+    // The SAME pattern string parses DIFFERENTLY in the two matchers.
     // A shared cache would let whichever ran first poison the other. Prime the
     // literal matcher first, then assert the segment matcher still anchors.
     expect(matchLiteralPattern('/blog/:slug', '/blog/hello')).toBe(false);
@@ -341,6 +342,78 @@ describe('matchSegmentPattern', () => {
   });
 });
 
+describe('regex-compatible details', () => {
+  it('lets `*` and `{.+}` stop at line terminators, while `:name` takes them', () => {
+    expect(matchPatternCaptures('/*', '/a\nb')).toBeNull();
+    expect(matchPatternCaptures('/:x', '/\n')).toEqual({ x: '\n' });
+    expect(matchLiteralPattern('/*', '/a\u2028b')).toBe(false);
+    expect(matchSegmentPattern('/docs/:path{.+}', '/docs/a\nb')).toBe(false);
+    expect(matchSegmentPattern('/blog/:slug', '/blog/a\nb')).toBe(true);
+  });
+
+  it('gives each wildcard, left to right, the longest text that still matches', () => {
+    expect(matchPatternCaptures('/:a*/:b*', '/x/y/z')).toEqual({ a: 'x/y', b: 'z' });
+    expect(matchPatternCaptures('/:a:b', '/xyz')).toEqual({ a: 'xy', b: 'z' });
+    expect(matchPatternCaptures('/:a**', '/x/y')).toEqual({ a: 'x/y', splat: '' });
+    expect(matchPatternCaptures('/*/static/*', '/a/static/b/static/c')).toEqual({
+      splat: 'a/static/b',
+    });
+    expect(matchPatternCaptures('/u/:id*/files/*', '/u/files/files/x')).toEqual({
+      id: 'files',
+      splat: 'x',
+    });
+  });
+
+  it('rejects a name that starts with a digit', () => {
+    expect(() => compilePattern('/:1')).toThrow(/invalid capture group name/i);
+    expect(() => compilePattern('/:2fa')).toThrow(/invalid capture group name/i);
+    expect(matchPattern('/:1', '/x')).toBe(false);
+    expect(matchPatternCaptures('/:1', '/x')).toBeNull();
+    expect(matchPatternCaptures('/:id/:id', '/a/b')).toBeNull();
+  });
+
+  it('returns names as own keys of a null-prototype object', () => {
+    const params = matchPatternCaptures('/:__proto__/:constructor', '/a/b')!;
+    expect(Object.getPrototypeOf(params)).toBeNull();
+    expect(Object.entries(params)).toEqual([
+      ['__proto__', 'a'],
+      ['constructor', 'b'],
+    ]);
+    expect(Object.getPrototypeOf(matchPatternCaptures('/old', '/old'))).toBeNull();
+  });
+
+  it('still offers the deprecated regex view', () => {
+    const { regex } = compilePattern('/u/:id*/files/*');
+    expect(regex.source).toBe('^\\/u\\/(?<id>.*)\\/files\\/(?<splat>.*)$');
+    expect(regex.exec('/u/42/extra/files/a/b')?.groups).toEqual({ id: '42/extra', splat: 'a/b' });
+  });
+});
+
+describe('large and adversarial patterns', () => {
+  it('matches a pattern too long for a RegExp instead of throwing', () => {
+    const big = '/' + 'a'.repeat(40_000);
+    expect(matchLiteralPattern(big, big)).toBe(true);
+    expect(matchSegmentPattern(big, big)).toBe(true);
+    expect(matchPattern(big, big)).toBe(true);
+    expect(matchPatternCaptures(big + '/:x', big + '/y')).toEqual({ x: 'y' });
+    expect(matchPatternCaptures(big, '/foo')).toBeNull();
+  });
+
+  it('returns quickly for many wildcards on a long path that does not match', () => {
+    // A backtracking matcher takes seconds or more on each of these.
+    expect(matchLiteralPattern('/' + '*'.repeat(20) + 'x', '/' + 'a'.repeat(13) + '\nx')).toBe(
+      false,
+    );
+    expect(
+      matchLiteralPattern('/' + '*a'.repeat(40) + '\nb', '/' + 'a'.repeat(16_000) + 'x\nb'),
+    ).toBe(false);
+    const rest = '/' + Array.from({ length: 10 }, (_, i) => `:p${i}*`).join('/') + '/x';
+    expect(matchPatternCaptures(rest, '/a'.repeat(40) + '\n/x')).toBeNull();
+    const plus = '/' + Array.from({ length: 10 }, (_, i) => `:p${i}{.+}`).join('/') + '/x';
+    expect(matchSegmentPattern(plus, '/a'.repeat(41) + '\n/x')).toBe(false);
+  });
+});
+
 describe('substituteParams', () => {
   it('substitutes :name tokens', () => {
     expect(substituteParams('/articles/:slug', { slug: 'hello' })).toBe('/articles/hello');
diff --git a/platform/packages/dispatch/test/unit/project-hostname.test.ts b/platform/packages/dispatch/test/unit/project-hostname.test.ts
index 1c9d461d5..676f3990e 100644
--- a/platform/packages/dispatch/test/unit/project-hostname.test.ts
+++ b/platform/packages/dispatch/test/unit/project-hostname.test.ts
@@ -47,6 +47,35 @@ describe('workers.dev routing', () => {
       workersDev: false,
     });
   });
+  it('serves the new domain and the old alias through dispatch after activation', async () => {
+    const { env, values } = fixture();
+    values.set(
+      PLATFORM_APPLICATION_KEY,
+      JSON.stringify({ ...application, baseDomain: 'example.com', zoneName: 'example.com' }),
+    );
+    values.set(project.slug, JSON.stringify({ projectId: project.id, workerName: 'user-app' }));
+    const workerFetch = vi.fn(async (request: Request) =>
+      Response.json({ origin: new URL(request.url).origin }),
+    );
+    const getWorker = vi.fn(() => ({ fetch: workerFetch }));
+    Object.assign(env, {
+      DISPATCH: { get: getWorker },
+      ANALYTICS: { writeDataPoint: () => {} },
+    });
+    const ctx = { waitUntil: () => {} } as unknown as ExecutionContext;
+    const post = (host: string) =>
+      app.fetch(
+        new Request(`https://${host}/api/state`, { method: 'POST', body: 'preserved' }),
+        env,
+        ctx,
+      );
+    const domainResponse = await post('kitchen-sink.example.com');
+    expect(domainResponse.status).toBe(200);
+    expect(await domainResponse.json()).toEqual({ origin: 'https://kitchen-sink.example.com' });
+    expect((await post(hostname)).status).toBe(200);
+    expect(getWorker).toHaveBeenCalledWith('user-app');
+    expect(workerFetch).toHaveBeenCalledTimes(2);
+  });
   it('refuses a saved configuration belonging to a different installation', async () => {
     const { env, values } = fixture();
     values.set(
diff --git a/platform/packages/dispatch/test/unit/routing-rules.test.ts b/platform/packages/dispatch/test/unit/routing-rules.test.ts
index 42ae06c92..6e4e84fcf 100644
--- a/platform/packages/dispatch/test/unit/routing-rules.test.ts
+++ b/platform/packages/dispatch/test/unit/routing-rules.test.ts
@@ -139,11 +139,28 @@ describe('applyRoutingRules', () => {
     }
   });
 
+  it('matches an oversized source instead of failing the request', () => {
+    const big = '/' + 'a'.repeat(40_000);
+    const rules = [
+      { source: big, destination: '/x', status: 301 },
+      { source: '/old', destination: '/new', status: 301 },
+    ];
+    expect(applyRoutingRules('/old', rules)).toEqual({
+      type: 'redirect',
+      destination: '/new',
+      status: 301,
+    });
+    expect(applyRoutingRules(big, rules)).toEqual({
+      type: 'redirect',
+      destination: '/x',
+      status: 301,
+    });
+  });
+
   // Percent-encoded / non-ASCII paths come in as-is from `new URL().pathname`
-  // (Cloudflare does not normalize them). `compilePattern` needs to produce a
-  // regex that matches the raw pathname byte-for-byte; non-ASCII characters
-  // are regex-literal and percent-triples have `%` which is not a regex
-  // special, so both cases should compile and match without special handling.
+  // (Cloudflare does not normalize them). Pattern text must match the raw
+  // pathname unit for unit; non-ASCII characters and percent-triples are plain
+  // literals, so both cases should match without special handling.
   it('matches non-ASCII path segments literally', () => {
     const rules = [{ source: '/café/*', destination: '/fr/café/:splat', status: 301 }];
     expect(applyRoutingRules('/café/menu', rules)).toEqual({
diff --git a/platform/packages/dispatch/test/unit/sse.test.ts b/platform/packages/dispatch/test/unit/sse.test.ts
index bae0067fc..20d71f179 100644
--- a/platform/packages/dispatch/test/unit/sse.test.ts
+++ b/platform/packages/dispatch/test/unit/sse.test.ts
@@ -1,6 +1,7 @@
+import { isEventStreamResponse } from '@void/isr/runtime';
 import { beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 import type { Env } from '../../src/env.ts';
-import app, { isEventStreamResponse } from '../../src/index.ts';
+import app from '../../src/index.ts';
 
 const edgeCacheStore = new Map<string, Response>();
 
diff --git a/platform/packages/proxy/src/email.ts b/platform/packages/proxy/src/email.ts
index 4b09e00d1..a8eb9fdce 100644
--- a/platform/packages/proxy/src/email.ts
+++ b/platform/packages/proxy/src/email.ts
@@ -185,17 +185,18 @@ export function sanitizeForLog(value: string, maxLen = 200): string {
 }
 
 /**
- * Cap the caller-supplied log correlation id. The framework sends 16 hex
- * chars (`newRequestId` in `void/email`), but a hand-built tenant worker can
- * send any string the request body carries, and the only consumer is the
- * `[email-log]` line — one per delivery, so up to `MAX_RECIPIENTS` copies of
- * it per request — in the shared proxy log stream. It is diagnostic, so it
- * is bounded and sanitized ONCE at intake rather than refused with a 400:
- * a missing or non-string id already logs as `unknown` instead of failing
- * the send, and a truncated id is no less useful to correlate on. The
- * control-char strip is what stops a `\n` in the id from forging a second
- * `[email-log]` line under another project's id. 128 leaves room for a
- * UUID or a prefixed id without inviting anything longer.
+ * Cap the caller-supplied log correlation id. The framework sends
+ * `req_<base36 time><16 hex>` (`newId('req')` in `void/email`), but a
+ * hand-built tenant worker can send any string the request body carries,
+ * and the only consumer is the `[email-log]` line — one per delivery, so up
+ * to `MAX_RECIPIENTS` copies of it per request — in the shared proxy log
+ * stream. It is diagnostic, so it is bounded and sanitized ONCE at intake
+ * rather than refused with a 400: a missing or non-string id already logs as
+ * `unknown` instead of failing the send, and a truncated id is no less
+ * useful to correlate on. The control-char strip is what stops a `\n` in
+ * the id from forging a second `[email-log]` line under another project's
+ * id. 128 leaves room for a UUID or a prefixed id without inviting anything
+ * longer.
  */
 const MAX_REQUEST_ID_LENGTH = 128;
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 80ae104e1..5110b85a8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -500,9 +500,6 @@ importers:
       void:
         specifier: workspace:*
         version: link:../void
-      vue:
-        specifier: ^3.5.43
-        version: 3.5.43(typescript@7.0.2)
 
   packages/platform:
     dependencies:
diff --git a/test/affected-vcs.ts b/test/affected-vcs.ts
index 4d72a3c35..5bf289b72 100644
--- a/test/affected-vcs.ts
+++ b/test/affected-vcs.ts
@@ -9,7 +9,7 @@ type AffectedVcsProvider = {
 };
 const execFileAsync = promisify(execFile);
 
-export async function changedFiles(root: string, base?: string): Promise<Array<string>> {
+async function changedFiles(root: string, base?: string): Promise<Array<string>> {
   const git = async (args: Array<string>): Promise<string> => {
     const { stdout } = await execFileAsync('git', args, {
       cwd: root,
diff --git a/test/affected.mjs b/test/affected.mjs
index 040eca6a5..d0759d5cb 100644
--- a/test/affected.mjs
+++ b/test/affected.mjs
@@ -1,12 +1,12 @@
 import { spawnSync } from 'node:child_process';
 import { globSync, readFileSync, realpathSync } from 'node:fs';
-import { join, relative, resolve } from 'node:path';
+import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
 import { deletedFiles, planAffectedTests } from './affected-tests.ts';
 import { createAffectedVcsProvider } from './affected-vcs.ts';
 
-export async function runAffected(root, values) {
+async function runAffected(root, values) {
   root = realpathSync(root);
   if (values.help) {
     console.log('vp run test [--base <ref>] [--list] [--unit]');
@@ -130,19 +130,17 @@ export async function runAffected(root, values) {
   }
 }
 
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    const { values } = parseArgs({
-      options: {
-        base: { type: 'string' },
-        list: { type: 'boolean' },
-        unit: { type: 'boolean' },
-        help: { type: 'boolean', short: 'h' },
-      },
-    });
-    await runAffected(fileURLToPath(new URL('../', import.meta.url)), values);
-  } catch (error) {
-    console.error(error);
-    process.exitCode = 1;
-  }
+try {
+  const { values } = parseArgs({
+    options: {
+      base: { type: 'string' },
+      list: { type: 'boolean' },
+      unit: { type: 'boolean' },
+      help: { type: 'boolean', short: 'h' },
+    },
+  });
+  await runAffected(fileURLToPath(new URL('../', import.meta.url)), values);
+} catch (error) {
+  console.error(error);
+  process.exitCode = 1;
 }
diff --git a/test/canonical-json-contract.ts b/test/canonical-json-contract.ts
deleted file mode 100644
index 4ca067e98..000000000
--- a/test/canonical-json-contract.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { describe, expect, it } from 'vite-plus/test';
-
-/** Check both migration implementations against one canonical serialization contract. */
-export function defineCanonicalJsonTests(canonicalJson: (value: unknown) => string): void {
-  describe('canonicalJson', () => {
-    it('sorts object keys recursively while preserving array order', () => {
-      expect(
-        canonicalJson({
-          z: 1,
-          a: { b: true, a: 'x' },
-          list: [{ y: 2, x: 1 }, 'tail'],
-        }),
-      ).toBe('{"a":{"a":"x","b":true},"list":[{"x":1,"y":2},"tail"],"z":1}');
-    });
-
-    it('omits undefined object fields and preserves JSON string escaping', () => {
-      expect(canonicalJson({ b: undefined, a: 'quote " slash \\\\ newline\n' })).toBe(
-        '{"a":"quote \\" slash \\\\\\\\ newline\\n"}',
-      );
-    });
-
-    it('throws for unsupported values instead of silently hashing them', () => {
-      expect(() => canonicalJson(undefined)).toThrow('Unsupported canonical JSON value');
-      expect(() => canonicalJson({ a: () => undefined })).toThrow(
-        'Unsupported canonical JSON value',
-      );
-    });
-  });
-}
diff --git a/test/integration-helpers.ts b/test/integration-helpers.ts
index 439a31512..50e0e063c 100644
--- a/test/integration-helpers.ts
+++ b/test/integration-helpers.ts
@@ -16,6 +16,7 @@ import { createServer, type AddressInfo } from 'node:net';
 import { basename, join, relative } from 'node:path/posix';
 import { setTimeout as delay } from 'node:timers/promises';
 import { stripVTControlCharacters } from 'node:util';
+import crossSpawn from 'cross-spawn';
 
 /**
  * Timeout multiplier for Windows CI runners, which are 2–3× slower
@@ -48,7 +49,7 @@ export type IsolatedPlayground = {
   cleanup: () => void;
 };
 
-export function shouldCopyPlaygroundPath(sourceRoot: string, path: string): boolean {
+function shouldCopyPlaygroundPath(sourceRoot: string, path: string): boolean {
   const normalizedSourceRoot = sourceRoot.replaceAll('\\', '/');
   const normalizedPath = path.replaceAll('\\', '/');
   const relativePath = relative(normalizedSourceRoot, normalizedPath);
@@ -66,21 +67,17 @@ export function createIsolatedPlayground(
   sourceWorkspacePath: string,
 ): IsolatedPlayground {
   const sourceRoot = join(workspaceRoot, sourceWorkspacePath);
-  const snapshot = process.env.VOID_TEST_SOURCE_SNAPSHOTS
-    ? join(process.env.VOID_TEST_SOURCE_SNAPSHOTS, sourceWorkspacePath)
-    : undefined;
-  const copySource = snapshot && existsSync(snapshot) ? snapshot : sourceRoot;
   const playgroundLocal = join(workspaceRoot, 'playground-local', '.test-fixtures');
   mkdirSync(playgroundLocal, { recursive: true });
   const root = mkdtempSync(join(playgroundLocal, `test-${basename(sourceWorkspacePath)}-`));
 
-  cpSync(copySource, root, {
+  cpSync(sourceRoot, root, {
     recursive: true,
     filter(path) {
       // `cpSync` reports native backslash paths on Windows, while these workspace paths are
       // normalized to forward slashes. Normalize before using the POSIX path helpers or the
       // top-level `node_modules` directory is copied into the isolated dependency tree.
-      return shouldCopyPlaygroundPath(copySource, path);
+      return shouldCopyPlaygroundPath(sourceRoot, path);
     },
   });
 
@@ -239,6 +236,34 @@ export async function startServer(
   }
 }
 
+/** Spawns a workspace playground's `dev` or `preview` script; pass it to {@link startServer}. */
+export function spawnPlaygroundServer(
+  workspaceRoot: string,
+  playground: string,
+  script: 'dev' | 'preview',
+  port: number,
+): ReturnType<typeof spawn> {
+  return crossSpawn(
+    'vp',
+    [
+      'run',
+      '--filter',
+      `./playground/${playground}`,
+      script,
+      '--host',
+      '127.0.0.1',
+      '--port',
+      String(port),
+      '--strictPort',
+    ],
+    {
+      cwd: workspaceRoot,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, VOID_INSPECTOR_PORT: 'false' },
+    },
+  );
+}
+
 export async function waitForServer(
   url: string,
   timeoutMs: number,
diff --git a/test/integration-timings.ts b/test/integration-timings.ts
index 55b0af111..903906097 100644
--- a/test/integration-timings.ts
+++ b/test/integration-timings.ts
@@ -10,7 +10,6 @@ export const integrationTimings: Readonly<Record<string, number>> = {
   'packages/void/test/e2e/cloudflare-deploy-live.test.ts': 6,
   'packages/void/test/integration/analog.test.ts': 38000,
   'packages/void/test/integration/astro.test.ts': 17000,
-  'packages/void/test/integration/browser-helpers.test.ts': 2843,
   'packages/void/test/integration/cli-help.test.ts': 1718,
   'packages/void/test/integration/cloudflare-compatibility-build.test.ts': 5000,
   'packages/void/test/integration/cloudflare-deploy-build.test.ts': 6700,
@@ -33,7 +32,6 @@ export const integrationTimings: Readonly<Record<string, number>> = {
   'packages/void/test/integration/prepare-cli.test.ts': 1957,
   'packages/void/test/integration/queue-dispatch.test.ts': 208,
   'packages/void/test/integration/react-router.test.ts': 9000,
-  'packages/void/test/integration/remote-bindings.test.ts': 90,
   'packages/void/test/integration/sandbox-managed-rpc.test.ts': 722,
   'packages/void/test/integration/spa-middleware-auth.test.ts': 26264,
   'packages/void/test/integration/ssr-playground.test.ts': 13008,
diff --git a/test/pages-client-contract.ts b/test/pages-client-contract.ts
index 0ba0d24bc..65c2e8b7a 100644
--- a/test/pages-client-contract.ts
+++ b/test/pages-client-contract.ts
@@ -8,6 +8,79 @@ type TestWindow = Window & {
   __preventedNavigate?: boolean;
 };
 
+/**
+ * Check the adapter's dev SSR output. The JSON, mutation and NDJSON responses come from void
+ * core, so only the React suite checks them.
+ */
+export function registerSharedDevSsrTest({
+  getBase,
+  framework,
+}: {
+  getBase: () => string;
+  /** The playground's framework name, as in `Vue Pages Demo`. */
+  framework: string;
+}): void {
+  it('dev: SSR renders pages, island pages and deferred props', async () => {
+    const base = getBase();
+    const appName = `${framework} Pages Demo`;
+
+    const rootRes = await fetch(`${base}/`);
+    expect(rootRes.status).toBe(200);
+    const rootHtml = await rootRes.text();
+    expect(rootHtml).toContain('__VOID_PAGE_DATA__');
+    expect(rootHtml).toContain('Welcome');
+    expect(rootHtml).toContain(appName); // shared data from middleware
+
+    // scriptProbe tries to close the inline page-data <script> tag early.
+    const probe = '</script><script>alert(1)</script>\u2028\u2029&';
+    const probeMatch = rootHtml.match(/<script id="__VOID_PAGE_DATA__"[^>]*>([\s\S]*?)<\/script>/);
+    expect(probeMatch).not.toBeNull();
+    const probeJson = probeMatch![1];
+    expect(probeJson).not.toMatch(/<\/script/i);
+    expect(JSON.parse(probeJson).shared.scriptProbe).toBe(probe);
+    expect(rootHtml).toContain(`This is the ${framework} Pages playground.`);
+
+    const usersRes = await fetch(`${base}/users`);
+    expect(usersRes.status).toBe(200);
+    const usersHtml = await usersRes.text();
+    expect(usersHtml).toContain('__VOID_PAGE_DATA__');
+    expect(usersHtml).toContain('Alice');
+    expect(usersHtml).toContain('Bob');
+    expect(usersHtml).toContain(appName); // layout with shared data
+
+    const userRes = await fetch(`${base}/users/1`);
+    expect(userRes.status).toBe(200);
+    const userHtml = await userRes.text();
+    expect(userHtml).toContain('Alice');
+    expect(userHtml).toContain('alice@example.com');
+
+    const blogRes = await fetch(`${base}/blog`);
+    expect(blogRes.status).toBe(200);
+    const blogHtml = await blogRes.text();
+    expect(blogHtml).toContain('data-island=');
+    expect(blogHtml).toContain('data-props=');
+    expect(blogHtml).toContain('data-hydrate=');
+    expect(blogHtml).not.toContain('__VOID_PAGE_DATA__');
+    expect(blogHtml).toContain('Hello World');
+    expect(blogHtml).toContain('Second Post');
+    expect(blogHtml).toContain('Count:');
+
+    const detailRes = await fetch(`${base}/blog/hello-world`);
+    expect(detailRes.status).toBe(200);
+    const detailHtml = await detailRes.text();
+    expect(detailHtml).toContain('Hello World');
+    expect(detailHtml).toContain('First post');
+    expect(detailHtml).not.toContain('__VOID_PAGE_DATA__');
+
+    const deferredSsr = await fetch(`${base}/deferred`);
+    const deferredHtml = await deferredSsr.text();
+    expect(deferredHtml).toContain('__VOID_PAGE_DATA__');
+    expect(deferredHtml).toContain('Deferred Page');
+    expect(deferredHtml).toContain('window.__resolveDeferred("stats"');
+    expect(deferredHtml).toContain('"count":42');
+  });
+}
+
 /** Run the full browser contract in preview and navigation/history smoke tests in dev. */
 export function registerSharedClientTests({
   getBase,
diff --git a/test/pages-island-contract.ts b/test/pages-island-contract.ts
index b488f60bc..965bdae9b 100644
--- a/test/pages-island-contract.ts
+++ b/test/pages-island-contract.ts
@@ -1,6 +1,10 @@
+import { readFileSync, writeFileSync } from 'node:fs';
 import type { Browser, Page } from 'playwright';
 import { beforeAll, describe, expect, it } from 'vite-plus/test';
 import { waitForIslandsHydrated } from './browser-helpers.ts';
+import { waitForServer } from './integration-helpers.ts';
+
+type HmrWindow = Window & { __hmr_marker?: boolean };
 
 /** Keep independent island coverage for every adapter without copying the tests. */
 export function defineSharedIslandTests(
@@ -132,3 +136,98 @@ function registerIslandTests(
     }
   });
 }
+
+/** Edit the playground's blog island files while its dev server runs. */
+export function defineSharedIslandHmrTests({
+  getBase,
+  getBrowser,
+  counterFile,
+  islandFile,
+  hmrKeepsState,
+  prepareHmr,
+  waitForHmr,
+}: {
+  getBase: () => string;
+  getBrowser: () => Browser;
+  counterFile: string;
+  islandFile: string;
+  hmrKeepsState: boolean;
+  /** Runs before the page loads. */
+  prepareHmr?: (page: Page) => Promise<void>;
+  /** Runs once the islands hydrate, before the edit. */
+  waitForHmr?: (page: Page) => Promise<void>;
+}): void {
+  it('island component HMR updates without full page reload', { retry: 2 }, async () => {
+    const base = getBase();
+    const original = readFileSync(counterFile, 'utf-8');
+
+    const context = await getBrowser().newContext();
+    const page = await context.newPage();
+    page.setDefaultTimeout(10_000);
+
+    try {
+      await prepareHmr?.(page);
+      await page.goto(`${base}/blog`);
+      await waitForIslandsHydrated(page, 2);
+      await waitForHmr?.(page);
+
+      await page.click("button:has-text('Increment')");
+      await page.waitForFunction(
+        () => document.querySelector('[data-testid="count"]')?.textContent === 'Count: 1',
+      );
+
+      // A full page reload drops this marker.
+      await page.evaluate(() => {
+        (window as HmrWindow).__hmr_marker = true;
+      });
+
+      writeFileSync(counterFile, original.replace('Count: ', 'Total: '));
+
+      await page.waitForFunction(
+        () => document.querySelector('[data-testid="count"]')?.textContent?.startsWith('Total:'),
+        { timeout: 15_000 },
+      );
+
+      expect(await page.evaluate(() => (window as HmrWindow).__hmr_marker === true)).toBe(true);
+      expect(await page.textContent('[data-testid="count"]')).toBe(
+        hmrKeepsState ? 'Total: 1' : 'Total: 0',
+      );
+    } finally {
+      await page.context().close();
+      writeFileSync(counterFile, original);
+      await waitForServer(`${base}/blog`, 10_000, { expectBody: 'Count:' });
+    }
+  });
+
+  it('island file edit triggers reload with updated content', { retry: 2 }, async () => {
+    const base = getBase();
+    const original = readFileSync(islandFile, 'utf-8');
+
+    try {
+      const initialRes = await fetch(`${base}/blog`);
+      expect(initialRes.status).toBe(200);
+      expect(await initialRes.text()).toContain('<h1>Blog</h1>');
+
+      writeFileSync(islandFile, original.replace('<h1>Blog</h1>', '<h1>Blog Updated</h1>'));
+
+      // Every request while the edit lands must succeed.
+      const start = Date.now();
+      let updatedHtml = '';
+      while (Date.now() - start < 10_000) {
+        await new Promise((r) => setTimeout(r, 100));
+        const res = await fetch(`${base}/blog`);
+        expect(res.status).toBe(200);
+        updatedHtml = await res.text();
+        if (updatedHtml.includes('Blog Updated')) {
+          break;
+        }
+      }
+
+      expect(updatedHtml).toContain('<h1>Blog Updated</h1>');
+      expect(updatedHtml).toContain('data-island=');
+    } finally {
+      writeFileSync(islandFile, original);
+      await waitForServer(`${base}/blog`, 10_000, { expectBody: '<h1>Blog</h1>' });
+    }
+  });
+}
diff --git a/test/playground-snapshots.ts b/test/playground-snapshots.ts
deleted file mode 100644
index e885f0693..000000000
--- a/test/playground-snapshots.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { cpSync, existsSync, rmSync } from 'node:fs';
-import { join } from 'node:path/posix';
-import type { TestProject } from 'vite-plus/test/node';
-import { shouldCopyPlaygroundPath } from './integration-helpers.ts';
-
-/** Capture sources before HMR tests edit them and other files clone their fixtures. */
-export default function setup(project: TestProject): () => void {
-  const snapshots = project.config.env.VOID_TEST_SOURCE_SNAPSHOTS;
-  if (!snapshots) {
-    throw new Error('Missing integration source snapshot directory.');
-  }
-  try {
-    for (const name of ['react-pages', 'vue-pages', 'svelte-pages', 'solid-pages']) {
-      const source = join(project.config.root.replaceAll('\\', '/'), 'playground', name);
-      if (existsSync(source)) {
-        cpSync(source, join(snapshots, 'playground', name), {
-          recursive: true,
-          filter: (path) => shouldCopyPlaygroundPath(source, path),
-        });
-      }
-    }
-  } catch (error) {
-    rmSync(snapshots, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
-    throw error;
-  }
-  return () => rmSync(snapshots, { recursive: true, force: true, maxRetries: 20, retryDelay: 50 });
-}
diff --git a/test/terminal-demos/README.md b/test/terminal-demos/README.md
index 6e11b8277..8f8469178 100644
--- a/test/terminal-demos/README.md
+++ b/test/terminal-demos/README.md
@@ -16,7 +16,7 @@ The shell types each command once. Deploy output opens with the resolved project
 
 When updating transcripts, compare wording and phases to:
 
-- `packages/void/src/cli/deploy.ts`: `runCloudflareDeploy`, `activateCloudflareVersionWithProgress`, and the final note.
+- `packages/void/src/cli/deploy-cloudflare.ts` (`runCloudflareDeploy`), `deploy-cloudflare-helpers.ts` (`activateCloudflareVersionWithProgress`), and `deploy-cloudflare-publish.ts` (the final note).
 - `packages/deploy-cloudflare/src/version.ts`: native upload, readiness, and activation progress.
 - `packages/void/src/cli/platform-lifecycle.ts`: install prompts and completion.
 - `packages/void/src/cli/platform-installer.ts`: progress messages.
diff --git a/vite.config.ts b/vite.config.ts
index afc29ad77..3607abaec 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,5 +1,4 @@
-import { randomUUID } from 'node:crypto';
-import { availableParallelism, tmpdir } from 'node:os';
+import { availableParallelism } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { defineConfig } from 'vite-plus';
 import { SuiteSequencer } from './test/sequencer.ts';
@@ -40,7 +39,6 @@ const e2eWorkerEnv = {
   VOID_E2E_CF_TOKEN: process.env.VOID_E2E_CF_TOKEN ?? '',
   VOID_E2E_CF_ACCOUNT_ID: process.env.VOID_E2E_CF_ACCOUNT_ID ?? '',
   VOID_E2E_RUN_ID: process.env.VOID_E2E_RUN_ID ?? '',
-  VOID_TEST_SOURCE_SNAPSHOTS: `${tmpdir().replaceAll('\\', '/')}/void-playground-sources-${randomUUID()}`,
 };
 
 // Windows CI runners are 2-3x slower for builds and server startup.
@@ -526,7 +524,6 @@ export default defineConfig({
           // schedule the longest files first and fill idle slots across package boundaries.
           name: 'parallel-integration',
           fsModuleCache: true,
-          globalSetup: ['test/playground-snapshots.ts'],
           // Bound simultaneous database engines and framework compilers locally.
           // Unit tests still fill unused integration workers in the same phase.
           sequence: { groupOrder: 2 },